Hello everyone, and welcome to this webinar. My name is Benjamin Mouchard. I am a product marketing manager at Proven Run, and I am glad that you could join us today. This presentation is a general topic around the solutions we can provide to enhance the security of your connected devices, and will present our offer around the STM32 MP1 board from ST Microelectronics. What about Proven Run? Proven Run is a French company founded in 2009 by Dominique Bolignano, and is specialized in cybersecurity. Our mission is to resolve the security challenges linked to the large-scale deployment of connected devices. We are independent and profitable, and have our headquarters in Paris. We also have a facility for research and development in Sofie Antipolis in the French Riviera. For numbers, we are composed of around 40 people, and we help requests from customers from all around the world. We are also an ST authorized partner, and this is why we have been promoted by ST Microelectronics to run this webinar today. We are internationally recognized as security experts. We can mention that we have been core partners of ARM PSA Certified Initiative. We are also security provider of European Processor Initiative, and our biggest achievement so far is that we developed a proven core, a formally proven secure operating system that has been certified Common Criteria EL7. This is a world premiere. To our knowledge, there is no other secure operating system at that level of certification. So Proven Run help its customers reach their security goals for connected devices through their secure by design solutions and expert consulting services. Securing connected devices against remote attacks involves various technologies, but exploitable bugs in complex part of the operating system, such as communication stacks and drivers, are currently the weakest link. With Proven Core, the formally proven operating system that runs on Cortex-A or RISC-V processors, Cortex-Proven Core M, a secure real-time operating system that runs on Cortex-M, especially for the IoT market and Provenvisor, Proven Run brings an innovative answer to the challenge. With our product, companies developing connected devices can attain unprecedented level of security. At Proven Run, we have industry-recognized experts backed up by years of experience in the digital security market with world-classed expertise in security and architectures, operating system, formal method, and security certification. We provide consulting security services, such as security analysis, security requirements, security architecture, mitigation plan, and have the knowledge and expertise to help you in case you need a security certification. Our experts are always available to work side-by-side with you on your IoT project to help you secure your existing or new IoT architectures. So why is cybersecurity the IoT's biggest challenge? First of all, IoT is one of the fastest-growing emerging technologies. According to several statistics, the global IoT market stood at hundreds of billion dollars in 2019 and is expected to grow even more in the few upcoming years. We are talking about a lot of money and business opportunities. Then, they are vulnerable to remote attacks, the bread and butter of hackers. But why is that? Simply because it means that connected devices are vulnerable anywhere, anytime, as long as they are connected. The windows of opportunity for an attack is almost limitless. And we are talking about billions of potential targets. And if a device can control remotely, it can cause a lot of harm, from service interruption to physical damage to user or nearby equipment. All of this gives hackers leverage to extort money from manufacturers, making it a very attractive business model. All of this raises the question, how do you answer this challenge? It starts by understanding what is at stake. IoT devices are easy to acquire. Hacker will get their hands on the devices and they will have unlimited time and unlimited access to reverse and generate. Flows and weaknesses will be found. We need a way to protect against hackers, but how can we perform that? If we can make an analogy here, I want you to think about a boxer. So boxer has to protect against punches. And it is really hard for him to defend against a punch that he has never saw. On the contrary, if he knows the punch, because he knows the opponent, he can properly defense against it and maybe even set up a counter. The same principle can be applied here. Manufacturer must conduct security analysis to understand the threats and define the security requirements for their devices. Most of the time, we see companies developing their product, as you can mine, only the functional aspect of it. And once the product met the desired functional requirements, they start to ask themselves about the security of the product. But sadly, it's often too late because either the product doesn't integrate the proper security architecture or adding the proper level of security turns out to be really expensive. This is why security needs to be integrated at the design state of the connected devices, using state-of-the-art technologies. Proven Run is composed of world-class security experts that can help you define more secure products and grow your team's awareness towards cyber security. Our services and solutions are divided into major topics. Our consulting services for all the study about the threats and mitigation plan for your products, and we're talking about our experience and knowledge in security analysis and security architectures, and our solution to secure by design connected devices. In this presentation, we're gonna talk about our advanced expertise and custom development for Opti and Proven Core, our ultra-secure operating system that we developed here at Proven Run. So that concludes our introduction. The rest of this webinar will focus on the presentation of the services and solutions to understand how we can help you meet your security requirements. So let's dive into our IoT Security Consulting Suite. It is composed of three different services. We have Training and Workshop, an IoT security requirement and a certification landscape. We have Security Analysis. We already talked about this one, but I could not insist enough on the importance of these services, so we will come back to that. And finally, our certification support for any kinds of needs. It can be from self-assessment to the highest level of security. So why do you need a training? Because security is complicated and very meticulous, but there is no mystery in it. It is based on experience and knowledge. We use methodology, protocols and standards that prove to be efficient. The purpose of this training is to get you familiar with these methodologies we use for risk analysis, a contour measure that can be applied to your product, and the standard and scheme that are relevant to your needs. And finally, we can also help you identify an internal team that could be involved in the security aspect of your product in the future. So to summarize about the training and workshop, the objectives are to have the key elements to shape an evaluation strategy and to be ready to set the relevant internal team for all the security aspect of your products. The benefit of our training will be to enrich your team's awareness towards cybersecurity and understand where you need to go to meet your security requirements. So why do you need a security analysis? We already mentioned this, but it's such a critical step toward enabling a secure product that we will have to say it again. So remember the boxer and how we can defend against punches that you know are coming and even set up for a counter-attack. Basically, the boxer defines the strategy to beat his opponent based on his habits. It's the same principle with the security analysis. We need to understand the threats in order to define the proper security requirement that will allow us to defense against attacks. With that in mind, we are going to define an evaluation strategy to measure and prove the security level of your connected devices. So about the process and how it is conduct, the first step is the information exchange. This phase is quite simple. We ask everything we need to know about your product in order to identify the applicable regulation and the desired security level. In order to conduct a security analysis, we also need to understand the architecture of your product. So then comes the concrete study phase. This will be done by our consultant and it will be based on our methodology and knowledge. And then when the study is complete, we will present the results to you and discuss all the potential security and evaluation strategies. And finally, the last services of our IoT consulting suite is the certification support. The purpose of these services is to optimize the efforts towards certification. But why would you need that? Because certify the product is no easy task. Certification is a complex and meticulous process that requires a lot of experience and implicit knowledge. That's why it can turn out to be time-consuming and very costly for newcomers. It is a risky process. Certification is never warranted. But we help de-risk the process with our know-how of the certification ecosystem, our knowledge of the scheme and certification procedures, and our expertise with certification documentation. All of this comes from our rich experience of having successfully supported the evaluation of our customer in the past. To sum up about the certification support, the objective is straightforward. Take the shortest path to certification. We can help you de-risk the certification process. We are talking about time, money, and success ratio. We can also mention that we have a direct line with certification bodies and labs. So we have now gone through the detail of our consulting service suite. I hope it was clear and that you have a good understanding about how the different services can help you design more secure product and potentially work for a certification. It is true that the requirements in the IoT market are not well-defined yet, but they will surely grow a lot in the future. So we will now focus on the solutions to secure by design your connected devices. But first, let's talk about cybersecurity-basic concept. So cybersecurity is the concept of securing connected devices. Connected devices, as the name suggests, are devices that communicate with one another. So we are talking about information exchange through messages. The four pillars of cybersecurity are meant to secure the communication between the devices by ensuring their confidentiality, authenticity, integrity, and availability. If we want an easy explanation we can take an example here. For example, you want to send an email to your boss. The confidentiality means that if any other than your boss receives the mail, he will not be able to read it. The authenticity is a way available to your boss to know that the mail is indeed coming from you. Integrity means that when the mail is received, its content has not been modified. Availability means that whenever you need to send an email, the service will be available and it will work, basically. So in order to further advance in this presentation and talk about some concrete architecture and implementation with the MP1, I will give the lead to Thierry, STM32 security marketing manager as STM microelectronic. My name is Thierry Crespo, working as security marketing manager at STMicro for STM32 microcontrollers and microprocessors. Due to help customers build strong end-to-end security products, STM is proposing a security framework that we called STM32 trust. Targeted towards IoT, it's purpose is to protect customer assets by providing all means to cover 12 fundamental security functions, mapping multiple worldwide security assurance schemes. This function will be covered either by means of hardware IPs or software from SC or some parties and by services. STM trust base its strategy to provide a security assurance level for IoT using either CSIP from trust TV and published by a global platform or PSA by ARM. These are aligned to multiple national and applicative security standards, allowing our customers to reach their own application security assurance requirements. ST is leading the race in general purpose microcontroller security, increasing year after year its security offer. An example of this can be seen in the certification obtained by various STM32s. ST was first to introduce PSA level one followed by a CSIP level three product on the market. This slide shows the current certification available on the STM32 project families. STM32 security can also be augmented by secure element companionship from the SD safe or TPM or authentication and with ST4 SIM connected device. These devices are certified command criteria for the L5 plus TCG, PHEAPS or GSMA. STM32 MP1 has been launched back in February 2019. It provides the following key values, 10 years, longevity commitment, strong technical support and recognized solid supply chain. The STM32 MP1 includes the dual Cortex A7 running up to 800 megahertz combined with a real-time Cortex M4 at 209 megahertz, providing a flexible architecture targeting real-time and HMI application at reduced cost. Thanks to the broad open line distribution, open source software and third party partners, customers can drastically reduce time to market. The MP1 comes with an ST power management unit called STMPIC1. This gimmick provides the right level of power optimized for low power applications. Looking at the MP1.5 family, you can find in this table, the list of hardware security IP proposed mapped on the 12 security functions from STM32 trust. An immutable secure boot in ROM allows to start the route of trust. Secure keys are stored into the OTP area and an STM32 HSM can be used to program the secure data. Trust zone with MMU provide the isolation between secure and the unsecure resources. Anti-tempering mechanisms are also present to detect board intrusions. Detection can be programmed, for example, on IOs and also on environmental factors such as temperature, voltage, and real-time clock. In terms of software, ST has been working on OPTI, an open source trusted execution environment maintained by ST. It ensures the route of trust and isolation. GFA also is a trusted firmware for Cortex-A from ARM initially running on ARM V8-A was back ported by ST on ARM V7-A. Thank you for your attention. Have a nice webinar. We hope we'll be using ST product in the near future and do not hesitate to visit us. Exhaustive information is available at www.st.com. Slash MP. Thank you. So thank you, Cherie, for this presentation. So we are going to talk about what we can do to secure the STM32 MP1 board. But first, here at proven run, we think that all connected devices should at least have a basic set of security application. And we are talking about a secure boot for ensuring the integrity of the firmware and software running on the platform. The firmware update over the air because we are talking about connecting devices and a very large number of them. So you need a way to remotely and securely update your devices because you can't just bring them all back every time you need an update. Secure communication because we need our communication to be secure as it is a very critical entry point for Haccus and the firmware version and device attestation to verify that the device has not been tampered before it is connected to the network. So this is the set of application we provide for ST Microelectronic STM32 MP1 board. And we developed this security application based on IoT general threat analysis and making proper use of the MP1 software and hardware mechanism. So before going into the details of the different security options, let's start by adding some context here and talk about the MP1 architecture. So Thierry introduced a bit about this architecture, but I'm gonna explain again. So the MP1 integrates the ARM trust zone technology that offer an efficient system-wide approach to security with hardware and for isolation built into the CPU. So basically trust zone develop the concept of normal world and the secure world that goes beyond just the isolation goes beyond the processor to encompass the memory, software, boost transaction, interruption and peripheral within the system and chip. So this technology is commonly used to run trusted boot and a trusted OS also called trusted execution environment like Thierry mentioned like Opti or proven core our secure operating system. So in this slide here are the different MP1 systems and security options. Like you can see a range of options with increasing level of security. They are all based on the basic set of applications we just talked about, but use different solution and implementation for better security. To make another analogy here, let's take the example of a house. You can protect it by adding a three point lock on the door and then add on top of it a big dog because it can turn out to be quite this specific and you can also add an alarm system and even video surveillance and so on. So this is what all these options represent. It starts with our custom services for any customer willing to use Opti. Then we propose to enhance the security by securing Opti with proven core our secure operating system. And the next options will focus on advanced use cases such as the secure firmware update as it is one of the most critical security function for connected devices. So we propose with the protected offer integrity protection and with the secured offer availability protection. And obviously all the options that are higher integrate the security from the lower level. And the last offer, the last services that we can have on top of that is the advanced option with runtime check monitoring of the normal world. So we are going to explain all these options in detail right now. So about the Opti development and integration services. With this option, we provide solution for people willing to use Opti. In order to properly secure your product using Opti, you must understand the pros and cons of this solution. So Opti is an open source trusted execution environment standardized for global platform. It is widely used and make uses of trust zone hardware mechanism. So basically Opti is an entry point for people willing to make a first step into security. If implemented well, it can be a decent solution, but it is critical for trusted applet driver and secure boot implementation to be developed by security experts. So that's what we propose to do for you. We propose to wrote every critical security function for you, basically. For the secure boot, secure boot ensure the integrity of the firewall and software running on the platform. It is a critical step in the security boot chain and it is a complex operation. Proven run as a long and solid expertise in implementing secure boots and integrated to cover the most complex requirements. So we can help you set up the proper level of security by enabling a good implementation for the secure boot. Okay, so now let's say you already has developed a solution based on Opti, but you want more security. We propose to secure Opti by using proven core on top of it and use a service that we developed which is the Opti abstraction layer. Thanks to this layer, you will be 100% compatible with everything you already have designed with Opti, but you will be using proven core to protect your system. But what is the benefits of using proven core in such an architecture? Well, proven core is an ultra secure operating system. It has been formally proven down to the generated code. What does it mean? It means that some properties like integrity and confidentiality has been formally proven. Formally proven means they are guaranteed whatever the OS execution pass. Thanks to the properties, proven core defines ultra secure containers for strong isolation between application. Because proven core does not assume that trusted application and drivers need to be trusted. Why is that? Because rogue trusted application and faulty drivers are usually identified as the major source of vulnerability for trusted execution environment security solutions. Because in practice, trusted application and driver are produced by different third party sources with different skills and expertise in security. So proven core act as a first line of defense against malichutes or vulnerable drivers and trusted outlets. So this built-in security enables flexible project organization that is adapt to the industrial requirements. In conclusion, we can achieve cost-effective development of security applications. So now let's talk about the secure Fireware Update Service. Providing a Fireware Update to device on the field is now a requirement for IoT devices because it improves the value of existing devices by enhancing their functionality and performance. It eliminates costly recalls or physical replacement because of functional or security bugs. And it reduces testing and support costs by keeping all your devices at the same version. But over-the-air Fireware Updates is a massive security risk. As many issues with the process enables an attacker to take over the whole device with potentially dire consequences such as breaking the device or leaking confidential or private data. So proven runs secure Fireware Update solution focus on one goal. Making sure that the Fireware of your device stays authentic and cannot be done great by an attacker. The secure Fireware Update solution or SFU solution is composed of two software brick, the SFU client and the SFU agent. The SFU client propose is to download the Fireware Update image and forward it to the SFU agent. The SFU agent apply the Fireware Update image to the board after checking the authenticity and integrity of the Fireware Update image using stored public keys. This application is executed in proven core while secure Fireware Update client is executed on the rich OS of the normal world. This solution is secure for several reasons. Because we have set up a VPN for secure communication and the key are managed by proven cores. Also because the secure Fireware Update process does not rely on the rich OS, but only on the SFU agent. And the SFU agent is executed in proven core, which meaning that it's protected from attack coming from the inside like other application running on the rich OS or the outside. On top of that, the authenticity of the SFU agent is protected by the secure boot mechanism that we talked about in the basic set of secure application provided in the STM32 MP1 board. So for the flow of a secure update, in this example, we will first start the VPN connection. And once the VPN connection is established, then we can download the package using the secure Fireware Update client as a communication with the server and then forward the image to the SFU agent which will run the authenticity and integrated check. So with the protected option, the secure update service is secure and will prevent any malicious software from being installed on the device. That is most of the time enough to ask from the secure Fireware Update services. But there are still a vulnerability that is not covered by the previous implementation. What happens if the rich OS gets corrupt? Yes, we will not be able to install any malicious software from the secure update service, but an attacker can still deny the update service itself. The reason is because in protected implementation, Provencore is working like a standard trusted execution environment as a slave of the normal world. With this implementation, we are going to see the full potential of Provencore. Provencore can work in a mode where trusted applications are completely autonomous and continue to run, even if the rich operating system is not behaving properly or crashed. The communication with the normal world can either be synchronous, meaning triggered by the normal world, or asynchronous. This enables advanced use cases, such as the secure option. With this implementation, trusted applications will implement a full VPN and TCP IP stack for secure communication with the server. The integrity protection will still remain inside Provencore, and the secure Fireware Update service process will be autonomous and fully protected, if the normal world is corrupt. Another advanced use cases that is enabled by Provencore acting as an autonomous secure operating system is the runtime integrity monitoring function. The purpose of this service is to detect and shut down a potential attack on the rich OS. On top of being independent from the normal world, Provencore can also perform integrated check initiated at regular intervals to verify that the normal world is behaving properly. If the integrated check fails, then we can trigger a customizable response. Like, for example, it can be to restart the rich operating system to limit the time frame from penetration to attack. This will reduce the time available to the attacker to perform an attack. So we reduce the surface of attack of our device. One of the key functions of any secure operating system is to provide cryptographic functionality. Therefore, we implement OpenSSL, a general proposed cryptographic library in Provencore. This will allow you to perform all the standard cryptographic operations such as key and certificate generation, encryption, decryption standard cryptographic algorithm. And all these crypto operations will be available to the rich OS, rich operating system through a set of well documented APIs. We also help you integrate hardware modules like secure element, trusted platform module and hardware security module. What is of interest with this integration is that Provencore will have the exclusive control of the module, meaning that it will benefit from the isolation property of Provencore for more security. In addition, we can also enforce security policies on each module request to filter malicious attempt toward hardware modules. So that concludes our presentation. And I propose to summarize how you and us can work together to make the IoT secure. So at ProvenRun, we have industry recognized experts backed up by years of experience in the digital security market with world-class expertise in security and architectures, operating system, formal methods and security certification. We developed secure by design solutions that are designed to address all kinds of security requirements up to the highest level. We are security experts and have an advanced understanding of the trust zone. So we propose a one-stop shop offer for trusted execution environment and related security services either by helping you with your opti integration and development to achieve your security goals or with Provencore and all the IoT security suite to drastically improve the level of security of your connected devices. Regarding the differentiator, we have to mention Provencore as a key differentiator for several reasons. The fact that Provencore is formally proven, therefore it is as close as possible to zero defect and enables the ultra secure container that provide cost-effective development of security applications. With Provencore, you can easily achieve unprecedented levels of security for your connected devices and at an industrial cost. In addition, Provencore can act as an autonomous secure operating system enabling advanced use cases such as the secured option we saw, the runtime monitoring and a lot more like an autonomous secure storage or recovery operating system function. So the presentation is now finished and we are going to answer your question. I hope there are going to be many of them. If you seek more information about us, you can still visit our website at www.provenrun.com or contact us directly by mail at contact www.provenrun.com Thank you very much.


We're here to discuss a little bit about the Missing in Action team. So first, the first idea is to give some information regarding how we are working now and then we will open the microphone and the discussion because we want to do some slight change on the process and the workflow, but we want to hear about it, we want to hear what other people think. Sorry, I don't have a proper PDF now. So I will move quickly. So right now we work with different tools. We have some sort of scripts that are writing in Python. We have a database, everything is on Quants. So the scripts do the tracking. We use the scripts to save status about the maintainers and to query. There is some service called Carnivore echelon that actually pulls out all the information from the mailing list to know when was the last activity from the maintainer. So we also use that to check. We have one privacy channel. The password and everything, the information is on the wiki. So if you want to join or report over there, it's good. And of course the alias, some people know. So tracking is done manually. That means nobody is actually looking actively for Missing in Action persons. We normally register the person who has been reported to us or if we bump with the people who looks not active, we manually add it to the database. Then we use several tools. When I say several tools, including social networks, I have been contacting people on Twitter and Facebook to see their words. So that's up to every team member how they decide to do the tracking. So now we have several status. This is the current situation. So we have all these status which represent what people is doing. Okay, it's the normal. Then we move to VC and then we start to move to different status, like in acting or responsible, retiring, until we get to Mia. And then we are from the package. Then we just move to Needswap with the Debian account manager. I need to take the decision and remove the account, et cetera. You can. So we have a way to reset the status normally. There is a full reset which is okay. And there is one temporary reset that we use that it's called WillFix. So sometimes we ask people, how are you doing? And people say, okay, I'm busy and I will come back in several months or we'll fix and put, like, we'll fix in three months. Then we manually check again if the people have actually improved the situation, package has been updated or whatever. And then we decide to move to Okay. And we have different prod levels. First, we start with Nice, which is a very nice email. How are you doing? Everything is okay. Can we help? Then we start to move a little bit more rude and ask, okay, you need probably more commentators. And then we issue a last warning telling, okay, if you don't do anything, we will orphan your package.  Okay, this is how we update the status. We normally do it by email. It's on specific information on the headers. So we can put comments there. So the comments are somehow privately, because we include information regarding what's happening with the people. We use several ways to see, to inform the other team members to see, okay, this guy has foreign views or he has not been uploading for one year or whatever. And that's it. So I will hand the microphone to Anna. I was working also on this, on the new ideas and Moniz, who is the other team member who is remotely participating. And I will move to the Titan path. So anyone is welcome to edit. Okay. So what we want to do is first, the first idea came to start doing some reporting using web interface to make it life easy and to have some way of inform the people about what we are doing because sometimes you send an email to the alias and probably you will never get an answer. But some action is taken in the background. I know we need to improve that. But probably if the people who report the people who are missing in action have a way to check how is everything going, it can relieve some frustration. And then we want to change the workflow also and remove the current plenty of status and pro and do a full merge of everything and change, for example, define specific times like start with a first warning and give 16 weeks to react then move to a second warning and move to a final warning and then offer the package. So we want to reduce all these status like responsible or whatever and just use three or four to make things easy to us and to other people who want to contribute. So the new idea is just to have this set of reminders. Okay, first reminder, second reminder, third reminder and it will fix and then move to next what? And that's it. Another question that we were having is how much of the information can be available for everyone because some people ask, for example, what is going on? But as I said before, we normally put private comments because some people actually tell us, okay, I'm changing jobs or I'm doing this and we actually add that information to the database. So we know how to ask and be more human when we ask because it's a kind of awkward job to ask someone to do something on the project when they are not active. And this is our current situation as Agus first. We have several people who need to be contacted, several people who need to be contacted for the second time and some people that the package needs to be orphaned and the discussion that the key ring maintainers has lately about pinging the people who has weaker keys on the key ring and decide what to do with it. It will be nice to coordinate together so we can actually decide what to do with these people, probably included manually pinned from the MEA team. Also as part of our tools, we save the mailbox with all the conversation with the maintainer who are being tracked. So we have a collection of mailboxes for each maintainer who have been tracked. So everyone who joined the team, for example, and want to check what happened a year before the people was contacted can open the mailbox and follow the threats and even using that information to contact the people back again. It's open for discussion, so I will really love if someone decide to... Michael? Just us. There we go. So on the private versus public status, it might be very worthwhile to come up with some indicators of status that don't include all, obviously, the personal information so you could still be able to provide that overall status. It says we're working with the maintainer or we're working with the developer or basically something that would allow someone to see that is actively being worked or the situations in good shape or bad shape without exposing the personal information. Okay. So with the current set of timings, are we not being possibly too nice to people? Well... And sometimes we lack of time. Sometimes it happens like we do a pink and we wait for four weeks or whatever, because one month or two months. Sure. So when mails are sent out, so the system at the moment, I've looked into this, I've pinged a few people over the years and whatever, I've forgotten the details, I'm getting old and my memory fades. Do the existing tools actually keep track and automatically ping people to say, we haven't heard from this person, should they? It's a good idea. I mean, that's the kind of thing I'm thinking. We were talking about automating this but with manual handling. So you just prepare the mails and approve. It's probably the best approach here. Because the discussion there has been like sending automatic emails. It's a little bit impersonal and this task requires some social interaction. I mean, it's very sad to ask someone what you're doing and then it's better when you actually write the email and try to be a little bit worn. We talked with Anna a couple of days ago about merging database with contributors at Bien Orc because there's a lot of overlap and the contributors is already tracking people's activity very coarsely. It only tells you, I've seen activity on that date. Yeah, actually we even use, at least me, for example, use contributors to see information that I don't have on the other system. So I could reasonably easily add some MIA features to contributors. Things that we discussed were the ability for anyone that is logged in Debian contributors. So both DDs and people with Ali of Accounts to go to a person page and click report as MIA. We have a comment added by Ricardo with the other team member working on MIA that is the first here that we should include a mandatory field explaining why or giving some information when you do the reporting. Yeah, report as MIA with field, saying I wanted... We can even track the status there. For example, we can check at least has been reported or has been tracked, or like two or three visible status, not the full status we have in the database, that will be cool. So if you log in back, you can see how the contributor is doing if he's actually been tracked or not. So I could have for each person in Debian contributors a MIA report log wherever people reported as potentially MIA with a text field saying why. And then if someone is logged in as part of the MIA team, they can see all the logs and they could click a button to send a ping, again with a text field with things to put in the email. And that would also be logged. The email may even have like click here to reply that goes on the website and adds to the MIA log the message saying, well, I'm actually alive. What are you just discussing? It's above. So I said what could be, from a different team, I'm kind of saying what could I can offer. So that will have a sort of lightweight, well, not lightweight but simplified but a swift workflow because you essentially log there and see a log with all the reports and what the person said and make like a very qualitative judgment about what's going on. So yeah, those are reasonably easy to implement. To what extent does this have any kind of API? Because I want to do, I'm part of the DSA team and I want to basically close a lot of shell accounts because currently we have a zillion shell accounts and like you pointed out with about 500 people being in various states of missing in actions then that's kind of accounts I might want to close. So what I want to do is both restricts so people don't have accounts on systems by default but they have an easy way to do I need an account on this portal box now please and then that gets provisioned so by default you can't just log into a portal box you'll have to kind of run this command and the other thing I want to do is currently we don't expire people from teams so being able to track a little bit especially if there's a way for me to take the information from possibly from contributors or from some of the things you are tracking so I can figure out that oh yeah you actually haven't done anything to the website for the last period of time. The query information is visible for all DDs you just need to log in on once and you can check the read me there you can see your comments you can see what was going on with the people there's one call it MIA to do that is the one that pulled the information that is in the bottom the one that you see over there and actually gives you the login and everything details the key etc is that in a parsable format or is that completely free for? We use two files we use one mailbox and we use another database with another text file and some Python scripts that do everything to it. Okay yeah sounds good like MIA team usually you measure inactivity right? For me it kind of seems reverse because when I find something that's broken I want to fix it I realize the person is probably MIA for a really long time and then I need to kickstart the MIA process which on basic timings if person is MIA and not replying is like 28 weeks or plus which is like half a year. But still you have an MIA? True. I still have an MIA that's true and like yesterday we talked about setting the expiry date on the keys to self-expire people. Can we assume that everyone is MIA? Then measure activity and to see if there is any activity within last year you are okay and then and if there are no activity that we can automatically detect in the past year or for example two years or three years right then we kind of should ping those people MIA even all of their packages have zero bugs and they have no posts on mailing list, no logins to any shell accounts, no uploads no sponsorships, no nothing such that we could kind of proactively clean people and kind of have expiry on your activity by default instead of measuring inactivity. I understand your point. Instead of defaulting okay? Defaulting MIA? I think it can be quite complicated no. Maybe not taking action on it but at least measuring it. Okay, Erigo was also just a short point I think it was said before that automated mails are impersonal I want to balance the point that when you interact with a package maintainer that it doesn't answer for months it's even more impersonal and I think I would balance the impersonal mail just ping and do something about your package is better than interacting with MIA people. About the MIA by default there's a problem in Debian in that no it's essentially impossible to track all possible Debian activity. If somebody is a Debian contributor and what they do is taking care of Vietnamese translation they would get an email a year saying are you still alive? And it's not that nice. On the other hand it's nice that as long as everything is fine in my work I don't get pinged even if I don't do anything. So it makes sense that things are triggered when something is lacking and I'm all for shortening the time because if things are triggered when something is lacking say there's RC bugs that are unanswered then we shouldn't wait 6 months those bugs should have been answered in the first place. So if I go and see a package that has dead activity in the BTS for some time and RC bugs and I want to take it over I would believe that we could move to a situation where it's easier to take over things when they're not properly maintained. I have one question for now that I see an evil and some other people I remember when we implemented the deviantainer process it was required to do an annual ping that has been done? No They're supposed to send the ping every They're supposed to send the ping every They're supposed to send the ping every They're supposed to send the ping every They're supposed to send the ping every No it's carrying on from Dimitri and Riko It is difficult to reliably detect activity so a lot of our contributors may not necessarily contribute all that regularly or it might be very difficult to track them I think we all understand that If we get to the stage, if you're in MIA then that means you already a DD Is it unreasonable to expect that either we should see contributions somehow we can track and send the mail once every six months if we haven't seen anything in six months and by all means there will be some false positives to start with but if we send mail to people and say we don't think we've seen any contributions if you think you have can you please tell us where and help us to track those in future that will be a really good answer to that but we definitely we should be able to do this and send definitely and impersonally mail and say sorry this sounds impersonal but our automated systems don't think that they don't seem to be able to find anything. Apologies if they're wrong please help us fix them Actually we have in the current scenario the MPA which is non-package activity so you can theoretically mark someone like okay this guy is doing web and it's not trackable and leave it there but after that there was no way to track it there was some discussion with Anna early regarding that and the point was we were supposed to take care about the package more than tracking the people itself so I think we need to balance somehow I wonder if there's a way to possibly expedite transfer of packages from an MIA to a team so there's been a couple of packages which I've immune and I've sent there's been clearly no no activity by the maintainer and I'd be interested in adopting it but not as a sole maintainer but transferring the ownership of that package to a team it's always possible for that maintainer to wake up and say I still am interested in it that's the quality assurance who take care of the orphan package I know what you mean because I have done that it's a package so you see a package that is not maintained correctly so you start loading it but keep the person that could be maintaining your blood and after some time you remove it some people do that in plenty of cases I think it's a good option but still reporting this person to MIA is good because this person might need what we actually depends on the scenario but sometimes we get reports people telling us like okay actually very interesting on this package and we skip all the process together and we say okay let's do this as a warning for the maintainer please take the package and leave the MIA process to continue in the background so but I get your point like you mean like a team to specifically maintain some package that I didn't be neglected yeah not like MIA maintainers team but sort of like well this package naturally would fit sorry thank you this package would naturally fit in this team and because they're the sole maintainer we have a process where we can adopt that package into the team and let the team maintain it but I like your idea of just keeping them there all the MIA process goes on and then if they do wake up then someone else was raising their hand over there do we separate which activity requires your GPG key to be in the uploader skeering and which activity does not and if all of your activity does not actually require your GPG key ring to be an uploader skeering for example you only upload and you only commit for example translations via SVN to alias then your GPG key you're uploading you don't actually make any uploads should it be in the uploader skeering but that will be something like moving existing developers or loading developers to the yeah well I'm just grabbing the microphone away from you because it's not the first time I hear this during DeepConf I do not think well I know it's not a hierarchical set of privileges but let's say several people have told me we should demote the accounts that do not show activity in some way the thing is it's quite involved if I have to move an account from one to the other key ring I also have to ask DSA change the account type and well maybe I am being responsible I'm not doing uploads for some packages but I for my packages I mean but I can still keep that ability so I mean yeah we want to require people to keep up to date not only with their activity but with the current practices well if their key is 1k that's so what I think is important here is for people that I don't think we should remove people from uploading a key ring because they don't upload what I think we should consider is things like if you never used your GPD key then maybe it's not a good idea for it to exist in the key ring at all because that means that potentially we have a cryptographic credential out there which is not under good control so it's not about uploading versus non-uploading if you vote for instance then you're actually using your GPD key and that's the same same approach I'm using for the accounts and groups is that if you're actively using a group or actively using an account on a portal box then I don't want to shut that down but if you have an account on a portal box and you've never logged in there for like in the five years that machine has existed then that account should not have been there in the first place I think we see a trend here in not having everything in one account not being a DD means being able to vote having an email address being able to upload etc and I think the current trend is dividing these things and having these virus things expire that doesn't mean that you lose your email address or the right to vote when someone orphans your packages because you're not doing work and I think it's quite important to not consider the MIA like we remove you from being a DD and that's the long process you know, our last step is orphan the package then everything moves to Debian account and it's their decision to do whatever they want to do with the person main point here is packages have not been maintained should be orphaned and then we decide after that was whether you're a DD or not it's not actually decided by whether you have a key in the key ring in Debian account and Debian systems Dam decides who is a DD and they ask key ring maintainers to add the keys of those people to the key ring and I don't think there's ever been a case where they haven't added that key but they are actually free to not do so and similar they will ask DSA to create an account and we're actually free not to do so and I don't believe that has ever happened but these are actually three separate concepts The inactive key reminded me that we do not currently have a system to audit key usage so when I log into my bank I get an email saying there's been a login into your account it would be nice to have a log of every time my GPG key has been used in Debian so I could see if there is some use that wasn't me and I detect replay attacks the same could be used if that actually works in a way that there's no way GPG key use that is not tracked with this it can also be used to see that that key hasn't been used for like three years and then move it to time out key ring of some kind also both studies Eklon actually tracks that so in LDAP there's a field which says when a key was last used and where so that's tracked on Debian lists and uploads we also query that information it's not used everywhere I don't think it tracks votes for instance it tracks a certain amount of GPG key usage even citing the dimension does it also track SSHK usage so I am going to change a bit the topic of the discussion I would like to talk about a phenomena we have been experiencing in the last two, three years that are the Fountain Maintainers so there are people you go to their developer page that maintains I don't know 15, 20 packages but actually they are doing no job in Debian at all they are used for maintenance several things for example the parallel thing is a very good example of this but they have no activity use at some moment they add themselves to maintenance so I would like to ask you all that if you have a co-maintainer who is doing no job at all in the packages to remove them because it may sometimes the MIA team work very difficult well remove it then notify us also ideally a maintenance contribution should be tracked by the change log instead of the maintainer field we currently have a problem with DCH not putting an email address in the square bracket when the co-maintenance is only used full name so try tracking Brian Elson and Luca Bruno if you can and I reported a couple of days ago back to DCH asking if there could be the email address at least added to that and I don't know how much that would break but at least that would make people's activity trackable via the change log which would be a step forward in this respect this is of course why we should have all packages and get that's what I was about to say it's probably easier to track email addresses from emails in the kids changes but not everyone use git how about you as sole maintainer yes sure but I mean if it is co-maintained it's most probably on alias so plugging in there it's probably be careful about tracking activity with git commit logs you import upstream sources upstream becomes the developing developer plus the change log is signed by the uploader at some point so that we can trust that information much more than we can trust git stuff because on co-maint I could commit anything in the name of anyone in any git repo actually at FOSDM me and Daniel Silverstone toyed with the idea of doing a white hat operation against co-maint which maybe they are not happy with but it would be fun to add to every git repo in co-maint build in Debin control saying x unchecked upload column true and see how many of those end up in the archive at some point I don't think DSA would have a problem with it the alias admins might be have a problem with it it's important to have enough sets of hats that we can distribute around everybody ok what I was saying is we probably should take notes so git tracking is not a good idea so far the only the only conclusion we reached is the use of contributors which Enrico also suggests and it's a cool idea having the way to get feedback keeps on data private improve the tracking regarding the tracking how hold on sorry we have another question there with the tracking what can we do with the with the teams sometimes we even find some teams that are being me and it's quite complicated because there's two, three people in the mailing list some actions need to be taken for example if there's a mailing in Alio it probably need to be closed or hand over to someone else yes exactly and then there's a few packages out there which well they appear to be maintained by a team actually it's just one person and they've got to get around being noticed so of course if they go away even worse if it's not an Alio list you've got no idea who's on that mailing list yeah a question for DSA do we have any way to track all the bonds in Alias I mean if I send an email to some developer if the email is bouncing we currently don't track that I think also it's not that there are two sides of that there's Listmaster which obviously does it for lists we don't currently do it for the normal Debian Alias we possibly should because last time when so about a year ago we did a fairly large whichever over how we do the email writing on Debian Og and during that process we discovered a few people whose email like they're Debian Og email in the forwarding completely didn't work there is a complicating factor there in that we don't necessarily actually have email addresses for all accounts but that's something which I think we should rather fix than say yeah that's a desirable property because we get sometimes reports and emails bouncing so it will be easy and it will be a very easy way to trigger action from me and from them and whatever at least tracking not so far as 400 less say 500 or something the problem doing just simple bounce tracking there is that some people will bounce their email based on it being spam yeah so people shouldn't do that but people still do it so I mean you would get a good bunch of false positives so I'm not sure like it might be an extra data source so you can use it to verify whether all their emails are bouncing I mean we can we can detect the percentage but actually we send an email and it bounces then obviously and then you also get around so you can figure out whether you know it says spam detected or it says like a user okay okay any more ideas yeah so if you want that then please file an rt ticket so we actually keep track of it rather than you know I standing here saying yes that's a good idea and then I forget because there's a good party tonight and nothing happens okay regarding the hijacking in orphanage I have one question for for people in the audience has anyone taking packages and not notifying me like hijacking one package and yeah I've kind of done that in the last couple of weeks and I haven't notified me yet okay sorry it should I don't know if the developers reference says that you should do so but if it doesn't then it should it actually say you should think he's in some section like beyond packaging or something like that I don't remember okay yeah I read the like when I became a DD 14 years ago and haven't really read it afterwards so so I will ask another question I mean how much manpower does the MIA or QA team have in general at the moment exactly it's to make a point obviously we're all talking about lots of things that it would be lovely to have here I'm assuming also lovely to have would be manpower to make these happen yeah I'm making a point of that for everybody in the audience yeah I was I was actually planning to give a call for for help we were discussing with Anna also that right now the situation is quite complicated with I mean it's confusing so if we want to change the way we work it will be better to have some people also to help because currently we are only actively Ricardo Anna and me so three people mostly Ricardo doing the job day-to-day job and me sporadically one week or whatever so bits of the MIA team are actually MIA and we also have an email asking on the MIA team if you are MIA inside the MIA team and it will not be the first time I remember before some people okay okay thank you we close a little bit early thank you


Acknowledging the importance of these courses and how they serve the international community in securing major events, today we have Paris 2024 who came to be with other colleagues from Interpol member countries to share knowledge and gain knowledge from them. All information and knowledge that will be shared and learned in this training course will be captured and will be available in the Knowledge Management System that we have launched and will be available for the rest of member countries. So member countries couldn't make it this time, we'll go to the Knowledge Management System and we'll see the learnings that was discussed and captured during this training course. These training courses, the six models, will be available to all Interpol member countries based on the request and needs and it could be delivered on regional or national level as requested by the member country or countries. We also look forward to being in Doha to do our third safety and security expert group where we'll bring the private sector with the law enforcement, discussing cooperation and challenges that both sides have and how to come over them. This will be another learning that will be capturing again to be provided through our Knowledge Management System. We have big entities coming such as FIFA, we have Arsenal, we have several private security companies coming with us. I think next week will be another big step for project study in the field of securing major events.


What's good y'all Chris from jassescasebreaks.com doing our last this should be our last Hit parade multi-sport spot giveaway randomizer giveaway. This is a pack 2014 prism football value sell random team number 14 Last filler for it top 10 spots at the end will get into our hip rate So our fresh dice our list from Todd Down to Brenda. Thanks again anyone grabbing a spot in here and our teams this first dice roll is for our Teams and our players for the pack itself three and six nine times nine times good luck one two three four five six seven eight and last one nine times nine times Danny Going down to Simon and nine times for our teams one two three four five Six seven eight and last one ninth and final time From the bangles playing tonight Down to the Panthers Monday night football is gonna be a good one Cincinnati bangles in Buffalo playing the Bills. Oh Man Penn State runs it here deep run that's six Penn State takes the lead 87 yarder Wow Let's look at our first half here of our teams Danny from the Cardinals Down to Peter and the Chiefs That's one to sixteen first half of our break and then Danny with the Raiders down to Danny and the Commander So a little grand opening grand closing plans free plays 95 yards and 33 seconds to score and take the lead here in the Rose Bowl Wow, all right 14 on Monday Danny down to Danny Thanks again y'all Forgetting in on this break. Let's do it and give away those last ten teams Jason Whitten Andre Johnson green Mike Evans rookie Nice little John. Oh a here. Not numbered, but nice Brian Hoyer and Larry Fitzgerald our bonus pack Mike Evans rookie for the Buccaneers there and they go to all over And our three in the bonus pack John Riggins, Lamar Miller and Patrick Willis All right Let's do the fun stuff and give away those last ten in our hit parade So we'll go back to our list here grab all 32 our fresh dice our fresh list and Let's do it We'll roll the dice and randomize this list four and four eight times. So top ten get in After eight. Good luck. Thanks again one two three four five six seven and last one eight 11 to 32 sad times. Thanks for getting in appreciate y'all So 11 is Danny down to Kevin. Thanks y'all. I appreciate it again But getting in is Jason Kersh Danny does get in Todd Jason Brandon with that last spot mojo nice Jason again Jason Matthew Peter and Danny grabs that top spot at number one So one down to ten right here getting into our hit case In case case of hit parade by jasper's multi-sport when we come back We will do that case check the site for many many more will be loading up Maybe one more on the site to jasper's case breaks calm. Thanks again. Bye. Bye


Hey guys, it's Nate A.K. The Foot Accountant. Welcome back to the channel. Guys, the team of the year voters out. We know the release date of team of the year. What's left? Oh yeah, leaks. And guess what? We have some leaks, especially for some of those icons. We always wonder about team of the year icons. Well, we've got some names. So look at today and some players to expect heading forward into team of the year. Plus, there's a lot of confusion on the market right now. And with leaks or leaks to evolutions, are we getting more evo content this week? Or is the price is moving like on Cristiano Ronaldo going from like 8, 10,000 coins up to 16k? Just a hoax. We're going to talk about that today a little bit. And of course, more market in today's video as it is a big day for the market. Wednesday, new team and leak. Maybe some more content that could make things move. All that and more in today's video. If you're excited for it, drop a thumbs up. Subscribe if you're new. Yesterday's content is going to be real quick to talk about because we had one player SBC. And that was it. It was one of the quietest days. I think I said this earlier in the week, that it was one of the quietest days of content. Well, EA have outdone themselves. Now, a lot of people are mad about the content yesterday just being this Ruben Neves. But I get the frustration with only one piece of content along with the other refreshes of the other upgrade packs and SBCs. But this is a good SBC. Honestly, for 20,000 coins, yes, these three star skill moves. But for Saudi League links, for 20,000 coins, may I say it again, four star weak foot, medium high, power shot plus, and also evo potential, maybe in a month or so. If you have a Saudi League team, this card goes straight in 97 composure. That's a really high status passing is incredible. His defending looks good too. Really, really well all rounded card with some other really good play styles like pink pass, long ball interceptor, bruiser and press proven. That's a really nice midfield card. So if you want to get this done at some point, it's only an 84 squad, which is so easy to do. That's nice. It's actually making some Saudi League cards go up as well. I have some Anderson Tuliscus that I had bought for like 80,000 coins on bid during the kind of the evo crash the last couple of days on the weekend. So he is up making coins there. And then, of course, this cool to Bali, which is a direct link from 45,000 coins to 56,000 coins. So maybe if you have any places where you want to trade and get on bids and flip cards, look out for these Saudi League cards because I was making, you know, like, that's like 10,000 coins, 12,000 coins, a card on those Tuliscus. And I think he's even hiring out about 100,000 coins from where he was earlier in the week. Now, since content was again, pretty quiet, there are also no lightning rounds yesterday. May I add, and with the refresh of the 84 times five, the team like SBC that people are still ripping out to get other SBCs done and crafted, our low tier fodder is doing the business. We've got 83s approaching 1.2k, we got 84s, 2.2,000 coins now on those rising nicely 85s are 5k 86s are approaching 8,000 coins fodder is rising nice because there's not much supply. And yet there is still demand. If you invest it, if you still have a lot of these cards, like I do, I would keep lazy listing them on the market. I'm even getting sales here on Havertz for 12 to 1300 coins. That's an 82 rated card that's like 800 coins on the market. I'm still lazy listing my high rated fodder. I'm still lazy listing promo cards. As you can see here, I got a Royce for 32 listing it at 39.  Some of these I've just stocked in my transfer list for my own use for SBCs probably coming next week. So if we do get lightning rounds today, that's one thing if you want to sell because you fear that we will get lightning rounds today in this game, you can sell a little bit of that low tier fodder Wednesdays have been days they've won't run lightning rounds before but that's in my opinion the only way that fodder drops from now until Friday, which will probably the day when it drops again a little bit. Another entry point if you have it invested, especially if we get to 84 times 10 lightning around all the weekend. But if we get any sort of lightning rounds today, the fodder could drop a little bit. But it's so low guys that if you bought it under 1.8k for the 84s or 900 coins or 800 coins for the 83s, you might as well just keep holding because that's about as low as it's going to get. So that's what I'm thinking for fodder right there. I'm going to hold on to a lot of mine just because I have next week in mind with a pre team of the year type of warm up promo in mind and then also these cards as well. We've got to talk to FC fire and ice the versus cards. These went for a crazy ride yesterday. We were talking about them on the YouTube video last night. They were about 20,000 coins, right? They had a crazy rise right before content up to 35k literally all of them. It wasn't just the Senjo. It was all of these cards. I can show you marathas graph. He had the same thing happen. It was absolutely mental. These cards all spiked at like 33, 34,000 coins. It was the peak of demand right before the content drop of people getting on and playing the cup and needing these players. But it was also the lack of supply. These cards, like we've looked at, and as we've been able to see through trading with them and watching their price fluctuations, these cards are very, very rare. So I'm not saying that I'm going to look into buying any of these in the early hours today, but a Senjo and some of these cards are already starting to go back up. They were, I believe, all of the fire cards were down at like 17,000 to 18,000 coins. Now they're approaching 19,000 to 20,000. There may be another rise before the content drop today. But those would be cards once again that I don't think would rise up through the remainder of this week. I would still take the cash. You don't want to mess with lighting rounds, especially in the lower tier cards. But that did make some people some crazy coins yesterday with some of those fluctuations, especially on the discard items for the fire versus ice. That was really, really crazy. Now, maybe a little bit of information to this, not being talked about a lot, but needs to be pressed to the forefront. At least shown is a player of the month, SBC, that is going to be coming next after this one goes away. Killian Mbappe, player of the month, right? It's its second in a row. The voting was released yesterday for who is going to be the next December player of the month for Ligon. And guess who's in the vote again? Killian Mbappe's in the vote for the third month in a row. But will he win it for a third month in a row? Is the question, he's up against two formidable opponents, Lacazette and Abamiang. And actually going and taking a look at the statistics. Yes, Mbappe, Abamiang and Lacazette all have four goals on the month and Mbappe did it in one less game. But Abamiang actually has four assists to go along with his four goals. So it's looking like with four goals and four assists, Abamiang could be the league one player of the month winner for December. I went ahead and voted Lacazette just because I'd be down for a special Lacazette. We just had the radioactive Abamiang, which is nice still on my bench. We've had two planted months in Abamiang in a row. If you've wanted to do an Abamiang, you've had two chances. Like if they drop a third one, it'll be kind of like, my goodness, man, EA or not even EA, but I kind of Abamiang wins this just for something different. But also an Mbappe player of the month that would be out during the entirety of team of the year would be a really nice craft for those of you that maybe haven't done an Mbappe POTM. Yeah, but once you do one of those Mbappe's, you're done. Like I've got the 92 and I think all the coins and the fodder that I put in that, there's no shot I would do a 94 even if you were to win that. But I wouldn't invest in fodder yet. I mean, the voting on the website says that it's going to take place until January 14th, January 15th. So we've got like five days to vote here. There's plenty of time before this SBC will even release. I don't think, I mean, Mbappe still has 11 days on his SBC inside of this game right now. I wouldn't think that we would get a player of the month league one SBC until like right before team of the year at the earliest, right? Because this countdown is basically counting to the start of team of the year. Sorry, team of the year not team this season. So watch out for that. I mean, that's the big news in terms of a player of the month SBC that could be coming soon. But that vote was just released yesterday. So if you want to go take a look at that vote, I'll drop the link to it in the description. I know some of those voting websites are hard to find. I'll drop a link to that down there. Also, there's no news or primarily player of the month. Like that was one thing that I was hoping to see on this tweet earlier in the week or this Instagram post, nothing about Prem player of the month. So watch for leaks. If it's leaked about who won the award, then maybe there's a chance that it could come out and they just forgot to put it on this two. I don't know. I don't know guys. That's one thing to me that's a little bit confusing at the moment is where in the world is primarily player of the month because we would have expected it to be this Friday. But the way that it's shaken up, it looks like it might not be. Now, let's get to the big news with team of the year, right? It seems like every single day, we just get a little bit more of news about team of the year, right? We had to vote. Maybe we have some leaks, right? And that is what we have today. It is the leaks and they all started off yesterday with foot sheriff with a big leak team of the year icons, guys, not team of the year players, right? The votes still going on. If you see a leak for a team of the year player before the voting is over, you know, it's technically last year we had that same thing. There could be that potential that like, how is their leaks before the voting is over? Like some cards are already in. Jude Bellingham, Puteas, like we talked about yesterday, they're definitely already in. But regardless, these icons are coming during the team of the year and EA has gone all out like we would expect them to, right? For the team of the year icons last year, remember the Beckham that we had, the Dinho that we had, all the insane icons. I remember Gerd Muller, there were so many good ones, right? Looks like they're going all out again this year. And again, R9 is going to lead the pack in terms of the biggest name of play. That's going to be, it's going to be a 10 mil plus card, right? If his 94 R9 card is 6 million coins right now, we're looking at an R9 probably plus one 95 rated with a dynamic image on the sixth team of your card design, probably going to be 10 million, maybe 15 million coins right away, maybe 10 million rising to 15 million out of packs. It's going to be a very expensive card. Now moving on, this is a official leak of what we've been expecting and we've mentioned it a couple of times, but foot sheriff does say that every team of your item will have two play style pluses. And honestly, just looking at it on the card, it looks kind of weird because right now we've been used to seeing just one right on a card. You look like the Alex Morgan with finesse plus like, okay, I'm just used to seeing a card with either one or zero. And now we've got two there. It does kind of look pretty crazy. And imagine, you know, some of these players like R9 with trickster and power shot or maybe somebody with like technical dribbler and finesse, it's going to be cracked. It's going to change the power curve a lot. And it's going to just draw people, especially to these team of your cards that are going to be again, just a little bit more meta with those extra play style pluses. We know how much they impact the game this year. They impact the game so much, they take your players abilities to the next level with the animations and the consistency of how good they perform those types of animations with whatever play style plus they have in game, that's going to be crazy. And that's probably going to hurt the market and create some panic on the market, maybe even during team of the year. And it's going to put so much demand on those team of your cards, because they're just going to have that extra bit of overpoweredness and meta aspect to them, since they're going to have two plus play style. So the only question I have is, what about goalkeepers are goalkeepers going to get play style pluses because we haven't had a single one yet with a play style plus? Will that change? We'll have to see. So our nine is our first week. Patrick Vieira is our second week. And I think they've done him dirty here on this prediction. He better get a higher rated card than an 89 plus one. Come on, man.  So I'm not getting my hopes up or down based off of this. But um, yeah, I think Vieira needs to be like 90 or 91 rated, man. You look at the Vieira card that we have in game right now. It's 88 rated. He's got 82 pace. He's got 78 shooting. He's definitely going to be holy gang, right? They got to give him 80 shooting. And they really need to boost up his dribbling and his passing because at this stage of the game, also a weak foot and a skill move boost, like imagine a four or four of Vieira that's 90 rated. I know I'm setting the bar pretty high here, but with a couple of play style pluses, maybe block plus and like bruiser plus or something like that, that's going to be an insane combination, right? So I'm definitely excited for these cards. They're going to be difficult to pack one of like every, I don't know, 100,000, maybe million people are going to pack these team of your icon. It's going to be crazy, but they're still going to be impacts and then at least be something to shoot for. So Vieira is the name that we have and ribbary is another one. Everybody wanted ribbary and we're getting his card. Again, just like Vieira, I think the juice needs to be bigger than just a plus one. And I hope that it is, um, especially because a card or a player usually only gets one or two different promo icon versions during the entire year of the game. So hopefully for this Vieira, it's a 90 rated card, 91 rated. I'm not doubting that EA will juice the cards. I'm just saying based off of these predictions, they're not that great, but man, ribbary and Vieira and R9, what a big set of leaks that we have. Now there's been other people that have been tweeting about team of your icons, guys, and especially Footbin, all right. And Footbin's never been leaking stuff before. And in some of these tweets, they say predictions, they're definitely going after the interaction bag here on X Twitter with these posts. Some of these icons, people have been asking me, Nate, did you see Charlton is leaked? Did you see that Cassius is leaked? Did you see that Rio Ferdinand is leaked? Guys, I think I read these tweets and since Footbin has never really leaked stuff before, like I think these are predictions, right? So don't read into these too much. Now some of them might end up being legit like Sawad doesn't have a promo icon yet because very easily get in. Javi, very good chance of getting into a team of your icon as well, right? They put ribbary. I guess this is a prediction. I mean, if we actually go back and look at the Sheriff tweet leaking ribbary, they said below, Sheriff seeing our ribbary prediction this morning, right? You know, with a little bit of a meme with a gift. So I think these are predictions, guys. I'm not reading into it too much. I mean, yes, I would like these, but I think what I would like to see is an actual leak from Sheriff, from any of the other guys that we look at for trusted leaks on X. More often posting those. So watch out for more leaks. They're going to be coming and they're going to continue to impact the market as well. You take a look at some of those cards that were leaked and other top tier icons yesterday with that news. Look at me a ham going from 2.9 mil down to 2.6. They have rebounded back up a little bit. Even like some of the top tier promo cards, Cristiano Ronaldo was is down, but he went from 2.07 yesterday down to 1.85 at content and then went back to 2 million coins and now he's right now down at 1.9. So that top tier of the market, I still think has further room to drop. I think the whole entire rest of the market has room to drop guys. A lot of the promo cards still, there is going to be further panic on, but at least right now, the way that we're sitting, there's not that much panic yet because we know we're not quite to team of the year and there's still a lot of demand for people to go out and buy teams to play in the cup, right? To play with these versus players to build squads to play champs, get the rewards, play rivals, get the rewards. So there's still a good amount of game play to man. And yeah, we're just awaiting more news that's really going to kick start some more the crashing on the market. I think that's going to happen probably this weekend or next week. Now, let's not get ahead of ourselves. Let's talk today, Wednesday, what's going to shake things up on the landscape of FC 24 today. And I think there's two things that we have to look out for. The one is already something that we've mentioned and that is lightning rounds, right? They had no lightning rounds released on Monday or on Tuesday yesterday, but Wednesdays with a brand new team of the week coming have been days that we've seen this year where they dropped lightning rounds. Remember, the global limits section here hasn't been there the last couple of days we watch out for today and 84 times 10, like we already mentioned, if they dropped 84 times 10, that is going to hurt everything that is in packs, especially fodder 84s, 85s, 86s, even all the way up to probably some of your 90 rated cards that are I think right now I saw Messi almost like 60 K, maybe not quite 60 K, but like, Oh, 60 K for Messi. Wow, man. That's crazy, man. Seriously crazy. How much fodder is going up on this game? Wow. Can I take a look at all 90s? Are they all 60 K or is that just messy because he's the goat? They're all 60 K. Wow. De Bruyne and Hollander 81 82,000 coins a piece as well. 89s are 37,000 coins. What a rise on those 88s are 22 K the market in terms of fodder is flying 87s or 14 a piece. Wow. I mean, it is tempting to sell some of this stuff guys, but honestly, I don't think for all these cards, it made I don't think that it'll drop off as much this weekend as we saw last week. And I think the lowest prices on some of the fodder was probably seen last weekend as much as we're rising up this week and thinking about how many people are not opening packs right now. So lightning rounds today would keep the fodder in check and it would maybe make them drop a little bit. Of course, it would make the versus cards drop. And it would supply the new team of the week pretty well as well. And speaking of a new team of the week, this is who we have leaked so far. We have Teo Hernandez getting a second Informity here. De Jong getting an informed Lautaro Martinez, Areola, Myra Ramirez there. It looks like a pretty mid team of the week. Teo will be nice. De Jong will be nice. Lautaro, Areola could be nice as well. Maybe a couple of gems in here that watch out for this Buon Giorno. He already has an Inform. He's a center back. His work rates aren't that good. But if he gets a featured team of the week, he could go to an 86 rated card and kind of be cracked. So watch out for that one. But the team league looks pretty mid today. But Wednesdays have been days where they've dropped lightning rounds before. Now the second thing that could impact things today as well is evolutions. And we as I'm recording this video right now don't have any new concrete leaks for any evolutions that are gonna come out. But there is a lot of fake news, TikTok, pump and dump, pump and dump in discords, whatever you want to call it. We don't really 100% know what it is. There are prices moving on the market because whether it's tweets, whether it's people saying that they have a leak, whether they do or whether they not, people are investing in these cards. Cristiano Ronaldo is 17,000 coins on the market for his base gold card. And again, we mentioned this a couple times earlier, but just to show you his graph, yesterday it started, right? He went from 8,000 coins all the way to 16k and he's been there. He's been at 1617,000 coins for this whole entire time. Other players that are up in value, Gakpo, I think, Joel Felix or other players that started rising in value a ton yesterday. He went from 1200 coins at 2.8 and is now back at a 2.3, 2.4k. Guys, Footpolice is who we've been seeing a lot of the evolutions posted by recently and he's been pretty accurate with these evolution leagues. I don't know, man. He hasn't posted a thing. He said there's no left-back EVO early in the week when Theo Hernandez and Ferland Mendy went up. He's saying there's no striker EVO that Ronaldo doesn't fit, right? So I don't know. I don't have leaks. I can't 100% explain all of this, but to me, this feels a little bit fishy. And also you think about when we've had, as we take a look at the index on footben and see that a lot of these cards that are up are strikers. A couple of centerbacks, Ramos, Spidey's out of packs, Campembe, who knows. But you see Rashford started to go up yesterday as well. Is there a left-wing EVO, right? Or is this just people that are sitting on the market and pumping and dumping these cards? Who knows. Evolutions recently have not been dropping during the week. That's one thing against thinking that an evolution would drop today. I mean, think about it. We've had evolutions on Fridays, Saturdays, and Sundays, especially during winter wildcards and even this last weekend during verses. That's kind of all that we got. And then it really backed off during the week. And content this week has been so quiet. I don't know, guys. So I would say watch out for some concrete leaks. Again, the guys that I show you for leak accounts on X on Twitter, those are the guys that you can trust the most when it comes to leaks. I know there's a lot of other accounts out there that are probably pumping and dumping or trying to get some clicks because they want to say that they have a leak, whether they do or not. It's not for me to judge, but we'll see when stuff actually gets dropped in the game who has the leaks and who is right. And the guys that I show you on these videos are the guys that are right like 90% of the time. So we'll just watch out for that. But honestly, I think some of the reason that these cards are going up and like pump and dump is happening on some of these gold cards, guys, I kind of think people are bored, right? But the way the content has been the past couple of days, it's been a bit quiet since Winter Wild Cards was a good promo with a lot of stuff going on. It's been a bit quiet recently. And I think that maybe some of that in there and people also making a lot of coins off of the Evo for like Finisher and the cut inside evolution, that's motivated some people to try to manipulate the market a little bit maybe. So that's just kind of what I think and what I'm seeing currently on the way the market is kind of looking right now. So again, just trust the credible sources when it comes to those leaks. Now, the last thing I want to talk about today is what's happening on Friday. It says right here, it's kind of blocked by the webcam, right? But it doesn't say anything about versus team one or team two. And usually when we see that it's only a one week promo. Are we getting a versus team two on Friday or is EA going straight into the team of your warm up series? The last thing I want you guys to watch out for today is a loading screen. Because if we get a loading screen for a team of the year warm up series, a pre team of the year type of promo, that could incite a little bit more panic. That could also get people thinking about saving packs, doing more 84 times fives and making fodder go up. Actually, that's the way that I would think it maybe would go unless EA run lining rounds, but it could make some prices drop on the market. And it could also just get people in that team of the year fever and that team of the mood once again. And it also may make the FC versus cards not drop a ton, because people know they're going to be going out of packs and there's no new ones upcoming with the cup still out requiring them. I know there's going to be a lot of investors that want to buy those FC fire and ice cards because there's still a cup that is there that gives good packs and XP. So be careful with that today. Watch for a loading screen. Watch for leaks too, because this is the tweet. Foot police is a guy that we do, like we just mentioned, trust a lot with this stuff. He said that there will be a fire and ice team two. Maybe it's a fire and ice team two alongside of a team of the warm up series. Maybe it's both of those combined. We're not sure if we start to get player leaks for a team two, right? Remember, we had a leak for Kingsley. Come on, never dropped right for ice and fire team one. If we start to get more player leaks for a team two, like if sheriff starts tweeting Romania starts tweeting these guys that we follow on Twitter, start tweeting about leaks, then it would make sense that there's a team two. So right now it seems 50 50 whether there is one or whether there's not one, we'll just have to see. So watch out for a lot of leaks today. And that's a lot of news in this video. Let's end it off with something fun. Let's go in 84 times five. I got two double walkouts from these yesterday. Can we continue the streak? Bernardo Silva looking good. It's not a double walkout though. All right, Bernardo Silva 88. I'll take that. If there's an informant behind this and I can go do another one of these, I'll be very happy. And there is and it's a lease say, oh shoot. I think he is really expensive for the evolution finisher, right? Okay, no, he's 32,000 coins, but his his card does look pretty cracked on that one. 93 dribble 89 pass. The shooting is a little bit tough, but he's got the low shop hours, which means his tribellos will be insane. So media, media, we're great.  That's probably going to go in either the Maldini, SBC, or yet again, another 84 times five put those tradable ones on the transfer list. And again, market wise right now, what I've been trading with in the last day is I have just been low tier flipping, right?  The market actually did pretty well yesterday. I picked up a doku at 200 so 205 exactly sold at 233. So the for me know that I sniped at 340, 370 for a small flip. There's the to list goes and I had a number of other sales that were cleared of lazy sales, right? Some 88 that I had listed up some 90s. I sold one Athenia yesterday. The the sonnets that I bought, do I still have both of them? I think I yeah, I still have both of them. Here's the other one right here. There's the Royce I got for 32. So I'm just buying low budget. I don't have that many players. I mean, I do because I have a lot of fodder stocked on the transfer list here. But I've got like two thirds of my coins at the moment liquid. And I'm just kind of lazy listing, man. It's kind of just a couple sales every few hours. And it's pretty easy to do that. But the market is moving okay, because especially yesterday, people were going out playing rivals, the content was dead. And if today if it's like that as well, get back on the market, there was some pretty crazy fluctuations on rare cards, find the rare stuff, most recent promos cards that people want to use, and make some coins, quick flipping those cards. So that's going to be the video for today, guys. If you did enjoy smash a thumbs up on a comment below if you have any questions and subscribe if you're new. It's been Nathan with accounts you guys and video tomorrow and a Twitch stream today that links down below. As always, peace out.