It's a beautiful day in the neighborhood. Wind gusts of 50 to 80 kilometers an hour What is that 40 to 50 miles an hour? Somewhere in there boat 10 centimeters of snow expected snow clearing operations and full swing It actually looks a lot better now when I first woke up. I have my eyes one a little wide I looked out my front window.  Okay Here we go It'll be a little bit of a slow moving day, but we're gonna get stuff done We'll stuff done. That's why we got the good old Chevy pickup truck Four-wheel drive for days just like this, right? There's so many people out here with these small little two-wheel drive cars Most cars are front-wheel drive, which is better in the winter time, but there's such low clearance I can't get over the snowdrifts and stuff But you save a lot of fuel throughout the year. So I mean the one or two days, I guess Personal choice. Personally, I like to drive bigger vehicles But you don't buy them for fuel economy. So you got to pay for it at the pumps, especially nowadays So off to the semi we go. I got a trailer to pick up in Winnipeg And then I'm gonna put some freight on it. We'll see what time we get back. It shouldn't take the whole day I might get another assignment this afternoon yet It's supposed to clear up yet and then start blowing again this evening Manitoba, I love my home Lovely day Such a lovely start to the day We got less than a quarter mile visibility here. I can still see the lane. So that's good a Lot of snow and a lot of blowing snow It was worse on the last highway. I was on Because the wind is coming straight out of the south so that's where our warm weather is coming from But when it was blowing over the road visibility was four feet at times I was actually considering turning around, but I couldn't find a safe place to turn around So I had to keep moving. You don't want to stop on the highway, right? You don't know who's coming up behind you. So then I got onto this highway, which is a north-south highway I'm headed northbound right now with the wind so the wind is sort of just pushing me along and The visibility is actually a lot better But you got something going on here. Someone's in the ditch. Okay, we're gonna slow right down Slow right down here. I don't got a tow rope that can pull them out either and I got no flashing be oh, there's a tow truck right there Okay, good Usually if I see someone in the ditch if I can reach them with my tow rope I can pull them out But in weather like this I don't got any flashing orange beacons in my pickup Which I maybe I should maybe I should have them for when stuff like that happens But if I don't have any way to notify oncoming traffic that I'm pulling someone out I find that to be more dangerous than just you know as long as their car is running and they can stay warm And it's just wait for the the professionals to get there With their towing equipment and you know beacons and signs and stuff It's a clear day. I can pull them out Yeah, so we're putting along here It has gotten better so I'm gonna keep moving forward for now I'm more than halfway to work So it's closer to go to work and stop than to go back home and stop And I don't know how much we're gonna get done but at least I'll be at work and Hopefully this weather will clear up in the next couple of hours and we can start getting stuff done That's more oncoming traffic here. Let's just make sure that they know where the lanes are too Everybody's doing good that car in front of me. No, don't pull over on the shoulder, man Do not pull over on the shoulder. Oh, he's pulling over on the shoulder Such a bad idea such a bad idea in a snowstorm and leave your lights on at least man Put your hazards on maybe If you want to stop I understand I totally understand if you want to stop But just turn on to a different road get off the highway Freaks me out, you know, I hope nobody I'm sure they'll be fine, but still makes me nervous We made it Well, we got to get around the corner yet, but we made it Man, you wouldn't believe it. I saw like 15 cars in the ditch There was one car that got scared.  I mean the middle of the road like between like on the middle line stopped and Because he did that there was about six other cars that just about hit him All hit all went into the ditch traffic came to a dead stop almost caused a pile up and he just sat there frozen frozen in fear I guess geez I have you guys strapped to my head, but my camera head turned itself off Well There's not too much snow built up back here And I can see the truck from here. So I mean that's pretty good let's go get it started and Get it warmed up. I'm gonna go back to the front and see what the plan for today is because Mother nature has her own plans, so we'll see if we can make our plans work with hers Another one of those days. It's gonna be good. You know the next warm day. We have we're gonna appreciate it so much more There she is In part right here. I don't think we're getting anything done today Yikes He's gonna try to get his truck through this snow here. Yeah, yikes And nothing's moving. The word right now is that we're gonna hang around till noon and see if it improves Most likely going home early today Brutal Visibility out there at the yard guys working hard here clearing snow back We've all got stuff to do Problem is Mother nature she's got a lot of opinions today So we're waiting around like I said till noon see what see what what happens if it clears up good if not we'll bring all these trucks back to the back and park them in there if we don't get stuck on the way and Call it a day Right now it's not safe to be out on the highways and there's probably a lot of people in the ditch Very low visibility the plows might be out already, but even if the plows are out on the roads The snow is gonna build up right away is again right behind them See what happens. I'll just keep the truck warm for now My lunch in the meantime while I'm waiting Not much to show you guys other than this thing Well, the weather did clear up I got you strapped to my head and we're headed back home. I went around the trans canada Uh, it's a little bit longer to get home, but it's also a four lane divided I felt like that was just a better choice to make today But around about one o'clock I think is when it cleared up It's still snowing and blowing just a little bit, but it's nowhere near blizzard conditions or anything Roads have been salted. They're doing pretty good Not slippery like well Depending on what your definition of slippery is I guess I But we're doing good Didn't get much done today But I did go pick up a trailer in the city and I also picked up a few parts Our winter trucks are getting ready to go up on the winter roads And uh, they needed an extra fuel tank So I had to go pick that up in the city In the in the work pickup truck Nothing to show you today Trucking wise though I'm gonna go home and enjoy the weekend now and hopefully by monday. That's all I'll be cleared up My beard is getting a little longer, isn't it? I'd say it's getting long But there's a lot of guys out there would be like, yeah, no, this ain't long yet. We're just getting started You know I don't want you to hate me just because I'm beautiful I want to grow it out at least once in my life And I always end up giving up because it's really hard to get past the awkward phase And then to the point where it's an actual like glorious majestic manly beard One of these years I'll get there For my excuse this year I'm using the fact that it's been cold and then it's winter and winter's cold And I'm using it to keep my face warm I don't know what's gonna happen when spring comes up I'm gonna have to come up with a new excuse to keep growing it then I don't I don't know Well, we're back at home Putting this together the next day friday was When I filmed all this this vlog day. It was nuts. That was nuts If I would have known how bad the roads were about halfway to work I wouldn't even have gone in in the morning. It was uh, the roads were pretty bad But when they got so bad I was already over halfway to work and it was closer just to go to work than to come all the way back home Because the weather got worse in a hurry And there was like Four feet of visibility at times and I was creeping along at 20 30 kilometers an hour And you got these nutcases barreling through that at highway speeds And they're almost running into you from behind even though you have your hazards on And then you get those other people who are so scared that they stop dead center in the middle of the road And you don't see them until they're four feet in front of you and you try not to hit them I don't know how those guys who are going like highway speed speed through that are missing these people I was expecting there to be some kind of massive pile up and there almost was Only I was telling you there on the way to work that one car that stopped like it's a four lane divided highway This car stopped dead center in the middle of the lanes the northbound lanes So the center of the road blocking both lanes Just stopped it was idling there where it wasn't stuck Wasn't in the snow drift could have easily moved forward and gotten over onto the shoulder The visibility at that point was probably about I don't know 50 meters or 50 100 feet like a little further than four feet you could see them ahead you could see the shoulder All right, so you could see Where the shoulder was you can get onto the shoulder. It was an open area. It wasn't covered in snow Get onto the gravel get out of the way. They wouldn't move And everybody's piling up behind them almost hitting each other A few people went flying into the ditch on both sides trying to avoid this person. They didn't even have their hazards on Parked in the middle of the road. No hazards lights were on. Yeah, but just stopped In the snowstorm I'm sure of it like I got around it and I'm not going to stick around because I mean their vehicle's running Right, so they have heat and they have what I'm I'm I'm not stopping in the middle of the road and creating another road hazard I don't want to get schmucked So we're gonna so I kept going down the road And uh, just hoping hoping that no one was gonna hit that car But I wouldn't have been surprised if someone just plowed into him just I know I don't want to get upset at people for being afraid and being uh nervous in snowy conditions But first off you shouldn't have left the house if that's how you are in this weather You looked outside you saw what the weather was like You made the decision to get behind the wheel and get out on the road You got out of your driveway onto the little road that leads to the main road You still decided to keep on going you got down the road a little bit and you realize that this is a little bit bad It's a lot bad. You still continue to keep going until you were in the worst possible spot to stop Ever in the middle of the highway, and that's where you decide to stop I don't know what to say that terrible decision terrible decision That's asking to get people killed So yeah, I I sympathize with people when they're afraid of bad weather conditions But in if you're if you know Just don't even get on the road and if you get on the road and suddenly it gets bad and worse than You thought it would get and it's something you can't handle You gotta you gotta suck it up just for a couple more seconds and get off the road Just don't stop on the road in a blizzard.  You're better off to just plow your car into the ditch. You'll be safer there And just wait for help to come If you can if you can handle it Get off the road onto an on ramp an off ramp a side road anything that's not the road or the shoulder but Oh, boy that made me really nervous and I probably should have stayed home But by that time I was closer to work when it got that bad and you know I'm a professional driver If it gets bad I'll get through it or I'll get some more safe And we made it through and it cleared up at about noon And so we did get some stuff done in the afternoon yet Not as much as we wanted to get done but we did get some stuff done And it turned out to be somewhat of a productive day after all Now I have snowdrifts in front of my house that are about four to five feet or four feet high Our yard where we let the dogs out was just covered in snow I had to shovel it out so that they could even get out the door We had to push our door open on the side. It was all snowed in We're lucky our front door opens this way instead of that way because our side door you got to push open Our front door opens opens this way, right? Excuse all my laundry here, but it opens this way So even if you're snowed in you can at least get the door open and start shoveling This is what it is a short video today a couple of short videos this week, but I'll see you later. Everybody. I hope you take care. Chevy. You got anything to add? Uh, just stretching. Oh, it's been a good day. Hi guys


Okay, the thumbnail was like this because I was seriously in shock at how many items I have in this category. I am decluttering foundations, concealers, powders, primers, and setting sprays. And I did a pretty good job of it, you guys. And I want to get into this so that you can see it and this video doesn't take a really long time. Please keep in mind that I keep a lot of foundations because I'm always testing foundations. What's better for mature skin? What is going to be the best thing for it? And I'll tell you what my criteria is for a foundation just so you know, it is that it works well on my dry skin. It works well on my mature skin. It doesn't show up any texture. It has to have like a natural like satin finish, not really matte, not really dewy, because a dewy foundation can accentuate my texture as much as a matte one can. So it has to be almost that sweet spot in there. Now there are some exceptions that say they are matte, but I find that when I get them on my skin they're satin. I don't know whether that's because of the primers I use or how I prep my skin. I'm not sure. So definitely cannot accentuate texture and it has to last on me. I don't want to put something on in an hour or two. It just be like melting off my face and it looks like it's either pulling apart or it just doesn't look good at all. And now I feel like I'm rambling. So I'm going to stop talking. Let's get into my declutter of my base makeup products so that you guys can see what I got rid of and what I kept. Okay guys, this is it. Powders, primers, finishing sprays or any sort of sprays actually, foundations and concealers. And that's what we're going to be doing today. I am going to run through these very quickly. Most of these you will understand. I'm going to do foundations very last. We're going to get concealers out of the way since they're in the front. We're going to go pretty quickly through everything. So let's start right here. This is the Catrice One Drop Weightless Concealer. This didn't work for me. It wouldn't cover. I'm getting rid of that. This is from Ulta. This is their Full Coverage Liquid Concealer. I like that one because it seems to hold up for spot concealing. This is the Maybelline Fit Me. I can't get this one to last underneath my eyes. It just looks blotchy and patchy. The Light Illusion Full Coverage Concealer is so good for me for spot concealing with the actual foundation. And I do like that one. Do you guys remember the Tarte Maracuja Concealer? This is their repackaged one. This is the Creaseless Concealer Now. I do like this one. It is very nice coverage, very emollient. I have two of these that are spot, I'm sorry, correctors from LA Girl. And I like the Apricot and the Green, the Green for Redness and the Apricot for my dark circles. I use those all the time. And this one should be in the foundations. This is from L'Oreal. This is their new Age Perfect.  So I'm going to keep that one. And then this is the Jcat Beauty Staysurance. This is their supposed to be their water sealed concealer. I did a video on this where I liked this since then. My skin has changed so much that it's super duper dry and I can't keep it. NYX Can't Stop Won't Stop. Very drying on my under eyes as well. I'm not keeping that one. From Believe Beauty, same thing. No coverage really and just didn't work out. This one from Milani, I think I'm going to hold on to for a little while, even though it's not the greatest underneath my eyes. It's really good for spot concealing and I really like it for that, as well as the Too Faced Conceal. This is the Born This Way Multi Use Sculpting Concealer. I have Mine and Vanilla. This isn't a light enough shade for me right now, but it is in the summertime when I wear darker and I'm kind of self tanning. So I am going to keep that one for duping purposes. I'm not necessarily that I like it. This is from Covergirl. This is a great one if you don't have super dry under eyes. So if you're an oily girl, this one's going to work for you, but it doesn't work underneath my eyes. It's going to go. There are two right here that are basically the same product, the It Bye Bye Under Eyes Full Coverage Anti-Aging Waterproof Concealer and then the Revolution Pro Ultimate Coverage Creaseless Crease Proof Concealer. These two are great. The Benefit Boing Concealer, this one is terrible on me, you guys. It creases really bad, even though it says Caceless Concealer, not Concealer. It is really bad and it will crease on me every single time. So that one's a no go from Juvia's Place. This is their I Am Magic Concealer. I'm going to keep that one.  That's how I'm going to use up some of these concealers. This one from the Maybelline Superstay Full Coverage Under Eye Concealer. This one is, if I use one dot of it, I'm okay in the summer. So I'm going to keep that one. This one is from Laura Geller. It's the Real Deal Concealer. This one works for me. It's emollient to like some other ones that I have. And then this one is the Concealing Define and the Concealing Hydrate from Makeup Revolution. You put these two together and they're great together. If you try to do just one or the other, they don't work. So I keep them and I use them together, you guys. And I am going to keep the Wet and Wild Photo Focus. This is the concealer. It works really good with the foundation as well. And lastly, I am going to keep the ColourPop Pretty Fresh Hyaluronic Creamy Concealer. I like all of those. Okay. Those ones are my concealers that I'm keeping. So we're just going to go right over here. These are all of my primers and I'm going to go through these again fairly quickly. This is the one from Hourglass. This is the Veil Mineral Primer. I love that one. From Mali, this is the Prep Perfect Prep Poorless Primer. Those two are just about the same exact product, along with Angel Veil. And I'm keeping all of those. And also this Misha one is very much like those but it has a lot of fragrance in it. So I'm really careful with this one. It has an illuminating property to it. I actually like this one on my body. I use it to be on my shoulders and my legs and stuff when I want that illuminating factor because it is a really pretty one as far as that goes. This one from Catrice, The Prime and Fine Keeping Me Matte. This one, even though it says it's long-lasting and oil-free, it doesn't, it really, really drives me out. It's really bad. I can't use it. This is the Color Corrector one from Makeup Revolution. This is so green, you guys, that it will turn any foundation that you have into looking like you're a gray ghost. So I'm passing on that one and this is the Revolution Putty Primer, Poor Perfecting Primer that they were trying to dupe the Tacha End, the Elf one. And this one is stiff and I don't like it. It is just a dimethicone product, but I don't like it as much as the Elf. This one is from Koki, Very Drying, even though it says it's a hydrating foundation primer. This one is the Revolution Blur Stick. You guys, they're trying, I'm sure, to dupe milk makeup, but I have never seen such a hard product in my whole life. That thing is terrible. I, oh my gosh, steer clear of that if you absolutely can. These are from Smashbox and I have the little one and then the bigger one. I'm going to keep the bigger one. I keep these for duping and then this one's almost gone. This is the Photo Finish from Smashbox, the Primerizer. That's almost gone. I've been using that up. I do like it. This is the original Elf Poorless Putty Primer. I like that one. I'm keeping it. From Revlon, this is the Photo Ready Perfecting Primer. I like this, but I'm going to pass it along because somebody needs to use this up. I'm not going to be able to use these before I need to use them all before they're done. From Derma Blend, this is their 3-in-1 Instagrip Jelly Primer. I like this one for gripping onto your makeup. It really does a good job. And then this one from Believe Beauty, this is their Pretty and Primed Stay Put Makeup Primer. I didn't feel that it helped my makeup stay put. And then lastly, this is from Revlon. This is the Color Stay Prep and Prime Protect Base. This one has an SPF of 34. And actually, that's not lastly. This is the Becca Primelight Filter. I like this one a lot for that glow. And then this is the NYX Honey Do Me Up. And I love this one for just being really very moisturizing. And then I put a poor minimizing one on top of it. So I do like that one. So we're going to just push these over here out of the way. And then we're going to start with these makeup sprays. And I really know exactly which ones of these I'm going to keep and get rid of. And they all boil down to was it too drying or not? And is it a finishing one or not? So that's really what I'm looking for here. So Cover FX Illuminating Setting Spray. So this is the Flower Beauty Luminizing Setting Spray. And then this one is the Lori L. This one is their Shake and Glow one. And I like all of these very much. I'm going to keep all three of these because I know that those are really great for a finishing spray on my skin. And then I have Primer Water. So I have MAC Fix Plus. I have two of those. One is in a Sant and I think it's Coconut. And then the other one is Smashbox Primer Water. I use these up on my makeup sponges. So those are going to stay as well. And then this one actually is a finishing spray too. This is not Algeness. I kept this because I like the sprayer. This one it was from Nix. This is their Radiant Finishing Spray. So I do like it a lot and I'm using it up in this bottle because the Nix one spit at me and I don't like spit. So I'm keeping that. The Morphe Continuous Setting Mist. I love these for my under eyes. When I don't want to set my under eyes with any sort of powder, that works so good on there. And then these ones right here, I'm getting rid of the Beauty Creations Peach one. Too much of a fragrance, too drying. Same thing with the Milani Make It Last. Even though I used to love this one to death, it just doesn't work for me anymore. I like the Dewey one better. I've already gone through a Dewey one and I don't like that one very much. This is the natural finish of the Wet N' Wild. This used to work for me really well along with the Elf one. But now that my skin's changing and I'm starting into men pause, things are so drying that these aren't working for me at all like they used to. I still like this. If you're still somebody that gets oil and break through through the day, use one of these. You'll really like them and they'll keep your oil at bay. I don't like the Refresh Hydrating Setting Spray from Koki. It dried me out. It is not a hydrating spray at all. I do love the Seal the Deal Hydrating Setting Spray Dewey Finish from Flower Beauty. That's one of my favorites. I'm getting rid of the Believe Beauty Makeup Perfecting Setting Spray. That one is too drying on me. I'm going to keep my bottle of Skin to Navy Makeup Finishing Spray. This one I use in the summer and it works really good during the summer. I am keeping a couple of good setting ones, but most of these are hydrating or primer sprays because my skin is so dry. Oh, and I missed a primer. Okay, you guys, this is from Laura Geller. This is her Spackle, the Tinted Under Makeup Primer. This one is in Champagne. I love this stuff, you guys. In the summer, if you're looking for something that's going to give you a little glow, it's going to fill in your pores. It's got some dimethicone, but it's really hydrating too. This is so good. That's why I have a huge one of it. So I really like that one. Okay, we're going to go on to powders. And I'm going to show you my finishing powders first because those are ones that I'm not getting rid of, and then we'll go on to the other powders. So Milani Prep Set and Glow, that's a finishing powder that I'm not getting rid of. I really love that. And somewhere over in the corner of my room, there's also a Flower Beauty Glow Powder. This is the Bye Bye Pores Illumination one, and I like that for a finishing dusting powder as well. I love my Lancome Absolute Powder, and this is in Absolute Golden. It's a gorgeous finishing powder. I think it's just an outstanding one that makes your skin look so perfected and pretty. This one is from Hourglass, and I'm hitting Pan on this one. This one is Illuminous Light. I love this. This is from Givenchy. I want to use this up this year. I'm really going to work hard on using this up. This was a present from my husband, and I love the powder. It doesn't have really any fragrance to it. It comes with the four different, you know, different colors that come together, and they make a really pretty brightening powder, and I really do like that, but I'd like to use that up this year. I've had it too long. I'm going to be getting rid of all of the setting powders that I have, except for three. These are the two more expensive ones. This is the Hourglass Veil Translucent Setting Powder, and then the Laura Mercier Translucent Setting Powder. I'm keeping both of these for two reasons. One, yes, I do like them very much, especially in the summer when it's humid, but two, they cost a bloody ton of money, and I don't want to get rid of them, and I'd like to dupe them for you guys when I can. So I'm keeping those. This one is a really expensive one. This is from By Terry. I got this from Beautylish. It's going back. This is one of their tinted loose powders from them. It's a hydra powder, and I got it because I thought, oh, cool, hydra powder, that's got to mean that this is going to help my skin not be so dry, but that's not the case. So I'm really disappointed in this very expensive powder and very drying. So I am actually getting rid of that one. That one's going back. I'll put that in the declutter pile, even though it's going back. This is from Koki. This is a loose powder, very drying on me. It doesn't work. This one is the Essence All About Matte Fixing Compact. If you guys have oily skin, you might really like this. Very, very creamy.  I really do like that one. This one from Juvia's Place is really, this one I'm going to have a hard time with, but I think I'm going to declutter it too because all of my powders that are loose are just too drying. So I might, this is a maybe, I'm going to put that one over there. This one's a Keep. This is my Essence Brighten Up Banana Powder. You guys just saw that in a video, my top five favorite powders. This was also in there, the Elf Sheer Tint Finishing Powder. Love that. Very creamy. This one was in there too, the Physicians Formula Healthy Powder. I love this, this one as well. Another one that was in there is from L'Oreal, the True Match. I'll make sure I link that video for you guys. This is my second one of these. This is one of my very favorite, second or third, one of my very favorite powders that I've been using for a long time, and this is the exception to the rule at the drug store for keeping a loose powder, and it's the Maybelline Fit Me. I love this powder. I think it's a fantastic powder. I will continue to use it. It does not dry me out like all the other loose powders from the drug store, so I am keeping that one as well.  I'm going to keep that one, and I'm going to keep the Elf one. And I like those in the summer. Again, they can pick up a lot of oils if you're having, you know, a very humid day. I do like those in the summer. This is from Tarte, a little sample of their loose powder I'm getting rid of, Revolution Pro loose powder, getting rid of that one. This one is from Catrice. This is their Healthy Look Mattifying Powder. This is supposed to be a brightening powder. I don't mind this one. I actually think this one is really creamy, and I had a hard time not putting this one into my favorites. So probably going to keep that one from Believe Beauty, a loose powder. That one is going. This one is from Wet and Wild. This is the Photo Focus. I almost put this one in my top five as well. But it just wasn't just that right, almost creaminess that I like. Also, the NYX No Filter line, Hashtag No Filter line. I like this one very much. I am ruining my fingernail polish. I like this one a lot. So this one almost went into that video too. So those are two that almost went into the video. The number one pressed powder that I use that did go into the video is from Flower Beauty and the Light Illusion, and love that powder for a little bit extra coverage and how great it is. And then this one is the It Your Skin But Better CC Airbrush Perfecting UVA UVB 50 Plus Broad Spectrum SPF. Okay. This one is so good, you guys, just to keep in your purse for the touch-ups during the day and getting a little bit of protection on your face. That's why I keep it. I don't necessarily like to touch up with powder during the day, but it's creamy enough that you can get your UV protection reapplied without disturbing your makeup. So that's why I keep that one, and I like it very much. Okay, you guys, I did do a top 10 of my favorite drugstore foundations, and I went into at length why I like those so much. So the Healthy Skin Foundation from Physicians Formula was in there. The Flower Beauty Light Illusion Foundation, that one was in there as well. So I like that one a lot. There was also the Conceal and Hydrate. Those were in there. I haven't had this in two colors because mixing them together, I have my perfect color. So I am going to be keeping those. The one from Believe Beauty that was in that video. Love it. The one from Koki that was in that video. I love that as well. These all went in my top 10. And then this one is the Soap and Glory All Day Wear. Yeah, you know what it is. And this one was my number one. Love it. So this one I put in a recent loves video. This one I found, this is from Physicians Formula Organic Wear. I love that silk one. That's a silk foundation elixir. The number seven, Lift and Luminate. This one, I love. You guys told me about that one, and you told me about the Color Stay from Revlon, and I love that one as well. So those are all great ones. So here are my high-end ones right here, you guys. From NARS, this is my Summer Go-To Foundation because it holds up so good in humidity. And I really love it. This is the Radiant Foundation. I love that one from Zoeva. I did a whole video on how beautiful and perfecting this is on your skin. From Dose of Colors, this one I'm not crazy about. Every time I wear it, it doesn't last on me very long. So that one is going. And I found the same thing with the Yves Saint Laurent. I don't know if that's how you say it, but this is the All Hours Foundation. I didn't like this one. It didn't, it just didn't give me a flawless finish like it says it should. So I am getting rid of that one. I just got this one from Becca. They gifted it to me through the Octolene Network for a review. And I tried this yesterday and it was really, really yellow on me. It just seemed to turn yellow really quickly. I'm going to try it a couple more times and let you guys know I'm going to try and color correct it with my color correcting pigments I have. And I'll let you guys know on that one from it. I love this one. It is their CC Matte one. I don't know why it doesn't look that matte on me, but I love it. From Ofra, I love this one too. This is their Absolute Cover Full Coverage Foundation. And then from Tarte, this is their Face Tape. This is one of my probably all-time favorite ever foundations that I have high end. And really like this one. This one is going from Revlon. This is one I'm not keeping. This is their Candid Glow. No coverage in this whatsoever. I did not like this one. Do not pass go. Do not get $200. And the Milani Screen Queen. There was no coverage in these two whatsoever. And like I said in my last video, if I'm going to go to all the trouble of putting on foundation, I want it to at least look like I have foundation on. So those are going. The NYX Total Control Foundation Drops. I mix these into foundations that don't give me enough coverage. Not like those two, but the ones that I do like that don't give me enough coverage on any given day. I can mix these in and really like it. From Wet and Wild. I have both their Dewey and their Matte. Now originally when I got the Dewey, I had said that I really didn't like it. And then I watched so many positive reviews on it. I went back and I tried it and tried it. And guess what? I do kind of like it. It's kind of really good. It's a Dewey foundation. It does last fairly good. But you know what? Again, mixing these two together, you have a really, really good foundation, you guys. This is pretty fresh. This is a Hyaluronic Acid Tented Moisture. I would say this is more of a medium coverage. If I want more coverage on any given day, but I want a lot of moisture, I'll fix. I'll mix in the NYX Total Control Drops in with this just a couple drops. And it makes such a gorgeous foundation that lasts and it gives me hydration. And I'm hoping I'm not bumping that camera too much. The NYX Born to Glow, so many people have told me that this is so good on them. I'm going to give this another try even though I was going to declutter it. I'm going to try and fix the color on this and see what I think and give you guys a different review. The Super Stay, this full coverage, long lasting, supposed to be 24 hours from Maybelline. I like keeping this one because in the summertime this one works so good for me. So I'm going to keep that one along with the Juvia's Place Summertime. That's a good one for summertime. These ones I'm going to probably be getting rid of. The NYX Can't Stop, Won't Stop, Way Too Drying on Me, and it looks so patchy. This one when it first goes on from Maybelline, the Dream Radiant Liquid, I cannot get this one to work whatsoever. I've tried so many times and it goes on so patchy and so gross and I just cannot get that one to work. So that one's going as well. The Milani Conceal and Perfect, actually I might keep this one because I want to do a full face of Milani for you guys so I might actually keep that one. So those are the foundations that I'm keeping. So the ones in the front right here, I'm getting rid of you guys. There are 33 things that I'm getting rid of. I'm actually really proud of that. So I'm really happy that I got to go through these. These are going finally and they're going to a better home in a better place and maybe somebody that can use them. So thank you so much for watching. Please give this video a thumbs up if you do like seeing de-clutter videos and a little bit about why I de-clutter. This one was kind of a quick run through but I'm really glad that I got to do it for you guys and I hope that I get to do many, many reviews for you on foundations. I did powders and I did primers, setting sprays come next and concealers. So watch for both of those videos. I hope that you guys liked it. Please take care of yourselves. I will see you all very soon in my very next video. I love you. Bye!


Hello everyone. Thank you. Thank you for coming to our webinar today. We're really excited to tell you more about this project that we've begun at the open SSF called Alpha Omega. It is the beginnings of this project. It is, as we call it, an experiment. It's something that we've put a lot of thought into but it's still very early days and we'd love to find ways to involve all of you and push this forward and faster. So just thought we'd try to lay the groundwork and look for perhaps some opportunities to collaborate with all of you. So let me give you just kind of an overview of what you'll hear about today. We'll give you a bit of the background, what drove some of the thinking and the conversations behind this. We'll do an overview of the mission and the kind of the vision for the project and then into some details about how we plan to actually deliver on that mission and vision. And we'll wrap up with some places to go to where you all can contribute. And then we really want to leave a good chunk of time. We anticipate perhaps about half the time of the webinar for open conversation and Q&A about where we can take this. There's still so much to think about and build on this. And so involving as many of you on that would be great. And just to get started, I'm Brian Bellendorf. I'm General Manager for the Open Source Security Foundation, which is part of the Lenox Foundation. I've been with the Lenox Foundation since 2016 in a couple of other capacities and leading open SSF since October of last year. And I've been in the open source space for about a hundred million years. Why don't I pass the baton to Mike Skaveta to introduce himself. Hi, I'm Mike Skaveta. I lead an open source security team at Microsoft. Within open SSF, I lead the identifying security that's working group. I've been in software and software security for about 20 years or probably more. I'm super excited to join Brian and Michael in getting this Alpha Omega project off the ground. And I'm super excited to see where it goes to Michael. Hi, everyone. Michael Windsor. I've been building software for way too long. First product was a kitchen design program back in the 80s. I've also been working at Google now for about seven or eight years. A lot of it in development tooling and most recently for the past four or five years really worrying about software supply chain security. I'm excited and terrified about how we're finally waking up to it and paying attention to it. And I've been working with Michael and Brian on Alpha Omega now to try and put together our efforts here and see what we can do. So very excited to meet you, everybody, talk about these things and hope we can all learn more. Thank you to the two Michaels. So Alpha Omega is an attempt to try to really look at how open source software is being written in the modern world. We know that open source software is the foundation of practically all modern technology. I mean, we see stats up there that suggest that 90% of the average software stack is actually open source software underneath. And we know that society needs that foundation to be safe, secure and resilient. There's no better evidence for this than the fact that a bug in a Java logging framework can start to trigger series of meetings and public proclamations by the White House and other policy-making organizations and drive actually a whole lot of disruption and investment by organizations to try to close up that hole. But this is critical infrastructure now. I think everybody's recognizing this even far beyond our own bubble. This is bridges and highways and these are also digital public goods. And so we really need to start to think about how do we best support the existing mechanisms for building open source code and the existing maintainers and the existing foundations and organizations in a way that isn't just about delivering a 300-page tomb of thou shaltz to them and say and penalizing them when they have a defect found but is instead something much more bottoms up, much more supportive, much more systematic in not just looking at a couple of projects but trying to really cover the breadth of all the open source projects that are used out there in a meaningful way. But let's go back and we'll be a bit kind of humble about the scope of that work and that there's a lot of open source projects, a lot of open source developers and we'll never close every hole. The last defect is fixed when the last user has passed away as they say. So we've got some ideas here. This is an experiment but this experiment along a couple of very specific lines. Let me start first before I hand it off to Michael Windsor to kind of elaborate a bit more on what it actually is. Let me just pause and help say what it's not. In particular, it is not a fund to pay open source project maintainers directly. There are plenty of other projects trying to do that, trying to answer the question of what's the sustainability model for open source in different ways. There are some targeted places where we might apply some funding to help get over the hump in a couple of projects, but we'll go into that. It's not a certification body or process. We're not trying to bless or recognize good versus bad or have a formal kind of fits oriented kind of thing. It's not a replacement for normal security practices. Our hope in fact is that this ends up being a capacity building mechanism and helps lift how other organizations, other open source foundations and how companies build open source code and the practices that they adopt. We're going to be reusing a lot of stuff coming from other parts of the open SSF to make that work. This is not a process for forking and taking over open source projects. People love conspiracy theories that doesn't get any traction here, nor is this a replacement for any other existing services. There's very little in this that we think is actually being done well by anybody else out there in the open source ecosystem. We'd really love to partner with anybody who has similar objectives or is complimentary in what we do because again, that's a big challenge. It's also not a private zero day trading club. We will be dealing with vulnerabilities, perhaps ones that haven't yet been disclosed, but there's a whole universe of proper thinking and proper care to be applied to how those get managed and how maintainers and others work through coordinated vulnerability disclosure processes. Finally, it's not a fully automated scanner that will just launch junk vulnerabilities at maintainers and leave it up to them to have to clean up. This is a bit more thoughtful than just trying to scabish off that out. We think at least. Why don't we transition to what it actually is? With that, I'd like to pass the baton to Michael Windsor. Thanks, Brian. Our mission is derived from the open SSF mission. The open SSF is here to create a space where we can, as an industry, collectively understand and solve and work out solutions in the long term for software supply chain security. More and more of us aware, most of you here because you've heard of it and are interested. Alpha Omega is really trying to be in a focused way, applied, directed activity. Some of that direction is specific to certain projects and some of it is meant to be able to allow us to scale and provide scale solutions. So our mission is really to provide that direct maintainer engagement and bring expert analysis to actually achieve concrete outcomes, even as the tool chains and the working groups and all these other machineries that we're putting in place in open SSF are starting to develop the future. We're trying to act now towards just improving things and then scaling it up. Next slide. And so our aspirational vision, this is where we're trying to get to one, is where critical open source projects are actually secure. And it's important to note, every word here matters, critical. Not every open source project is critical. Not everything has to be secure now, just like a startup is going to prioritize certain things over others. Same thing we true for projects and how we consume them. And we also have to be pragmatic. We're not going to eliminate vulnerabilities. We want to find them and fix them quickly. And we've learned over and over again that the operational management of vulnerabilities post facto is as important as actually fixing the source code when you see it or making the build process is more secure. And so if you think of this as sort of constraining our vision, our mission sort of divides the big problem domain, and then our vision starts to say, this is where we're going to do this, how we're going to act our solution space. And then I think Michael Scavetta will now talk to us about each of these, Alpha and Megan, how we think about them and break it down from there. Thanks, Michael. So for Alpha, the main point of Alpha is working with maintainers directly. So I have more information on the next slide. But basically, we're going to target the very most critical open source projects, even among critical, if we think that there are 10,000 or 50,000 critical open source projects, the most critical 100 or 200 of that list would be targets for Alpha. Alpha will be essentially expensive, time-consuming, heavy weight, at least heavy weight on Aaron. We hope it's not heavy weight for the maintainers. A way for us to engage, understand what their security posture is, understand where their gaps are, and help them to fill those gaps and remedial those vulnerabilities and triage those bugs and kind of whatever is needed. If a project, if the thing that they need help with most is moving rocks from A to B, and if that helps their security posture, then we should be there to help them move rocks from A to B. Next slide. So getting super specific here, and while this slide has lots of words on it, it's all intended to be examples of the kinds of things that we can do and where our thinking is. As both Brian and Michael said, this is an experiment and this is very early days. So some of this is subject to change. But imagine you're in a restaurant and you want to know what that restaurant can offer. So on Alpha's menu, at the appetizer, at the beginning of an engagement with a project, we want to learn what their security challenges are. So we'll engage them, we'll have a conversation probably over the course of probably weeks to understand where we could have the most impact. If both we and the project both think that this is a fit, then we move, take a step forward and we look at the main courses and we look at where could Alpha provide the most value. This could be things like a source code audit. This could be setting up tools. This could just be encouraging them to set up two-factor authentication when publishing or commit signing or things like that. There were some projects like the OpenSSF scorecard, which can give a rundown of where a project stands on certain metrics. Maybe improving those metrics is the way forward. Or maybe it's just that they get lots of security vulnerability reports and some of them are low quality and they just need help triaging them. And maybe they need help actually creating fixes for whatever's needed there we want to be on the table as long as it's generally in the direction of improving the security of this critical open source project. And then for dessert, we do want to look back and see how we did because we do want to improve over time. Especially for the first five or 10 of these engagements, we're going to expect to learn a lot with each one and refine things. So I hope that the 11th one will go better than the first one, but we have to start somewhere. Omega is at the opposite end of it and not opposite meaning like the least used or impactful open source project, but still within this critical, let's say 10,000 is the nice round number that we've been using. We want to use a combination of automated tools and scoring and ML if that's reasonable, kind of whatever tool is appropriate to identify critical vulnerabilities. So not all vulnerabilities, but just those are the ones that are most likely to be impactful. And then to have security analysts, so these experts reviewing those results, validating them, and then assuming that they are authentic and important and need to be fixed, working with the project directly, reaching out and doing the coordinated vulnerability disclosure, but also lending a hand in creating those fixes if requested and if appropriate. So while there is a large degree of tooling here, it's not exclusively tooling, it's not fully automated. There are people involved. And if you go to the next slide, sorry, I should have gone here earlier. Yeah, the appetizer is using the tools to collect lots of information and lots of vulnerabilities, lots of facts about these projects. We will have engineering, software engineers or security engineers, I guess, refining this rule set and building the system to automate the triage as much as possible. We want this thing to be like magically efficient such that we can kind of turn the crank on this machine and get a high quality vulnerability out of it. And then we just keep turning the crank. Once we validate it with experts, we reach out, we get the thing fixed. And then again, we look back to see how things are going and improve the tool and process over time. Again, this is an experiment. We think this will be successful in this way. If not, we will adjust and tune our approach as we learn more. And back to Brian for how you. So there are a lot of questions, of course, that all of you may have about how all of this will actually work. We are very much a part of the rest of the Open Source Security Foundation. A lot of these ideas came out of conversations that were had in a number of different working groups. And we plan to stay very close to those working groups. The three that matter most for the activities here are the Securing Critical Projects Working Group. This is a group that's been developing a mix of objective data from things like the Harvard Census Report that talks about kind of their set, their view of critical projects based on metrics that they're able to obtain, to conversations that we have in those working groups about code that sits very critically in kind of the build infrastructure, but might not show up in a software composition analysis, that kind of thing. So that's a group that's chartered with creating and maintaining a list of the top 100 that was used most recently in distributing MFA tokens, for example, at the end of the year to developers on the top 100 projects. So we plan to work with them to kind of come up with these additional lists and refine that over time. There's a related question I see popping up quite a bit, which is, you know, how do we select from those top 100 the ones we'll be working with? And that's still a work in progress, to be honest. But we'll talk about that in a bit. The second working group that we work quite closely with is the Best Practices Working Group. This is going to be a feeder for so much of what's on the menu, especially in alpha, to kind of talk about with projects, try to help them understand how they might adopt the Best Practices badge, those sorts of things, the scorecards, other practices. But that's, again, we do not want to walk in with the, just read all this stuff and use these tools and you'll be okay. It's got to be more bottoms up and needs driven than that. But the Best Practices working group is creating a lot of value in what they're doing through that. And then the vulnerability disclosure is working group. This is obviously going to be a big deal as we work through the scan and the results of the scans and we see things that are problematic, perhaps not yet clearly a vulnerability, but something that is worth talking about with the maintainers. As that evolves, if those evolve to being actual vulnerabilities, then finding a way to work with those maintainers through a graceful disclosure process such that those fixes get rolled out to major stakeholders and everyone can be updated as quickly as possible once it's public is going to be pretty important. And so that's a working group that's done a lot to try to figure out what are the standards and benchmarks that might be appropriate for open source projects because most of what's out there has not been written, particularly with open source in mind. So one way for all of you to get engaged with us is to find us on those working groups. But we know as well that we will need to be developing kind of a public engagement model for each of these two halves of the project. We've got some ideas, we've got some things that we think might work, but we want to evolve that kind of a little bit more with all of you in mind. So one of the ways to stay on top of that just a little bit out of order here is to join a Slack channel. We use Slack pretty extensively at OpenSSF. We know it's not the best medium for having kind of deep thoughtful conversations sometimes, but it is a good way to brainstorm, a good way to kind of share some things coming in from the side that we might want to think about. So if you all of you could join the, if you're interested, join the Alpha Underbar Omega Slack channel at slackopenSSF.org. That's a great conversational way to stay involved. But if that is a little bit more than you want right now, you just want to hear about updates and that kind of thing. Obviously we'll push updates to Twitter and the OpenSSF account and the like, but we've also created a mailing list specifically for announcements related to Alpha Omega. That link and all these links, by the way, are being dropped in chat so you could follow that. We also have just a raw expression of interest form. If you are interested in knowing more, interested in, you know, have some things you might be able to contribute, that's the link there will take you to that place on the website as well, or you can fill that out. This is, you know, this is really what we figured out so far. I think now it's actually appropriate for us to pivot and look at the questions that have been submitted. I've sort of been scanning those a little bit and I know, and let me just kind of paraphrase what I think is about half the questions here to the two Michaels, which is what will be the criteria for, you know, deciding what's critical and which of the projects, particularly for Alpha, I would imagine, that we decide to work with.  So I think a stab and then about jumping in, Michael should chime in as well. You know, this is actually a question we've heard a lot already. We're working with the working groups to get that initial list and build out from there. But our priority up front is really about our ability to get actionable, sort of shovel-ready work that we can start to think about and do and learn from. And as we said several times, we're still figuring out how this is all going to play out over time. And so one of the first sort of criteria for the early project is not necessarily what is the most critical project, what is the most biggest security thing we can fix or whatever. That's not even answerable, really. But where is somewhere we can go off and start doing something now, making a difference now, learning from that effort, and then feeding it back into how we do it, how we interact, how we select for projects. Michael? Just to add to that, there have been multiple attempts, you know, over the years at coming up with a list of the most critical projects. Those lists are usually different. They're all reasonable. There's no standard to judge, you know, which one is better than the other, really. The critical projects working group does have a list. We like the list. That list will inform the project that we choose from. But if we made a mistake and we chose the 150th instead of the third most critical project, according to the criteria that they used, we're still dealing with very important projects. So we don't want to be overly myopic to just start at number one, and we don't look at number two until number one is done or anything like that. We do want to optimize for, as Michael said, optimize for impact, optimize for speed, optimize for learning. We don't want to choose very, let's just say, unimportant or unimpactful projects at the very tail end of it. We're also looking at, you know, projects, you know, in the larger context of how do they interact with the rest of the ecosystem. An individual library may be incredibly important. An ecosystem may be, like, de facto much more important than any individual project. So we're trying to look at it holistically and come up with the just good choices that we all feel good about. In terms of volume, we'll probably have some sort of a beta test kind of pilot phase for this kind of work, where we'll try to evaluate, you know, how successful we've been, is there a repeatable pattern to this kind of thing. And I think, you know, we've been talking about trying to aim for five different projects that we could reach out in that period of time, you know, lasting a couple of months. I think our hope would be that over the course of the first year, we could try to reach more like 15 to 20, perhaps of such engagements. A lot of this is going to be based partly on how will we scale the staff that we're, we'd like to recruit for Alpha Omega. How will we think about, you know, engagement of volunteers in that process? This is hard work and it's harder to ask for folks to volunteer for this kind of thing or to even vet that they have the right approach to this. But I think it's on us to think about how do we scale this out to, you know, to be able to take advantage of volunteers who show up with real skills and are willing to kind of work on a systematic process for this. So I think those are, you know, again, five, 15 is just a dent into the 100. Hopefully we find ways to scale up. Certainly more resources would help with that as well. But, you know, I think it'd be a while before we can claim to cover all 100. My hope as well is that if we can talk about the kind of work we do, hopefully we can have a, you know, kind of a ripple out impact on the other 100 projects as well. An interesting question that came up is, you know, in this work with Log4J, if we had started this a year ago, would Log4J have been on that list? And I think there's a couple of ways to dance this, but I'll leave it first to the two Michaels. No, probably not. I wish it were as a, in the description of Log4J and what we would have seen from a high level, it wouldn't have been up there. Now, obviously it would be, but, and logging frameworks in general, I think, you know, people are starting to think about them a little bit differently in terms of kind of, say, magical functionality. Yeah, I agree with Michael. I think that it's interesting to see how we learn about classes of problems, right? So there's a team I work with here at Google who are focused on fixing all kinds of sort of problems in the Linux kernel. There's a class of problems that try to eliminate from the kernel, not just once, but in a durable way. And we could look now with the, you know, 2020 vision of hindsight and let's say looking, okay, points of extensibility that can have essentially, you know, outbound calls to other network services or whatever are an interesting pattern of potential risk, right? Which is not really earth shattering news. We just hadn't looked at it through the same lens as we have now. So we might entertain an effort to go look at various points of extensibility. That's exactly the kind of direction I would like us to sort of start understanding and how can we reliably detect those things, right? Are there patterns of coding or analysis that we can apply to get there? These are exactly the kind of questions we would like Omega to be able to scale up and answer. And then as we are evaluating any particular project to try and figure out what we can do to make it more secure, we might look for points of extensibility as one of our touch points. So the thing I'll add to this is, you know, that this is a question that kind of even a little bit more focused on securing critical projects working group, because they, you know, one of their data sources, right, is the Harvard Census. And there's an updated version of the Harvard Census coming soon that does rectify this. But the previous Harvard Census is, there's one or two, I can't remember which, but the previous one did not list log for J. And part of that was, you know, it's very dependent upon the data sets that they have access to. Getting access to data about which components are downloaded with what frequency is actually rather hard to get to. And without that, you can do software composition analysis on what's embedded inside what, but you don't get a sense of impact or really, you know, does this matter without also having usage data. So the Harvard project's getting better at that. And again, we're going to try to hang our hat on, you know, that list of 100 coming from securing critical projects. As we whittle that list down, I think engaging with not just, you know, the individual projects that we find interesting to talk to, but also with the foundations around them is going to be important. So it's not just about talking to the log for J. Maintainers, right? We might do that for something critical. You know, we'd look at that, or for, you know, a different JavaScript kind of component here or there, but potentially talking with the organizations around the Apache Software Foundation, the OpenJS Foundation and others to go, where might you think, you know, there's some criticalities here to here's some projects that perhaps don't show up in the stats, but you know from your experience are perhaps a bit more native of some of this kind of thing. So how might, this is perhaps a provocative question, can an open source project request to be included in either Alpha or Omega? Like, do we anticipate having kind of an application form for that kind of thing? Good question. Only a person named Michael can speak at the same time, right, Michael? Look, we would certainly entertain the conversation, right? Early on, we'd love to hear from you and your interest at some level, but there is no sort of like, I'm on the list and therefore someone's doing things for me kind of thing going on here. We're still figuring a lot of the stuff out in the engagement model over time, but if you are interested in being part of this, first of all, I would just say again, what we already said earlier on, become part of the working groups, have a conversation there. We're really going to listen to the working groups around which projects are critical. If you think yours is critical and it's not on that list, that's the consensus place to have that conversation, but we're certainly open to the conversation, chat. Good. The next question I want to take from Emily Fox. Emily, I think we've enabled the ability for folks attending to be able to participate in the conversation. Can you unmute? Is it possible for you to unmute? Great. Do you want to ask your question about automated security analysis? So I'm a little curious because automated security analysis is a large field and there's a lot of potential things that can go in it. So is there a kind of phased implementation approach around the kinds of automated security analysis you intend to do with these projects, or is there one particular one that you think will be the most bang for the buck in its implementation? So right now we have a kind of a proof of concept technically.  Those tools include CodeQL from GitHub as well as probably 15 or so other static analysis tools. They're all in that kind of, that style tool. We're not constraining ourselves to only static analysis. We're trying to think of what a fuzzing story would be around Omega, particularly when it's low touch, how to automate the fuzzing harness stuff as a whole rabbit hole of challenges. But we want to explore that as well. So those are the kinds of tools that we want to do. But again, another similar tool in a slightly different category, sure we would consider it. What we're really looking to build though is something that has a very, very low false positive rate.  That's one of the challenges that we want to face head on, particularly with the security engineering talent that we're going to hire for this is to eliminate that either through kind of constantly looking at the rules and whittling them down and scoring them adding more context so that the rules can be more applied more accurately. And then just generally, I guess with the goal of if the security analyst who's like reviewing the output of these tools mark something as false positive, we should consider that a bug in our tool chain and that would be on a list that we would fix. We know we're never going to get completely clean results out of a tool chain. But the only way that we're going to scale is by reducing noise. I'm going to drop the slides though. I'll talk more directly as well. I think there's a couple of things like that to that as well. One is this is I think a useful place for us to think about engaging the community on. Like everything we do, the software will be open source and figuring out how to plug in additional scanning tools is an area we're happy to engage in and think about how do we add it to some common infrastructure. But as well as thinking about things like what are some of the scanning patterns for those tools and how might we work together on devising a rule set publicly, collaboratively with the public on that. But this point about trying to identify and reduce false positives I think is also a real opportunity for us to work with open source developers on whether it's advanced machine learning tools to look at these things or flags that people can put in code to try to highlight. This really isn't a problem. If there's ways in which tooling can help fight the false positives problem because that will be the major burden upon both the staff we hire and maintainers we work with to try to sort through. That's a place we could really use it or use some help. The second one is one of the things that we may end up being bound by is the operational expenses required to do scanning. Anybody who does CI for a modern open source project that pulls them onto dependencies and tries to do testing and security scans with each pull request or each commit knows what I'm talking about. These costs can quickly overwhelm even a bit size project. One of the things we have to look at is how do we cost effectively try to really cover the gamut of 10,000 projects efficiently and where might we try to get other additional resources? Cloud credits, I know some folks do offer this kind of thing as both a paid service and often free for open source projects but corralling that into a uniform environment is going to be perhaps a challenge. But again, we'd love folks helping in trying to answer that. Anything, Michael Windsor, you wanted to add to that before we jump in? We've got a lot of questions. Let's keep going. Okay, great. Is Irving Wadowski-Berger able to unmute himself and would you like to ask his question? Then if not, I'm happy to ask it. I'm here. Hi Irving. Good to see you again. Hi, very nice talking to you. So as I'm hearing you talk, it would appear that the methodology processes tools you're talking about apply to any complex mission critical software project, not just open source, am I correct? 100% Irving. And a lot of the practices that are being developed and discussed and evolved in the working groups came from projects that happened in other organizations or practices that are starting to emerge. And as we in Alpha Omega try to become even more applied and really bring what we have today and refine it and improve it, we want to make sure that people can benefit of that. And there's really nothing specific to open source about it. Obviously, access to the source code is a critical component for some of the analysis techniques we use. If it's within your, since you sort of, you know, ecosystem of source code in this organization, you have access to that code, it's great. There are some very interesting conversations I've been having with other open assistive members about vendor relationships and how do I ensure that the software I'm receiving from a vendor has had similar analysis and using things like scorecard as a way to imagine a vendor producing a scorecard report of their repos and other things and some sort of standardized report about what kind of work I've done to analyze my own software. These are great concepts. We'd love to see that sort of stuff emerging out and playing out. And certainly the lessons we learned through Alpha Omega will be very much shared with the community and made more available. And one reason this is particularly important is let's say at MIT, which I'm affiliated with, there is often people say, well, and where do the kids learn software engineering and things like that turns out, especially schools like MIT and maybe the same Stanford and so on, don't teach it. It's almost like, well, that's plummy or something like that. And part of the reason may be there is no methodology that there is agreement on to teach at the college level. Do you see it that way? I think, first of all, I dropped out of school a very long time ago, so I can't speak to how it happened then or how it happened now. But I think that I share your enthusiasm for ensuring that engineering practices start showing up in all forms of software education, whether it's a computer science degree where it theoretically is theoretical to a more intentionally computer engineering degree. And certainly these software practices need to become part of the norm. One of the phrases we use a lot internally here is we need to make writing secure software easy. And it's not today. And that's, I think, one of the sort of effective goals of Alpha Omega is to learn more about where it's hard and how to make it easier by doing it. So very much in spirit of what you're trying to do. I appreciate it. Thanks. Irving, I'll also direct your attention. The Best Practices Working Group has developed a set of training materials for secure software development that three different courses that have been put up on edX that we've had about 6,000 people register for so far. We have very ambitious goals to grow that to be something that can reach 100,000, although frankly, it's the kind of thing that every software developer should go through and read and understand just how their own code could be twisted against their intent, right? Just how to red team their own code and how actually that matters in open source as well. So, yeah, separately from Alpha Omega, I think there's more investment we'll see in getting that out there and more widely promulgated. And I think some partnerships with schools that we'd love to explore too. Thanks. Yeah. Tom Jones asks, and I'll just kind of be quick to paraphrase, will disclosure be different from CVEs? Maybe one of the two Michaels could talk about kind of your view on how disclosure processes will be managed for the things that are kind of discovered during Omega. So, the CVE is kind of the tail end of the disclosure process. I don't see any reason why we would invent our own, you know, and to be fair, there's a lot of conversation going on about the future of CVE and how to make that better. And we would kind of slipstream into that. I'd rather really smart people are thinking about that stuff and we should leverage that. The disclosure process though, right, you know, up until CVE is coordinated disclosure and working directly as we described. So, that process, you know, we follow kind of just industry best practices of, you know, how to reach out and how, you know, one thing, just to be super quick, there was another question later on, are we going to make vulnerabilities public 90 days after? We haven't, we've talked about that. We haven't really made a decision exactly on precisely what that timeline and workflow would be. The conversation and the principles that we have in mind are, we want to do right by the project in terms of giving them the support and the time that they need to fix things. But we also recognize that, you know, we are doing this on behalf of society that is, by definition, at that point running a vulnerable version of the thing. So, we have to balance that need. And we're trying to do that in a thoughtful way. We'll, we will be transparent when we know what we want to do. And certainly, we're, we want to continue that conversation there. Plus one to what Michael said. That's great. So, plus one. Kayla under the coffler, would you be willing to ask your question live? Yes, yes, I am. So my question is mostly focused, and I wrote Omega in the question. Now I'm thinking, I mean, it's could apply to the alpha side as well. Is there going to be a community focus when it comes to the security researchers who are identifying vulnerabilities or helping to identify vulnerabilities in some of these projects? So yeah, I'm mainly wondering if there's a community emphasis or if we're going to be working with, you know, a selected, consistent group of researchers. So I think initially, the answer is more of a focus on paid staff hired for this project. There's a couple of reasons for that.  I think we're all in agreement that, like, in theory, having a larger community working at that, like, there's a lot of security researchers out there that I would love to, like, direct at interesting, not directed, but have thinking about interesting problems. There's a whole other side of, like, disclosure and how do we vet and, you know, because there are bad actors out there as well. More to come, we're thinking about it actively. We absolutely want to use Alpha Omega generally as a lever to get more out of the system than, you know, we can put in directly. But initially, I think the focus is on direct, you know, like doing things directly and having the community help in terms of what Brian and Michael have said, you know, the Slack channel, the openness of working groups, the core tools that we use and kind of advancing our thinking and how to do this, do this well. Okay. Let me move on to D.J. Ware. D.J., would you be willing to ask your question about Linux distributions on the call? Or I can read your question. I'm kind of calling people out of the blue. I might be surprising them. I apologize. Well, D.J., what is our vision for how this interacts with, say, Linux distributions and their associated repositories? You know, we might also cover some of the other sources of repositories out there, you know, Maven, PiPi, those sorts of things. I don't think that we're limiting ourselves to any particular distribution or package ecosystem or anything else. You know, we should be thoughtful in going, in looking at places where we think we can have the most impact. So for certain Linux distributions, you know, I don't think, well, for me, I haven't thought deeply enough about it to have like a really good can to answer here, but everything's on the table. We'll try to do, we'll try to focus. I wasn't trying to get too much in the weeds. I was just trying to understand if I was looking, there's so much overlap in different packages on different features that they have. How would I identify that as a developer to say, I know this has been vetted and this one hasn't? There's really, really more of the question. Okay. I think, D.J., that's a really good question. And it leaks into some of the other questions around S-bombs and are we doing applications or packages or whatever. I think the granularity of effort in Alpha Omega will be at what you would think of as a package level, whether it's an operating system package or a language package or some sort of open source project of some kind. But when you start aggregating and assembling things into an application, then your S-bomb of like the other day, the person who cares about the S-bomb is the application operator who says, what do I have running live in production? What vulnerabilities have I pushed out there or do I not want to push out there and what has emerged since I pushed it out? And those are two different conversations. Our effort is not in Alpha Omega focused on sort of that aggregated space of what happens and all this stuff comes together or how do I deal with that. It's a great problem and there's a lot of work going into it in various working groups and organizations. But we're looking at essentially the raw ingredients of that cake, if you will, and trying to like on a piece by piece basis. Now, obviously, there's a dependency graph. Some Debian package is built up using some Python library or something like that. And so there's obviously a transitive set of problems that kind of work through there. But the decision about how a particular vulnerability affects the package is a package level interpretation. So you may use Alpine, it may have tar, it may have a vulnerability, but the way you use Alpine and tar does does not create that vulnerability. So that each, again, the granularity of the package becomes the point at which we can start to make a security decision and evaluation of is there a risk or not. And I think that's how we're trying to focus it right now. So this is not a, I checked with Alpha Omega and they said, I'm okay. That's not this is where we're going. This is can we address the industry-wide debt around security posture across a whole bunch of packages. And that leads to, I think, Andrea's question as well. And so I'm actually, can we call Andrea to ask her? Sure. Andrea Brambia, you had a good question about critical projects. Do you want to ask that if you're able to unmute? Apologies again, springing this on you. Andrea asked, I may be naive, but the most critical projects are probably also the ones with the best security posture. Is the current security posture, posture party of picking the projects for Alpha, or part of picking the projects for Alpha? And so you're not naive, but I think that industry-wide everybody is starting to realize that we have a certain amount of security posture debt across how we do things, whether it's how we build them, whether it's whether we've gone off and looked for, you know, vulnerabilities, you know, on a regular basis and looking at these new patterns that are emergent, like I mentioned about extensibility before. And then, you know, what are we going to do about it? How are we going to lean into that? So our feeling is, although there are a lot of projects that have a tremendous amount of eyesight on them and a lot of eyes helping make it better and a lot of investment in security, there's, like, every one of those has work to be done. And there are opportunities where we can make a difference either by scaled approaches or by focused efforts. And again, we'll find out, right? But we certainly had conversations with various projects who would unabashedly tell us that, you know, the way they build their software is not how we might have offered to do so. And those are interesting conversations to have and non-trivial journeys to change, right, to get from where you are to the right place.  Some of them are, as you said, posture in terms of code reviews, two-factor auth, et cetera. Those are some of the more actionable things. But there's also a fair amount of stuff where has anybody looked and said, how can I go off and do this now that I've learned about this new pattern? And that's where I think we can lean in as well. It's a great question. Appreciate it. Let me turn next to John Mark Walker. John, are you, John Mark or Jam, are you able to unmute and want to ask? I am here. Yes, thank you. Can you hear me okay? Yeah, so I've noticed that, like, even when fixes are available, a lot of times vendors, technology, software vendors have very poor practices when it comes to updating their dependencies and getting the upgrades into their products in a timely fashion.  So vendors specifically, I would say probably not. Yeah. I mean, although I would hope that the Alpha Omega itself kind of spurs future conversations that do have an impact there, I would, but if you change out vendor for another open source project, then I would say part of our analysis, you know, if we see, especially as part of Alpha, that a, you know, a larger project, you know, has a package log file that's has been updated in four years. That's interesting. And that would be part of our, you know, is there a, is there a reason why that's so out of date and testing challenges? And there's all sorts of reasons why, like, package log files are good, but they're also, they're also bad. Yeah, be able to, I think, I think the world needs another year or two of kind of thought going into how to, like, what the right tradeoff there is. This is a really interesting problem, John Mark. And, you know, everybody has it in some way or another. You don't want to live ahead, but you want to live kind of close to head. And what I'm starting to see, right, and I'm starting to see, there's a couple of things, and I'm going to talk about one is the cost of adding a open source project to your organization's dependency graph. You might have a security view, some sort of business policy or whatever, or in some cases, no policy whatsoever, the cost is, can be quite deceptively low. And the total cost of ownership matters here. And then the cost of keeping up to date with it is a hidden cost that people often don't pay. And the metaphor I like to use here, and it's my favorite one and somebody in my team gave it to me is people tend to treat open source as free as in free beer, but it's really free as in free puppies. And you're taking on a responsibility within your organization for maintaining that thing.  They're awesome. We're getting free work here. But then you don't pick up those updates. And now you're not living ahead. And now you are essentially an unofficial poorly declared, half baked, Greenspun's 10th rule like fork of that original project. And you just haven't admitted it yet. Wow. Right. And so that's a big problem. I want to be clear. I don't think that that is within our remit within Alpha Omega to solve. It's part of the openness decepts remit. And a lot of people are thinking about things to get there. And one of the things I think is important there is what is stopping people from continuously updating? And I think it's about information. Do you have enough information to make an informed decision about this update? Do you have enough trust in the community such you can pick up changes more reliably, more frequently and live closer to head versus, Oh man, I got to do another three month review of this three line PR, right? Like, you know, and that boundary is really interesting. That's where, you know, love to have continued conversations there, but I don't think that's part of the Alpha Omega scope. I want to follow up on one other thing from the previous question and answer to, which is it's not our intent to be seen as an arbiter of whose security postures are strong or weak or to be publishing stats on that or that kind of thing. There are other efforts to do that. You all are familiar with the best practices badge with the scorecards. You probably know that you can go to metrics.openssf.org and see for, I think a million different repositories, how well they do against the scorecards and best practices badges. Some of the CNCF landscape pictures now offer best practices badge as like a variable to select from some of the other landscape deployments out there. And we do see actually in a different part of OpenSSF expanding kind of that type of understanding risk and security posture across open source projects and other ways too. That look more for that and inevitably that'll be a factor in some of what Alpha Omega work on, but that's certainly going to be a separate kind of initiative. There's a lot of good questions that Emily Fox asked. Can I bring her back to the mic to ask one of her choice? Sure. As part of your engagements with these projects, are you also looking into the IDE extensions such as those that maintainers are using? Not everybody does. To assist them in ensuring that they're writing better, more secure code prior to its commit or merge into these projects. I know this is a newer conversation I've been having with other security professionals across industry that we often forget that IDEs are used and that's really where the code actually starts to happen. I love that question and I'm going to be careful. Yes, we absolutely need to do it, but we as the Royal, we have OpenSSF. The security tooling working group I think is the perfect place to have those conversations and advance those things. We would love to feed our learnings into that working group as well as the broader community because absolutely we need better IDE based squiggly underlines or whatever is needed to write more secure code. Very strong supporter of that. In here. I know we're getting close to time so I'm going to try to be super quick here. There's an interesting question from Yohan Holmberg. Thanks for the initiative. It is a daunting task and lots of real work ahead. At the same time, the security experts are not really idling at the moment. How do we attract volunteers to this project? I'll add on to that. We're going to have to hire some people for this as well. Any thoughts the two Michaels might want to share on that? Frankly, I think that was one of the reasons why we are growing down the route of we need to hire people because it is very difficult finding available security talent, especially ones that you can count on for many hours. We also don't want to treat security researchers as a free resource. Fundamentally, you should get paid for your work and that gets much more complicated in a quasi-volunteer sign-up scenario. Yes, we fully recognize that the market is difficult at the moment or also at the moment, depending on which side you're on. We will try to tackle the remaining list offline and get back to the folks who have asked that question. The backlog is 30 questions, so try to give us a bit of time to get to them. Try to think about the ones that are probably worth trying to answer here in the short term. Michael, do you want to pick one? I think there's a couple of questions I saw about are we going to work with commercial vendors and what's our relationship with there? Would we license commercial tools? I think everything is on the table.  Much prefer partnerships there, partnerships meaning free, but I think the most important bit there, especially for Omega, is the quality of the tool. Having a free tool that generates lots of false positives could be a negative for us. We want to be careful in what we integrate, how we integrate, and how we're able to tune that tool over time. While a large portion of the tool chain that we use and everything is intended to be open source, like CodeQL, the engine is not open source. To be clear, we are using CodeQL. I'm open to using others in the same kind of capacity. Or even better, absorbing data sets of high quality result. At the end of the day, what I really want to do is find more vulnerabilities and fix more vulnerabilities. Whatever helps us do that, I think we're open to at least a conversation about. Then I'm just going to grab one of Emily's questions because I think it's very mentioned a few weeks previously for the appetizer portion of the Alpha project. Is it expected engagement to take one to two months and do you have an intended cap for the engagement time frame? That's a great question, Emily. On a long list of great questions already, the answer is we don't know yet. We're excited by all the interest and we get to hire our first employee. But I think that these are things that we will probably start out with an initial impression of let's spend two months on Project X and then after two months we'll say was that enough? Did we learn enough or whatever and we'll figure out what the right engagement is. If you have experience and thoughts that tell us the average engagement on this takes n months, that would be awesome to know. It would help us plan our thoughts there as well. I don't pretend to know the answer to that question. To me, the reason I chose this question is it embodies the spirit of all the things that we don't know about how to do an Alpha Omega-like effort. I think it's a great way to close the questions and we will, as Brian promised, answer as many or all of them as possible offline. We're here learning and these questions were as much a valuable part for us having this conversation as it was for you to hopefully hear what we had to say because we will then incorporate this back into how we think about it and continue to build on it. We are getting close to time. It's tempting to ask one more question which is from Ben Rockwood, to what degree will Alpha Omega forward other security standards such as salsa provenance or software bill of materials? Which of you would want to take that? I'll take a stab. We're obviously very interested in what the working groups are doing in the Open SSF. Those standards are about practices, they're about tooling. As I said at the beginning, in terms of our mission and vision, they are essentially starting to shape the future that we hope will influence the whole industry and help the whole industry make writing software easier. That's not what we're doing in Alpha Omega. We will look at the signals that they represent. For example, if a project has a very high security posture in a community that has invested continuously in that, that's a signal that's interesting to us. By the end of the day, it doesn't change whether or not we can go and find bugs in there or whatever. Somebody else asked a question about the kernel. There's obviously a tremendous amount of eyes on the kernel from a security point of view. Do we need to make that one of our projects? Those are exactly the questions. We probably don't. We're not going to prioritize them because there's a lot of eyes already looking on it. I think I've answered it. Thank you, Michael. We'd rather wrap up here. Michael Scavetta, any last words? No. I really appreciate everybody's time and taking the hour to listen and engage with us. I'm hoping this is the start of a longer discussion and continued engagement. So please keep the questions coming and hold us accountable to delivering on the vision that we've articulated. Michael Winsor, anything? I think I ended nicely. Okay, great. I want to thank everyone for showing up as well. We dropped the links in the chat, the link to the presentation deck as well as the recording will be on the webinar page and everywhere else we can put it. If you want to continue the conversation, join us over at Slack on the Alpha Omega channel, the open SSF Slack. And with that, thank you all for attending. That's such great questions. Thanks.