This is covering the spread here are your hosts Jim Saunas and Dr. Ed Fang What is going on everybody? Welcome on into covering the spread That's right here on the fan dual podcast network and number fired comm as we are getting ready for the biggest week of college football So far we got LSU versus Alabama Minnesota versus Penn State We're gonna break it all down with Rufus Peabody of Massey Peabody today to get you set from a betting perspective For college football week 11. My name is Jim Saunas I am a senior writer and analyst for number fired comm joined here as always by Ed Fang of the power rank comm You can find Ed on Twitter at the power rank Ed We got to see the first edition of the college football playoff rankings last night How are you doing and then reactions to that? I'm doing great and Yeah, you know, I mean, I thought it was both interesting and correct that Minnesota was as low as 17th That was about the only thing that kind of got me to get on Twitter and make a comment about I Also thought it was interesting that Clemson's out at this point, but yeah You know, honestly, that doesn't really matter. There's a lot of things that are gonna shake out I mean you have two SEC teams ahead of them. I think if either of those teams are at one loss It's it's an interesting conversation between them But you know, I mean Clemson's not had the best beginning of the season That's potentially by design because I know Dobbo likes to to get his guys in I think Trevor Lawrence is probably having a little bit of a hangover after being so dominant last year and Not really having to worry about the NFL draft because he's only in the second year there Clemson I think they'll I think they'll get it together, you know And then in the Pac-12's got to be thrilled to have two teams, right? And some you know a team in contention would be great. They actually got two Right. So both of those teams can reach their championship game with one loss I think I mean they're at least in the conversation not saying that they're gonna make the final four They're at least in the conversation with a one-loss conference champ and you look at the teams ahead of Clemson going back to them like Those teams aren't going to win out like they can't because unless you plays Alabama Ohio State plays Penn States Like they statistically cannot win out Clemson probably will so like it's not even a concern I think it more so is a statement about their seeding once we get to the playoff like the odds of them being the one seed I would say are very very low now and that does matter because it will influence who they play in the first game But I think that there's no real concern for them there I agree with your thoughts of Minnesota where like it was kind of surprising to see them be 17 but not unjustified I want to talk with a reference about that But I think that it makes sense and To me what that said was that they are weighing Factors around games not just strength of schedule, but factors around them because Minnesota's played a lot of non-starting Quarterbacks and I think that that does matter. So I think that that was that was very interesting as far as their ranking It's interesting to see how they play this weekend too for sure as we'll see them play in Penn State Yeah, big big game. We're gonna break it down with Rufus Peabody He is of Massey Peabody. You can find his work Massey-peabody.com We're gonna talk about the college football playoffs actually Massey Peabody has Rankings and a model that helps project out the odds that a team goes to the playoff and we're gonna talk to Rufus about the difficulties in Making a model like that net. I know that you don't have one public But you said that you were creating one just kind of tinkering around with it But like I can't imagine that's an easy task at all Well, you know to toot my own horn a little bit like I actually looked like the first year of the playoff I did it. I did it with Bleacher report. So, you know Rufus and Cade Massey there They were definitely late to the game just kidding Rufus you know, it's an interesting thing and You know, I do it very differently from what they do Usually have pretty much the same answer but it's Yeah, I know it's definitely interesting to look at and I'd be you know We can we can talk about a little more later in the show. Absolutely. We sure well We'll talk with Rufus find Rufus on Twitter at Rufus Peabody is a pro sports better Not just talking about college football, but everything Rufus is there find his insights on Twitter there We'll also have our NFL preview coming up later this week So make sure you subscribe to cover in the spread wherever you get your podcasts Apple podcasts Spotify Stitcher wherever you listen you can find us and while you're there on Apple podcasts Please leave a rating and review as well because those do help us out a ton Thank you to those of you who have already done so before bringing Rufus talk week 11 of college football We got to go back to last week where we went down Ed's numbers and Ed you did pretty well So let's go back at what Ed's numbers said for week 10 of college football Covering the past All right, so last week we wanted to dive into Ed's Adjusting success rate numbers and talk about the formulation of those numbers what they mean why they are relevant and We went through the picks of Ed and did really well He wanted SMU plus six against Memphis and actually wound up being a push there You said six was just high enough to get you to bite and it wound up being exactly six So the numbers pretty accurate there a little bit of a back door there Yeah, that's scored late and but the most interesting part about that was they were up 14, right? I'm almost asleep They score a touchdown, but then they go for two Yeah, and that is the right play when you are down eight and you need to touch down to play So essentially basically like if you make it then you can kick at extra point to win the game Right if you don't you still know that then you know that you have to go for two the next time And it just makes a lot more sense than kicking kicking an extra point. So I kind of woke up you know or at least You know Turned my attention away from my glass of wine and got on Twitter and And it was actually very got a really good response for 11 p.m. On a Saturday night people arguing. Yes, this is yes That's right. No, that's wrong But it is the right play And you know Kevin Cole's done some work on that flow chart I was gonna mention that he has a flow chart on Twitter if you look at his like his media section on Twitter You'll see a flow chart and it just shows the logic in the decision-making I think it's even different to when it's an offense as good as SMU's because we're assuming they're odds of making a 2-point conversion or 50% for SMU. It's probably a bit higher than that. Well, and especially the way that game went, right? Yeah, I mean neither offense was having much of an issue So the odds are even more in your favor and then obviously if you're betting the game and it pushes at 6 no complaints there at all Absolutely, and the other two you won you wanted Utah minus three and a half They did trail entering the fourth quarter, but they came back and they kind of kicked some butt in the fourth quarter They got the win and they covered and that was despite Washington getting a touchdown late to make it actually closer than it really was So I think Utah they got love from the committee as they are Currently an eighth, but I think that's justify honestly. Yeah, I mean, I think you toss the best team in the pack 12 That's what my numbers say. I Still think Washington is a good football team like that. They're not that that's not right a Washington State or a Cal out There that's like, you know a program that has been to the top Still recruiting well, and I think a team that's really gonna bounce back Maybe not this year, but you know, don't don't count them out going in the future and I felt like Utah really dominated that game So you could kind of see what my numbers were saying there So that was nice Washington was tight against Oregon They were tight against Utah and those are the number and number seven and eight teams in the college football playoff rankings So Utah, I would agree is gonna be a team. We're gonna be talking about in future years You mentioned Kansas State minus six and a half against Kansas and they obliterated them So easy cover there for Kansas State any thoughts on that game? Yeah Well, I mean, I watched the market go what two three points in the other way against me It closed at minus seven or at minus five and a half. Sorry. So I think it got down I think it got down further. Okay. I think I saw a minus four at some point. I was like, what the what the But I Think I don't know you obviously want the market to go your way in general, right? But because you're getting no free points at that point. Yeah Well, and and like and and but I gotta say it was pretty good to watch them so emphatically win even though the market Disagreed with me not not often that you get to be like get to to beat the wisdom of the markets Because that's obviously very hard and the other thing is, you know I mean when I talked about that game I talked about success rate calculations And I think we should just stop talking about success rate for the rest of the show for the next Ten years that we do it because maybe we'll just keep that to ourselves. Okay And we'll keep it to himself. I will cry in a corner and we'll all be fine You did really well. I did not and it was very frustrating. It was Halloween I wanted Baylor minus 18 against West Virginia. They won by three and actually almost lost that game But Baylor outgained West Virginia 453 to 219 and almost lost that game if they had lost that game out of God nuts Baylor lost two fumbles in West Virginia Territory they were stuffed at the goal line turned it over on downs. I was I was about to go to bed and I was following the game my phone and They had it at the two. It was like second and goal and they were up 14 to 7 I was like, okay cool. They're gonna be a 21 to 7 a half. That's fine. I feel good about this and I Woke up to bed early. Yeah, I'm old I was in at 10 on Halloween, which means I'm just checked out like socially checked out But I checked it and it was I was like, okay cool 21 17 awesome They didn't get to 21 for the entire game because they got stuffed So I was not close to being right. They could have lost that game very easily if not for a block block field goal Yeah, I also don't feel that bad about it from a process perspective I don't know What do you feel about that like where you get a game where it doesn't even come close to covering? But the yardage was still like heavily in your favor.  I mean there's It all depends it both all depends on the underline metrics. It depends on how it looked on the field I mean there's a lot of factors, you know I mean when you look at you know, just for example the Ohio State Michigan game last year where Michigan got thrashed You know, it was a lot. Obviously there was a lot of big plays or a lot of breakdowns in the Michigan defense But by success rate it was pretty close I mean Ohio State was still definitely the better team and there's no way that Michigan should have won that game so I That one doesn't feel like one where you can justify it after the fact just by saying success rate, right? Right, you know, but we also know that that's what's gonna be damn. I'm talking about it again, Jim Stop Yeah, it's not really a justification for it, but we do know that success rates the best projecting forward. So You know, it's always a case-by-case basis. Yeah, if Baylor could score in the red zone. I'd be have man. They can't I'm not so We're gonna leave that one the past Hopefully Rufus can give us some better picks than what I gave last week We'll talk to him in just one second But first if you want to get in on the action check out the Fandall sports book and place your first bet today If you lose Fandall give you a refund of up to five hundred dollars in psych credit visit sportsbook.fandall.com more details terms and conditions apply Must be 21 plus and physically present in New Jersey, Pennsylvania, West Virginia or Indiana gambling problem call 1-800 Gambler let's bring on Rufus Peabody now of Massey Peabody follow Rufus on Twitter at Rufus Peabody He is a pro sports better. You can find all of his numbers at massey-peabody.com We're gonna break down the college football playoff rankings and take a look ahead at what should be a thrilling week 11 across college football Covering the present Let's welcome Rufus Peabody into covering the spread Rufus. You've got a jam-pack schedule this time of year So I really appreciate you taking some time to swing by here to talk some college football How you doing today? I'm doing well and I always enjoy talking college football I don't I don't do it enough And it's a pretty good time to have you on because last night the playoff committee just released their first rankings of the year You over at Massey Peabody have been doing some work around these rankings So before we could dive into the model that you have and kind of all the factors that go into trying to predict How a committee will select things. What was your initial takeaway from those rankings last night? So I actually just saw them this morning and I was a little bit surprised I I think everybody thought or most people thought LSU would be the number one team We actually did have Ohio State at number one I thought that and I thought that Clemson probably would get the nod at number four But we had it as a coin toss basically between Clemson and Penn State depending on how I tweeted about this depending on what you think How you think the committee values a defending champion and generally in the past and obviously this is we don't have a huge Sample size here because what this is what the fifth or sixth season of the college football playoff in the past That a defending champ has kind of gotten a little bit of a boost in sort of these close calls And so we use sort of an ensemble model and so Clemson actually edged out Penn State But it's like a 50.3 percent chance thing in our model. So Penn State got that nod there So that was I mean the top four is all that I mean that top four is what people are focusing on But what I was really surprised about was where they put Baylor in Minnesota where we whipped in a big way on those teams And why do you think that was? Because I think that when you look at Minnesota you can look at you know facing a lot of back of quarterbacks And maybe the committee is accounting for that But when you're looking back at the reasons that may have led to the deviations for Baylor and Minnesota What sticks out to you as being potential explainers for where the committee put them? Well, I think the biggest thing there is the fact that the committee actually seems to be in this particular instance seemed to value how well a team has actually played like how good a team is Much more than they did in the past in fact when when you look at sort of the Massy Peabody in-season rating, which it only uses a prior to control for strength of schedule That rating had three more than three times as much weight in in this first installment of the college football playoff ratings implicitly then it has in historically so Normally we we think start measured such as strength of record are a little bit more important which is measured that it says basically given It's the likelihood that an average top 25 team would have as good or better a record as the particular team if they played that same schedule So, you know, Ohio Ohio states number two in that metric. They're 15% LSE is number one at 13% Baylor is number five at 25% because they've beaten everybody they played Minnesota number 10 at 49% So that tells you about their strength of schedule there a little bit, but Actually, Baylor and Minnesota have pretty similar strength of schedules Baylor's 92nd in Minnesota is 103rd, but the strength of record gets into the fact that like You know, it's the not not every 92 is the same you could have I mean if you're playing like Arkansas or let's say Jacksonville state or southeast Missouri state or one of these FCS teams or if you play a UMass type team, like if you're favored by it doesn't really much matter If you're favored by 40 or by 43 or by, you know, 32 in a particular in a game, right? I mean, that's going to be a win But what matters is is more in the strength of record is those tough games and so So basically Baylor and Minnesota we gave them too much credit for being undefeated That's basically what it comes down to and and we didn't penalize them enough for being Inferior teams to a lot of the teams that we had them slotted above And that's based on what we predicted the committee's behavior would be based on previous years But it's and it shows what a tough task this is to especially Given the fact that it's a different committee every year. These aren't the same people as last year So in fact in in what we do is every year We actually wait the current season much higher like three times higher than than previous seasons just because of that. There's no Where'd I come up with that number three? I don't know but it's So I really enjoy this though. It's fun. It's sort of I don't gamble on it or anything like that But if you would you could have bet on Ohio State of plus 225 to be number one somebody pointed out Probably like $20 at bet online, but I don't bet on this but it's it's just kind of a fun fun project So Rufus, I think it's always going to be difficult to predict human behavior like that I think it's easier to actually project given the human behavior how everything's going to go out forward because we know how Stronger college football model is Anything interesting in terms of odds to make a playoff or odds to win a national title After this first committee rankings So I'm not sophisticated enough where I'm using these committee rankings to impact my My well, I guess it is going to impact my future model, but but I'm not saying okay Michigan or not Michigan. Um, Minnesota is number 17.  So I'm still running it based off of the same thing Okay, because I think when we get to the end, I think it's it's things are different when we get to the end of the season Um, okay, you know, I think I don't know if you agree But I think if Minnesota runs the table they beat Ohio State or Penn State in the big 10 championship game I don't think politically. There's any way they can be left out like an undefeated big 10 champion. No But what's the likelihood of that though, right? So uh for no, um One point two points seven percent. Okay. There you go 2.7 chance that they went out includes the title game that includes the title game Interesting that I mean that includes the conference championship game That's not winning the national championship or anything. That's just right. Right, right. Sorry So that would include and you know in your model playing, you know, Ohio State playing a Penn State in that conference championship game Okay, it was it would and and Baylor's even less likely at 1.1 So what's interesting in this is that Minnesota and Baylor both had very easy schedules so far But if you look at the remaining schedules, they they rank among the toughest of these, you know In fact, actually have Minnesota as the toughest remaining schedule of the teams in the conversation And obviously this model is has to be semi new because the college football playoff is semi new What was that process like trying to build out that model? As you said, there are a lot of factors It's a small sample. There's a new committee every year What was the process like for you trying to build that out with all those weird competing factors all all in play there Well, initially, I tried to build out something to bet on college football futures. So I remember the first year I did it I was building it out during the year and kind of It was more about it was sort of rules. I was like, okay, we'll slide you know We'll slot we had sort of tears and we'd say, okay It actually It did we used individual teams. You say, okay. Well one one lost Washington will We'll think we'll always get in above a You know two-loss USC or something like that And so so it was it was much more of an ad hoc thing there And and then we actually once we had more data Then we actually started building something and the thing is we're what we're trying to do is use thing Use our metrics or metrics that come out of our numbers that we think Makes sense logically. So it's obviously we know that the committee is not using mass EP body numbers. They're not But they're they're not using the same strength of record metric I'm using But we think that we think that it's a good proxy for for the strength of a team and for how good the resume is and so We we basically are blending a lot of these things and running a bunch of different models because we don't know I mean, there's a lot of things that are that are pretty similar. For example a team strength of record Which I explained before is very similar to their surplus wins, which is how many wins above expectation for a top 25 team playing that schedule they would have and and and and So it's kind of just blending all these together and and obviously I think predicting Predicting it at this point is much more difficult than predicting it at the end of the season But luckily for the future stuff all I really care about is at the end of the season But I think one of the really difficult things is figuring out how it how much a conference championship matters And that's something that I think has varied from year to year based on the committee The one year Ohio State made it I think they that was year they got blown out by virginia tech early in the season and they got in I believe despite not did they win their conference? They won their conference that year. I think it was a different year for they They had the the win over oklahoma, right? But then penn state won the east So but they got in over penn state. Yeah, so so some years you have you have things like that, but I mean, I think this year it's going to be particularly relevant given what we have with well, I guess with the big 12 potentially the pack 12 and the sec so I think the lsu the loser of lsu alabama is that team Still if they went out the rest of the way and don't even make their own They don't if they don't even make their own conference championship game or they still in I think if it's if it's lsu if lsu loses to alabama I have them as 68 percent chance of getting in as a one-loss If they went out the rest of the way Whereas I only have alabama 44 in that scenario, which I guess comes is due to the fact that I think It's a much stronger win for lsu than it is for for alabama in a way But what happens where do they slot relative to like a one-loss? You know big 12 champion oklahoma, right? We know that at this point Well, actually oklahoma. I think it's a very underrated team, but What if you have a one-loss pack 12, you know champion? I mean personally, I think they shouldn't even be in the conversation, but you know, that's that's that's what my numbers say, but Right, we'll see right. Yeah, absolutely So rufus, let's get into some games. Penn State goes to play undefeated minnesota on the road Penn State's seven-point favorite at a fan duel right now the total is at 48 Minnesota has looked good recently, but they also struggled at the beginning of the season. Penn State has looked pretty solid What are your numbers see and what do you see in this game? So I actually this is one of the games. I really like this week If you get plus seven on minnesota, I really really like that bet. I make the I make the line Penn state minus three here It's you're right minnesota I actually just looked looked at their schedule when I was trying to figure out why I was so wrong on them And I was like wow, they've really squeaked by some bad teams here. Yeah, I mean it's it's it's uh I mean they beat south dakota state at home by seven, you know fresno by three and overtime They only be Georgia southern by three Yes, they've they've been better recently But but I think they're actually a good team I mean, I think that we do the way we do things we rate later on in the season a little bit Higher. I mean What happens more recently is more predictive It's not a huge huge difference. But I think that does make a difference and and I'm also not as high on penn state. Maybe as some other people are They are I got to pull up my ratings here They are only number seven in my ratings. Okay overall, so You know in that game against michigan. So the michigan, I mean they have some quality wins, right? I mean, but again, I think they were outplayed by michigan and Um In that game, even though they were up 21 nothing and and held on to win they they We had that them graded out worse there if you look at um, if you look at the game statistically and wait, what is wait? Wait stats by how predictive they are moving forward So I think penn I think the big thing here is I think penn state is a little bit overrated and minnesota I have them as the number 14 team, but obviously they're at home. So yeah, I think it'll be a close game And I'm I'm hoping uh, I'm hoping the minnesota plus seven will come in Interesting. I like that. Let's move on here to lsu against alabama. Obviously the big one for this week out in alabama alabama currently a six and a half point favorite The total here is 65 and a little bit of unknown here potentially with to a tongue of aloha Apparently is splitting practice reps with mac jones as he comes back from that ankle injury Do you have enough faith in tula's availability or potential lack thereof to have a good read on this game as of Wednesday as we're talking right now. Well, I have a lot of faith in your ability to pronounce tula's name correctly Really impressive It's a lot of practice standing in the mirror staring at myself. We're doing it over and over. Yeah So I I actually lean lsu here, but you're right It is one of those games where there is a big unknown and How do you quantify the impact of tula? I was I was talking with um with jeff about this actually earlier today and to the value of tula is not The I guess to his value on an alabama team is not nearly as much as it would be on a lesser team Because alabama is just so good all around. They're a very physical team. They probably have the best wide receiver core and football They can win without and you look at their run the last decade They've won generally without a dominant quarterback and you know, who's Who's the last starting quarterback from alabama that's Made it in the nfl really, I mean agent mccarran is still hanging on I think he's on houston's roster right now. Greg macaroy lasted like a year and a half maybe with the jets I think it's it's probably mccarran. Yeah mccarran. Hey, he actually got traded for something so that's that's like success story for an alabama quarterback, but But I don't know like I I do I do not know what that difference is between two and mac jones I have um, you know, I can look at the recruiting numbers. I can look at I have a I have an estimate in general based on Player's experience level and recruiting. I can sort of say this is you know a point estimate The mean of a distribution of possible adjustments for this quarterback, but It is a pretty big unknown and so The fact that I lean lsu as it is now kind of Which is sort of assuming to a plays Would almost indicate that if you know, if you think that there's any a decent chance to a doesn't play That's probably a good bet. I actually was able to buy To plus seven and a half for a little bit Plus seven up minus 130 only buy on on or off the seven if it's 10 cents kids but So I lean lsu there I know if we've on here to iowa state at oklahoma oklahoma here is a 14 point favorite the total in this game is 68 and you alluded to oklahoma before And I think that they're a very interesting team because they do have that loss to kent state or to kansas state Not kent's idea really bad loss. That'd be a beautiful terrible loss, but the remaining schedule is tough So let's talk broadly about oklahoma before we dive into this game specifically They're at number nine in the initial rankings What do your analytics say about their odds to make the playoffs here? So I think they're very I think that they're Way underrated by the market. I mean, I think you can bet them a 21 to 1 right now features I have them as 14 to 1 there's more than a 50 percent chance that they control their own destiny So I guess that's not completely controlling your own destiny right, but if they win out I think that I have them um as a 53.8 percent chance of making the playoffs so So I guess basically a coin flip, but I still think that there's 60 chance to win out So I have them with a one and three chance 33.4 percent to make the playoff The big thing is I think that they're just a they're a very very good team I think they're kind of they're I don't think they're getting quite the credit that they deserve for that. They obviously are not a powerhouse on defense That's nothing new for oklahoma, but I'd rather have a great offense and a I'd rather have the number two offense and the number 21 defense than say have The number 22 defense and the number three offense and by the way, that's oklahoma and auburn So It's offense in general. There's a there's a bigger spread between teams Generally, I haven't looked at this season in particular, but in general There is a bigger spread in an offensive talent. I guess our offense performance than than defensive Yeah, I mean, I think oklahoma having a top 25 defense, which is something my number of support as well That's got to be ecstasy for link and riley Given how they've been Over the last couple games. Are you on a side in this game? um, I I actually Am but not at 14. I was or not. I was able to get oklahoma a little bit earlier at minus 13 and minus 13 and a half And and by the way talking about that canza state loss. I don't know if you add i'm sure you you Drove into the numbers, but I mean oklahoma actually outplayed canza state in that game I think there wasn't expectancy based on the box score in that game was like 65 percent or somewhere in there It was it was high I remember looking through in the middle of the fourth quarter and seeing that oklahoma was averaging more than 10 yards per play I was like, right? They just they weren't getting the third down stops and they had a few costly turnovers Yeah, no, I mean that's a few plays here and there right a few plays made a huge difference Yeah, yeah, and but I mean rufus. Don't you think that's the kind of thing that kind of leads the value sometimes, right? When the final score isn't indicative of what happens People don't dig into the underlying numbers.  I completely agree but one thing that We're also ignoring this conversation is that oklahoma was playing from behind so You know sure a huge part is contextualizing things and so oklahoma You know when they when they were down what were they down? They were down 20 something 24 Is it 24? They had a couple on-site kicks At the because they had the touchdown They had the on-site kick that they recovered but then was overturned. So I think it was a couple scores at least But I think about this. I mean think about this. Let's say you had the same team Up, you know, let's say oklahoma was up 24 rather than down 24 How would your expectation of the yards for play at that point change? It would go way down because they're right and so kansas state was not kansas state was not trying You know, they were not playing as if it was a tie game. They were certainly um Trying to stop oklahoma from scoring quickly more than scoring. So so it I think you have to you have to consider that but I mean for the majority of the game oklahoma Was not in that situation and still Like was playing quite well on offense Yeah, yeah, absolutely. Well rufus. You got a busy schedule. So we gotta let you go in a second But first outside of those three games any numbers you see that are Advantages on the board for week number 11 For college football. I I like, um, I like Hawaii minus seven and a half at home against san jose state. I've been on the fade san jose state trained for a few weeks now hasn't worked out particularly well they they beat army outright and I'm not I'm blanking who they played last week, but I remember I remember I lost that bet also I'm hoping I'm hoping their travels in hawaii or not Are not as successful Yeah, that no, I think that's interesting.  I like Is virginia tech is a two and a half point home dog Against way forest who made an appearance in the in the toss football ratings they they cracked the top what top 25 that I think they were what right around 20 but I think I mean virginia tech, um, obviously they started the season very slow They they played quite well against Notre Dame. I I didn't actually I haven't dug into this game So I don't have a lot of intelligent things to say, but um, but my numbers my numbers like it at this point I mean Do people forget that priors still do matter? um, you know team talent matters and and virginia tech, um Has a little more talent than than the level they were playing to early in the season at least Yeah, wake forest came out as number 19 in the initial rankings Jamie Newman looked healthy last week, but uh virginia tech plus two and a half at home there for rufus All right rufus. I want to let you go. I know you've been busy day for today So thank you for swinging by and talking modeling around Things that we can't control which I think is a super fascinating subject Really appreciate the time and good luck in week 11. Thanks a lot and thanks for having me on guys I really enjoyed it. Absolutely. Thank you Covering the future All right, one final thank you is out to rufus peabody for swinging by and breaking down week 11 and I've I was excited for week one of college football, but I don't think I've been excited this excited for a week of college football and like I don't remember the last time honestly I know that there was that the lsu alabama game where it was like a nine three game or whatever when brad I think brad wiggins still had lsu at that time and like I was jack for that one, but I think I like offense. I know it's like it's very Very plebe of me to like offense, but I like offense and these two teams are so different now than they were that I think that like my Level of excitement for college football this week is like the highs has been Is for as long as I can remember. Yeah, I think it's going to be a great weekend. Um Yeah, we'll see.  Um, You know, he's he's going to be probably one of the top two picks. He's incredibly accurate And you know, I always use defense has been looking better. So, you know, I think they're going to need everything Uh to win that game and what rufus said is true where the situation around tula is so good that it does mitigate Some of the effect, but it's still obviously an upgrade to have Tula there. I mean anyone could throw a football to jerry judy and look pretty good Because he's basically a running back playing wide receiver with his yard after the catchability, but It does matter still so hopefully tula can go because that'd be a huge bummer If he could not but uh and also I'm from minnesota So like it's been fun to follow twitter this week with all the pj flex stuff getting his extension Minnesota could go and four down the stretch. So it'll be a pretty interesting week. They have an easy one in there, right? I mean, they have and state, but they play northwesterns. They're clearly going to lose. Oh, yeah Poor northwestern. I think they play iowa too. Um, so they have three tough games And northwestern plays umass and that might be the worst game in college football history No, come on man. It might be the worst Umass had to play someone else this year that is is much worse worse than that That's true. Uh, maybe we need to get edward egros on uh for the for the northwestern umass game So he can pump his vocal podcast about terrible college football games because I would have to assume that will be included But it's there's too much good fault college football this week to to waste time talking about that terrible team in evanston So we're going to talk more about penn state versus minnesota in a second But first ad and I always preach searching for the best value in betting on games Well, look no further than the new odds comparison our engineers have developed over at number fire dot com Odds fire is the premier odds comparison experience across major bookmakers in the regulated us market compare odds Quickly identify the best value and even examine first party fan dual data all in one place Never settle always get the best odds check out the experience for free now on number fire or at odds fire dot com gambling problem call 1 800 gambler Let's dive in now to covering the future in ed you want to go back to the penn state versus minnesota game I think it's one that I have no ability to diagnose personally. So I was glad to get rufus's thoughts What are your thoughts in that game up in minnesota? Yeah, man I've actually been thinking about this game for a couple weeks Looking at minnesota And always at this point in the season you're looking for undefeated teams that The underlying metrics don't support that they're undefeated and minnesota is definitely That team when I look at success rate They're 26 on offense 50 second on defense You know the one thing they are doing well is throwing the ball So with tanner morgan they're 14th in passing success rate But you got to remember, you know, like I I'm very interested in fading this team I have been for a couple weeks and people have been like, well, they're playing better over the last couple weeks Which is fine But you got to remember how much they struggled at the beginning of the year the south Dakota states and the fresno states So and I think penn state is legit. Uh, there's seventh in my member rankings Same as where rufus has them 20 second on offense and adjusted success rate third on defense Um, I I think this is a really good team. I think they're going to contend for the playoff And um, you know, I I like penn state minus seven on the road here. My number has a close to nine Uh, I already bet it this week I'm a little flabbergasted that like of all games that I picked this week It had to be the one that's six points off what, um, my number has it almost, uh, penn state by nine I'm a little I I bet you couldn't find another game where rufus's and I predictions are off by six points and, um And there's no one else. I mean, I mean, there there couldn't be a worse person to be going against on the show Really, just keep body professional sports better. Uh, I have all the respect in the world for his models Uh, and and, uh, you know the betting career that he's built up. So anyways, I did not know that one when I When I plan this, um, but You know, I mean, I also want to say it feels a little bit like the maryland game Even though, you know, minnesota's a better team than maryland, but we thought maryland was kind of good back then Uh, penn state took care of business then I just don't think these two teams are on the same Level and I think it's also interesting because your numbers are on line with rufus on penn state Uh, so like that makes it even more interesting to me, uh, but I also I can see both sides Which is why I said I have no read on this game. So I have I will not go either way But I think that just seeing minnesota face a An offense that hasn't started a quarterback is a deviation for them And I I view them as being kind of an unknown And I think the reason that Minnesota probably doesn't grade out that well from the success rate models because they've kind of lived off of big plays this year Especially in the passing game. They lived off of big plays, but that's not always predictive of living off big plays going forward which Why it makes sense that your numbers would be a little bit lower on them Yeah, yeah for sure. And um, you know, they're outside the top 25 In in the numbers that I use for for my member predictions. So Um, yeah, we'll see. We'll I mean, it's obviously a big game and a lot of things can happen But I expect penn state to To to win and cover and smart a pj flag to cash in before this So whoever his agent is hit us up kudos Well, I mean, I think part of it was that he got mentioned for the florida state job, right? So big changes there Pulling it all worked out really well The timing of it was really a tagger getting fired and uh, minnesota being eight and no right before a tough game That worked out really well for his pocketbook. Dude. Good good for pj flag Yeah, you know, these coaches have such a volatile life Like if he's going to get his extension and his buyouts like, you know, 100 more Good, I think it's 10 million or something like that. So I mean, that's That's not too much in the grand scheme of that's true Like I feel bad for the tagger because like the situation he entered in fsv was terrible.  So, you know, I guess it could be worse As far as my cover in the future, I want to talk about clemson. We talked about them being I think that's interesting from a college football playoff perspective I don't want to touch their spread, but I do like the over on 53 points against nc state I think a lot of it is because clemson could put up that number all by themselves They've been they've struggled so far this year, but some of that has been injury related They had trevor lorenz apparently hurt his shoulder earlier this year just in ross missed a game He was active, but he didn't play in that game and amari rogers didn't play in the opener And they had a buy in early october the injuries to both ross and rogers Happened early on and that buy may have allowed them to get a little bit healthier if we look in the foregames since that buy trevor lorenz is adjusted yards per attempt is 11.2 Which is a very good number 12 touchdowns compared to just three picks So he's kind of cut down in the interceptions Which was a major problem for clemson earlier in the year nc state has ranked 46 defensively If you look at bill connelly's s p s p plus rankings So they're not awful but florida state is also just outside the top 50 there Clemson put up 45 on them and anecdotally Like if clemson feels disrespected by being fifth in the in the committee and being out of the playoff at this time We can see them try to hang a big number here and blow this game out They're fifth in the standing so they would be fine if they went out, but It's not as if things are super comfortable For them right now the spread is 32. I think that's high enough where I don't really have an desire to touch it But with the total at 453 I can buy in number of fire projects clemson to score 48 points by themselves in this game So if they uphold their end of the bargain, I would bet this game goes over pretty easily The algorithms at number of fire have the hitting the over 79 of the time which is Probably a little bit high I would say but I'm not going to turn it down when it is that high So the total opened here at 53 and a half and it's actually gone down Half a point so it might not be one where you have to bet it right now You might actually get it down to 52 and a half It's actually 53 and a half still at some books if you look at odds fire But I do like this game to go over 53 ed. What about you any thoughts on clemson versus nc state whether it be the spread or the total Yeah, I mean i'm continually impressed with what brant venables does on the defensive side of the ball I mean their their defense has just been so consistently good You know nothing new this year top 10. I mean top two and yards per play adjusted for schedule there And man north Carolina states. I just looked at it. I haven't really been following this team But man, they're they're offense numbers look awful. Yeah, like literally So my model says 57 points. So definitely on The side that you'd be on 57 points despite respecting Clemson's defense and hating nc states offense. So I will take that for sure So that's what we have for this week and again. It should be a pretty fun week I'm pretty excited to see how things play out Um, you know, I think that it's interesting from a betting perspective But also just as a college football fan, it should be a really fun week across the board Ed anything you want to plug here before we close up shop and get to the nfl podcast next week or tomorrow? Yeah, yeah, I mean Go sign up for my free email newsletter. You get a sample of my predictions Usually say for paying members of the site. Uh, I looked at some success rates stuff last week And I guess I promised that more of that this week. So I guess I have to fill that I don't know. Maybe some college football playoff numbers too. So I try to put some good stuff in there It's not on the site. You got to sign up for the email newsletter. Go to thepowerrank.com Yep, you can sign up for that there and get that and follow Ed on twitter at the power rank I am at Jim Sonnis on twitter j i m s a n n e s You can also follow the fan dual podcast network at fan dual podcast to get our dfs podcast Which goes up on Thursday and the number fire daily fantasy podcast feed our nfl podcast will go up on covering the spread on thursday as well So make sure you are subscribed to get that and rate and review the podcast while you are there Big thank you to calvin thea ball for running the video side of things here today as always Thank you cal and a thank you rufus p body for swinging by and breaking down week 11 of college football And talking about those initial rankings. Thank you to everyone for tuning in for today We'll be back at you tomorrow to break down week 10 of the nfl and get some thoughts on that one Joe Ostrowski will break it down then and talk to you tomorrow This has been covering the spread right here on the fan dual podcast network


� fond Ṣidwa Ṣfood нее Craiyah �auto Ṣ loops Ṣavya Ṣofya Ṣyugu Ṣa Ṣalw ṭiadth ṧene ṱtha Ṭhabhi nuj ta Ṭhaaj Ṭhaaj ڈІΙΩΤΕΡΧΑΔΕΝΑΞΤΉΔΕΣΑΤΟΑΑΚΑΔΕΤΚΚΙΒΒΑοΑΙΣΑΚΑΔΕΙΣΑΤΟΟΕΕΉΕΕΎΣΑΚΑΕΕΕΕίΕΕΕΙΕΚΕΕΕΕΕΕΕΙΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕΕ sistemas  Partnership Reconnectsими  repositories chut tailoredew  policemen  side teachers  side departments  side paragraph  side considers  side, sideaps 有21  video  side with  side comments お Les In  video We will  video a Someone G


This review aims to present unique considerations for manufacturing and regulating new vaccines in Muslim-populated countries such as Malaysia, highlighting vaccine production, ingredients of concern, the current mechanism for ruling and recommendations on new vaccines, decision-making steps, issues and challenges, commercial viability, and promoting self-reliance through Halal vaccine production. This article was authored by Yvonne S. K. Koo, A. A. B. Ghani, A. A. Navamikandan and others.


We went over the steps of the secure boot implementation in Asakus and Ubuntu today, Asakus and Debian, which is kind of partial support, but not enough to actually do anything useful. Yes? I'm going to create a document going to be under DEF CON 14, Bob. Really? What's it called? QEI space block. OK. So we didn't have, it's unfortunate we don't actually master representation here because of last time on as well, but we largely agree that we are basically just going to learn the same general idea, namely we use let us share with which is correct, which Matthew can probably expand more about, but whose purpose is to be signed by an SD like Microsoft, essentially, bootstraps our way into better bootloader like Grubb, which we can then bootstrap the rest of the system from. The Grubb itself needs to be signed by a Debian key, so we need to do that, I think, on an activity master in order to have remotely acceptable security. To do that, we need to sort out key management so that the point of attack so we want to protect it in more or less the same kinds of ways that we protect the key for the Debian archive. So is it going to be an FTP team number one in the room? Oh, hello. I think it was not here. That's very useful. I'm an FTP assistant, so not. Excellent. This can't be your fault. You can at least tell us whether we're confused about something about the general. I'm just going to go over. Since there's a bunch of people here, I'll quickly go over what SHIM does, what features it enables that are relative to Debian, and a few things that need to be considered based on some changing requirements. So SHIM is an EFI executable, which is in a format that is acceptable for signing by Microsoft. It performs one real function, which is to execute EFI executables that are assigned with a key that is not in the firmware key database. So UFI security systems have a database of acceptable keys, and exactly needs to be signed by bits in that database to be executed through the standard UFI mechanisms. SHIM exists to be signed by a third party who is already trusted by the platform, and then bridge that user trust to a different user trust. So the typical way of using it is for the vendor to ship SHIM signed by Microsoft or some other trusted third party, and then embed their key inside that. Any further binaries that's assigned with that key, SHIM will perform its own validation, its own relocation, and will launch them independently of the firmware, so you don't need to go through the firmware key database. In addition, SHIM also supports its own user-modifiable key database, so the end user can generate a signing key, install that in a standardized way that is consistent between different systems. It requires the user to be physically present. There's a point where it requires you to type in a confirmation phrase on a screen at the console. So it's designed to prevent it from being easy to social engineer, sending it to installing arbitrary keys. GRUB will then call into SHIM in order to verify the kernel, so you can then have a fully signed user trust up to the point where you then use whatever additional user trust you want. If you wanted to build something on top of this, where you had a verified INR MFS and a verified GRUB file system, you could do that. That's not required. As far as we're concerned, once user space starts, then the usual trust model is that user space is assumed to be trustworthy, whatever it is. There's no enforcement there. The other thing you can do with this key database is disable signature validation, which means that SHIM will launch anything you get it. Again, that requires physical presence. Under limits, you type in a password, you reboot, and then SHIM will want you to type in the same password again. And then, after that, you want to disable signature enforcement. And from then on, it will boot any GRUB or any kernel. So the user has a standardized way to disable this enforcement. Without saving security? Without saving security entirely. So that means that you don't have to jump through whichever boots you're going to do, but that full vendor has implemented just in order to do current development or correct development. Which is quite a serious problem, because at present, while there are certain requirements on firmware, particularly from things like the Windows End certification, on the box that you must make available, it says absolutely nothing about whether there's to be a remote, even slight inconvenience. Or whether you can figure out from the menu what it's called. Unless you deeply understand security, you're half the time unlikely to figure out which option relates to putting it in a setup mode. The aim of all of this was to reduce the least worst thing that still respects the user freedoms. I think we came as close as we could possibly get. The local key management stuff was implemented by SUSE, originally. Most of the rest of it was implemented by Red Hat. The future stuff, there's not a great deal of additional work being done on SHIM in interesting temple ways at the moment. There's support for ARM, has just been added. It also has support for 32-bit X86, if you have one of the tiny number of systems with secure boots and 32-bit UBFI firmware. It has support for being a fallback boot loader, where if you put it in a well-defined location, if the system loses all its boot entries, then SHIM will launch, re-enroll your boot entries, and then boot normally. One thing is that Microsoft have recently modified their sign-in policies slightly. In order to sign up to Microsoft SignService, you now require an extended validation certificate. So in HTTP lands, those are the ones where you get the big green thing in Firefox, just the level one that also gives you the name of the company you're talking to. That costs more money, because it means somebody actually has to go to real efforts to verify your existence and identity. It also means you're going to have a real existence and identity and be verified. So I think the issue is that I've seen so far is on the order of $1,000 for a three-year certificate. This is within Debian's round, but it is a little bit hostile to the individual end user.  It also doesn't affect the most of the keys. Right, you can't sign other keys with that. You cannot get a CAB cert. But that's in itself not a problem. Microsoft's originally requires that any embedded keys also be in these certs. They can last that requirement. It's now perfectly accessible to generate your own key, but said key is supposed to be maintained in a FIFS-compliant hardware device. Now that sounds kind of terrifying, but FIFS-compliant hardware devices includes just Java smart cards. So that's not a particularly high hurdle to get over.  Yes. So a real hardware security module is way beyond the FIFS requirements here. A smart card that plugs into a USB reader is completely acceptable. There also exist USB tokens that's defectively presented as smart cards. The thing that we're doing in Inhibitor is none the above, but we do use GFs for this. So we have three of seven requirements on reconstructing our master security key, which I don't know if it means the letter of FIFS, but it is equivalent to this variable. So the other thing is that Microsoft has no way to verify this because it's a key thing. Yes. So if that's what it is... It's always too much that you're not doing what you do. You probably should not put that in the e-mail. I don't know. You probably should also not put that in the e-mail anyway. It's a good thing that you can hear this on the screen. But that's more a case of if you do somehow screw up, then there might be problems later, but just don't screw up. So we have gotten informal, at least, approval from Microsoft for the key sharding that Colin described. We haven't actually gone through the certification process or the signing process since they did change their requirements due to some other issues regarding minimum version requirements for SHIM. We did a public too. So the other thing in terms of SHIM development is a desire to move to... SHIM's now moved to a model where the vendor certificate is stored in an additional section. It's not embedded in the code or data segment. There's a separate section within the executable that contains the certificate. This means that if we do the appropriate work to ensure reducible builds, even if you receive a binary from Debian, you'll be able to verify that the binary you build from the source code is identical to the one in Debian with the exception of the certificate. So you can verify that all the accessible codes are identical. This is for two purposes. First of all, it means that users can actually trust the Debian or whoever are building the binaries from the same source code and that if it is backdoor, it's backdoors in the tool chain. It's not backdoor by Microsoft. Secondly, you can check that in other ways by confirming the signed objects. And secondly, this is also, we hope, going to make life easier for Microsoft because they'll be able to verify that the code is identical and if a binary matches something they've already signed with the exception of the certificate, then it can go through a shortcut. This is not through some altruistic desire to make life easier for Microsoft in general. It's because the signing process can take months. Or result in rejections if they simply go on. Yeah. In terms of the long-term politics of Microsoft being the signing thing, then that's going to continue being a conversation for a long time. I can't really say anything more about that at the moment. That's not going to change in the immediate future. Nobody else has offers to take that role. Have we seen anything that was suggested that they are not acting as a part of our business? We have not seen anything to suggest that they are acting in their own interests as opposed to others. There are ways in which they have been annoying in one way or another, but none of it is. None of it appears to be malicious. None of it appears to be malicious. They're a signing authority and they're a large company. So they're expecting some different suggestions of us. So there was a mention that we're going to need to start signing grub. How would this interact with, I wanted to start having UEFI stub Linux kernels that can be directly booted rather than using grub? Right. So the way I designed this in November 2 permits both. The state of the code in Debian today is as follows. Grub has a number of patches mainly from Matthew's network pass which cause it to behave in a secure, but appropriate way when loaded and such. So for instance, when the grub core image is signed it will refuse to load any modules which are not in the core image because that would amount to executing unsigned code in the framework context which you're not allowed to do. As a result we build a rather larger core image in the case of the script that has everything we need. All that code is in Debian. Some of it I think is configured off when involved with us for any trivial. We have code to build a custom upload. So the sort of thing that a handful of packages do to put things into rather old lists in the archive for instance DI builds a raw installer custom thing which ends up being unpacked by Dac into... actually my ham script I think into installer-thing somewhere under this. We have the code to do something similar for UEFI. At that point Dac would unpack the raw boot loader images into Jesse then UEFI, something rather, and also sign those with the SP sign tool and the FUE. I laid that out in the implementation I have today to put in such a way that you can have different packages, it's not just for grubs so different packages could do the same thing. The kernel could omit, in fact probably should omit, an object for signing in a much simpler way. For that kind of thing to be sensible it has to be entirely automated really it should not be something that requires manual action by a team master otherwise it's going to take all week. To answer another question that was possibly also what you were asking, SHIM does not care whether you're looking grub the kernel or any other valid UEFI executable as long as it's signed with the trustee key you can tell SHIM to just launch the kernel directly instead of having SHIM launch. Oh sure, I was more concerned with as we work toward trying to integrate UEFI direct boot into Debian which I hope we do at some point. I would really recommend not doing that. It requires you to put the NRMFS in a unified system partition. That's just a fast idea. Don't do it. Let's talk about that later. I can imagine it being useful in specific situations under the same general purpose approach. Just to clarify the, for this purpose of getting this working in Debian you outlined at least a to-do being enabling that code for secure boot and grub but were there other things that I should note down as being we need to actually come straight with you. Right, so I asked a question on IRC to Colin and I looked and scrolled back to him. I recall that we had a to-do list that somebody said was recorded somewhere can we refer back to that earlier document? What's the URL for that so we can grab that into the copy here? Well I sent in a mail which was a summary of it was hoped again probably recently we had a link on I think it was I guess it would be a shame we spent most of the time moving forward, rehashing that and describing what the secure boot is. Just to dignite that. Can we move on by various people trying to find that? That's basically the Can you paste it into copy? Do you want a copy? I think that's fine, thanks. One thing I want to add regarding the state of the current code at present rather than preferred to to permit you to put on sign kernels this has been so-called confidential the reason for that is that the version of SHIM that has been in certainly a boot I think also to whatever extent it's indebted is it does not have mock manager enabled to be a machine only key thing that Matthew was talking about a moment ago. Without that if you acquire signed kernels then the barrier to entry testing new kernels and kernel development etc goes up so we need to mock to be in place before we can require some kernels Once we do I'll be happy to prevent that bit of growth and then we will not be in a position where there are many trivial kernel exploits that will get our key root so you're saying like the step zero is to get mock manager well we can do many other things in preparation but step zero in order to get in order to get to the sign kernels is having a mock manager so we don't need to hedge unnecessarily on user freedom we have a bunch of packaging that enables mock manager just needs to get the new option version of SHIM for signing purposes but any SHIM work will be in key so we need to be talking about making sure it is addressed to someone so I do have looking through Ben's mail I do have some duff changers to support this I can really use assistance with setting up the test environment or if it is just easier to test the production system today then I can review that I did a different one for you I would like to grab you Ben this week the other thing that is important there is that as I said earlier I think that this should run unattended I would prefer to run it unattended where possible I don't want to be in a situation where all grab uploads go through new effectively but there is it is possible that we may want to make this require some kind of basic white listing or depend on the uploader's key or something so that we are not effectively saying that any Debian developer gets to upload an object which can get signed by Debian's secure boot key because that would be quite a large exposure the compromise we have in Ubuntu today is that any binary upload that is going to go through signing bars it does require a button push sign off just check with it matches that is something that will be signed before basically in the same kind of way we know what it is we can very very easily make new queue processing we are going to be able to share what we want to think so are you saying that is something that you can work with on to make it happen the other important piece is actually having WP which we do not have today Todd I think you said you said a little earlier you wanted to have an HSM for this if you want to have that done away just for the developer is that something that you have hardware for at the moment and if not once a week I think we have the hardware to change there is also it would probably also then be on a different coast than at the HSM itself so we would need to make that protocol product basically one thing about the HSM when we looked at this in particular we found that there were basically none on the market that had to be free drivers which is why we ended up using smart cards is that your experience or is that just not I have one here which has free drivers I'm not sure it actually supports every single thing we want to so I would need to make sure it does that we basically just need an RSA 248 for this purpose even if we just have a community we can just use anything we can actual smart cards are kind of finicky and rake and stuff I use I use I use the rest of this baggy I know the upstream people quite well given I also maintain packages in one of the upstream teams are you effectively volunteering to research and make sure that the HSM is acquired? yeah I'll make sure that happens and then you said there was a second piece which was setting this up so it can be detached from the e-master yeah we don't we probably don't want that running on the e-master directly partially to limit the attack surface so the machine could be running on probably not be on the I-26 machine at all would that be something you'd also be doing? I would need to check the exact status there but yeah I can make the DSA side of that okay secure route with the main micro it's the essentially the patch set which is so I can definitely do that so this consists of the Linux CFI module which is basically straight from straight from my patch with a couple of weeks and I also added a patch to cause the linux and linux ID commands to automatically check through to that is this different than the ones that SUSE is using? I don't know what's in SUSE it's essentially the same as what's in Federo it's possible do you have the automatic chaining of Linux 2.0 sorry you've got to be sure that's not the answer should they not probably just go upstream? yeah so it's been a little bit controversial there to at least the thinking on this I think the most practical answer for the timing is a standard I can speak to some people I think the concern Grubb upstream have is not linked to assumptions about the FSF's desires on this front and I think if this can be made clear as the only way this actually does anything is to guarantee that there's user control for keys I don't think it's necessarily going to be a problem long term but there's going to be some discussion about that and to figure out what there is a way to determine the FSF policy do you want it to be policy? I don't think folks from FSF here is that something that you can pull in for that discussion? John Sullivan's are on he was just talking about it so we don't do well I'm not saying derail but if there's a plan to have a conversation let's make that a to-do so just to we have this list of to-dos we're generating here it seems like we've got a couple concrete things for dealing with getting the Debbie and Key of the HSM pieces and then someone's going to have to get the key then there you mentioned that we need to get mock manager support from the SHIM the one-two stuff that does that is there's someone who is going to take care of that I'm happy to maintain the SHIM package step to minus one and you can give me a key you guys no you can get the you can get the name of the key I can but it's not useful if you want me to upload it would you be in it? sure so this discussion you guys were just having was a meeting with the SSF to talk about freedom do you see that? emerging the growth changes would it be an objection to see it? will we have to keep walking on getting as much as you can go? no so this would just be in Debbie? it would be more convenient not to be in too much of a battle of days for everybody to have a gigantic growth set in every district that is kind of that of copying around that's not really very satisfactory but it doesn't block us immediately one useful thing that growth upstream did do in response to the in response to things like this was implementing a verification layer so you can do the best signing of growth modules and it might well be nice to integrate that so that we don't have to embed all of the modules that we care about in the core image but again not a particular locker so just in terms of an interest of making it clear to do this what is the meeting with the SSF it sounded like you didn't need to do that it's not blockable at all to try to try to make sure that Debbie and the SSF are vaguely aligned on what we're doing and not doing with a hardware-enablement level support for UF and security and by the way are there any considerations for answering this sort of step to not recompile all of the shared parts of the room on CDs for recovery packages you're going to either have to ship the same car to the stadium or you're going to have to also rebuilds growth and ship and finally how does that work I don't know you know but how does that work like someone else is like a signed shim that's signed by Microsoft as long as the shim itself is not GPLed so there's no problem there but because it's used in computation with shim it's always possible for user to replace it with one they build themselves so again there's no problem that's it but would so like if I wanted to use Microsoft signed shim in my distribution yeah I'd give you that one yeah you'll also have to use their caravan and their caravan or if they're signing you'll have to use theirs on packages well I would like the booties now and the one you released a while ago yeah you could do whatever you want if you mod it mod without any user involvement if you want it to be turnkey if you don't want the user to have to set up their own machine overking in order to boot your distribution then you need to I'm booting it's either yours or the bootie one that I'm booting a 32 bit kernel that I can tell myself the bootie thing only works because today we boot unsigned kernels after after the exit services call okay yes that's Holtz I told you that that's why it's hard to hard to break is it possible that kernel still be signed just like kernel yeah are we talking about shipping a Microsoft signed shim with the bootie that's what we're doing that's what we're doing it's it's not exactly pretty obviously you're dependent on an external and not always friendly entity it means that in order to upgrade a particular piece of software we basically need a sign off from Microsoft which should be very comfortable with on the other hand the alternative is low and protracted processor trying to set up a CA and getting that into enough actual hardware that real users will be using so that they can boot our systems we have we did explore the possibility of signing with two keys with Microsoft's key and with one that we operated ourselves that falls and runs in file of various firmware not actually supporting that we're not should we ship a Microsoft signed shim we have to have one other option I mean to encourage people to use soft sign keys but the important how you're going to put the installer you need to bootstrap it if you buy a I bought the shelf it only will trust the Microsoft key so you have to talk people into figuring out the obscure UI that's different on each hardware or you can do a lot of them so the point for me is not does it suck that we have to rely on Microsoft for this yes it does suck but I think it's more important that we not make the process of installing a free operating system on modern firmware the process that involves typing in a long string of hex digits into your firmware setup screen before you need to start the effect of that is going to be turning off lots of people from free software and I don't see that as what meets our long term goals I'm not comfortable with all of the ways we have to get there but as long as we're still building the actual software ourselves and the only involvement from Microsoft is a signature that we can verify refers to the same code then I think it's basically acceptable this is actually really good for my in this case which is we release a live live distribution which would be great to have with Microsoft so from what I understand from our to-do list here the uploading of the shim mock manager the updating of the grub package to be signed by the Model 1.55 and the kernel team changes that will be the uploading kernel images that are signed depending on the stack changes and all of those are relatively easy things to do just simple package changes so maybe we need to and there isn't anything else really that needs to be done that has been identified as additional tasks since the last time we talked about this is that correct do you already have a process to acquire the key who doesn't know who's going to do that it's going to be do you say it's going to acquire the key well somebody actually had a discussion is what is about whether the is locking down things do you want to turn that up so the brief summary is that in the European world for meaningful security you need to distinguish between the root and the kernel in terms of all privileges in the past it was straightforward for root to modify the kernel in various ways and there's no particularly strong reason to prevent that because at worst they could always edit the kernel on disk and reboot into a new modified kernel Secureboot prevents that and so as a result there is an incentive to lock kernel down such that it's not possible to modify the running kernel in the root which means checking for signatures on modules it means not allowing root to modify the kernel through any debug interfaces or through DEF-MEM or for the or for roots to be able to control PCI devices directly through their resource regions so various things also KXX it's really easy to use KXX to modify the running kernel you can jump back into the first kernel from the second kernel it's not like you actually have to kill users things to do this it's there's a set of patches which may eventually get upstream I spent a while doing that and then Linus said something that we contravened because we fucked up here we're right to repeat it and now case cook has taken over trying to get that upstream but right now it's an external patch set that Debian would probably want state responsibility for we in any way actually obligated it isn't any real state of need but for Microsoft to do that no but if your kernel can be used to subvert security counter-operating systems then you will probably be blacklisted there is not actually anything other than a bunch of typing stopping some of these KXX cultural jokes yeah I know I know that but I mean right now do the words say this the words assume that you're not stupid right but what I mean is Ubuntu is currently just really binary that would allow that you know you would have to speak to two of them to spoilers I can't speak on that behalf I would say this is a really bad idea okay so the is there a question about including this patch set in Debian that you want to discuss or is there something that needs to be done the details well including the patch that seems relatively uncontroversial I think the question is are we going to turn it on by default when booted via secure boot and what will be the point otherwise I mean it's optional then it has no effect I mean it would obviously not be optional in signed kernels question is what do we do with it in other cases I think that's a detail that can be sorted on right so it sounds like this is definitely not this is definitely not blocking anything else we have one minute left the the blocker for everything is getting a key or at most is that something that a single person from DSA can do is require getting several people together so the process is basically we generate the key and then submit a significant request do you mark or something the process is that we generate a key all the equipment form which is then embedded in the ship package which is then forced on you by yourself so we generate the key we decide where you store the key we generate the key you create your own self-signed certificate check package check package hang on how do you do the signing request is that a person that requires you to be the search from a CEO and then you upload the binary through a web form that is recalculated yes using that sitting around for that purpose every other possibility so these types form where does it come in? it's an eV it's an eV it's available for two vendors right now you use that to sign the uploads you use that for anything else you use that to sign the you sign a cabinet which then rotates your file so the question does the existing setup allow for being signed with multiple keys not just for Microsoft so the setup in theory of it being binary back from Microsoft so you add your keys in addition to the Microsoft key and then about 10 to 15 percent of the key to refuse to boot right because it was not in the initial stack it was not usually in the initial stack isn't that what this is doing is it able to use a key on the HP machines that's for to do preloaded slowly not for any other situation obviously if you're pre-loading it on a particular vendor's firmware then you can make sure that it works then so the thing is to purchase an eV generate the key in the self sign pieces that then would be fast on to receive to jam into the shim package that would then be loaded via Windows what stage in this does the shim get packed into a signed package we upload the shim source to Debian get that through Nu well I guess we're not doing source multiple we go out either we upload the binary maybe we want to use that to this package so the binaries are always built on the build deal we get through binary Nu and we have the shim binary package we extract well whoever controls the certificate whoever controls the key that has the eV served the executable puts it in a cab signs the cab and all those steps can be done on Linux then you submit it to Microsoft through the website which has to be done on Windows does anyone tested to see when that site works with the silver light compatible thing built on like I don't think works with any current excessive life resembling chips I kind of figured it's a shot I'd ask it also in our experience can't even be run in a virtualized instance of windows oh you kidding me what so far as we've been able to determine RIS team is not available that particular silver light in application doesn't because silver light in general seems to be for the purposes of submission it does not work so so we can use that could be ineptitude with Windows on the part of RIS team it's not exactly a skill we select so the DSA obtains an eV served and generates the key in the self-signed is that clear that DSA is going to do that or should that be a key manager role or is that in dispute DSA would in fact be in control of the key to manage the hardware connected to make sense for people so then someone from DSA would also be doing the extraction and say is there any value to the two-level setup that we have in the room to so we use the at the moment we have a two-level setup so that we have something which is kept compliant but not approximately kept compliant anyway but not online and an operational key which will retain DSA so I mean the reason my understanding of the motivation for that but I remember it being that we were interested in being able to revoke particular signatures we've done without having to go through microsoft the actual implementation of that is somewhat questionable due to the fact that we don't have the same process for propagation by microsoft has bugs in theory at least we should properly do the same thing I don't know we haven't used it it hasn't been useful to date part of that is the fact that we cannot write to dvx means that we cannot that the way you get around this is by simply grabbing an older version of shim or whatever so we can certainly provide you with the procedure that we use to generate the old market I don't know of anything so let's it's time for this one but I mean when you already have it it's good to just talk about it it was sadly not especially straightforward in both ways so we won't get that to talk I don't mean to forget this but we are very keen to make sure that we do this in a certain piece in my other case yeah great put your name down so it's not that we haven't understand what's needed and we've got names next to our tasks yes yeah are there deadlines for anything are we expecting this all to get in or it will be nice but of course it's going to depend on what you're talking about it would be nice quiet things need to start moving if we actually think we're going to get it done for Jesse which means that the BSE piece will be done in the month oh yeah not the big one within aim but just about so by how do they feel about some pieces can go through new and all that even before then it may not be useful but at least maybe if we're not running the label or anything else okay very shortly after that we should then be able to sort of like work in I will be using sort of sort of so once that filters very shortly after it starts like a signed CD image or signed boot from CD images and that kind of thing clearly I commit to making sure that way you've already done this any way before so we can work through that there are TDS so yes so the way that we do this right now you need it in a you need it in a dev in order to be able to spot upgrades so this means that that we have to to set up those so we need to we have to go up to that signed by DAC machinery later on we upload go up to signed which downloads the signed thing from the archive verifies it against the the keys it expects and it stuffs that into a dev and uploads it and the same will happen for SHIM SHIM works differently because you're waiting for it to come back from Microsoft because we need to verify that Microsoft actually signed the thing we do that but yes, it functions it's not basically a signed SHIM it's really being done in the office it sounds like the DAC that you work with in testing the environment can probably happen in parallel you don't get blocked out unfortunately the SHIM why we use software that particular piece of it is inspired by DAC alright thanks everybody jesse