The Jack Benny program, transcribed and presented by Lucky Strike. The cigarette that tastes better. It's light up time. Be happy, go lucky. It's light up time. For the taste that you like, light up a lucky strike. Relax. It's light up time. This is Don Wilson, friends, and I certainly agree there's no time like right now to light up a lucky and find out firsthand what real deep down smoking enjoyment is. I mean the enjoyment that comes from better taste because a lucky tastes better every time. And the reasons why are world famous. First of all, LSMFT, Lucky Strike means fine tobacco. Tobacco's so fine, so light, so mild, it just naturally tastes better. And then something very important happens to Lucky's fine tobacco. It's toasted. It's toasted is the famous Lucky Strike process that brings Lucky's naturally good tasting tobacco to its peak of flavor, tones it up to make it taste even better, cleaner, fresher, smoother. So right now, while the show gets underway, or whenever it's light up time for you, be happy, go lucky, enjoy Lucky Strike, the best tasting cigarette you ever smoked. For the taste that you like, light up a Lucky Strike right now. Light up a Lucky. It's light up time. The Lucky Strike program starring Jack Benny with Mary Livingston, Rochester, Dennis Day, Bob Crosby, and yours truly down-well. Ladies and gentlemen, tonight Jack Benny does his last television show of the season. But meanwhile, let's go back to yesterday. It's spring again. And as we take you out to Jack's home in Beverly Hills, we find Rochester up in the attic, busy with the spring cleaning. Well, I got all the magazines stacked up. Now I'll move this box over and... Hello, what's this? I never saw these before. A bundle of Mr. Benny's old love letters. I wonder if I should... No, I'd be a heel if I read them. But nobody would know I'm a heel but me and I ain't gonna tell anybody. I think I'll open this pink one first. Well, look at this. My darling blossom boy. I've been thinking of you all day. I'm still thrilled to the memory of how you said good night to me and crushed me in your powerful arms. Powerful arms. That can't be the boss. I know how excited you must be about having been elected captain of our school football team. But I can't get over your reluctance to talk about it. You're so modest. Modest? That can't be the boss. We sure had fun celebrating your election at the ice cream parlor. And wasn't it lucky I had my purse when you discovered you forgot your money. That's my boy. And another thing. Oh, Rochester, when you finish up here in the attic, what are you doing with those old letters? I'm putting them away. Rochester, have you been reading my old love letters? Oh, no, boss, not me. Well, then put them away and straighten up this pile of books in the corner. Okay, blossom boy. Oh, so you have been reading them. Just one of them, boss. And Eloise. Eloise. Oh, yes. Eloise Stanley. Rochester, you should have seen her. Long, golden curls, big brown eyes, rosy cheeks, dimples. And when she smiled, she was the silliest looking dame you ever saw. Now, come on, let's finish straightening the attic. Put that carton on top of the trunk. Yes, sir. How about putting the... Boss, what are you looking at? This old picture album. Most of them were taken when I was a kid. Oh, yeah. Say, who's that man in this picture here? A relative? No, no, he was my first violin teacher. May he rest in peace. And oh, look, here's a picture of me taking when I was two years old.  Not quite. And this is my sister, Florence. Who's that on the other page? Oh, that's my second violin teacher. May he rest in peace. Oh, look, here's a picture of my graduating class in grammar school.  Wait a minute, boss, I don't see you. Well, I took the picture. See, I had a little photography business on the side. And look, here's a picture of our house in Waukegan. Sure is a nice place. Who's the man standing out in front? Oh, he's my third violin teacher. Is he resting in peace? I don't know. He ran away and joined the foreign legion. And Rochester, here's the picture of... Well, that must be some of my gang. We're gonna rehearse here today. You want me to come down and take notes? No, no, I think there'll be a lot of changes in the script, so I asked my secretary, Jeanette Eiman, to come over. See you later. Gee, seeing all those pictures reminds me of the very first violin concert I gave before an audience of thousands of people. May they rest in peace. What memory? Coming, coming. Oh, hello, Dennis. What are you giggling about, kid? Well, this morning I went out in my yard and I caught a golfer. Why should I make you laugh? I got him in my shirt and he tickles. Dennis, you got a golfer inside your shirt? No, I just said that for a joke. Why didn't you laugh? A joke? You got no sense of humor at all. Look. No wonder they put your program on Sunday when people are at church. Oh, close the door and come inside. Oh, am I on time for rehearsal? You're the first one here. I asked you to come a little early on purpose. I sent you your new contract, Dennis, last week. Have you signed it? Well, no, it hasn't come back from the doctor yet. The doctor?   She never satisfied with anything. Oh, you're wrong about that, Mr. Benny. She liked the present I gave her this morning for her birthday. Say, today is her birthday. Uh-huh. Well, what did you receive on my mother's birthday, Dennis? Why should I get presents on your mother's birthday? Oh, it's in our contract. Oh, yes, yes. Yeah, I don't know what to get you for Labor Day. You'll think of something. Sing the song you're going to do on the show. Okay. Ah, no. Look at Mr. Benny. Oh, I was fine, Dennis. It'll probably sound even better, you know. Come in. Oh, hello, Miss Simon. Hello. Well, summer must be around the corner when my little secretary comes to rehearsal in a bare midriff. Well, the weather's kind of warm, and this midriff dress is comfortable. Yeah, but it must be very inconvenient. What do you mean, inconvenient? No place to carry a gopher. Dennis, stop.  Immodest? But everybody out here wears them. Not my girlfriend, Gladys. She's too modest to wear them. She's not modest. She just doesn't want to show her tattooing. Dennis. She has more pictures on her than Channel 2. Now be quiet. One little battleship, and everybody makes a big thing out of it. Anyway, Miss Simon, I'm... Excuse me. Hello? Hello, Mr. Kitzel. Hey, what can I do for you? Nothing at all. I just called up to tell you how much I enjoyed your radio program last week. Well, I'm glad you listened to it. I didn't listen. I was there at the show. Oh, that's nice. Where'd you get the tickets? What tickets? I was nonchalantly walking down the street when all of a sudden somebody threw a sack over me, gave me a bump on the head, and the next thing I knew, somebody was whispering in my ear, welcome to CBS.  Oh, oh, I see. And you know when the program was over, I went back to see you, but you was already gone. But I did see that other comedian. Which other comedian? Edgar Boingstein. You mean Edgar Bergen. He's very funny. By the way, Mr. Kitzel, I haven't seen you in a long time. Oh, this is because I now have a job as an extra in pictures. I already worked in six westerns. In western pictures? Yeah. They went dirty way. And smile when you say that, partner. You're pretty good. Oh, you should see me on a horse. Oh, can you ride? The best. When I'm on a horse, I'm looking like hop along. Pacity? Whom? Oh, excuse me, Mr. Kitzel. I better hang up. There's someone at the door. You're excused. Goodbye. Goodbye. Now, come on in, Don. I'm glad you brought the sportsman with you. Hi, fellas. Say, come on in, everybody. Say, Don, how come you're dressed that way? Oh, I just came from the golf course, Jack. I played 18 holes this morning. I didn't know you played golf. Yeah, I just took up the game. I take lessons twice a week now. Oh, that's how you're playing? Oh, pretty good. But I'm having a lot of trouble with my tee shots. Well, Don, hitting off the tee is one of the easiest shots in golf. You just remember one thing. Keep your eye on the ball. That's my trouble. I know it's down there, but I'm not sure where. Oh, that could be a problem. What course did you play today? Oh, I was out at your club, Jack Hillcrest, and I was doing all right until I came to that fourth green. You know, the one that's down in a gully. Wait a minute, Don. The fourth green isn't in a gully. It's on top of a hill. Not anymore. Look, Don, if you... Come on. Let's get this rehearsal over with. My gopher's getting hungry. Then, as you said, it was a joke. Now, leave it alone. I think we ought to get started. It's getting late, Jack. Jack? Miss Iman, you called me Jack. What do you want me to call you, blue eyes? Not during business hours. That's for night. Or drive-in movies. Now, come on. Let's all go... Let's all go in the den and rehearse. Pause. You can't rehearse. The script's haven't arrived from the studio yet. That's funny. They always send it to my house so we can... Hey, that must be the script's now. Come in. Hello, hello, hello, everybody. Long time no see. Well, Steve. Hey, kid, this is my publicity man, Steve Bradley. Steve, what brings you around? What's up? Benny, I'm worried.  We gotta do something about your publicity. Publicity? Well, at your department. I know. And I've been working like crazy to get a good stunt to land you on the front pages. Benny, I want you to be as well-known as Smog. Smog. What's good about Smog? It's in the public eye. Benny, I'm thinking every minute. Oh, look, Steve. Can't you wait? Can't wait. Can't wait. No time to lose. I thought this was so urgent that when I couldn't reach you by telephone, I sent a message by carrier pigeon. Carrier pigeon? Well, that must have been the pigeon that landed on my window sill. Yeah, yeah. Didn't you see the message tied to its ankle? Message? Rochester! Don't look at me. You ain't the legs. See, I thought the paper on that leg was a panty. Now, Benny, I've been giving this serious thought. We've gotta come up with something for you. Something unusual. Some sort of a stunt. Now, wait a minute, Steve. Wait a minute. I don't want any more of your stunts. Wait a minute, Benny. Wait a minute. Hold it. What? Why didn't I think of this before? What an idea! All right. What is it? Baseball. Huh? Look, some years ago, Bob Hope bought himself the Cleveland Indians. Bing Crosby bought the Pittsburgh Pirates. And today, who is everybody talking about? George Goble. And there you are. Now, Steve, what are you getting at? Benny, you've gotta have a baseball team. Well, look, Steve, I like the idea, but a baseball team is liable to run into a lot of money. Leave it to me, Benny. I'll find you a team that won't cost you much dough. Well, good, good. I'll get you a team that's unknown, but with a proper training and a year or two, you can sell them to somebody else and clear yourself the net profit of a million dollars. All right, Steve. That sounds like a great idea.  Leave it to me, Benny. So long, everybody. You know, kids, I think Bradley's got a good idea with that baseball team. He certainly has, Jack. And look at the commercials you can do. Commercials with baseball? Why, certainly. You've got the quartet right here, and they can take a song and fit it to anything. Don, I'm not sure that... Now, Jack, look, I'll show you. They can even ad-lib one right now. Ad-lib a song about baseball? Sure, sure. Go ahead, fellas, showing. Baseball in the springtime Baseball in the winter When it drizzles Baseball in the summer When it sizzles Lucky's in the summer They're so pleasing We smoke luckies at the ball game Makes a hit that's clean Like lucky It's light up T, it's light up T Baseball idea is going to work out great. It'll give me a lot of publicity. You're right, Jack. After all, baseball's the national sport. Everybody loves it. Don's right, Mr. Benny.  Oh, did you play? Sure, but every time I hit the ball, I broke a window. What? I broke seven windows. Well, kid, maybe when you went outside, you played too close to the house. Oh, Dennis, why can't you? Jack, Jack, look, I haven't been home yet from the golf course, so let's get out of the rehearsal, will ya? Don, we can't. The scripts aren't here yet. Oh, yeah. Well, why don't you call up CBS and see what's wrong? All right, I will. Take me out to the ball game Take me out with the crowd I know a way to save 80 cents I'll drill a hole and I'll look through the fence Dumb, dum, dee-dum, dee-dum Oh, Mabel, what is it, good truth? You get it, will ya? Now, Mabel, it's Mr. Benny. I wonder what Blossom Boy wants now. I'm acting with the Mimeograph Department because they haven't delivered his scripts yet. Script? Pop off as an ad-lib comedian. Yeah. Ad-libber click if he had full teeth. I don't care if he can ad-libber not. I think he's cute. No more times than he has with you.  When we look like we do, we should be happy we got each other. Well, I don't know about you, but I'm expecting Mr. Benny to pop the question any day now. Pop the question? You know what happened. What'd he say? He didn't win the shopping. That's what you mean? You do? I mean, he was kissing me. I saw my reflection in his glasses and I thought my mother was watching us. Operator. Operator, I want the Mimeograph Department. What? Well, when you get them, tell them to send the scripts out to my house. Goodbye. Here's nothing to do, but wait, I guess. We won't be able to rehearse. Hold everything, hold everything. Benny, I'm back. Steve. Yeah, Benny, you won in the baseball team and Bradley didn't let you down. Hey, that's swell. Now, just sign this contract and the team is yours for $1,000. Good, good. There you are. Now, what's the name of the team? The BBBs. BBBs, what's that? Benny's Buxom Bloomer Girls. Bloomer Girls? Certainly, Benny. I can see it now. All over the sporting page. Pictures of Bob Hope and his Indians. Bing Crosby and his pirates. Jack Benny and his bloomers. Steve, you can't do this to me. So long, Benny. See ya. You like that. A girl's team. I got a mind to... Oh, Mr. Benny. Mr. Benny. What? Your slip is showing. Oh, wow.  Ladies and gentlemen, here's an important message from the United States Forestry Service. Picnic time and camping time have frequently become disaster time.  When you're in the woods, do your part to prevent forest fires. Be sure every campfire, every match, every cigarette is out. Remember, only you can prevent forest fires. Thank you. Ladies and gentlemen, Jack will be back in a minute to tell you about his television program, which goes on at 7 p.m. tonight over the CBS television network. But right now, here's a suggestion for you. Light up a lucky. It's light of time. Be happy, go lucky. It's light of time. For the taste that you like. Light up a lucky strike. Relax. It's light of time. That's a grand idea for a pleasant Sunday evening at home or any time at all when you want to enjoy a really great cigarette. Just lean back and light up a lucky because every lucky you light is sure to give you better taste. And here's why. First, luckies are made of fine tobacco. Lucky strike means fine tobacco. Light, mild, naturally good tasting tobacco. And then, that tobacco is toasted. It's toasted is the famous lucky strike process that tones up luckies' fine tobacco, brings it to its peak of flavor, makes it taste even better, cleaner, fresher, smoother. Result? Lucky strike, the best tasting cigarette you ever smoked. So right now, friends, or any time at all when it's light up time for you, be happy. Go lucky. Make your cigarette better tasting lucky strike. For the taste that you like. Light up a lucky strike. Right now. Light up a lucky. It's light of time. Well, Rochester, I gotta rush over to the studio and do my last television show of the season. Yes or no? Say boss, usually on your last show you send out tickets to all your friends. I did this time, Rochester. Every one I know is going to be in that audience, except Mr. Scarlatti. Mr. Scarlatti, who's he? My fourth violin teacher. May he rest in his straight jacket. Anyway, folks, I'll see you in a few minutes on my television show, and next week again on Radio. The Jackman show tonight was written by Milt Josephsburg, John Takkeberry, Al Goldman, Al Gordon, and produced and transcribed by Hilliard Marks. Filter smokers, true tobacco taste, real filtration, famous Tarleton quality. They're all yours when you smoke filter tip Tarleton. Filter tip Tarleton gives you all the full, rich taste of Tarleton's quality tobacco, and real filtration too. Because filter tip Tarleton incorporates activated charcoal, renowned for its unusual powers of selective filtration. Look for the red, white, and blue stripes on the package. They identify filter tip Tarleton, the best in filtered smoking. The Jackman program is brought to you by the American Tobacco Company, America's leading manufacturer of cigarettes.


Thanks everyone for joining. I'll start out just by doing a quick introduction of myself. My name is Dan Yonner. I'm a product manager at Pivotal. I've been working on Cloud Foundry since early 2016, during which time I've worked on two main projects, both of them sort of in the security realm. The first one, which I had the opportunity to talk about last year at Summit, is CredHub. And most recently, I've moved on to the security triage team, which focuses on application security in Cloud Foundry and at Pivotal. One of the things just top of my mind right now is thinking about how to integrate security-related automation and tooling into big development environments. So if you all have experience on that, I'd love to chat with you in the hallways. So the focus of my talk today is on application security of the platform in Cloud Foundry. I'm going to start talking about the importance that I see of the community's contributions to security in the platform. After that, I'll be talking about who I think should contribute, run through a quick start guide, just like a one-on-one on security testing, if you're not familiar with how to do that. And then finally, I'll wrap up talking about how to do disclosure in the event that you do find a security issue in Cloud Foundry. Let me just start by saying, security loves the community. Like the phrase that we often hear is, with enough eyes, any bugs can be discovered, or any bugs are shallow. I think that really is one of the superpowers of having a community. If you have a lot of people looking at something the more scrutiny, the more secure it's likely going to be. Cloud Foundry has a lot of enterprise members. We have more than 60 member companies and hundreds of individual people contributing. And the exciting part about that is we all have the opportunity to contribute to the security of the platform. But one thing that I will mention, there's a little caveat to that, right? The many eyes thing only works if we're actually engaged. So the whole point of this talk is to hopefully inspire you all to get more engaged in security in the platform so that we can find all of those bugs. Three areas in particular that I want to talk about for where I think the community can really make an impact in challenges in Cloud Foundry. The first one is about complexity. Thinking of this as just like specific platform level complexity or a platform component level complexity. We have a lot of really highly complex components in Cloud Foundry. And it's really hard to understand a lot of their boundaries and features and interactions. And as that complexity grows, the likelihood of security issues with that functionality also grows alongside that. So it's not necessarily bad. A lot of times this is necessary. But where that complexity is necessary, I think a good counterbalance to that can be all of your interactions in the community to provide more scrutiny on that and provide more auditing of the security of those components. Another area is around just like integration and variations. If you deploy Cloud Foundry, you might see in CF deployment, I think there are 2,500 lines of configuration. And with each of those different settings, there's a possibility for different things to go wrong. We do a really good job in CF deployment of shipping this really great product. But Relent can only test a certain number of configurations. It's not going to be the full breadth of all the configurations that are out there in the community. So I think having the community do testing on their specific flavor of Cloud Foundry is really important. And I think one of the reasons that's important is with these well-worn paths, we may make assumptions about different components contracts and how they interact with each other. And some of these custom deployments can surface that those contracts aren't as well enforced as they should be. And then the last area is diversity of experience. So a large number of security vulnerabilities, basically the underpinnings are that you broke an assumption that someone had. So if you have a user sign up form and you assume that no one's going to put drop table users as their first name, you might have a bad time. So generally speaking, people that have similar experiences are going to have similar assumptions. So having a good diversity of people in the community is a good way to counter that. So fresh eyes and new perspectives uncover a lot of things that are overlooked. One thing I'll also mention is I think this also applies to security experience itself, which is to say a cryptographer might be the best person to try to attack a system by predicting a random number generator and using that to leverage attack, but also somebody that doesn't have specific experience in security might be able to discover that there's a default user. And at the end of the day, if they both get to the same place, I think both of those are valuable things to research. All right, so who should consider contributing to security at Cloud Foundry? Hopefully you're listening to the previous point, which is I think everyone's experiences are really valid, and I think diversity of experience is important. So you all, that's the answer to that question. All right, so let's talk about how to contribute. So next few slides, I'm just going to go over. If you don't have any experience in security, you're thinking, hey, this might be a good idea, but you don't know where to start. This is like a testing one-on-one. But of course, I'll start with a disclaimer. So next few slides, I'm going to talk about thinking about how you could do an attack and picking your target for attack. One of the assumptions here is you're working on a local environment or an isolated environment. If you don't have permission to do vulnerability assessments on a platform, it's likely illegal, so don't do that. Certainly unethical, if anything, so don't. All right, so first step is really about a mindset. I've got a picture here of a bunny. And if this is a normal bunny, it's going to look at those pegs and it's going to say, I'm going to get to the other side by jumping over those pegs. But if it's a hacker bunny, it thinks, why do I go to all that work? I should just go right through. I don't care about your access control. I want to go from one side to the other. So first thing is thinking like a hacker. Don't focus on positive scenarios. Don't focus on where you would expect it to work. You would have to focus on things that are negative scenarios and edge cases. So that's the first thing. A few things that I'll just point out as resources that I thought were really interesting as a mindset shift were the first one's physical security testing. It might sound a little bit counterintuitive, but the reason that I thought these resources are really interesting is because they're really engaging. And also, it's one of those things where I've got an elevator and a door hacking link on here. And it's interesting to watch those and then look at things that you experience in your everyday life and think, oh, hey, I could hack this elevator. It's an interesting thing, especially when your intention is to change your mindset a bit. And also, I think a lot of these principles carry over between the two. So thinking about the various points of entry, thinking about how those are secured, how they're authorized, overcoming different obstacles along the way, and chaining those together to get from point A to point B. I think translates well. The other thing is, there's this whole host of applications. A lot of them are hosted by OWASP, where they basically build an app, and they build it intentionally and securely so that you can go in and get some hands-on experience in doing different exploits. So the ones that I've tried are OWASP Jew Shop. And Hack this site is also just a site that you can visit without deploying anything. But those are really cool because they basically just make it a game. And the fact that you're going to succeed makes it a lot more fun. All right, so you're starting to think like a hacker. The next thing you need to do is start some actual testing. So the first thing that you might want to consider is what sort of attack methods you're going to use. So one of the ways that you can go about this is basically just go to the OWASP top 10. If you're not familiar with this, this is a list of the most common vulnerabilities that are found in software. A way that you could go about this is select a specific one that you're really interested in, like thinking about injection, thinking about the various types of injection that happen in applications, what sort of general attacks in injection look like. And then you could also explore some of the tooling that surrounds a lot of these attacks. A nice primer on that is there's this presentation by PagerDuty that I've linked up there. They walk through each of these different exploits and get into a lot more detail about each of them. Another option that you have is looking at historical vulnerabilities. So if you basically look at all the vulnerabilities that exist, if you see, for example, that a specific component has been affected previously by SQL injection, a pretty reasonable assumption would be that that application doesn't have holistic protections for SQL injection. So if you wanted to narrow down your targets and see basically just increase your odds of success, you might want to look at historical vulnerabilities. Speaking of historical vulnerabilities, a quick plug today at 5.30. Molly and Rupa are doing a talk, which I hear is not going to be recorded about the top five security vulnerabilities that we've discovered in Cloud Foundry. So definitely go to that. All right, so the last method that I'll mention here is just doing plain old automated tooling testing. I mentioned this, but I will put a little caveat on it, which is a lot of these are really good at finding things, but they also find other things along the way that aren't very good. So if you do decide to use automated tooling, make sure you look at the end result and validate that there are actual security issues that you care about and not just a configuration of your deployment or something like that. All right, so you've got a method. The next thing you want to do is think about a target for your test. This is really just a matter of doing a bit of good research. You would want to be somewhat familiar with the application that you're testing, do a little bit of research on all of its different behaviors and interactions and configurations, and then also look at all of its interfaces. If it has different APIs, different ways to interact with them, each of those can be a different surface area. All right, then the last thing that you want to do is you want to perform the test. Basically what you're looking for here is any change in behavior or response that compromises either confidentiality, which is information you shouldn't see based on who you are in the attack. Integrity, so if you can modify something that you shouldn't be able to modify. Or availability, like if you find a way to send three attacks and it falls over, that's certainly problematic. Some of these can be really subtle, like if you send an attack and it sends back an error message, but the error message includes details about the environment or something like that, that could be cause for a concern. So look out for subtle changes and do a little bit more research. The last thing that I'll mention is denial of service testing or availability testing is one of the outliers here, which is usually you don't want to do availability testing that basically just like throws a ton of load at a component. There are a lot of tools and services that prevent that sort of attack. So just throwing a bunch of load at CAPI and seeing it fall over isn't super interesting or unexpected. And then the last thing is around reporting. So as you're doing this testing, a thing to point out is make sure that you keep good logs of the tests that you're doing so that if you are successful, you can actually report it. And it will be really easy for us to reproduce and really easy for us to fix. Testing can be really frustrating because 99% of the things that you're doing are going to fail, which is a good thing. So if you finally do get a result that you think is a vulnerability, you want to make sure that you're recording along the way to make sure that you can reproduce that. And the other notes here that I'll reiterate in the disclosure section are if you find a vulnerability, you're super excited about it, please do not disclose it publicly. Please don't create an issue on the components GitHub. Don't create a PR even, even if you're trying to be helpful because we want to follow a responsible disclosure process, which I'll talk about next. All right, so the last thing I'm going to cover is responsible disclosure. So basically what we encourage here is that people report vulnerabilities to us privately. So if you find something, the concept of responsible disclosure is really just disclosing to the maintainer of the software privately that you've discovered something and giving them a reasonable amount of time to fix it before you start talking about it in public. So the idea is when we do the disclosure, hopefully we can also provide people in the community the fixed version so that they can remediate that at the same time that they know it's an issue. And as part of that process, we also do commit to disclosing vulnerabilities that are discovered in a reasonable amount of time. So if we get a fix for something, the next step is telling everyone that a vulnerability exists so that you can make a good judgment about when you want to update your systems so they're not vulnerable. The disclosure and vulnerability process is really straightforward. It's just starting with reporting, going through validation, remediation, and then finally disclosure to the public. Hopefully, if you didn't take anything from this talk, this is the one thing that you do, which is if you ever encounter a security vulnerability in Cloud Foundry, please do send an email to security at cloudfoundry.org to let us know, and we'll research it and get back to you. As a general rule of thumb here, err on the side of being more communicative than less. So if you see something and you're like, I'm pretty sure, but not really sure, I don't want to bother them, change your mindset, definitely bother us, send it to us, and we're fine if it turns out not to be a vulnerability. Quick shout out here to the security triage team. These are my colleagues, the folks that I work with every day. They handle both the open source Cloud Foundry security stuff and also the security things with Pivotal. So if you send a report to us, you're likely going to be talking to one of these folks. I'm super biased, but I think they do great work. So I think you'll be surprised and delighted with the interaction. All right. So validation. So once you send us a report, we're going to validate it. This is pretty straightforward. Basically, our intention here is to try to verify what you've sent to us. Our hope is that we can really get a good handle of the issue that you report and make sure that we can analyze any impacts that it has on the platform. If it's unclear or if we don't know, we're going to reach out to you and ask some questions here. So it'd be great if you report something to respond back to us. And then, of course, remediation. So if we are able to validate something, we work with the teams to produce fixes that patch that issue. The timeframe for this is going to vary, but the main motivators here are primarily severity of the issue. So if it's a critical or a high severity issue, we're going to start working on it right away. We're going to have eyes on it and we're going to try to get something out right away. But then, of course, we also have to weigh the complexity of the fix. So the combination of those two determine how quickly we are able to remediate something. Lastly, once we've got fixes out, we've released something. We'll do the disclosure. This is primarily communicated via the cloudfoundry.org website.  We do this shortly after a fix is available. And we basically just do this so that as members of the community, you can look at this and say, I see this vulnerability was disclosed. I see what severity it is. I can make a really reasoned decision about the risk of either patching or not patching that issue. And it's sort of up to you to do that. But please do patch. So all right, that's the end of the disclosure process. As I wrap up, I just want to say thank you to these community members that have reported security issues to us over the past year. Cloud Foundry is definitely more secure because of the involvement of the community. But I will say, hopefully, I've inspired some of you to do more testing and have a little bit more interaction with us in the open source security side of things. And next year I'll come back and I'll do a presentation called Community Love Security where I talk about all the cool reports that you all have submitted to us. Thanks for listening.


Hello and welcome to today's episode of the International Daily Roundup by People's Dispatch where we bring you some of the top stories from around the world. Let's take a look at today's headlines. UK parliament passes story health and care bill. US jury implicates pharmacy chains in the opioid crisis. Australia designates Hezbollah as a terrorist organization and Chile's Congress passes marriage equality bill. In our first story, we go to the United Kingdom where the Tory government has passed the widely criticised health and social care bill. The legislation passed its third and final reading in the House of Commons on November 23rd with a majority of 294 to 244. The stated purpose of the bill was to undo reforms introduced in 2012 under the Cameron administration. However, it was dubbed the corporate takeover bill for its impact on public health care. The national health service is facing critical issues including funding shortages and millions of people in waitlist. The health and care bill will break up the NHS into 42 different independent integrated care systems or ICS. Rather than one central NHS body, individual ICS boards will have the authority to decide which services they want to offer in their area. Of particular concern is the fact that private health care companies will be members of these boards. The Labour Party tried to remove this provision in Parliament on Tuesday but it was blocked by Tory MPs. The NHS was already privatised by an estimated 7 to 22% between 2018 and 2019. Labour MPs were also blocked when they tried to remove parts of the bill which gave the health secretary broader powers to intervene in changes in NHS services. A crucial amendment calling for independent workforce projections to solve the staffing crisis was also voted down. Anti-privatisation campaigners like Unite the Union have warned that the bill will implement a US-type health care system. They have also pointed to consultations between the UK government and private companies on what to charge for operations. In our next story, three of the United States' biggest pharmacy chains have been implicated in fueling the country's opioid epidemic. A federal jury in the state of Ohio held Walmart Inc, Walgreens Boots Alliance Inc and CVS Health Corp, liable on November 23. Jurors backed Ohio's Turnbull and Lake Counties who said that these chains failed to create adequate systems to track illegitimate opioid prescriptions. 140 million pills were allegedly pushed into these counties over six years starting in 2006. The jury ruled that these pharmacies contributed to a so-called public nuisance by selling and dispensing huge amounts of prescription pain pills. Some of these ended up on the black market. A separate hearing to determine the compensation will be held in May 2022. By 2019, the public health crisis had led to almost 500,000 opioid overdose deaths over the past 20 years. The state of Ohio witnessed an increase of 26.6% in such deaths between April 2020 and 2021. Long synthetic opioids like fentanyl accounted for nearly two-thirds of these cases. At a national level, overdose deaths increased by 28.5% between May 2020 and April 2021. Tuesday's verdict sets a key precedent for the over 3,300 lawsuits filed against drug manufacturers, distributors and pharmacies across the United States. It is also important in light of the Oklahoma Supreme Court ruling, which overturned a $465 million judgment against Johnson & Johnson based on a similar public nuisance argument. A judge in California also threw out a case against farmer companies brought by over four municipalities earlier this month. Next we go to Australia, where the government has designated Lebanon's Hezbollah as a terrorist organization. European Home Minister Karen Andrews announced the decision on November 24. The government had already banned the organization's armed wing in 2003. The move is being seen as an attempt to appease the United States and its close ally, Israel. Hezbollah is an anti-occupation and anti-imperialist resistance group which was formed in the 1980s. It successfully fought Israeli occupation of southern Lebanon and rebuffed subsequent invasive attempts. It has also aided the Syrian government to regain its territories taken over by United States-backed so-called rebel groups in the war. It recently also defied U.S. sanctions to bring Iranian oil into crisis hit Lebanon via Syria. U.S. has long claimed that Hezbollah is a proxy of Iran. The group has denied these claims while maintaining that Iran is a close ally. The Biden administration blacklisted some Lebanese individuals in May over their alleged ties with Hezbollah. It also called for international action stating that the group posed a threat to the United States, its allies, and interests in the Middle East and globally. Some European countries and Saudi Arabia have taken action against the group since then. However, they avoided an outright ban given that Hezbollah is one of the largest political groups in Lebanon. Importantly, it is a part of the government raising concerns of a diplomatic crisis between Lebanon and Australia. And for our final story, we go to Chile, where the Congress has approved a Marriage Equality Bill. The Chamber of Deputies approved the legislation on November 23rd with 101 votes in favour, 30 against, and two abstentions. The bill will now head to the Senate where it was previously stalled for four years for another vote. The Congress has now introduced several changes into Chile's civil code. This includes the replacement of terms like husband, wife, mother, and father with gender neutral terms like spouse and parent. While Chile had accepted same-sex civil unions in 2015, this did not apply to adoptions. The bill passed on Tuesday guarantees non-discrimination based on sexual orientation and gender identity in matters of child custody, parentage, and adoption. Parentage is also extended to people who had children with the assistance of reproductive technologies. Moreover, all articles that prevented married trans people from making changes to their birth certificates have been repealed from the Gender Identity Law. The Marriage Equality Bill, as amended by Congress, also regulates the pension system to include surviving spouses and guarantees family allowances. It also recognises same-sex marriages contracted abroad. If the amended legislation is passed by the Senate, it will go to the President to be signed. It will finally become law 90 days after being published in the official Gazette. And that's all for today. For more stories visit our website at www.peoplesdispatch.org and follow us on Facebook, Twitter and Instagram. Thank you.


Let me say first that it really was a pleasure to be there at that first summit and to wonder whether there would be a second summit. But if anyone knows Angela BKW well, she certainly is one who is so determined and so committed and I'm sure that we're going to not only have a second summit, we're going to have several other summits. But at that first summit we were focused on the investment opportunities and our macroeconomic context. That was at least the theme of what I spoke about. But the theme of the second summit is clearly meant to be complementary, which is leveraging diaspora resources for economic growth. So my very brief remarks today will focus on the hows of bringing in diaspora resources. How do we mobilize resources for both foreign direct investment and portfolio investment? And how do we effectively market these vehicles? Also, should we not, as has been suggested in some studies of the problem, and there is a particular study of the problem from which I have taken quite a few ideas. But the questions that have been raised in some of those studies is how do we explore the prospects of international cooperation to make the mobilization of assets across borders easier? Could we, for example, work out rooms by which our local banks can accept assets located abroad as collateral? And how does that really work? How do we make that easy? There's a very excellent work done by Aaron Terazas. It's titled diaspora investments in developing and emerging capital markets. It really speaks to some of the very concrete issues that we are meant to be talking about today. And I've borrowed quite a few of the questions and ideas that have been raised in that very important survey. Some international agencies, for example, USAID and OPIC, and these are two U.S. agencies, they have supported diaspora investments in their countries of origin through risk reduction. Of course, we have USAID here. What USAID does is that they focus on lenders in the country of origin. OPIC, on the other hand, focuses on diaspora investors who are U.S. citizens. But, of course, there are several of our diaspora investors who have dual citizenship. Then they have the Development Credit Authority, DCA, which is also a U.S. government initiative. And these have provided partial credit default guarantees. For example, we've seen that being used for Ethiopian entrepreneurs in diaspora who have been able to access bank credit. I think that we Nigerians in diaspora can also access some of these products of these U.S. agencies, especially, of course, for those who live in the U.S. The way it works generally is that credit guarantee allows USAID to partner banks to mobilize locally held assets and savings. Then the DCA guarantees 50% of losses in cases of default. So these two agencies sort of work together. As I said, they are both U.S. agencies not only to guarantee losses, but also to even guarantee a specific value of those losses. Also, OPIC supports U.S. registered companies investing overseas by offering discounted insurance to protect against currency risk. Now the sort of currency risk that they protect against is one that I think we frequently encounter. That is the possibility that an investor may have difficulty converting profit or capital from local currency to dollars. And that's a risk that we, of course, face in many emerging economies and we face here as well. And also, political risk and expropriation risk. We don't have these kinds of problems here. Certainly, we don't have expropriation risk here. So now it's entirely possible to work with both local and international agencies to seek ways of de-risking diaspora investments to encourage more interest in local investment opportunities. I'm glad to see that our sponsor today, United Capital, is one that is in the forefront of these kinds of initiatives. And I also saw, I think it's called Simplify, I think it's called, who are also doing something quite innovative in this respect. So we may look, for example, at ways by which the Nigeria incentive-based risk sharing system for agricultural lending, the very long name, but the acronym for it is NESAL, or NERSAL, PLC. Now, what NERSAL does is that it can de-risk diaspora investments in agriculture and agribusiness. NERSAL's mandate is to stimulate the flow of affordable finance and investments into the agricultural sector by de-risking the agribusiness finance by region. So NERSAL presents a real opportunity in my view for those who want to invest in agriculture from the diaspora, especially to look at how to de-risk their investments. So how can we make diaspora bonds or diaspora mutual funds work? Interests in previous attempts at diaspora bonds appear to have just attracted mainly institutional investors. And I think that we've had problems, a bit of problems with establishing the diaspora bond as one that individual investors, single investors, can put their resources into. It appears that the ones we've had, their attempt we've made, was only able to attract institutional investors and they took it all up. But I think that we have to make this, we have to make this so accessible and so interesting for individual investors that all of us in the diaspora can actually put in resources. How do we mobilize non-institutional diaspora funds? I think we can explore how diasporance in the financial industries, in their countries of residence, can partner with local private capital companies to raise capital in both jurisdictions for investment. So very much is possible. There's a lot that is possible. In the past four years, our major focus as a government has been on infrastructure development, rail, roads, bridges, power. Our infrastructure spend is by far the largest in Nigeria's history. Yet the infrastructure deficits remain quite significant. We have major funding gaps, as I'm sure those of you who are following the debates on the budget have seen. Part of the solution is private sector collaboration by way of tax credits for investments in public infrastructure. And we'll put that out there that we're prepared to partner with private sector individuals who want to put in their resources for tax credit. Of course it involves a fair amount of money. We've had a few takers, but I'm sure that there are those in the diaspora that can mobilize a kind of resources that can be invested in this kind of public-private sector partnerships for infrastructure and derive significant benefit from it for possible tax credits. The other is the infrastructure fund. The fund at the moment has only received institutional investors. But there is, in my view, room for investment from diaspora funds as well. Such investments, especially when managed with the known expertise of our Nigerian sovereign wealth fund, can be both safe and profitable. So we have an infrastructure fund. It's managed by the NSIA, the sovereign wealth fund. But as I've said so far, all we've seen are investments from institutional investors. We think that diasporas can benefit from this significantly and we as a nation can benefit from it. Our focus so far has been on renewable energy. For example, in the power sector, you know, we've done quite a bit of work in renewable energy and this again presents opportunity, especially with our green bonds. We have something called a green bond, which is Africa's largest sovereign environmental fund. It's the largest sovereign fund of its kind, anywhere on the continent. And that's also one which we think there can be some interest by brothers and sisters in the diaspora. The bond issuance has done so well and has been supported by very lucrative investments. What we've tried to do with that bond is basically to focus on certain specific areas of investments in renewable energy. So for example, we have a program called Energizing Education. This program is run by the Rural Education Agency. What it seeks to do is to improve access to power for 37 Nigerian federal universities and seven teaching hospitals across the country. It will also impact the residents of surrounding communities over a million people, all told. The whole idea of this particular program is that we are providing private sector funding for solar power initiatives in our federal government universities. So far we have a total of about 819 megawatts of power, which we are providing, and about 60 megawatts of power, of that is purely solar. Only last month, at the burial by a Euro-investing panel, we commissioned the largest hybrid solar plant in Africa as part of this green bond initiative. So it's doing really incredible things. The bond is one that provides resources for several things. And we think that the diasporas can invest in this bond because, as we've seen, it's a very lucrative bond. And at the same time, it has an important economic and environmental purpose. And these purposes have been served very well. So the possibilities are many. And I hope we are going to spend some time today. I'm sure you might have spent some time yesterday. Looking closely and scrutinizing the options for mobilizing diaspora capital for local investment. There are so many different opportunities and we can't talk about them all. But I think that we should look at some of the local opportunities that have been provided even now. Government is providing some. The financial institutions are providing quite a few. The central bank has also been extremely proactive in providing products that can be of some interest to our diasporas. So let me again commend the excellent work done by the diaspora commission. I remember the days when we just used to talk about the diaspora, the diaspora and diasporas just used to talk about how they were neglected and ignored and all of that. But that is all changing now. We're meeting regularly. We have a commission and we have devoted leadership. So I think the future is extremely bright and I think that it will greatly benefit our country. So I hope that this summit will take us to the next level in that journey. Thank you all very much.


Running Cybertraders! Let's how's everybody doing this lovely Tuesday? Good to see you, Raymond. Good to see you, everybody, on YouTube, Facebook. Well, I don't you love that song. That was a really good song. I wanted to keep playing, but we're running a little late, so we'll figure we'll get started. Hold on. There we go. All right, everybody, just want to do a quick little audio check. Everyone, just give me a hello so you can hear me loud and clear. Good, good, Norman, good to see you all. All right, good. By the way, that music sound great. I'm sorry, I was running a little late, but I wanted to play that song a little bit more. Love that song, Sweet Alabama. All right, so anyway, we're getting a little bit of a rally that happened yesterday. We're getting another rally that's happening today. I'll tell you the truth, I was just talking to Josh about it. What's really moving? I mean, what is really moving? I mean, when you really look at the Dow Jones and see what's happening, you're getting somewhat of a bounce, right? We were at 34,000, we're up about 1,200 points. What's really moving? I mean, look at the highs of some of these stocks. I mean, a little brand name stocks. Disney, I mean, Disney was at 210. You know, where is that 140 drop? It's at 150, Cisco? All right, maybe, you know, Alibaba, the stock got crushed down to 230. Apple, okay, Apple looks like it's, you know, big Dow movers moving that pretty well. Other than that, I'm not really seeing that much out there. Friday, we have Inflation Report. Oh, Andrea. Here we go. Looking forward to that one. But anyway, we'll talk about some of the stocks that are moving this morning. I mean, not from, before we do that, let's talk about what's happening yesterday. By the way, if you missed yesterday's class, you know, if, for all the students, you could always go back and review the recording, but I spent a very detailed description of how and why these stocks break support resistance levels by using the latter effect, how to write it down, how to know where the numbers are.  When you trade, once you know those numbers, where the resistance and supporter, you don't need to chart anymore. You don't need to level two anymore. The only thing you gotta focus on is to level three and see if those orders are there. That's pretty much it. But before we do that, let's go on the end, because we have class today, phase three, lesson three and four, and I wanna get ready to get started. But what we traded yesterday, just wanna talk about a couple of stocks, Tiger, TIGR, so anyway, this stock was really cool yesterday. So we talked about this stock yesterday, and it was so unbelievable. This stock had a huge iceberg order, huge. And then we're looking at it and we're waiting the last two minutes, look at it, the last two minutes. We watched it from here, and then it ran up to here, and then the last two minutes, the thing just ran from 84 up to 88. Now, I know that's not a lot. Let's not go crazy there. But you know what? Look where it is right now. Look where it is right now, everybody. It went to 608. Did I not tell you as an overnighter? Did I not tell you that when we traded? Okay, the students in class, that was a huge buyer. And by the way, that's going on the watch list, okay? It's not a big mover so far, but because we traded it yesterday, and because I told you the stock was a $40 stock, it got hit. Look where it is. Christmas I get, that was a nice swing trade. Listen, do I hold overnights? No, rarely. Actually, let me take the step back, rarely. Do I hold them once in a blue moon? Now how often do we have blue moons every couple of months? But I do hold overnight if I really feel that confident looking at it, and we've seen sometimes it does work. As long as you can afford to lose all that money tomorrow, then you have nothing to worry about. But that was a classic, great move. And by the way, if you are a Golden Platinum student, I highly recommend go watch the last 15 minutes of TIGR when we traded and see how that worked out. It just basically did exactly the way I said it was gonna do on the overnighter. So that was awesome. Couple of other stocks, SIG, S-I-G. I'm spelling wrong. S-I-I-S-I-G, duh, okay. So that one also, great pop, stock from for $5 to $15. Then it picked up again, another really nice move right there. You can see it, there we go, springing it back. And that stock basically made a move in the middle of the day. It got halted a couple of times. But ISIG was also a really nice move yesterday. CPI-X, another one that moved really nice. Once again, all middle of the day. So we trade the first hour and the last hour, but some of these stocks did have some nice pushes and they did, some of you guys can only show up in the middle of the day. Maybe you're taking a lunch break. Maybe it's not a full-time job. But yeah, this is, you probably have a full-time job and says, only trade a certain time during the day. Obviously we do have some stocks that do move and those were some of them. What else we have here? We had the LCID. Now we know that one very, very well. That stock had a nice run from 25 up to 55. Stock took a huge hit, made a little bit of a bounce, came right back, dropped from 38 all the way to 45. Once we know this is also a level four stock, pretty volatile. And that pretty much does it. You know, that pretty much does it. But the TIGR was just a, it was a very slow mover and I just thought it was really cool because we traded in class. It was a lot of fun. All right, so what's moving this morning? So what we got moving in pre-market. So if you've been logged in early this morning and you've been part of the pre-market movers and you're part of Cyber Group and if you're on YouTube, Facebook Live, you're watching it, you can always friend us and like us, join us, do a trial, we'd have to lose, right? Get in the trading room. But this was one of the stocks that we found this morning. It moved really nice. Here it is, when we called it out, gonna put this in there because some of the people in there, just wanna post this up there. That was actually the time, was at 748. Let me just put that in there. This was that time. You can see it up there on the watch list. But at that time, at 48, it was right around here and you can see how the stock kind of made a nice move right there. Some of you logged in around 745. So you got in a little bit earlier, but it was a nice move. That stock's got a nice push. Just remember, we traded the stock before. The stock, if you remember, ran all the way to about $10 and came back down. So there is a fun short squeeze in the stock right here in SYTTA because there's only other way to explain it why it went up that high and came right back down. JZXN, another stock that gapped up really big. You could see this one here back in January. It was high all the way up to here. Let me just go back. I can't go back. All right, so the stock was an IPO. It was at $50, got hammered. Looks like it's going up a little bit. Decent volume, nice spread. Maybe it's starting on an uptrend. I don't know if that has something to do with the Dow, but you know what, I'm gonna put on the watch list. A-Bus, another one that we found early this morning too. That was on the watch list too. That stock kind of like flattened out all of a sudden. We know A-Bus very well. We've traded the stock in the past. If we traded a couple of days ago, we traded it back last year in July. Nice decent move, nice spread, nice tier sizes. Great volume, look, 5.5 million shares already traded. So that one we're gonna put on the day trading watch list. STRN, this is the one I found earlier. It's got resistance levels at six. Stock took a big hit, went down to three. If it breaks this resistance, it's in uncharted territories, which is great. It looks like it hit it twice already. Looks like we're having a double top. Let's see if we get a triple bottom. If it does it, the stock could break out, but keep an eye on level four in the stock. It's got great volume, great iceberg orders. And one of them, I'm just gonna put last on the list. I'm with the TSSS. I don't know, it had a good move this morning early. It had a big pop, not too early. Around, you can see it right around here. What is that, what time is that? Been a move right around there in 8.30, which is program trading time. It's kind of holding here. I just kind of like it, 26 million shares. I don't like to spread though. I don't like to spread. Look at, tier size is very thin, very light. So I'm gonna put this in the three category. But hopefully we have a good day. I mean, listen, we had a very fun day yesterday in phase three. I know you guys did pretty well in trading. Let's see how we can go, what we got going on here. And remember, a lot of these stocks, if you remember, I talked about this yesterday in class. And for some of you have been here for a while. A lot of these stocks on our wash list, sometimes they don't move. And all of a sudden, stocks are on a B list and a C list or something that shows up out of nowhere, finally just takes off. So we're always finding and shopping. And that's why we try to train what you guys want to do. It's all about working together like a team. All right, everybody. So let's get ready for class. For some of you are gonna be joining me. If you're not gonna be joining me, don't go anywhere.  And Rich will be coming back tomorrow. And by the way, today at 11 o'clock, just to let you know, if you didn't get the email, I will be hosting an event with May at Hedge Fund today. And there's gonna probably be about like seven speakers. I'm gonna be going on at 11 o'clock. So if you wanna come and join me, more than happy to. But great, great speakers there. Register, sign up. If you wanna ask, obviously you won't be able to watch them all, but if you wanted me to know who my recommendation, who you should and shouldn't, just look what your style of training are. But they're all pretty great speakers. So enjoy that too, today. Good luck, everyone. Happy trading. Everyone, YouTube, Facebook live. We'll see you back here at 2.30 for the afternoon meeting.


who is a veteran loafer and works for John Mitchell of Flat River Ranch and Kelly has a few projects on the side as well and we want to shine a bit of a light on our loavers. So Kelly tell us a little bit first how long you've been over here in the States lobing. Well I've roughly been in the States for about nine years I started off at ESMS vet clinic I worked there for about a year and then decided you know change things up a little bit and I actually ran into John and he was looking for somebody and I have been there ever since so I'm going on eight years now working for John and yeah it's been great. So that's actually a long time in the world of loafering because most the probably the majority young kids who get in and get out they you know switch around they not sure what they want to do and they have a you know have a go at loafering. Why have you been committed to this for this long? Well I think it came with I was a little older as well like when I started doing it a lot of people when they get into it you know their teenagers early 20s I'm sort of one of those people that once I get something on my mind and that's what I want to do I want to learn it that way and that's you know it's like I didn't want to switch around and you know I have a great rapport with John and Slate River and and it's one of those things that's like well I don't want to learn it any but any other way I want to do it that way and I also wanted to learn more about training horses as well not just the loping side of things so I wanted to stick with the one program and and that's and I've been sort of like that my whole life it's like well I'd rather than chop and change or something stick with it you know there's gonna be tough times and you've got to get through it but when you come out the other end it's like oh wow I learned something and you know it just makes you better so.  Well yeah and you know even my experience that I had at the vet clinic before I actually started with John and Slate River that in itself especially for an Australian but things are pretty for lack of a better term primitive when it comes to doctoring horses and stuff at home like that and pretty much you'd spray some purple spray on a cut and be done with it and I was like wrap a leg what do you mean wrap a leg I don't know what to do there so I I didn't have a lot of knowledge when it came to those kinds of things so being at ESMS taught me a lot and that that information there is just gold you know just that experience and having the knowledge of when the vet would come over and look at our horses like I'd know what was going on and and so I just have that inside knowledge of that was in itself you know pretty valuable and then you know also learning how to work with a trainer you learn you know what to do what not to do and then you end up being in a position where you get new people in where you can train them as well and it's less stress on the trainer them having to do all of that you know then that sort of falls on me now and I can train people the way John wants them trained so yeah it's it's I like being in a position I like to have the responsibility but like I said I think that sort of comes with being a little bit older as well and yeah it's not how can we convince you think more loafers to stay not longer and think of it as a career you know what that is tricky I think basically like they've got to realize times are gonna get tough and it's like that with any job like I was always told you know animals and kids are the hardest thing to work with you know like it's they can be unpredictable and it's definitely definitely that way in our industry things change the going gets tough you just got to tough through it like the only thing I that's only advice I can give is you just got to stick with that work work through it and get through the other end and you're going to have a great foundation like of and know the program and yeah it's it's hard to convince people of that you know it sometimes it looks like there's not a light at the end of the tunnel but there often is well and one thing I think that's obviously increased the challenge or the responsibility for you is that you've taken on management yeah yeah well you know it sort of came about I started with John at Slate River then John decided he was gonna go out and and train out of his own place and train for the public and that really opened up the door for me as far as opportunity like I had had prior management skills in other jobs I don't like I work for lawyers for seven years and I actually trained the new lawyers that came out of law school and then went into shopping shopping mall administration and managed the admin for that so I had management skills so it's something that I was like I really I craved you know having that management kind of role and so we went out to his place it was like well it opened up this whole world of like okay well then there's we have to build customers and we have to keep track of cow feed and we have to do all this so it's like I really took it on with open arms because it was something else for me to learn and it gave me more responsibility which you know in some cases some people don't want the responsibility but you know I took it as a like okay this is how I make this better you know what I mean and obviously pay more because I guess the one yes yeah that's it maybe the long hours yeah the long hours and that's what I always tell people like never sit down and work out what you get paid hourly because you'll never keep doing it and and that was for me to like I wanted to make a career out of it and so I that's I that's why I took it on the way I took it on it's like yeah I'll do the extra work you know I'd be in that office at 10 o'clock at night doing the bills at the end of the month but it was just like you know what it's worth it because this is I'm gonna be more valuable and you know it's like it opens the door for a pay rise and that kind of thing and it just and also for me too I knew what was going on around the place you know so if you know hear conversation something about this or that or the cow truck and when they're gonna be I know when it was gonna like I could answer that question for somebody and you know it's some people don't want to have that like I said but for me that was what that was a driving force it's like I want to be part of it I want to do the best I can and yeah I wanted I want to know everything inside out yeah well and you've obviously tackled that and now you've got another outlet okay so I'm at first I just thought I was completely insane coming up with this idea but I just had this this craving basically to like you know channel my creative energy somewhere and I actually it actually started out with I wanted to make leather handbags and do them all by hand and my brother he actually he has got his own leather business back home in Australia and when I grew up rodeoing at home and I actually made all my own shirts like that I just I wanted I wanted my shirts to look like they're the ones that were over here in America because we didn't really have a lot of that readily available to us in Australia and if you did go get them you'd pay a bunch of money for them so I was like I'm gonna start making my own shirts and my mom she was a seamstress and she was super creative as well and so I got her to help me and before I knew it I was like designing my own shirts and making my own patterns and stuff like that so I've always had that real creative deal going on and I got this wild hair and I bought some leather and well lo and behold I could never find the time to do it anyway one week I got so mad at myself because you know John's wife hope she knew I was gonna she's like you made a bag yet and couple of my other friends I'm like no I haven't it's really frustrating me so one week I got super mad at myself I'm like you have to finish a project by the end of the week so I had some I had the kangaroo leather I had the kangaroo lace because I think that was going to be part of my bags and I had some I ordered some freshwater pearls as well I had all these stuff sitting there and I'm just so hmm so I started you know tinkering around with it well the next thing I made a necklace there's this long tassel necklace with these pearls and I'm like huh that's pretty cool it didn't take me very long to do and that is honestly how this came about I'd had my I got my had my logo I had my my name and everything from a business Brumbi Goods and I had all that that was all in place but I just the product wasn't coming about so lucky didn't call it Brumbi handbags well it was going to be called that at one stage yeah it was but I just left it for a while I just left it Brumbi and then it just I'm like well I want to leave it open for maybe one day I will still get to those handbags so but for now it's it's evolved into jewelry and yeah it's so how long ago was that I started basically launched my business in February it's been in the works for probably oh my gosh three years now like it's been something I've been thinking about and and I've been you know gathering information and like stuff to make the products and but yeah February was when it all came about and that's when you launched your website no I actually just did it on social media Instagram is my main platform also Facebook I really use Instagram a lot though and then as as it evolved and got bigger it's like I had so many inquiries about do you have a website and I was actually I was going to go another route like with Etsy but it was a lot of work and I was like you know what just bite the bullet so I got Jordan Snyder she helped me get my website up and going and yeah it's it's been great it's been a learning curve and it's yeah it's good enough for the moment like I've got it reeled into where I can I can control you know what's going on as far as you know how much I make and all the rest of it and basically what I can handle for right now but I know like if I kind of let the rain loose a little bit it could it definitely could get up get quite a bit bigger and quite a lot yeah it's it's doing really good for me though so the website was very professional um your photography is very professional do you do that yourself yes yeah so I've dabbled in a little bit of photography um a lot of it just the horses and scenery and stuff like that and I was like you know what I can do this product photography is is quite difficult as I um but you know I just shadows and oh my gosh absolutely yeah all of that but once again I'm just like well just do a little research and see what you can find out and yeah I just have a little deal at my house and yeah I do a lot of it just in like a little photo briefing at home and then sometimes I'll venture outside and do some stuff out there but it's yeah so how do you get your ideas for your pieces usually when I'm loping yeah like it's yeah you know I started when I was loping around um because every morning we usually start an hour before John does so between saddling horse and just getting set up and stuff and I jump on that first horse and that was always a horse I'd have the most time on so I started listening to um like books on tape and stuff like just and they you know educational motivational all that and um just to you know get the mind right and keep learning um so like I always like it's it's a matter of the you know when you're loping around utilize that time as well to I don't know whether and you know sometimes I would listen to Joyce Myers um you know just take that time instead of just you know not thinking about anything thinking about something so it's turned into me now I actually don't listen to my books on tape as much anymore I actually aren't constantly thinking about Romby and what's next and you know that kind of stuff so and I stay tapped into the western world like the western industry a lot you know um the rodeo world and especially you know the cutting world and and also my my roots from home as well like I like to try and keep that spin on it as well so that's your style that you like yeah yeah and I yeah definitely um I've sort of I've ventured into a little turquoise and things like that as well here lately because you know I did I did grow up rodeoing so I've kind of got that little that little piece in me as well and I like to you know sort of dabble in that sort of stuff as well but you know I wanted to use the the kangaroo leather not only for its durability and um yeah it's just it's just a great product but you know it's something that ties me to home as well it's kangaroo leather you know it's yeah so Brumbie was just something I it just it just came up like just like I'm here in here in America I'm an Australian I really want something that that sort of ties me to home as well and but also it's you know something that explains me a little bit as well well then I was just like well a Brumbie you know it's still it's a horse um little wild free spirited kind of you know that's kind of where where I went with it and um and a lot of people know what a Brumbie is from me I'm from Snowy River some people don't but I kind of I did deal on Instagram Facebook just explaining you know what Brumbie and um yeah it just seemed like the right the right name and it's yeah it's pretty catchy so you work with leather you've obviously got some pearls um turquoise turquoise um you know what I've just started um like with like copper wire and stuff I've just started playing around with that and that's kind of fun so I've got some stuff coming there that's sort of some new stuff um a lot of beaded beaded necklaces um I love working with beads there they're really fun you know there's so many and part of the fun of it is sourcing the product to to you where do you find it a lot of it actually Etsy um it's a really good that I have a great connection um the bead barn in mineral wells she's been fantastic it's funny I knew um her name's Amber and she actually worked at the dry cleaners in mineral wells and that's how I met her um and then on Facebook I saw that she'd opened up a bead shop in mineral wells and yeah we've we're actually had a lot of fun together just like I'll you know call her I'll be like hey I'm looking for this and she'll like I'm on it and she'll she's she's got the contacts to track it down for me so now you're you're wearing um a necklace yes yes yep um there's some floating pearls I do this with um some silver on as well um I glue the pearls in the place on on the leather so they so they don't move they stay spaced evenly the earrings um super light and a lot of this stuff I had in mind for the working girl and the girl who rides like I'm kind of this was this was my original idea behind doing these it's something that was still feminine but it was easy to wear um and same with the earrings you don't have to look like a loafer you can still look nice exactly that's it it's just like I still want to look feminine um and you know some some of my some of the beaded stuff like I'll even myself I'll just be like oh it's too heavy on my neck whereas you know this stuff is super easy um the leather is so durable um and earrings like I would always just wear tiny just tiny little earrings that can stand something big in my ears but when I made these like you don't even know you're wearing them and that's what I love about them so so the fashionable and functional yes yeah and then of course I ventured out into some longer stuff and stuff with pendants and tassels and stuff like that but yeah this stuff originally started off like with you know having a shirt in mind wearing it with the shirt and it being comfortable to wear yeah so you got a range of things what about other is it mainly necklaces necklaces earrings um I do bracelets as well a lot of beaded bracelets I also do the kangaroo leather and the pearl bracelets with like a snap on them um all my um my leather like leather chokers and stuff like that they actually tie at the back so it's you can size them so a lot of people like to you know wear them as a choker have them a lot tighter other people like to wear them longer um so but they they fit fit everybody and yeah and how many kind of styles or designs do you have a bunch it's amazing like because even I've sort of started getting some different color pearls and things now and that's really fun and then once you like I can I'll just sit there at night time and I can I'm just like oh cool this will look great together and yeah so who are your customers you know what I shipped to Australia I um I have been shipping to Colorado Florida all kinds of places here lately it's been really fun instagram is fantastic for that and people they love how personable it is well you know they can shoot me a private message and be like hey I've got this in mind so your custom custom make something yeah for sure that's really fun actually I enjoy doing that and working with people on that and everyone's been great so far they're kind of like this is kind of what I want but you know just put your like put your spin on it like yeah it's that's a lot of fun now that you've got this creative outlet what does that do for you overall that um you know in your in your job as a loper and a manager how is it how are you feeling now as opposed to 12 months ago you know it's just giving me something for myself um that's what I like about you know I'm accountable I'm just it's all me you know if I if I haven't made a necklace that night and I wake up the next morning it's like oh you should have done that but I've got no one I've got no one to be like Kelly why haven't you done that you know it's it just gives me something to be you know not that like in my job you know it's very rewarding um there can be times where it's not rewarding as well and it's you know it definitely is you know it's it's hard work and you know something doesn't go the way it's supposed to it's just like for me I really do wear my heart on my sleeve and if something doesn't go the way it's supposed to I it'll stick with me for a day or two I don't let it go it's not like oh well we'll get it next time it's like oh like I really I'm quite hard on myself um so it's with this it's kind of it's making something it's being creative and I love to be able to make something look at it and be like you know what I just made that how does it feel when you see people walking around oh that just it's fantastic you know and I always tell people like there's a little quote it's something about you know jewelry is like like a spice you know just adds to what's already there and you know you've got all these beautiful people around and you know they wear one of my necklaces and it's yeah it's very satisfying yeah so would you offer any advice to other lopers to find an outlet whether it be creative or whether it be just something else that they might have a passion for to help keep them in the industry absolutely like I was saying you know like even you know listening to my audible in the morning and stuff like that you know find something else to kind of kick you along and give you something to look forward to yeah there's plenty of avenues like you just got to this industry itself there are so many successful people and it can be so motivating to just talk to some of the people without an industry because they are smart they're like I said they're successful they're there's so much knowledge to gain from just talking to people within our cutting-horse industry it's it's fantastic and it's very inspiring mm-hmm yep so what long-term what do you think your plans are with ramby goods you know what I I would like to say I hope I'm famous one day and I joke around about it with John and John's like you're gonna have to you're gonna have to hire somebody to help you and I hope that's a problem I have one day I really do I hope I would like to build it to where I do need some help and for me you know like having a booth maybe like somewhere like the NFL would just be the ultimate you know I'm at this point like having a storefront isn't something I kind of I kind of want right now no I like the online store and it works good for me right now you never know you just you never say never basically but yeah if it's to a point where it's I can you know hit some yeah like the NFL or something like that that would be that would be pretty rewarding yeah well best of all your real asset to the industry thank you joining us today thank you very much


out of ground already about the outcome of this one. Nine to the raise. When it included an Aaron Boone ejection. So let's hear from the manager. Now the manager's report brought to you by Geico Aaron. What what set you off? Was it the generous strikes owner? Was it more than that? Yeah, you know, I just yeah, I just, you know, thought some things, you know, express some things and got run. So I wanted to just get my point across. You know, I thought there were some close pitches, but, you know, the but the raise out played us today's. What was your point? What were you trying to get across? Well, I just had I just had some disagreements throughout the day with them and and and got run. Obviously, when I went out to the mound and probably said some things that can't get away with and and so that's about it. That's about the gist of it. It seemed like to right handed batters in particular down in a way he called a lot of strikes off the plate. Just how much does that affect you as a hitter in the box when the strike zone is somewhat? Yeah, I mean, look, I thought it definitely didn't go our way today, but that's all part of it. And and you know, you know, we still had some chances there and, you know, didn't get it done today. And with Garrett, he didn't necessarily look like himself out there. What were you seeing from him? I thought stuff wise. I thought he came out throwing the ball really well. You know, I thought there were some close pitches that did not go his way that, you know, even on some of the a couple of the walks, you know, Meadows Meadows hit a change up got on it good and obviously hit that ball well. But, you know, definitely some things that didn't go his way in the inning where, you know, he gave up a few runs, you know, that I thought close to going the other way. Who else Dave Lennon? Go ahead. Hey, with that Kermire play at first base, I guess baseline situations aren't reviewable, right? No, yeah. The only thing I was just checking to see if if we're going to review on the tag and then I just wanted to get some clarification on, you know, obviously the three foot and you know, I actually I felt like it was within, you know, he was within his his rights and didn't avoid too much. It was probably the right call. Okay. And then just as a series as a whole, I mean, how do you kind of look at it with today? Does it look like kind of a missed opportunity for you guys? You just have to kind of go with the split and move into another big series weekend.   So that stings and frustrating that we didn't go out and get it done today. But you also got to you got to get past it right now and know that we got a big one starting this weekend.