All right, I think we'll get started so today we have the pleasure of having Ian Greg from CSRT here and If you if you know anything about SSL You probably know that SSL is a little bit of an elaborate scam to Which consists of taking people's money and selling them numbers Right now to be fair the the certificate authorities do some verifications Of your identity when you buy an SSL cert Or so we thought before the EFF released the findings from their SSL observatory Where they found for example that quite a few people around the world have a valid cert for <IP_ADDRESS> So maybe it's not all that great But anyways CSRT is a grassroots Response to the SSL cert business now CSRT believes that anybody should be able to afford SSL certificates Not just people who happen to live in rich countries that can afford to buy expensive numbers So anyways, that's a little bit of my rant that Please help me welcome Ian Greg Thanks, and it's good to be here This is nominally supposed to be an assurer training event and a training event for assurers Which we're going to do in the next session. The next session was too short for that event So we've sliced out some parts and put it into this session Which means this session is more like an open introduction. It's talking about things that General and that means I'm going to talk about stuff that I'm interested in If you want to hear something then you probably need to stick up your hands and ask I'd like to say thanks to Francois for this and also a big thanks to the the Linux people for actually having managed to get their disaster recovery plan to work I Would ask did they have a disaster recovery plan beforehand or did they invent it on the fly? Either way they got there. That's me. I am Ian Greg Commonly known as Ian G. I'm on various teams But the most important ones that we're talking about today assurance order and board This is a rough agenda for this part two things I would like to talk about SSL everywhere and Client certificates and then finally a bit about CA cert and where we fit into things and then the later Afternoon session is this assurer training event which starts out with CA cert and how it got affected by the audit process and Then goes on to the assurance side what you as an assurer need to know And we won't cover that area this time, but it'll be in the next session. How many people here are actually assurers About one how many people know about CA cert and are part of it? Okay. Oh, that's not bad. That's not bad. Okay So this talk here As you can see I've cobbled these slides together from a different set of areas. Oh Wrong one Okay, SSL everywhere. I just put this together in the half hour or so before this so it's the first time it's ever been seen What are we trying to do with SSL certificates We're trying to get SSL to protect stuff But what tended to happen over the last ten years it started in 2001 actually by 2003 it was proven and that's this thing called phishing While phishing was arising and other things started happening lots of breaches and so forth The response to this to my mind Consists of three things that we can do HTTPS everywhere is a new label which is being brought out by the EFF people Client certificates are something that can help there and so can CA cert. So that's what these The first thing I would talk about is this HTTPS everywhere thing What went wrong? This is the very much the helicopter view. This is not the technical view In phishing the attacker manages to convince Alice to go to the wrong website How he does that is another issue, but he's actually managed to do that. So let's start from that point at that point The browser is supposed to tell Alice that she's on the wrong website or she's on the right website or whatever She the browser is supposed to tell her that but the browser didn't tell her that so what went wrong? Well, it turns out that there's a big problem with the browser it runs two protocols HTTPS and HTTPS HTTPS the basic clear tech stuff doesn't say anything at all. It doesn't warn it doesn't do security at that level at all and Also HTTPS doesn't really say enough to be able to stop this happening Why is all this well we can look back in history and it's a lot of history. We're going back to 1994 when the web really started up Netscape was the big thing at the time And there were a set of browser wars going on firstly with mosaic and then moving on to Microsoft coming in a lot of stuff was going on then One of the responses was the SSL Development which had problems right from the start because they adopted a threat model which is probably inappropriate for various reasons All of this got caught up in a real estate war on the browser You've probably come across the padlock. How many people here know that the padlock is going to disappear a Few yes after 15 years the padlock is now deprecated in Mozilla Things are moving on then there's the whole CA business how the CA started up is an interesting story in itself The PKI concept is part of it special interests. We've all heard of the conspiracy theories. No doubt and and and and and and If you go into the history you end up getting the feeling that too much was going on and you really can't unravel Why SSL and browsers are as they are But we can look at the market and we can say what's going on here. Well, it's quite simple HTTP is overused. It's used everywhere for almost everything and HTTPS isn't used that much at all It's literally underused and now we can From our helicopter Look at the result of this and that is if all of the traffic more or less statistically speaking or 99% Or however you measure it if that's all HTTPS And if a tiny portion of the traffic is HTTPS, that's the protector stuff Then the attack will always be the same. It will be to downgrade from HTTPS To HTTPS and that's what phishing is it simply downgrades from one method to the other And the other just happens to have no warnings So to address that what we need is more HTTPS. We need more security more SSL At the least what we want is a whole lot more instead of 1% We want something like 10% and at 10% things start to happen people start to respond people to start to learn about it So why didn't that happen? Why don't we have HTTPS everywhere? It was originally meant to be everywhere But when it first came out speed was an issue as soon as you turned on HTTPS You lost about a factor of 10 on performance, but that was back in 1995 Now in 2010 we've got laptops that are fast. We've got servers that are fast Most of them are sitting there doing nothing the effect of switching to HTTPS is not very strong So we don't have to worry about speed anymore another factor was that there was a bug in SSL Now I say it's a bug although nobody much agrees with me The problem was that you need one IP number for one SSL connection to one site Which became a problem because fairly soon after the website started up everybody went to virtual hosting Across one IP number which worked fine, but you couldn't do it with SSL all of your Apache HTTPS and so forth are all set up to run multiple websites over one IP number and they can't do SSL over that There is now however a fix for this bug It's called TLSS and I SNI is server name indication. It's in HDPD Apache now Question is has it got to the Linux distros? I'm not quite sure on that The third reason is that certs are complicated and expensive you had to buy them and when you did buy them They were messy to install. They weren't like other things. They weren't like good start-up situations Where you download the software you get it up and going and away you go So it's a complicated and this is where CSR comes in. We try to deliver free certs That's one of those two issues there sold Now what can you do right now? I'm conscious of the fact that I'm speaking to the Linux community Linux run just about all the web servers in the world by statistical basis Because you're all doing virtual servers You can all make a big difference by looking for this TLSS and I server name indication patch It's shipping in the HDPD. I'm not sure how many does anybody know how many distros are actually shipping with TLSS and SNI yet Nobody how can you tell I don't know The bug got fixed or it got distributed out of HDPD about one to two years ago It was ten years coming that particular bug Okay, what you can do is look for that Get it running on your Linux servers Switch all of your virtual servers across to SSL across using sharing your one IP number And that way we build up the number of SSL websites Why am I saying this? The thing is that we're missing out on a whole lot of security because we have so few HDPS websites The downgrade attack is very easy. Nobody notices when The attacker manages to switch you across to HDPD The solution to that is to get more HDPS more SSL out there Once we've got more people out there more SSL out there people get more Familiar with it and it also puts more pressure on the browser people to work on the user interface There are a lot of good user interface ideas out there, but unfortunately They've all been downgraded because not many people are using SSL The browsers are not that interested in this problem The other thing is that It isn't going to affect that this change isn't going to come through From the big institutions the banks and so forth which care about SSL and so forth aren't going to do anything about it What's going to happen is once the TLSS and I Starts to filter through once the grassroots Linux people can start to do Virtual SSL sites the experience will build up and the demand will build up from in from the lower side And then that experience will bounce up will move up the tree to the high end areas such as the banks that do need the protection Okay, that's my if you like my personal rant on why we need more HDPS Does anybody want to challenge me on that? Yeah Does it require? Yes, yes, but all the browsers have supported it for years I mean, I think there's like one browser in one version that doesn't support it or something like that Sorry Ie six doesn't yeah. Yeah It's always this check and a neg problem. Yeah, there's always some laggard But as far as the browser world is concerned, we're waiting for Apache I'm not sure whether Ie has it, but I guess that's not interesting to this audience, right Yes I Think because the browsers have it once Apache once the Apache website start to use it The push will come through that way if this was put up and done They probably wouldn't be able to see they wouldn't be able to understand the certificate. So they probably have to click through Yeah, and that's not a bad thing. Is it they should be upgrading? Okay? So what else can we do? We can do client certs Now this is kind of a self-interested thing because CA cert delivers client certs and it can do and there's no problems We come up to the other problems a bit later Client certificates are a funny beast They address an authentication problem Authentication this whole idea of knowing who you're dealing with it went through a whole bunch of phases Which I sort of put some numbers on there right in the beginning of the internet. This is probably pre-web times Everybody was using email and so forth and everybody was more or less trusted on the internet and that didn't last very long Then somebody came up with the idea of passwords and usernames and that went for a while Then the whole web thing started up and web once the web started up the internet became for the masses at that stage We got to the idea of single sign-on. This was the the stuff people were talking about in the late 1990s and then in the early 2000s people were talking about Federation and so forth this whole authentication thing goes on There's there's other things going on now What is it identica and open ID and things like that? What kind of went wrong well if you don't have something then there are too many people on the net and Some of those people are entrusted passwords have a problem with complexity if you've got too many sites and You've got people crunching passwords. You need passwords, which are too long So you've got this end times end problem and then once that happens once you've got each person having too many too much complex passwords you get into this security and support problem too many people losing their passwords The problem with SSO and Federation was more or less this situation of technology versus sites Everybody had to have a method every site had to have a method and you ended up with a lack of a wide spread adoption There was also the issue with who's got your data It was a bit scary because a lot of people were talking about Federation from the point of view of One trusted party looking after your data, but who really believes that? and even the Businesses were starting to get a little bit scared about that because they were seeing their customer data Lent out to other people and that's something that does scare businesses Businesses do care about privacy as long as they're in control. They're very happy But if somebody else has got their customer data, that's the worst thing that can happen to them So the thing is why don't we have computers and technologies and protocols to do this? Well, we already do it's called client certificates and if you look at it from a sort of Information-theoretic point of view public private keys are like extremely complicated passwords which are tied one for one with big numbers they are and From a technical point of view they can replace passwords quite easily There's another great advantage to them every browser and every web server has this code in Unlike some of the other technologies that we've talked We've heard about all of these buzzwords that you hear about This stuff is already in there. It's been in there for a long time. So why didn't they work out? Well, it wasn't because of the software It wasn't so much because the data was at risk or the customers were at risk it was again this chicken and egg problem every person needed a certificate and every site needed to switch on the certificate the client certificate access Which meant that every site would look at the people who had client certificates and almost nobody has them and Every user would look at client certificates and say oh, but none of the sites require it. You've got this chicken and egg problem Yeah Because there wasn't enough demand for the product the browser programmers weren't putting enough effort into the working of the software and the end result is that the Interfaces are quite buggy. There's a lot of difficulties there So this is kind of a story about how CA sir got into the business of solving this accidentally Certificates, they're supposed to be about identity and they're supposed to be about assurance they're supposed to mean something and the way the CA business has evolved not through Grand thought or strategy, but through accidental circumstances CA's check your identity and Then they can issue a certificate now We ended up in CA sir with something like at the time 10,000 assurers around the world mostly concentrated in Europe CA sir Just as a digression which comes in a bit later. I guess see a sir. It was started in Australia However, it wasn't particularly successful in Australia in terms of numbers initially It was quite successful, but it moved to Europe and we have a very strong base in Europe These these assurers that are all all the way around the world Needed to be audited they needed an audit said they needed to be tested They needed to be to meet a minimum standard So what happened was we at CA sir sat down and thought about this and said, okay We'll create an online test. We'll do a simple basic test, which we called CSR automatic testing system and we said, okay a Bunch of multiple choice questions every assurer must go through this We're talking about 10,000 people there And at that point we also had an inspiration. How do we know who is an assurer and whether you are an assurer? Well, we said, okay. You've got to have a client certificate from CA cert Why did we do that? Well a bunch of reasons could be put forward because we're a CA It's so cool to do so We wanted our assurers to know about certs client certs. Yeah, that's a good reason Actually we kind of did it because we had the feeling that this was the way to go The cat system only accepts client certificates You can't get into there with usernames of passwords and so forth So as an assurer, you've got to go get your client certificate go into cats Do your 25 multiple choice questions and then you can pass the challenge and be an assurer It worked it worked it went live in early 2008 It was obligatory in 2009 which meant that you couldn't be an assurer without this when it started We had 10,000 or so of these assurers and immediately it dropped down to zero By the fact that nobody had done the challenge very quickly it came up into the low hundreds and Climbed and climbed today or as of last night. I checked it. It's 4,136 that's people around the world who've connected in and passed their assurance challenge and The thing there is that the end result is we are a lot stronger because we have this test or this Objective test of what these people can do what they know and so forth So it worked out as a big process for us, but it also meant they all know about client certificates They all have a client certificate. We now can make the statement every one of our assurers has a client certificate Which means that We can now move across to all of our websites and that's what we've been doing and turn them all onto client certificate Access we can throw away with usernames and passwords and this is what we've been doing We've migrated so far the WordPress the Simpa the mailing lists a voting tool There's a bunch of other things such as Surveys and testing It's it's basically something that's on the sys admin work list and has been for the last year or two to move every system across to client cert Results now what is this meant for the blog? It's fairly it's fairly clear If you've got a certificate you can get right access to our blog You don't need to ask anybody You don't need to get permission. We've got a blog that speaks out to this entire community there And we don't have to worry about spam because to be a spammer You'd have to go and join the association join the community get your client certificate and then start accessing the the blog It's too much work for a spammer and So consequently we've now got a situation where we've lost We don't worry about lost accounts anymore. People just go and get another client certificate We don't have to worry about passwords being lost. So our administrator who's Generally bogged down doing this sort of administration is now doing other things. It's released that person on to other work and there's also no more arguments about who is Allowed to access the blog who's allowed to write a post who's allowed to speak to the user community everybody's allowed everybody can get into our blog and write a post and it's a fairly Middle-ranking reasonably ranked blog with a lot of links So we end up having a lot more authors and a lot more users writing their posts This has been sort of duplicated across the other sites where we've used client certificates Once you get over the hump of getting everybody to have client certificates You get more productivity But there are a bunch of gotchas a bunch of problems firstly as the gentleman down the the bottom here said there are problems the Firefox for example gets confused about multiple certificates. So if you've got two three four five certificates in your web browser Firefox isn't so good at deciding which certificate to use in which place and basically what we're doing here is we're waiting for the guys over in The Firefox team to add weight this thing to add an ability to record which certificate goes to which Which place that's that's one issue the second issue is that you get a bunch of crazy messages and The root of this is if the Apache is somewhat misconfigured and that's a very broad term and It doesn't like your certificate for some reason or other it will treat it as a security problem and dump the SSL connection So what then happens is the browser sees an SSL protocol error Instead of saying oh your certificate isn't quite right We need you to go and get it renewed or you need a certificate from another vendor or something like that it gives the user a protocol error and The user really isn't equipped to be able to deal with any of these random errors which are popped up This is just an artifact having looked at both sides of the argument It's an artifact of not enough demand for the product once client certificates are in more you widespread use and once People have had more arguments the developers on both sides will get together and start agreeing How to deal with these strange client certificates? We just need more user complaints. That's my view there There's The next thing is how do you actually use these things? There's several strategies You might find yourself using passwords and client certificates as well and this is going to happen if your user base is already using Passwords and you're adding client certificates The problem with this is a bit too much like the existing problems with HTTP You've got an attack between the gap You've got a downgrade if you like a downgrade attack if you've got multiple methods. You will always have problems Also, you're always coding around the edge You're always trying to code around the best way to move between passwords and client certificates It's more work. So you're better off going for client certificates only Why as it says there only do that if you have to For example, the CA cert main website does take passwords because everybody's got a password We won't be able to switch that off for a long time The second strategy is to only use client certs That's the only way you do it and this in this in essence amounts to outsourcing your password problem to the CA client certificate vendor now Here we find a bunch of questions firstly Apache There's several ways to do this you can do you can do the processing within Apache using the various config files and so forth the problem with Apache is that it's got quite a Complicated way of arranging its client certificates and this is mingled in with a complicated way of dealing with its Directories and various other permissions. So the end result is Apache does like too little or too much. It's it's always a bit messy The alternative is to put all of the processing in your application and This is good. If you've got control of your application, which is to say if you're doing your PHP programming Then you can do all the processing yourself to be able to deal with it. So what you do is you turn your Apache into transparent mode, which is easy enough. It just ships the information up from Apache as the client certificate comes in you get this bunch of variables telling you precisely what the client certificate is about and Then in PHP or whatever language it is you can read off this information and make your assessment That works out to be better because there you can get much more control about what you're doing You've just got to write some code if you're installing some of their application however, like one of the ones straight off the web it's it's a bit harder because That's already written The third gotcha is that certificates can and do change every year or two people get a new cert And this is where it becomes very valuable to do your own coding with client certificates You can read the certificate straight into a database. That's a good idea Once you've got that certificate you extract out the information you need which is primarily the username and the email address and As the new certificates come in The first time you see a certificate. It's unfamiliar. It's not found in your database of certificates But you can match on the name you can match on the email address Now as long as the person carries on using the same name the same email address You have essentially a capability to swap from client certificate to client certificate and it becomes a fairly seamless painless user experience If the user goes and changes their name or their email address or both Then you needed a bit more thinking a bit more intervention at the sysadmin level Just to conclude that client certificates do work and they do work very well We've been using them for a couple years. They've solved a lot of problems They reduce the complexity they Save us a lot of administration headaches There are the methods. Yes, there's open ID client certificates using SSL are a higher security solution The problem with other solutions such as open ID. There's also Open or visit Etc. Etc.  We simply told them, okay from now on You're all part of co-cert as a system administrator You get your certificate and then in you go into the various applications You can do that if it's small If you start off with a new site Then you can use the certificates to pull people in that's helpful or alternatively you can build a an internal factory CA which distributes the certificates straight out of the website to the users That's the end of that Okay question Why can't we use it? So how do you deal with? Portability if you do use client certs as as your author method for your site Like how do you log in from someone else's browser or an internet cafe or whatever when you're not using your laptop You can't really do that Client certificates are for the user who's basically using their own machine And their own browser. I Have a little bit of a difficulty wondering how you can secure access in a net cafe when somebody else owns the machine and Theoretically cleans it up. So I it's one of these areas where it's kind of difficult. Can you really make that work? I don't know, but yes portability is not a not a good answer Yes Yes We will see this issue In the future as more and more smartphones get more and more browsers Using that sort of access material To an extent we spent the last ten years Securing our laptops and now we're going to start the whole game again with smartphones And smartphones are going to be hit by viruses and various other problems And they're going to be a way behind the laptops or the desktops. So It's an ongoing issue You can kind of see it as a battle of attacker versus defender third part of this Has disappeared Bear with me while I go searching for the third part of this talk Which is one of your other proposed solutions It's a total mess because everybody's got their own protocol It It could be To be honest, I don't know very much about open ID I think on their own admission they indicate that it's a fairly Medium-to-low security solution. It's more a single sign-on Thing which gets you up and going which is good, which is good there is a System called identica. I think it's called which converts certificates into open ID Which allows you to use your certificate? go to Set up your open ID Hooks or however it works and then you can go and use any open ID system Yes, yes Which is a good hybrid. There's nothing wrong with that. Does CSR offer that? It's interesting. It's already there. Identica is is doing it And and CSR it's got a little bit of a dilemma there because as soon as we start talking about it people will say Oh CSR approves of this and we don't know who is doing it. We don't know the people behind identica we tried to find out but They're not responding So we're trying to be quiet about it because we just don't want to scare anybody away There's a few around. Yeah So That's our experience. We ask people and they say not us Okay, here we go Finally CSR now you're all most of the people here and use the CSR And we don't have a good presentation for that sort of thing, but this is what I've cobbled up CSR is a certificate authority certification authority Now the problem with these beasts is that they have all this power to issue certificates to people and Supposedly these certificates are good for something supposedly we can rely on the certificates, which means they're kind of scary and The way the browser world has responded to this this kind of scary situation is that they require every CA to get audited CA cert has not got an audit. So it's not currently in any of the browsers so consequently Back in 2005 they start at the process of getting audited And the last five years have been the history of CA cert getting audited and it has been a five-year story So a lot of our documentation starts from that point Who we are we are a community CA which is to say you join you're in the community We are all volunteers We have as I mentioned four thousand plus plus assures people are checking the various identity aspects Strongly based in Europe, especially Germany a lot of people over 800 in the USA and a smattering across South America And a few across all the various other places. It started in Sydney to do with wireless networking in Sydney and Quickly spread across Australia and then out to the rest of the world However, we have the problem that we're very under represented in Australia our association which runs the Which is if you like the executive part Has something like three Australian members amongst 60 worldwide members and we need Australian membership hence. I'm here also Banging the drum to try and build up our Australian membership To get a bit more balance into the The whole community We are challenged by this audit process We have to get the audit to get into the browsers and this has caused a Big lot of changes a lump of changes across the way it works The first audit went into high gear in 2009 It hit an immediate difficulty in the the executive the board and the various managers Didn't have the capacity to respond to the auditors requests now when I say that I'm being a little bit deceptive I was the auditor and I requested various things from co-cert and they weren't able to respond The the deeper reason was that the community itself had been Encouraged by previous boards and presidents and so forth to not worry about things to be patient and Wait because somebody's doing the audit and this didn't really work out because everybody sat in their arses and did nothing So consequently we've been going through a big Rethinking process of trying to push all the work out from the center Which wasn't doing anything out to the community which are capable of doing things. We have a very big community We have a lot of good people and if we can bring them in and start working on these various issues We can get them done So the last year two years was about getting that message out and we've more or less done that So I need to update these slides The community has the capacity for doing the audit So that's part one change the message to build up the capacity This is what we have been doing and I'm going to run through the list of teams here these slides are more or less internal marketing and Five engage the auditor for the next two audits All right, let's let's talk about co-cert from the vertical point of view Which is to say if you're at the side you can see three vertical areas In a business sense. We have these areas one is the assurance and this is in PKI terms It's the registration authority. They call it of the RA and this is the 4,000 assurers that are out there across the world doing these verifications and There's the systems and this is the classical certification authority. It just issues the certificates According to the information that comes from the previous group the assurance and then there's the community which is the larger body And these are the people who have certificates who rely on certificates If you join CA cert as a community member, you will be part of the community That group is estimated about 20,000 people We don't have hard numbers on that because it's too easy to create an account and get a certificate Consequently, we have something like I think it's a hundred thousand accounts And most of them haven't been touched for a long time my estimate there is about 20,000 people in the community So in terms of the teams we have a group of people doing business operations And these are essentially the sort of managerial functions you will see In your workplace that aren't technical a Big group doing policy we have something like 20 people monitoring the policy groups to create the documentation And I'll just say a little bit about that CA sir is different to most open source organizations. I suspect we're kind of unique I only know one organization that comes close and that is because we are required to get an audit We are required to have business like processes specifically audit works like this it's We do what we say and we say what we do That's a kind of mantra that comes from the audit world. We do what we say and we say what we do Which means we have to say everything that we're doing Which means we need documentation and serious documentation that can be tested and this is kind of novel But in most of the open-source world the code is the documentation the code tells you what's going to happen And people just dive in and change the code Where they where they want to where they can So see a cert has had to take all of its processes and dump them into documentation And this has been a four-year effort, which is now complete Then there's teams for the assurance side We have an events team which runs around does these ATEs So today I'm here as part of the events team doing this particular event There is an education team which prepares the challenges That's the the assure a challenge. We also have a support challenge coming up and Various other initiatives around the place. We have organization insurers There's about 10 or 15 organization insurers and that's to really deal with companies and so forth dispute resolution is something that is a Newer area for co-cert We have something like 10 arbitrators around the world listed who can rule on the various disputes I'll say a bit more about that. They're supported by case managers Those were all business aspects which are fairly standard across business and now we get to the technical side in the technical side We've got teams for triage and support engineers Software is a little bit of a black mark for us, but we do have now a good testing team We have development of the PHP code and we also have software assessment And these are controlled areas For systems administration We have several groups doing this So the takeaway from all that is we have a lot of teams But all of those teams have something in common these days and that is you need a little bit of familiarity with co-cert so You need to have spent a little bit of time You need to be an assurer these days That's because we require a certain amount of reliability Which then gets fed up to the audit process? an Assurer the the role of assurer is where we can put that Stake we can put that label on saying this person's reliable Everybody tends to help with recruiting and training But more than other organizations We also need a little bit of attention to detail and the detail here is we have a bunch of policies And you have to follow them we have practices and when things go wrong We have a formal process for resolving issues, which is to say we have a thing called arbitration which allows us to resolve difficulties in a quasi legal fashion Okay, so now I'm just going to run through the various teams that are out there Senior assurers help and run these ATEs. That's what I'm going to be doing this afternoon And basically help around the place Blah blah blah blah Okay, not to worry about that. Okay policy group policy group is very interesting because it's open But we set firm rules we create policies and the policies are Written and approved through a democratic or voting process. They then become binding on every member of the community So if you've joined if you've just signed up at the website You may suddenly find that you're bound by certain documents and these documents are created in an open web in an open mail list So anybody can join and practice this part and to an extent the policy group is like our legislature It's like our parliament Organization assurers. They're basically just very good with assurance and they know more about companies and so forth Arbitrators another big difference with co-cert, which I will cover in some depth in the ATE process of the ATE section later on We have a formal method of resolving disputes and I'll just say a little bit about that Certificates are supposed to be important They're supposed to secure things. They're supposed to be reliable We are supposed to be able to use these certificates for all sorts of important things like online banking like security and so forth What happens if something goes wrong? If something goes wrong, somebody's out of money somebody's out of pocket some damage is done How do we resolve that situation? The classical answer is you go to the courts and you sue somebody Now see I said for one reason or another which I kind of get into in the next section Has chosen to not go to the courts instead. It's brought it all in and created its own arbitration forum, which is to say its own legal way of resolving disputes Based on a thing called the arbitration Act in every country So we have something like 10 people around the world who are listed as arbitrators They will hear a case and deliver a ruling which is legally binding and which can if it's done Well, and there's no problems with it. It can be taken into a court and respected by that court So that gives us an answer as to how we resolve disputes So these people are very important to us because they're actually Making changes to the way we work and they can do so in a quite solid legally binding fashion Case managers support the arbitrators Generally the way it's worked which wasn't intended the arbitrators will work in Buddy pairs one of them will be the case manager. The other will be the arbitrator the next case. They'll swap around Triage to support people they're the front line basically what they do is they see this the incoming support traffic and they quickly Direct it to one of several locations So they're able to dive into web apps and follow the staff and get a few and quickly directed a ground It's the starting place for a lot of things because it gives you a good familiarity with what's going on Which leads us to the critical roles Because we are dealing with privacy information and because we're dealing with these certificates Which are powerful and they're audited and so forth. We require people who have powerful access the route System administrators as it were in a conceptual sense to be checked out and Rolls that come under our security policy Require a background check which is called ABC. It's called that because the arbitrators run the background check They're an independent voice over the various recruiting activities of the team leader. The team leader has to propose somebody and The the board has to finally approve so Support engineers are put through this process because they do have the power to adjust people's accounts Software we have a situation with software. We have two bodies of software one of which is new and hardly started the other which is the old Running software and that's PHP requires a lot of patience to deal with it because it wasn't written in a good fashion to start off with To to support this we have a bunch of people working as testers and software assessors Infrastructure team these are the people who manage all the other systems not the CA itself access engineers are people located in the Netherlands in 80 which is a little town which has a very secure data center They will control system administrators going in there be present for every access and they are the physical liner protection Chris critical system administrators. These are your classic system administrators running the CA itself They always work with other people. There's always four eyes Audit team. I'll leave that See a certain corporated This is the association that owns the legal part of CSR. It's a New South Wales Association of members We've got about 60 people on the books. We're always adding more. It's very easy to get in There's not very much to do in CA cert Inc Unless you're on the board in which case there's a little bit to do It's the counterparty to every other person and that's the 20,000 active people around the world So it's quite important and it also acts as the final deciding point There's seven members normally on the committee We appoint various roles and we oversee things We also implement the policies which is is curious because we have outsourced the control of policies to somewhere else as An institution as an association. We are bound by a group of people that are outside the association So from a governance perspective, this is the helicopter view We actually have three heads of power three Central areas which are very powerful in and of themselves the policy group that open group can create binding policy The arbitration people can deliver the rulings in any dispute and they can knock policies down and the board is Supposed to implement those policies and also follow the arbitration rulings But the board itself also appoints people who are arbitrators So we end up with this three-legged stool Which actually mirrors the classical Western democracy thing of the legislature the judiciary and the executive And this has worked very well for us We've had a number of bun fights between these various groups and at the end of the day everybody said okay You've got your power. You can beat us on that point. We'll beat you on another point Let's all sit down and work it out None of these groups has been able to achieve supremacy So what are we up to? Building these teams the last annual report showed us something like 40 people who were consistently Permanently involved in the situation in CA cert And another message for our internal team, what can we do for the audit? Okay? that brings me to the end of that ad hoc description of CA cert and Questions web trust is the starting point for a lot of audit processes for browsers We are actually under a much fiercer regime called DRC for David Ross criteria. This is part of the next talk David Ross took the web trust audit criteria and rewrote it. He took their 25 points and expanded it out to 150 points and he also rejigged it completely and if you like web trust is focused to keeping the CA's in business and David Ross rewrote it such that it addressed the user's interests So it's a very different process. It more or less covers the entirety of web trust But a lot more as well and that extra part is what makes CEO cert different Yes, I mean that is basically our our strategy if you like we do issue those certificates to businesses They're of limited use because of the the problem with not being in the browsers We have been basically working to get into the browsers and get the audit process done for the last five years or so It's a lot of work. It's a lot more work than open source groups really Anticipate or understand so last question before the before the afternoon tea After that that you can come back and they'll be the sure training event Just gonna ask just from a very general perspective What does an assura actually do and is this next session intended that any of us become an assura? I just don't really Not really aware of what the next session entails entirely. Yeah What does an assura do and is the next session intended to make all of you assurers? It's a cautious. Yes in the sense that certainly please turn up learn how to be an assurer It's oriented towards people who are already assurers and need to upgrade their skills over the last few years worth of big changes But practically speaking you will find out what it takes to be an assura What and then to prejudge that or to predict that talk?  You have to help Verify the identity and a bunch of other points of each person you come across You created piece of paper Documentary evidence for that enter the points into the system and that way you add confidence to our web of trust In and our web of trust is intended to provide a statement over every member of the community Assurers collect the information for that if that makes sense From a totally non-official Point of view it's kind of like The GPG web of trust except that one big difference is that you download a form from the CSO website That's what you fill out and you keep that form for seven years. That's a main main difference Yeah, but is it is essentially the same thing like checking someone's passport kind of thing It's essentially the same steps. CSO has a formalized web of trust Whereas the GPG or PGP web of trust is casual informal And you'll find most people in CS are also part of the GPG and PGP communities So we'll see hopefully most of you after a break


Hmm looks like this will be a cool breeze get the hook up out Rayfield's mind what what are you doing? Jackie Wells my old pal from the hood see you haven't grown an ounce whiter Detective Sticks in a while, huh?   Give us a break, huh? Lock us up. I just took off till trial and then what? Worst case we get some months Standing room only nowadays in a lot there The proud be out early are these the thieves fall dirty trash Got them in custody mr. Fujioka will be taking them now. It's a waste of effort I have no time to testify or play it on investigation Suggesting we let him go sir. I suggest we toss them in the sea Catholic broken so this trash doesn't flow You heard him looks like this would be a cool breeze Familiar to come on spit it out. I'm waiting left for Atlanta looking for a slice of happiness Guess you didn't find it. I've always been tamed.  Lock us up.  Worst case We get some months Standing room only nowadays in a lot there proud be out early are these the thieves fall dirty trash Got them in custody mr. Fujioka will be taking them now. It's a waste of effort I have no time to testify or play it on investigation Suggesting we let him go sir.   Come on spit it out. I'm waiting left for Atlanta looking for a slice of happiness Yes, you didn't find it. I've always been tamed.  Give us a break, huh?   Worst case standing room only nowadays in a lot there proud be out early Are these the thieves? trash Got them in custody mr. Fujioka will be taking them now. It's a waste of effort I have no time to testify or play it on investigation Suggesting we let him go sir. I suggest you toss them in the sea Catholic broken so this trash doesn't flow looks like this will be a cool breeze In a while, huh?  It's familiar too. Come on spit it out. I'm waiting left for Atlanta Looking for a slice of happiness. Yes, you didn't find it.  Give us a break, huh?   Worst case standing room only nowadays in a lot there. They're proud be out early Are these the thieves? trash Got them in custody mr. Fujioka will be taking them now. It's a waste of effort I have no time to testify or play it on investigation Suggesting we let him go sir. I suggest you toss them in the sea Catholic broken so this trash doesn't flow you heard him


Hi everyone, Sean with jaspyscasebreaks.com here doing 2021 Panini Chronicles draft picks football four box break Random college football teams number four or six team spots Everyone gets five teams from the list below and all cards shit List below starts with Alabama Crimson Tide all the way down You can see all these teams on here to the Western Michigan of Barrancos and the alumni of Corey Davis and his brother who recently passed away Here is our list of customers from Anthony Venturino down to Ryan Redmond last spot mojo Let's copy this list and since every spot gets you five teams. We need to times this by five so two three Four So there should be 80 spots. We're just gonna randomize this one just to make sure that I have 80 entries on here See 80 and we're gonna go back and it'll put it back in the same exact order So you can see Anthony down to Ryan last spot mojo All the way down to Ryan last spot mojo and here are the teams Alabama all the way down to Western Michigan we're gonna randomize that one just to show that there's 80 spots as well And then we're gonna go back. You'll see Alabama on top Western Michigan on bottom So dice for to randomize both lists and pair both up three and a six nine times Ninth and final time Jose Rodriguez down to Microsinski nine times on the randomizer nine times on the dice and Now nine times on the teams to finnally finalize it nine the final time Tulane down to Boston College So nine times there So we're not gonna read through the full list, but We will Go through it slowly So there's the first 20 From Jose and Tulane down to Ryan Redman and the Purdue Boilermakers Here's the second 20 from Matthew Hedges in Ohio State down to Matthew Hedges and the Auburn Tigers Nick Coba and Texas A&M down to Mike Krasinski and Louisiana Rage and Cajuns and our final 20 Oliver Smith Penn State down to Mike Krasinski in the Boston College Eagles So that's the full list trade window is open Let me sort this by by customers so that everybody can see which custom which teams they have Pair it up. So Anthony Venturino. Here's your five Eric jock. There's your five Jose Here is your 15 Karen steel. Here's your five Matthew Hedges with 10 Mike Krasinski with 10 Nick Coba with five Oliver Smith with five Roy DiPietro with 10 and Ryan Redman with 10 Did you well there you go So like I said trade window is open Is anybody trying to trade? Does anybody need to see their teams again? I'll give it another 30 seconds or so if anybody needs to see their teams or is trying to do any trades If not, we'll just go ahead and close it up. So trade window going once trade window going twice trade window going three times Okay, let's print rip Good luck. So here are the four boxes. This is the final four boxes From this 16 box case There will be more to post. I believe I have another case. I will post that Remember all card ship Here's that finalist as well Good luck everyone. So just to go off of this It's obviously all card ship, right You're gonna see a lot of Mack Jones, which is for the Alabama Crimson Tide Those will all go to Ryan Redman in Alabama you will see quite a few of The Clemson Tigers and Trevor Lawrence Which goes to Jose Rodriguez We will see or hoping to see lots of North Dakota State Bison Trey Lance Which is Jose Rodriguez as well Justin Fields in the Ohio State Buckeyes, which is Matthew Hedges Who am I missing? Listen feels Trey Lance, Zach Wilson, which is BYU Is it under Brigham Young? Yeah BYU Cougars also Jose Rodriguez There you go, Jose Obviously Travis Etienne Clemson another big running back there. That's gonna be for Jose Rodriguez and Najee Harris another big running back from Crimson Tide and Ryan Redman There you go. So all those ones you'll see are going to those folks there You'll probably see quite a few of them. It's Chronicles is a great value Lots of big rookie names But we want to obviously see those in the numbered and the autos which we'll stop for on each one of those and figure out Who is who? So you got opportunities for Trey Lance, Zach Wilson, and Trevor Lawrence Not too shabby The randomizer definitely went into your favor. Good luck. There's our box number four I forgot about our big wide receivers, too Like this guy Jaylin Waddle Alabama, that's Ryan Redman and so is Devonta Smith Ryan Redman Diami Brown from North Carolina Is our first auto? North Carolina is Ryan Redman. We have all cards are gonna ship Jamar Chase, that's your LSU Tigers and Ryan Redman There's our first one Mack Jones For Alabama and Ryan Redman another Mack Jones for Alabama and Kyle Trask relic for Florida and Nick Coba and Otto Zach Wilson BYU that is Jose Rodriguez and Jaylin Waddle to 49 for Alabama and Ryan Redman. They tricked us. It was flipped backwards. I'm not sure if this is a variation of some sort Just a heads up Jose you might want to check on that When you get it see if maybe there's some photo variations or something It was flipped backwards like it was gonna be an autograph. I thought we had one. It was not Say that was gonna be quick Peter would have struck real quick for you Tricked me too Well, that we had it for sure Carrie Vincent juniors our second auto. That's for the LSU Tigers and Ryan Redman go Tigers Go Tigers That's what uh What's his name says? Najee Harris for Alabama and Ryan Redman another Najee Harris Alabama Ryan Redman and Jamie Newman optic hollow for Wake Forest That is Oliver Smith Ben Skornek Otto for Notre Dame our third auto in this box That is Notre Dame Jose Rodriguez How I feel about Matt Tice? Matt Tice is a Have any feelings about Matt Tice He is not Producing for the angels Not even on the mate on the pro squad so No feelings whatsoever. So you get three autos two and one man in that box Jared Patterson for the Buffalo Bulls Buffalo Bulls is Jose Rodriguez Travis Etienne for Clemson and Jose Rodriguez Zach Wilson BYU Jose Rodriguez Kyle Pitts for Florida and Nick Koba Zach Wilson again for BYU And Jose Rodriguez and nice Kenneth gain well two-color patch auto for Memphis Mike Grzinski Mack Jones, that is number two forty nine Alabama Ryan Redman and Justin Fields for Ohio State that is Matthew Hedges Zach Wilson again for BYU and Jose and Nico Collins to 99 for Michigan Karen Steele.  I've been trying to follow them at all in the minors and He hasn't done enough to really spark people to talk about him at all as we talk about like Brandon Marsh or You know Joe Adele and stuff like that. So I Mean, I don't know Yeah, I haven't looked at anything about how he's doing or anything like that. So But I would say this The angels are not a good team nor are we very deep and He's not up or getting any time or consideration whatsoever That's not good Travis Etienne again for Clemson and Jose and Seth Williams Rookie relic for Auburn Matthew Hedges Zach Wilson again for BYU and Jose Nice Jalen Waddell red. That's to 149 for Alabama and Ryan Redman 9 out of 9 Devonta Smith on card auto out of Spectra Very nice Alabama Ryan Redman 9 out of 9 Amin Ross St. Brown nice patch 4 out of 10 That's for Southern, California USC that is Jose Rodriguez nice one Jose It's my guy Trevor Lawrence for going to Clemson and Jose as well and Najee Harris for Alabama Ryan Redman and Devonta Smith hollow also for Alabama and Ryan Redman See so now you got the auto and the hollow to go with it See the 9 out of 9 right up on top there I don't know why it's not a 9 since he's Jersey number 6, but I'm sure you're not gonna be mad about that our Darius Washington TCU horn frogs Texas Christian That is Matthew Hedges Mack Jones Alabama 49 for Ryan Redman Kyle Trask to 49 for Florida that is Nick Coba Justin Fields for Ohio State the Ohio State as they like to say it Matthew Hedges and Trey Lance That's for North Dakota State, which is Jose Rodriguez nice Justin Fields refractor here for Ohio State Matthew Hedges Saw that for a second that we had it That is Cornell Powell rookie wide receiver autograph for Clemson and Jose Mack Jones again Ryan Redman Alabama Travis Etienne Jose and Clemson Zach Wilson BYU and Jose and Mack Jones Alabama Ryan Redman Brevin Jordan for the University of Miami That is Anthony Venterino and Justin Fields again for Ohio State Matthew Hedges Zach Wilson BYU Jose and Florida Gators Kyle Pitts Is Nick Coba Zach Wilson BYU Jose another Zach Wilson BYU BYU Zach Wilson and Kyle Pitts Florida and Coba Devonta Smith rookie relic Ryan Redman in Alabama. We got one box left For autos or mem cards to go Let's get another big quarterback or actually let's get a quarterback We haven't got we've got that nice Devonta Smith, but we haven't gotten a quarterback Travis Etienne Clemson and Jose Trey Lance North Dakota State and Jose and Thailand Wallace for Oklahoma State University. That is six out of 25 Oklahoma State Cowboys is Ryan Redman to Maureen Terry. That is to 149 for Florida State which is Nick Coba Justin Fields Ohio State Matthew Hedges and Trey Lance North Dakota State Jose Devonta Smith to 149 for Ryan Redman in Alabama Trevor Lawrence Clemson for Jose just heads up Jose you can see that little line right there. It's like a scratch right across it for some reason Najee Harris Alabama and Ryan Redman and Travis Etienne for Clemson Jose Travis Etienne Clemson and Jose again and Please damn it Zach Wilson relic Jose and BYU Trey Lance North Dakota State Jose And Justin Fields For Ohio State and Matthew Hedges Okay, so we should have at least either two more relics or autos in this one Yeah, that's the second time they've had Zach Wilson flipped around. It wasn't an auto remember this one's a relic We need that auto Trey Lance North Dakota State Jose Darren Hall San Diego State Aztecs That is Matthew Hedges Trevor Lawrence Clemson Jose and Trevor Lawrence again Clemson and Jose Zach Wilson BYU Jose nice Jamar Chase for LSU that was Ryan Redman Trey Lance North Dakota State Jose Tricked us again Dax Milne for BYU and Jose that's just dirty and Chubba Hubbard to 149 to finish it off for Oklahoma State and the Cowboys That is Ryan Redman. There you go guys. That's the break That was 20 21 Panini Chronicles draft picks football four box break Random college football team addition number four from jaspyscasebreaks.com There will be more in the store jaspyscasebreaks.com. I'm Sean. Thanks for hanging out. We'll see you next time


Local business owners are raising concerns over a proposed hospitality tax by the Bemidji City Council, which would help subsidize Bemidji's event center. Josh Peterson spoke with local hotel owners and shares their thoughts on the tax proposal. In Monday's State of the City address, when speaking about the Samford Center, Bemidji Mayor Rita Albright said that all property owners, both business and residential, are helping support Bemidji's event center through property taxes. She added that just over 5,000 taxable parcels in the city fund the entire subsidy, which is why some members of the City Council say there is a need for a hospitality tax. Implementing a hospitality tax is an opportunity to provide real, individual property owners relief, while assuring the Samford Center is operated and maintained as a community asset. The hospitality tax is said to offer property tax relief. Some Bemidji hotel owners don't see it that way. They see it as another tax just added to the cost of doing business in Bemidji. To throw more tax on us, I wouldn't want to see that. Now, at what point do you get prohibitive for people coming into town? For the Super 8 that sits on the northwest side of Bemidji, when events are held at the Samford Center, the Super 8 does not see a direct impact, feeling that the tax would only penalize the business. Right now we don't see a lot of people coming in for the Samford Center. We really don't. Stereotype or the stigma out there is we're benefiting. We don't see much at all. For two of Bemidji's largest hotels, the Hampton Inn and the Double Tree Hotel, it's the need to see successful results coming out of the Samford Center before adding a tax to pay for it. I mean, how much money can you keep shoving into that thing? That place has got to start producing and make some money. It's all there's to it. If the city was to remove the Samford Center's management company Venue Works, some business owners could be more open to supporting the idea. I'm tired of listening to excuses. Let's get some work done. If they can't do this and can't do that and we're just as good as everybody else, nonsense. I think they're just looking for excuses and it's too easy to raise taxes. One common theme shared among these business owners is being responsible and working within a budget. Whether it's a business or a household, if you have 50, don't spend 51. And you can't do that and then ask for someone else to make up that dollar for you and that's what the city has to be careful of. In Bemidji, Josh Peterson, Lakeland News. The hospitality tax has a long way to go before it would become a reality. Right now the city is seeking public opinion and is looking to build support for the tax. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


I'm Tom Scherer. I'm an Extension Agricultural Engineer with North Dakota State University and today we're going to be talking about sump pumps, sump pump installations and why they're needed. The primary reason that sump pumps are important is that they are the first line of defense to keep water out of your basement, protect your possessions, also protect the foundation and the structural integrity of your house. And so there's some steps you have to go through to make sure that your sump pump is running correctly and ready to take on because in the early spring when we have a lot of snow melt or in the summer when we have heavy rains, your sump pump is going to be running and it may not have run for a while last fall or even a year ago. And so we need to check it annually just to make sure that it's running properly, it's in good shape. Behind me is a kind of a typical sump pump installation here in North Dakota. There's a cover over the top and then this homeowner has put a plastic over it and there's a couple of reasons for that. First is safety. It's a safety concern to keep children and pets out of there plus also debris that may be in the basement that could fall in and plug the pump. Second thing in this case, the plastic is to reduce the evaporation and smells that might come into the finished basement. And also in this part of the country, radon is a concern in basements and sump pit is a good place for radon to enter. So what we want to do then is check your sump pump and before I do take the cover off I want to point out some features.  It just trips the breaker on the GFI. Second thing is this is the discharge pipe. As you can see, if I remove the cover, this is the discharge pipe going up, lifting the water up and it's going to go out to the rim joist and exit the house straight out to the side. Now outside the homeowners probably has a pipe on it that directs the water away from the house so that it drains away from the house even in the highest water situations. This is the sump and of course that's the pump and they call them sump pumps but they sit in a sump which is just a term for holding water. And as you can see right here, this is the drain tower where the water comes in from the footing drains from the outside of the house and pours into here. This part of the discharge piping is the check valve and what a check valve does is it only allows water to move one direction. In this case it would move up the pipe and there's a flap inside there so if water tries to flow back again, it holds it in the pipe and that's important because you don't want the water that's trapped in your discharge pipe to flow back into the sump. It just adds to the amount of water flowing in and makes your pump run more frequently. You can also notice there's a very small amount of sediment there but there's no other debris in there. If for some reason your sump pump has debris floating lint or other material you probably should clean that out first before you test your pump. In this case we have a dry hole. This pump hasn't run for a while so we're going to put some water in it just to make sure that it's running properly. In this case we have a garden hose and we're going to run the water in there very slowly so we can observe the operation of the pump and the float and to make sure that it's in working condition. You can also, if you don't have a hose available, you can use a 5-gallon pail of water and just pour the water in very slowly. So then we'll just slide this to the bottom and slowly add water to it. If you watch the operation float you want it to be nice and smooth. You can see it moving and as the water level comes up it will push the float up and turn the pump on. When the pump comes on you want to listen to it very carefully. One of the main features of these pumps is that the switch is kind of the weak point of them and so you want to make sure that when that switch trips it trips and stays on there's no hesitation. And then you want to listen to the operation of the pump and make sure there's no squealing or any other noise to indicate that probably the bushings are not in proper working condition. This pump makes a nice smooth sound. There's no squealing or anything. It indicates it's in good working condition. But if it does make any unusual sounds then you probably want to have a replacement pump on hand in the basement so it can be replaced very quickly. If you're going to check it this way you'd like to do it twice just to make sure that everything runs properly and that it de-waters the sump as it's supposed to. And then we'll listen to it shut off to make sure that when it pumps it down and you can hear that the check valve is also working. So you heard the check valve click that means it's holding the water in the pipe and that's not flowing back into the sump. Another type of sump and pump operation is what we call seepage sumps. And we have one right here and these can be almost any diameter anywhere from, in this case this is about a foot diameter but they can be up to 18 inches diameter. And this one has a small amount of water at the bottom and you can see some materials have fallen in here. If enough of that got in it could pose a problem for getting sucked into the pump and preventing the pump from doing its job. But as you look real close you'll see that there's no outside inlet. The only way water can get in is through these small holes here it's not connected to any footing drains and that's why we call it a seepage sump. In this case we have a small diameter sump that's pretty deep and so we have a small diameter pump. You can see the inlet where the water comes in but most importantly because it's a small diameter this tethered on switch has a long travel distance. So when the pump does turn on the water has to come up as you can see probably over a foot before it turns on and so the pump runs for quite a while which is good because the flow in a seepage sump the flow is going to be much slower than in a standard sump where you're connected to some kind of an outside drainage system. When you have to buy a new sump pump or replace one and you go to the hardware store sometimes it can be very daunting to come to the display and see a wide variety of pumps with different connections and so forth and we're going to show you some different types of pumps and explain some reasons why you might select one type over another and look at the different connections to them and how they work and hopefully give you a better idea when you go to the hardware store how to buy a replacement pump. Now in front of me right here you can see that we've got some pump setup. First I want to point out this is called a pedestal pump it actually sits on a pedestal it has the impeller or the part in a pump that actually moves the water is located down here the inlets are here and the discharge would come out here and rise up in a pipe and then we have submersible pumps and again as the name implies they are designed to be submersed in water these are sealed pumps electric motors here you can see very similar same type of impeller here in the intake the water flows in through these screens right here and these are fairly small openings so they can get plugged if there's a lot of lint or other small floating material in the water same as these types they're all very similar what sets them apart is the float mechanism that turns the pump on and off in this case you can see very clearly that the float is here this would sit down in the water and as the water rose it would turn the pump on now you can see that this has about 10 inches of rise to it and you can adjust it higher if you want to that's a very desirable feature in some sumps because then it pumps out a lot more water and as you can see it drops down and shuts off again on the submersible pumps this type has a diaphragm switch and the diaphragm is underneath here and when the water level is here it shuts off and when the water level rises up to about right here it would turn on as you can see that one has about 8 inches of travel and there's no adjustment to it this one has the float attached just like the pedestal pump has a float on the outside and it rises up turns on the pump and as it goes back down you can hear it shuts off the pump you can see that this has about 4 inches of travel and then the last main type is a tethered switch which is tethered right here and as this float rises up it turns on and then as the water level recedes when it gets down there it shuts off so it's about twice this distance or about 8 inches you can actually loosen this and pull it out so that you can increase the amount of travel so that now the water level that you're pumping out becomes equivalent to the pedestal pump the other thing that a lot of people are concerned about is the horsepower rating how do you go about selecting what horsepower pump if I turn these around we have three different size pumps here one third horsepower this is a one horsepower this is a one half horsepower if you only have to move the water 20 feet away from the house then a one third horsepower pump will probably work just fine to move the amount of water you need out of a standard house but if you have to add on more length or you have to move that water farther away in a hose or a pipe there's more resistance to flow and you're going to have to go to a higher horsepower for instance if you have to pump that water 60 feet or more from the house you might want to look at a half horsepower pump or a three quarter and even a one horsepower pump the important point to remember here is that before you go to the hardware store look at your pump that you're replacing and look at the horsepower rating on it and if you were satisfied with the operation of that pump and that it moved the water away then replace it with that horsepower rating not much is going to change beyond that


The two effects of climate change that I think we can be absolutely certain about, beyond any question, is that the temperature of the ocean is rising, and the acidity of the ocean is rising, and work that's been done here in Heron Island and elsewhere makes it absolutely clear as to what the effect of those two factors will be upon coral growth. So I still remember in the early 80s, for example, when the lab that I was in at UCLA in California, Los Angeles, the first bleach samples coming out of the Caribbean and being sent to my professor, and people going, we don't know why this has happened, but large amounts of coral have gone white. We're calling it bleaching. I've worked on every major coral reef region in the world now with very few exceptions, and that's a lot, that's 66 expeditions, that's 6,000 hours of scuba diving, and working on corals, not playing, and I've come back to the same place sometimes 20 years later, and I've seen this drastic deterioration in coral reefs. As we've pumped more CO2 into the atmosphere from the burning of fossil fuels, about 30% of it has actually been absorbed by the ocean. Now in one sense, that's been quite good because we've had less greenhouse gases, so less of a warming effect, but that CO2 going to the ocean has had its own chemical impact on the ocean. It wasn't until the early 1980s that I really got alarmed about what was happening to coral reefs, and then I realised it was happening to oceans everywhere. We've not only stressed these systems from a temperature point of view, we've also imposed a rapidly changing chemistry, and that chemistry is, well I think it's fundamental to their biology, biology of most organisms. Something like a third of all marine species have some part of their life cycle in coral reefs. It's a huge proportion, and so when coral reefs go down, it's not just the extinction of corals, that's almost trivial in this thing, it's the entire ecosystem goes down and takes with it, it'll take with it a third of all marine species. The other horrible thing about corals is they commonly grow best right at the tolerance of the temperature that will inevitably kill them. They like to live on the edge, thrill seekers in so many ways, and so if you make it a little bit warmer and they don't have time to adapt, then you get the coral bleaching issues. We're really in the early stages of changes that are probably happening, or they are according to the IPCC, at a rate that's the highest in 65 million years, and so much slower and less significant changes have had huge impacts on life and ecosystems. We can look at what happened in the past, were mass extinctions happened because of rapid climate change or because of habitat loss. And I think what we generally see, I'm no expert in this, but I think we generally see is similar types of organisms go extinct as those organisms which we now see on red lists that are very sort of critically endangered. Well the mass extinction events I think show us what's possible with actually a lot slower change, which is pretty frightening. When you think about the rates of change we're seeing, apart from the Cretaceous Boundary event when you had an asteroid hit the Gulf of Mexico or made the Gulf of Mexico, it's hard to think that a lot of these other ones happened over thousands of years, yet we're doing equivalent changes over a few decades. So I suppose these mass extinction events tell us that we can have some major effects with even a lot lower rates of change. It's not the amount of carbon dioxide, it's the rate at which it's building up, and for so much of the animal life and the oceans, they're not genetically equipped to accommodate such rapid change. Coral cover on the Great Barrier Reef has dropped by about a half since the early 1980s, so in a way that's really like demonstrating that adaptation isn't effective enough to drop that decline. If evolution was working to give them the tools to adapt to changing climatic conditions, they wouldn't be disappearing from hot places, and they are. I can't see a grain of evidence to tell me that we are not launching into the sixth mass extinction. There's never been an increase in carbon dioxide like we've seen. So observed extinction rates around the world right now have reached what I think most biologists would call a mass extinction level, so we are about, I mean the exact rates are not precisely known, so we normally speak about extinction rates in terms of orders of magnitude relative to what would happen in the absence of human activity. So what the geological record indicates is a normal baseline rate of extinctions. Right now we are at about one thousand times the natural rate of extinction, which puts us more or less in the middle of the end of the age of the dinosaurs in terms of how fast species are disappearing from the world. The increasing, the time passing and increasing of those figures will lead to disaster unless something is done, and there are those who say that there's almost nothing that can be done, except, and my response to that is that it'll be worse if we do nothing. There's not an excuse for doing nothing, saying you can't stem it. You can slow it down, that's for sure. And it'd be really culpable if we don't.


So today guys we check out a new world update, a new new world update, the 1.1.1. So landing right now more or less by the time you watch this video you'll probably have it installed and today we're getting to all the changes. How's it going guys? My name is DPJ and to give that to you guys I'm giving away 10,000 marks of fortunes. To be even for chance of winning these simply drop a like on the video, leave a comment down below, make sure you are subbed and have no notifications turned on. The more of my videos you support me on the more of a chance you have of winning. Winners will be announced at the end of the week. Good luck everybody. So here's a new world update 1.1.1. We'll release at 11pm PT on November 30th so like I said by the time you've watched this video it's probably already updated for you. And it comes with some interesting changes and explanations to some of the well efforts they did with the November update so let's get into it guys. Molts from elemental enemies. Fixed an issue causing a large number of molts to drop from elemental enemies. We also removed elemental molts as rewards from gathering elemental creatures and reducing amounts of other resources acquired from them to account for the number of them in the world and the frequency at which they respawn. The original intention with these creatures was to make them challenging and infrequent encounters in the world. The way we use them in practice resulted in them becoming less dangerous and more frequent which caused an imbalance of the amount of resources they provided compared to primary resources such as elemental plants and stones. So yes the bears, the wolves and the stags have took a massive nerve guys. Okay so I'm missing horticultural gear. In our latest update we made a mistake that treated all tiers of the in-game horticultural harvesting gear as future content and unintentionally removed them from the game. We apologise for this bug that has caused you to lose some items you rightfully earned. If you have lost an acquired piece of harvested armor you should have an extra reward chest in your inventory after this update. These reward chests contain a full set of horticultural armor provided at the highest tier you personally have acquired in the past for any piece of this harvested set. They're also rolling at a maximum gear scale for that tier so that's pretty cool. And will be usable at any level to ensure you can equip them. These items are marked as bind unequipped. Like any harvested armor piece you would encounter normally. Once you open the chest it will provide you with five items. The harvested hat, shirt, gloves, pants and shoes. Okay so unto housing. Re-enabled trading, moving and salvaging are furnishings and housing items so that's pretty cool because my inventory is filled up of these furnitures and it's just driving me round to bend. Okay so unto crafting. Fixed a bug where dual crafting recipes were not granted enough trade skill XP. Recently we lowered the amount of trade skill XP provided by lower tiered items when a player reaches a new tier of crafting bases per skill. To use metal as an example when a player unlocks steel recipes they end less from crafting iron recipes. We did this to emphasise their crafting higher tiered items as you progress through trade skills and to also improve the value of higher tiered materials. Our intention behind this change is to reward players for crafting higher tiered items as they progress through the ranks of each trade skill. Before this change we found players were spending too much time crafting lower tiered items as opposed to pushing their crafting skill up crafting items that they may actually use at their current level. That does kind of make sense but you know okay so unto trading. Fixed an issue where players were not able to fill by orders from local storage sheds. Can't say I noticed that one myself. Servers, technical groundwork for server mergers, nice war performance enhancements. So when are these server mergers actually coming? Because I've got a funny feeling guys they'll probably arrive with a big December update and to be honest after the November update I'm not really looking to the hit world estate again after the December update but let's face it it can't be as bad as what happened after the November update I mean that was atrocious. Okay so a general bug fixes. Void garnet. Fixed to oblivion not going on too cool down if players swap weapons during skill startup. Void garnet. Fixed to consumable status effects being cleansed by oblivion. Fixed an issue that was causing drew crafting to not reward appropriate amounts of XP for higher tier crafts. Fixed an issue preventing players from earning a lumberjack achievement. And that's actually it guys it's actually a short uh well short patch notes. There's a few interesting changes here for sure guys but yes that's it the end of the video has arrived. Tell me your thoughts on these down below. Also guys if you enjoyed the video leaving a like really helps me out. If you're new around here want to see more be sure to subscribe and hopefully guys and we'll see you on that next one.


Hi everyone, I'm Joe for jasphyscasebreaks.com, coming at you with 2020 Panini Chronicles Football, Fat Pack Rake, number 47, giving away five impeccable number block spots, that was for the New England one, which fills that number block, here it is right here. So $32 could get you a $200 random number block spot. That randomizer coming up in a separate video in the next video. So let's do the break first, this pack break first, and then let's give away those spots with a different dice roll at the end. Let's do the pack, roll it, randomizing, names and teams, two and a three, five times, one, two, three, five times for the teams, one, there's the first half of the list right here, and the second half of the list right here, no trades, no trades in these filler breaks, slide that down a little bit there, let's print this out, go to the other game now, the other game's on commercial. Alright here is a Jordan Love rookie card, future Green Bay QB someday, it's Justin Herbert rookie card, that'll be for Shane and the Chargers, Adam Levy has the Green Bay Packers, we'll get that Jordan Love, Michael Pirine, Jake Frong, T. Higgins, Darnell Mooney, again did Antonio Gibson have a touchdown today, some nice rookies here, Justin Jefferson as well in that luminance design, very cool, alright so take care of all those rookies in a second but let's flip back to the other screen really quick, Shane has Minnesota as well, let's flip back to this screen now the whole point of this though is to try to win those number block spots let's gather your names again, new dice, new list, and it's gonna be the top five after nine, three and a six, top five after nine, good luck, one, two, three, four, five, six, seven, eight, and ninth and final time after nine, there's nine right there after nine, a lot of sad names here because it's only the top five so from six on down, sad times, thank you for trying though I appreciate it, very close Alan, no cigar there but top five very happy because they're in that number block they just saved themselves some money, Mark is happy, Mike is happy, Russell is happy, Josh and Tommy happy times for the top five, thanks for watching, thanks for breaking with us, I'll see you next time for that impeccable break, bye bye


I'll talk about local perceptions of tenure in both, in two sites where we've been working. Now this is what that's again contributed by the whole group, and the title is A View from the Inside, Forest Communities, Perceptions of Tenure Security in Selected Sites in Indonesia. Again, just to show that many, the many partners were engaged to it. And CalUPSIA is actually the acronym for the project, Collaborative Lunges Planning and Sustainable Institutional Arrangements, which is really the vision. I'll begin real quick just to talk, talking about our objectives. Then I'll provide, Ninning has done a good job of talking about the study setting, so I'll just also breeze through that. I'll mention some of the methods that we used, and I'll go into the findings and make some concluding remarks of which it would be helpful. I think I'll end up with questions, and that will be the basis of our discussions. Okay, so our objective is really to try and identify local forest resource, tenure and resource management systems, and in particular to get a sense of local perceptions of tenure security, given the things that are happening around people. And some of the questions we're trying to ask is, what are the property rights and tenure arrangements that regulate access and use of forest? What are the roles and responsibilities of different actors, especially the actors at the local level? We're focusing very much on forest adjacent communities, and then what are some of the things that constrain access and use, and in particular, what are people's perceptions of tenure security? Now this is all part of the land use planning process, and clearly tenure is actually central to land use planning. Can you imagine that it makes a lot of sense to try and get a sense of what are the key interests in land and in resources during a process of planning? The setting is as Ninning had shown in West Calimantan and in Central Malukas. So that's Calimantan, and Serum Island is around there. So this is just the location of the project within the broader Asia region, Southeast Asia. So just to talk a little bit about Serum Island, as indicated here, it comprises quite a huge proportion. Oops, what did I just do? A relatively large part of it is a national park. Population density is pretty low, about 15.2 inhabitants per square kilometer. Generally in Indonesia, I think it's 128 people per square kilometer, so this is pretty low density area. And the main economic activities are agriculture and fisheries. Now these are the sites where we collected our data from. Yellow spots is a village, so there are about 20 villages that we worked in. But the purpose of this is also to show you that there are quite a number of issues, conflictual issues that have a bearing on tenure in and around the villages. So for example, there is some issues of conflict of access between people and the national park authorities. Similarly here we have again issues about oil palm expansion, plantations. Again in this region, the issues of again conflict over land with Manusella National Park. So all around where our villages are, there are certain issues with regards to development, plantation development for oil palm, for cocoa. But also the long standing issues with the Manusella National Park. Now this is a Kapuas Hulu site. Again, an even larger part of it comprises protected areas, two national parks and forest reserves. The population density is even lower at seven persons per kilometer square. And the main source of revenue and incomes are agriculture fishing, but also forestry, timber and non-timber forest products. Now again, the areas we work in, there are increasingly issues about oil palm plantation expansion. Mining, the mining industry is also big, they are gold mining. And so these are just some of the key development issues that affect forestry in the region. And that potentially could affect people's forest adjacent communities access. In terms of method, those villages, we selected about 20 villages randomly selected. We conducted a series of household surveys which I won't be reporting on today. We also did key informant interviews. But I'll present the results of focus group discussions which were conducted amongst, in all, you know, 20 villages in Saram and 20 in Kapuas Hulu. And the focus groups were disaggregated by gender and age with 35 years as the cutoff. So we have a total of about 120, and each focus group averaged about six individuals. So what did we find? In terms of forest use, of course, diverse users of forest by people. And the users span from sources of income, daily subsistence, but also cultural users, especially in Saram, where you even have sacred groves and burial sites which are protected and set aside. But importantly also, people talked about the environmental services that these, the forests that they use, that they take care of, use and manage, provide including disaster prevention and clean water. So clearly multiple users for the different users at the local level. And this just shows you, this slide is really just a table showing what are the, what the different users people have. So they are wood based products, there's firewood, timber and leaves for, and then that as well as rotten. None timber forest products from medicinal plants, honey, et cetera. But also they hunt game, which you saw over there. Now in terms of forest management, there does appear to be broad participation in managing. And there are different management functions here from protecting borders which are, it's a responsibility to enforcing rules, to monitoring compliance, resolving conflicts and, and, and sanctioning. And you will note that on this side, this is the Saram, oops, there, right there. And that is for Kapu as Hulu. The table shows who does what of these different functions. And in both cases, villagers are involved and their leaders. But in the Saram Island case, what you will find is that there appears to be some kind of cooperation between officials, between external actors in enforcement, in the different management functions, as opposed to Kapu as Hulu, where the management functions are concentrated with local, you know, level actors, both villagers and their customer, the customary authorities that are, that authorize use. Again, in terms of rights and access, what we find is that for the shared forests, for the village forests, because there seems to be two categories of, of, okay, thanks, Ninning. The shared forests and land parcels for cultivation. Again, we do find that people have withdrawal and management rights. They can harvest products. They are able to have responsibilities for protection and management on, on shared forests. But they also have land parcels for cultivation. And this is through inheritance, you know, the land is passed through inheritance across different generations. So what are the source, where do these rights come from? Overwhelmingly, the respondents talked about customary rights as authorizing their access and use. And then customary authority as being at the head of, of, of, you know, being at the forefront of regulating their use. They also talked about geographical proximity and, and, and also indicated that clients, you know, these, these are, the rights are exclusive to people living there and who are also members of different clan and kinship groups. What's interesting is that there's a general unawareness of, you know, of some of these regulations that are coming from the top down. I think Moira did a good job of, you know, indicating that a lot of the forests are supposedly state owned. But people do think and they believe that they're the, the, the genuine and rightful owners with very little knowledge of those, that there are other laws of which they are subject, except for those who live in direct, very close to national parks and other protected areas. In terms of tenure security, most people perceive that their rights and access will not be violated now or into the future. But, and they believe they will continue enjoying access to forests under these customary authority and rights that they have enjoyed over time. Families will continue to have their own plots for cultivation and they'll continue to access the shared forests. And they also believe that the, the forest areas that they have are vast and that customary restrictions will, will maintain that. But however they do indicate that there are certain, you know, things that are happening like all palm plantation, mining national parks. And they do see opportunities such as, you know, involving more stakeholders in management. And the issue about having some clarity between household land and forest areas. Since I'm running out of time, I think I'll just go ahead and make my concluding remarks. It seems then that there are, like any other forest anywhere in the world, there are multiple users. And multiple values that people have for their forests. Clearly, customary authority is really strong. It is legitimate and it is respected and people comply with the rules. In Saram, in particular, in one part, we did see some, a lot of interaction between officials and customary authority in terms of monitoring and also with regard to sanction. Okay, so there was a lot of interaction between those two organizations, which I think is very interesting. Because mostly customer and state are usually in contestation as opposed to being in cooperation. So overall, villages tend to believe that their rights are secure regardless of the things that are happening around them. Which I think, to me, I think that's really interesting coming out of this. And it's one of the puzzles that we still need to think about. Why would people who are confronted with different kinds of things, conflictual, which may have impact on their access in the future. Why would they perceive and believe that their rights are secure? We're still trying to think about this. But I think we'll still go back to the issue that they still pretty much have access as they did before. So these things that are happening haven't yet completely disrupted or violated their rights. But meaning might say something different because of an example in Saram. Moreover, they do not perceive scarcity and so they're not yet competing for resources. These are still questions that we're asking. And importantly, they continue to receive benefits, streams from the resources as they expect. But then the question is, does this disconnect that, first of all, is it real? Is it a figment of my imagination? But if it is there, does it really matter that there is a disconnect? I don't know. And what exactly is at stake? Some scholars say that property rights scholars, a number of them say that people's perceptions are the best indicator of insecurity. But others say that this has to be combined with the so-called objective measures of security, which includes issues about enforcement, about just and fair conflict resolution, about the clarity of rights. So I'd be interested to know your thoughts on how to think about this disconnect and whether it really matters at all, although I would pose that it does. I think that's it. I'm done.


QuickBooks Online 2023 tax law business use of your home deduction. Get ready to earn the skills needed to boost your bank books on up with QuickBooks Online 2023. Here we are in our QuickBooks Online test company file jumping over to the income statement remembering we're thinking about situations where we have a sole proprietor who is able to deduct business expenses on their federal income tax return with the help and use of the Schedule C. How can we then optimize our bookkeeping so that we can make that process as easy as possible? We're going to be thinking about this through primarily the use of class tracking. You might be able to do a similar process with the tags if you don't have access to the class tracking or if you're using them for something else. So keeping this income statement the primary form that we're going to be using for