This is covering the spread part of the Fandall podcast network We have got four pretty fun games on tab for this weekend in the NFL divisional round We're gonna break down all four from a betting perspective by talking to dr. Ed Fang asking him what his number say about all those matchups and Where he sees value for this week over at Fandall sports book This is covering the spread right here on the Fandall podcast network and Fandall research My name is Jim Sonness. I am a managing editor of digital media for Fandall research joined here as I am every Thursday by Dr. Ed Feng you can find his work at the power bank comm and check him out on Twitter at the power I can add Michigan wins the national title Detroit wins last week. Will the state of Michigan ever lose a football game again? Probably it'll happen at some point will it happen this month We'll talk about that later in the show But it's fun to be at the divisional round right where you get rid of some teams that maybe shouldn't have been there like the Eagles What's that Mason Rudolph We get a little bit got a rib Mason Rudolph and as and as as well as Joe Falco had played Turn out quite so well last week. No, we didn't get too many close games except for, you know Rams lines last week, but I think it's gonna be I think we're gonna get some better football this weekend So I am particularly looking forward to the action I was confused why people were so mad about all the the wide margins And I realized this because I was on the right side of them from a betting perspective So like I love the fact that that Brown's Texans game got out of hand like Texans money line Packers money line like hey, I'll think about any day when I'm on the right side of it So right that may have tainted my perspective on how the games went down for sure I had put a Song someone written a song about Joe as an ode to Joe flacco last week And I was working on my newsletter and and I sent it over to cleave TA because I just had him on my pod last week I was like, hey, did you see this and he's he was like, yeah, there's like ten of those out there this week and And then and then it turned out to be kind of like bad luck and To pick sixes at a critical time in that game and it was that game was also pretty interesting because cleave I would not bet against the team He would not recommend it But he essentially recommended it because he was like well, you know When Stroud was gonna play flacco a couple weeks. He was minus, you know, Houston minus two and a half and You know, my numbers definitely were we're on market there, but I feel like I should have I mean hindsight is 20 20, but I was like, yeah, I had a pretty good week So, you know, I'm not not complaining at all, but right It would have been nice to also cash a pretty easy Houston ticket Houston plus two and a half right at home Yep, he's the most plus two and a half. They closed at one and a half though So it did move toward them as a week went along So and I think that was right as we saw with the results as well, but also just like Betting on regression for a 38 year old quarterback who was unemployed a month and a half ago Probably a good thing in general. So I think that from that perspective to it did make a lot of sense Well, don't any spots quite like that for this weekend, unfortunately But we'll break down all four games outline where Etsy's value for this week at Fandall Sports Book But first a reminder to make sure you're subscribed to covering the spread wherever you get your podcast tomorrow JJ Zachary is with us to break down player props across the divisional round I have my first look at the divisional round of betting markets as well from Tuesday a couple of those numbers have since moved so the value primarily gone there But still gave my insights on all four games on Tuesday on the show You can find those here on the covering the spread podcast feed a faddle TV plus and the faddle YouTube page as well when it comes to the NFL playoffs You got to win one game at a time when you bet the NFL playoffs on faddle one game can mean a lot of wins Fandall America's number one sportsbook has all your favorite bets like the money line in the spread There's all sorts of prop bets like quarterback passing yards or who will score the first touchdown Plus every day. There's an NFL playoff game Fandall is giving all customers a no-sweat same game parlay That means when you combine your bets for a chance at a bigger payday You'll get bonus bets back if your SGP doesn't win Make every moment more with Fandall an official sportsbook partner of the NFL must be 21 plus and president select states Minimum three leg parlay required refund issued is novel trouble bets bonus bets to expire seven days after a seat Max refund $5 unless otherwise specified Restrictions apply see terms at sportsbook.fandall.com Fandall is offering online sports waging in Kansas under an agreement with Kansas Star Casino LLC gambling problem call 1-800 gambler Over to Fandall.com slash RG in Colorado, Iowa, Kentucky, Michigan, New Jersey, Ohio, Pennsylvania Illinois, Tennessee, Virginia and Vermont call 1-800 next step or text next step to 5334 to in Arizona 1-88-789-7777 over the ccpg.org Slash chat in Connecticut 1-800 9 with it in Indiana 1-800-522-4700 visit ksgamblinghealth.com in Kansas 1-877-770 stop in Louisiana visit MD gambling health at Oregon, Maryland 1-800-522-4700 1-800-522-4700 visit 1-800-gambler.net in West Virginia now add before I dig into the actual games This is one of our final chances top futures for this year. So anything stand out to you as far as futures go prior to the divisional round The Super Bowl odds look interesting. I feel like it's probably shaded a little bit too much towards San Francisco We're calling the juggernaut. Well, we'll get into that a little bit later But you know, I don't have any calculations on it I do have a ticket for Niners Raven Super Bowl 13 to 1 probably about two months ago and it was suggesting me by my son and He had, you know, some YouTube theory about why why those two teams should be playing in the Super Bowl, but I looked at my numbers and I looked at You know all my ratings was like those are two really good football teams and You know, it's not quite 13 to 1 right now Probably more like was 230 if I was just actually looking at the conference odds So it looks like, you know, we're probably talking. Oh, hey, there we go. Plus 230. Hey, that's that's pretty good. And that's actually You know, the Sumer had it at 26% last week.  I mean maybe with Dallas out, right? So Dallas, I think losing is is one factor I don't think the Rams isn't gonna be that big of a difference because like the Lions are pretty good, too So right, I think the Dallas loss was probably the primary motivator there Right Yeah, actually, I wonder like I the cash out has been like Non-existent on that for weeks. So I wonder if it's back Yeah, I've got a Ravens plus 50 Super Bowl ticket that I keep checking that the cash out number four And I've not gotten anything that's been good enough to justify it If you read it, you got something. What's that? Like I don't even have an option. Oh really. Oh, so I do I have And it's been like a profit for a while But like if you read Ed Miller's new book Interception it goes through kind of like the math He can go through and deciding whether a cash out's a good bet and like I just haven't gotten a good offer at all on it And it hasn't been close to me to consider it So like I feel like I'm inclined for now to just let it ride I'm okay betting against Baltimore if the situation arises where I think it's a good value to bet against them, but like Honestly, I'm disappointed that I haven't gotten a better offer on that and even though they're you know, plus one plus two 70 right now.  I thought that section in Interception was really interesting about the cash out because they make the point that it's a new bet Right. Yeah, and it's a new bet that you can only make if you've made a prior bet, right? And so let's just talk about like NBA spreads and like in-game betting They actually have this proposition in there that says well, let's just bet every single spread So that you can find if in efficiencies because look, I mean Through price discovery the books are gonna be pretty good at getting that pregame spread correct, right? That's not the case for cash out And in the game. So can you just make bets that you know, you're gonna lose a little bit on and Then take advantage of cash out when it is appropriate. I think it's an interesting idea but definitely a place to find value at the modern sportsbook and The cash out options definitely vary by book to like some if you try to cash out immediate Which you shouldn't do because it's kind of shady from like a like a Money laundering perspective like you shouldn't do that because you'll get flagged and you should get flagged for that Like catching out bets immediately The offer on an immediate bet is gonna be different from book to book So keep that in mind as well when you're doing those kinds of things because you're not gonna get your full stake back in a lot of places Whereas some places you will but again, don't get yourself flagged as a potential money laundry account while you're while you're at it They're just be wary of that Let's talk about the first game of the week That is the Houston Texans at the Baltimore Ravens right now at fan dual sportsbook Ravens are nine and a half point favorites total in this game He's at forty three and a half right now and Texans have stepped up at in two must-win games But now Facing what was the best defense in football the second half of the year and actually if you include last week I've actually got the Ravens the best defense overall this year now taking over Cleveland spot in that in that number So can the Texans do enough here to cover a big number against the Ravens? I think they can I mean my numbers have Baltimore by eight here So that is certainly suggesting value on Houston. Can they cover? Yeah, it's certainly like I would only lean that way I haven't bet this Houston obviously has been playing really well with CJ Stroud and just it just How he is absolutely?  There's so many questions here, right? Like what if CJ Stroud went to the Panthers? How how how would that have gone, right? And So anyways, he I look at my adjusted passing success rate. They're seventh But they have just been really good 52.4 percent success rate last week against Cleveland and you know the NFL average is about 42 percent So look, they're gonna they're gonna get tested at Baltimore. Baltimore is certainly the better team here I Just see like I think this is gonna be pretty close. Sorry my prediction is pretty close to the market I don't see any value there but Yeah, you know, I wouldn't be surprised if they cover I guess I would be surprised if they actually pulled the upset here Yeah, the money line right now for the Texans is out to plus 370 I also show value on the Texan side here talked about that on Tuesday in the preview the the first look show where when we were talking on Tuesday It was an eight and a half and you saw a lot of nines nine naps out there So it didn't make a lot of sense to bet them then I do think there is enough here to consider the Texans You're showing a bit of value with the being an eight I have it at seven Baltimore minus seven in this game right now in large part due to the passing efficiency You loot you alluded to with the Texans the reason I'm not like Pounding down the door to take the nine and a half is because it is in an indoor team going outdoors which does The decrease expected efficiency the Ravens defense like I said is very very good obviously that's accounted for in the numbers, but Overall, I think it's concerning enough where even though I do show a good amount of value And I've been on the Texans a lot this year still even a bit hesitant with it at nine and a half so I Do show value there if you're looking for a bet here I think that's the better bet now. I talked about the under on Tuesday That was one is a 45 and a half. It's not under 43 and a half So that's numbers that numbers moved a lot and I've got that at 43.7 So no longer value there So if you were if you were looking for a bet in this game actively I would say the best one would be taking the Texas plus nine and a half But honestly It's not a big enough value and I have enough concerns about it where I'm like not pounding the table So it sounds like we're kind of the same page or value in the Texans but not enthusiastic about actually betting it Yeah, I would agree with that Jim and also another thing to note about my numbers with Houston Like I've thrown out the prior on this coming into the season. They were 31st out of 32 teams Do not a lot was expected of the Houston Texans and You know saying this is the second worst team and having part of that in your prediction doesn't really make sense right now I think Yeah, it makes more sense to just use what the data from the current season use the data from markets and You know, it gets me pretty close to the market So so I feel pretty good about that and it's also interesting to think back to the preseason too because I had Dr. Eric Eager on my show and he gave me Houston as one of the surprise teams yeah team that could do a lot better than people expected Despite the fact that at the time that you know, they were gonna start a rookie quarterback And at that time we didn't really think they had much talent at the receiver position, right? That Assessment seems a lot different now, you know after the season that they've had So it's all pretty interesting. But yeah, so so my prediction is definitely involved It's a little bit different than than I already given this last year and I think with Dr. Eager too It's probably it was probably based in part on the fact their defense heads and pieces Derek Stingley juniors played really well recently didn't use hurt be any part of the year So makes sense their defense was not playing well then but got him healthy will Anderson healthy enough to get through there So they've got like impact guys and impact positions left tackle wide receiver quarterback defense event corner That's kind of how you want to build the team. So fun teams. Not sure what we'll see from them this weekend Let's talk about the Saturday night game That is the Packers at the 49ers right now a fan dual sportsbook spread is nine and a half Total is 50 and a half up a half point from where it was earlier on this week and the Packers passing offense And their efficiency continues to rise but now at facing a juggernaut of a defense here of a team I should say what's your view of the Packers in this one, right? I mean, I think that San Francisco is not a juggernaut. I think they are a very good NFL team They are at the top of my ratings and how I rate 32 teams, but they're certainly beatable Baltimore showed that pretty recently and should the Niners be the Super Bowl favorite. Yes But I certainly think they're far from unbeatable. So my numbers in this game have San Francisco by nine points. So you're including some home field You're including some a little component for the fact that they didn't play last week And maybe that should be more because they really didn't play the week before But honestly this Green Bay Packers team is the most interesting team in the entire playoffs to me We talked about it last week and everything that we talked about last week still applies this week Jordan Love and the Packers by my adjusted success rate have had the best offense in the NFL since week 10 and That is the stickiest part of football That is the most predictive part of football if you're gonna be good at throwing the football That tends to persist and we're getting a reasonably large sample size on a young player like Jordan Love It's not the same as a 38 year 38 year old guy like Joe Flacco that really stunk last year, right and Flacco we had a smaller sample size It's not like we're getting Mason Rudolph This is believable and Also on defense defense tends to be less predictive So when you have the worst past defense in the NFL The way you tend to go is up and strongly so sometimes we really didn't see that in the game against Dallas They didn't pick six in that game But Dallas had inaccessible 50% passing success rate while above the NFL average and that was with Pretty much looking horrid for big parts of the first half CD lamb looking like he had never met his quarterback Before for large parts of that game So the Green Bay defense didn't play well last week they need to harness the power of regression For real this time if they're gonna have a chance at beating the 49ers But you know no team in the NFL is unbeatable, right? I mean, this is a team This is a league of regression to the mean so I will not endorse them as a juggernaut. They're certainly beatable Probably doesn't happen this week, but you never know Yeah, I think what you're saying here is expect points and I'm hoping their point because I did take the over in this game It was 50 at the time It is now a 15 and a half a fandom of sportsbook over as minus 115 The minus 115 part gives me pause and saying like I would still take that but I've got that at 52.1 right now and 50 is not a huge key number as far as betting totals go like a 27 23 kind of thing with land there but it's not a I guess 30 to 20 but it's not a very prevalent one where a 51 is So it is still being below 51 I do think there is at least some value in the over in this game because like you said like Packers defense Didn't they haven't been great all year. They've had some flashes for sure but overall not been the world's best defense and I think that the reason why I felt okay taking the over at here Despite the fact it's a large spread sometimes you can see I could be one-sided I think the Packers move the football if they're down big because Jordan love is beneficial enough to be to be good through the air and that to me gives me more confidence in taking an over in a Game like this where I do think the spread is justifiably large So to me because I have confidence in the Packers to move the ball put up points You know if they're down big later on That's why I feel good about taking an over here because I think that both teams will score points for all four quarters Regardless of the script we see throughout this game. Yeah for sure. I definitely see that right I mean, I definitely agree that the Packers are probably gonna put up some points if they are down in a second half Alrighty, let's talk about these Sunday games and begin things with the buccaneers at the Lions my two sons Quarterbacking this game Baker Mayfield versus Jared Goff right now at Vandals Sportsbook Lions Six and a half point favorites total is 48 and a half and and we've talked a lot about how the Bucks are A bad team on early downs throughout this year and they have been they did have their best showing in the season at least By my numbers on early downs last week against the Eagles But that was against a broken football team. So I don't want to put a lot of stock in that So can the Bucks do it again here against the Lions who are very much not a broken football team right now? Yeah, for sure. I mean the Lions definitely aren't broken, but their defense isn't good I actually thought they got pretty lucky to This week the Rams had more overall yards They were able to move the ball the difference in the game was essentially that they got a couple stops The Lions got a couple stops in the red zone were able to eke out a one and Then you know it From kind of a fan perspective if you're a Lions fan like who did you want to play Tampa Bay or Philadelphia? And I actually still wanted to play Tampa Bay I just think that they are the weaker team They don't have the ceiling that the Eagles have and as bad as the Eagles played You know the Eagles have a ceiling that the Tampa Bay doesn't Tampa Bay is very NFL average on both sides of the ball And I actually make this I have Detroit by a six point six points This actually moved towards Tampa Bay yesterday It was six in a lot of places and I was really hoping it would get to five and a half in which I definitely would have bet the Lions But it didn't get there. It's back to six and a half now I think this is a great matchup for Detroit as long as they play their game don't turn the ball over And the defense isn't too awful. They they should be fine in this game I don't particularly have a lot of faith in Baker Mefield. Mike Evans is great, but This is not a great football team in Tampa Bay and Detroit should be able to win this game Yeah, and like I said, I think a lot of last week with Tampa Bay Showing up on the way down for the first time this year was due to the opponent. Now the counterpoint would be They had a lot of drops in that game with Kate Otten and Mike Evans having like key drops You could argue they should have won by more in that game and like then if the Bucks win by More than 23 are we talking about this as being a six and a half point spread at that point? I still think we probably are personally But I think that overall you're getting a game here where the Lions? Yes, they may struggle to run the football against this Buccaneers team, but they've shown With Jared Goff, they can be efficient enough through the air to beat you that way as well So I completely understand where you're coming from My numbers been higher on the Bucks, which is annoying because I don't feel that way about them personally It's it, you know, right it wants overall passing efficiency and they get there They get there via the stupidest means of all time by relying on late-down magic for a Quarterback has been the scrap in three separate times in the past 18 months or whatever it is So I'm lower on the Bucks and my numbers are so to me This one winds up being a stay away and not seeing enough value there with it being At six and a half It sounds like that's a stay away for you How much would it need to move for you to have interest in laying the points here with the Lions? I would love to bet Lions minus five and a half or anything better Maybe some money line. I haven't really fully decided on that You do make the point that Tampa Bay had a lot of drops But they probably got an equal number of yards and productivity from this tackles from that's true That's very true. So I think it's kind of a push there. Yeah, they had an amazing offensive game overall I I Say most likely that does not continue even though the Detroit secondary is is not great No, they're definitely not they're healthier now than they were with CJ Gardner Johnson mean back But it's still not a good secondary and we saw that several times last week against the Rams luckily though Sean McVeigh kind of a coward when it comes to punting fourth down decision-making so that definitely to bail them out there Let's talk about the final game of the weekend and potentially the most fun one That is the chiefs at the bills were right now a fan dual sportsbook bills are favored by two and a half That's held pretty steady throughout the entire week Even since things opened during the game on Monday total in this game is 45 and a half and this chiefs offense Showed some life last week against Miami despite rough conditions Facing a bill's defense that has a lot of injuries at live backers. What's your view of this one ed chiefs versus bills? Right. I mean, I think there are some really interesting matchups in this game Kansas City's defense has been incredible second in the league in points allowed per game But it's really been the past defense that's been incredible and the run defense has not been good They're near the bottom of the league when I look at rushing success rate adjusted for opponent That's a bad matchup against the bills who have really been running it with James Koch really well They're near the top of the league when you're talking about rushing success rate if I were coaching the bills I would definitely mix in a heavy dose of run plays because I do think they're they're gonna be able to find success there But the thing that really flips this game for me is just the injuries that Buffalo has in the secondary we've talked a lot about Buffalo's defense and you know, they've been rated better There's just a wide variety of opinions depending on whether you look at passing success rate or yards for pass attempt or PFF grades And I've definitely been making the argument that Buffalo secondary is better than the numbers say Simply because they do have some talent and all that talent is on the injury list now. It is insane I mean, this is like the definition of cluster injuries, right? Turn on Johnson had probably a concussion last week against Pittsburgh. I don't think he came back Christian Benford had a knee injury another corner back Pretty sure he didn't come back because this nap count was super low Rassoul Douglas who you know some consider to be the best trade deadline acquisition in all football He didn't play and then a safety tell wrap has a calf injury None of these guys practiced on Wednesday or at least fully practiced on Wednesday. I think some most most of I forget who actually Karen Johnson practice Out there so he might be able to clear in time, but he was the one who is out there Right This is the definition of cluster injuries even before the cluster injuries. My numbers had Buffalo by about a point. So my numbers are right in Casey ahead of Buffalo I think there's value in Kansas City Plus two and a half. I actually sent out some members when you keep grab plus three at Draftkings. I think it was yes It was Tuesday. I think I sent out Tuesday. Anyway Yeah, I mean just with the cluster injuries, I just think I think Kansas City's right side here I have value in the bills, but the cluster injuries are why I've not pulled the trigger on that and it the other thing is like right now if into a sportsbook if you want to lay the two and a half you're laying minus one twenty two to get there and I Feel like if you're like a new better You need to understand how big of a difference there is between minus one twenty two and minus one ten minus one twenty two The implied odds are fifty four point nine five percent and minus one ten fifty two point four percent That's a big difference in betting. So I know you could say ah, it's minus one twenty two It's the same point number like who cares two percentage points two and a half percentage points makes a massive difference so When I see the two and a half there are the minus one twenty two there that to me allows me to Lean on those injuries as being excused for not taking the bill So I have not taken that yet despite the fact we talked about that on Tuesday It was minus one twenty two then briefly got to minus one twenty on Wednesday at some point but it's now back to minus one twenty two and To me Ed the biggest reason for avoiding it is those injuries you alluded to because they matter a lot especially For a cheese team even if we ignore the secondary and focus more so on the linebackers Where it is this cheese team at in its current state beat people they beat people with underneath passes to Kelsey and rice And they beat you with is a Pacheco Stores don't stop in the ground. So and that's gonna be show up a lot with those linebackers So we both kind of wind up in the same place where I'm like, I don't really want to like Bet the bills here, but it sounds like the plus two and a half even money. That's not a three yet So would you be looking at the money line for the chiefs at plus one twenty six What do you think is the best route for betting them if people can't get that three that you alluded to here?  I would definitely bet it especially a plus 100 Okay, so even money in the cheese plus two and a half is where Ed likes this one for the bills and the chiefs That's all we got here for the divisional round of the NFL playoffs next week the conference championships That is going to be a blast We're gonna see either Jared golfer Baker Mayfield in the NSU championship game pretty pumped about that personally very good for My quarterback prospect model looking very much less stupid than it has at times in the past And if people want to find your newsletter find your podcast, where can they do that? What's going on with those things this week? I? Had Evan Silva of established to run on the podcast this week It was a great conversation, especially if you were Green Bay Packers fan I highly recommend listening to that and you know, how he would answer the argument Well Green Bay's offense is not going to continue to do this well because the receivers are young and they suck So check that out wherever you get the football analytics show and then yeah check out my free Sports betting email newsletter every Saturday I put out five no get Saturday, which is my curated list of sports betting tips and analytics Not just my own stuff, but stuff from other people as well Check that out at the power rank dot com You can find the chat with Evan at the football analytics show as well to get that find Ed on Twitter at the power rank I am on Twitter at Jim Sonnis You can find me on threads at Jim dots on us and check out fan to a research on Twitter at fan to a research Want to thank you all for tuning in for today. Good luck to you with your bets across Thursday We'll talk to you once again tomorrow break down some player props for the divisional round of JJ Zachary So this has been covering the spread right here on the fan dual podcast network


Oh, there he is. There's a good crappie, good crappie. Howdy-do and welcome back to the channel everybody. I just want to say thank y'all from the last video all the awesome comments and just loving that video because man it felt good to catch that big old Mando. Today we were heading out to another lake that is known for giant bass and it is literally what started up my life. As a fishing freak the world-famous Lake Fork. But before we get out on the water I want to tell you about today's sponsor, which is Tecron Marine Fuel Treatment. First of all, let me say if you guys are not using a fuel system treatment in your marine engines You better. If you're fishing constantly every day running your motor, that's actually a good thing for it. It's kind of like your car, but if you're like most people and even like me where you're letting your boat sit for a week at a time or a couple weeks at a time That's kind of a rare stretch for me But even then I like to have some sort of treatment in my fuel to make sure that the engine is not getting gummed up. Tecron is great. They put a ton of research behind their product. Chevron of course making some of the best fuels on the planet and they treat all different types of fuel systems before this marine treatment system particularly focuses on rust prevention and cleaning your engine components while you're running this stuff. Especially if you have an older motor, it's going to help clean that engine up and get better performance as you use it. Best thing to do for your motor, get you some Tecron and use it at every fill-up. This stuff is 10 ounces right here treats up to a hundred gallons. So that's going to last you quite a long time, especially if you're running a smaller motor. As you guys know, I like to go out on the deep angles sometimes like this time I'm out in East Texas. Sometimes there's not a whole lot of gas stations around and a little tip for you. Try to fill up at the places that frequently are going through gas where there's a lot of activity because you get out to some of them places and there's like one car there a week that fuel is going to be a little stale. That's when you especially need something like Tecron in your fuel system. And if you're taking a long pause from the dangle, Tecron's got you covered. Stabilizes your fuel up to two years. Now thankfully I live in the great state of Texas and I never have to winterize my boat, but if any of y'all are north of the wall you need to stabilize your boat for the winter, Tecron's got you covered. There'll be links down in the description where you can check out Tecron Marine, but you can pick it up basically at any West Marine store nationwide, walmart.com or you can go to tecronclean.com and they'll show you exactly the benefits and the features of Tecron at a detailed level. So thank you Tecron for sponsoring today's video and keeping my engine clean. Now let's get out to the world's famous waters of Lake Fork and experience the Mount Dore greatness, y'all. Oh man, I'm glad you're here. I'm glad we're here together on the sunrise moment here at Lake Fork, Texas, baby. Y'all that are new to the channel, this is literally the place that changed my life. I was into fishing always been into fishing, but when I came here I went out with a guy, me and a buddy of mine. When I was a young man, I saw what was underneath the water and it changed me. It made me want to dedicate my life to bass fishing and try to figure out how to catch bass. I've never seen anything like it. Respect to the day when Fork had a lot of grass, clear water. You can see in the water really good. Nowadays, it's still good the fish are just kind of hidden in other spots and this lake makes you a really good angler. When you're here all the time trying to figure out these floor to strain mostly bass, it makes you a real good angler to go anywhere else and learn a lot of techniques here. But anyways, I'm here today. I got Billy with yourlakeforguide.com. He was nice enough to let me and LunkersTV stay at his crib last night and he's taking out Lunkers right now. So I'm coming back from my other trip, coming off a 10 pounder baby. So life is good. I'm feeling really good about today. What I'm going to be doing though is I'm going to be targeting bass and some crappie. I'm going to try both. I hear they're up in the shallows. Hey buddy, where are you going? It smells like shed right here. Do you smell it? It smells like watermelon candy. I love it. Oh, is it? I don't know. I've been smelling that for 10 years out here. Where are you going? How about it? I just rocked out just to say I went 50 in a fast boat. Water temps looking around the 60 degree mark. This is when you can get out on the points and do some damage on some big ones. See, here's a problem with me on the floor is I'm just, so many bass memories come back. I'm like, oh man, I remember this spot. I remember this spot, this spot, and here, here, here, here, here. It's like, I can't ever focus on the matter at hand because I've been always thinking about other spots. But I'm going to start in this one creek that normally has a later spawn and see if there's any that are going to pull up. I'm going to start fishing just some moving baits. Probably throw some baits and stuff like that and then go from there. If I see some shallow pool, that's what this lake's known for. Big stumps. Okay, I got to focus. I got idle through here. And we're off to the races, everybody. Oh man. Hitting the pavement here with a little swim bait, a five-inch swim bait, with a little spinning hook on it. And then I'm also tied on a frog. I had a frog tied on from the other lake. There is a lot of skim and a lot of shallow bushes around. So my strategy here is just kind of slowly swim that swim bait through there, work a frog, maybe throw a chatter bait a little bit. Well, it's been no luck throwing the swimmer so far. Probably going to end up breaking out a jig.  If I don't get anything on this bank, I'm going to change low cows and maybe even change up species. You're the crappier up in the shallows right now. I decided to change methods, y'all. Headed into the back of a creek right now. One of my buddies, his grandpa used to live over there. And there's some some brush back here. And I'm hoping that some crappier moved up into this brush to spawn. It's a good place to bass fish, too. Actually, Rob and Billy are right over there, and they're doing some blind-bed fishing. And basically what that is, is you're just looking for sandy spots. You're not really seeing the fish. It's kind of overcast. You can't really sight fish too well today. So that's how they're tackling that. I want some crappies. I caught one. I literally have one in my cooler. I need a bunch more. I'd love to come home with at least a dozen. Well, not the right species, but we got ourselves a bass. It's quite a small bass. I actually got that one throwing a little rooster tail. Trying to see if there's any active crappies in here. Oh, another little bass. Trying to throw this rooster tail. See if I can get a crappie on the line and jig for him a little bit more so far. He's catching a little bass. Okay, this is not a crappie, but it is just as delish. That is a yellow bass, folks. And I think I just had another one following me up right here. Normally I catch these in super deep water, but they might be spawning as well. Oh, here we go. Here we go. Big crappie. Big crappie. Big crappie. Come in here. Oh, yeah, that's a mondo. And let's pull it down here. Right, y'all. There's a freaking toad crappie right there now. Golly. That's what I was looking for. Hit that rooster tail. Hopefully we can get in the mess of those. Oh, there's another one. Oh, boy. Oh, gosh. Uh-oh. This might be a bass or a big crappie. I mean, a tree. Oh, still there. Still there. See, they're a big crappie or it's a bass. Oh, gosh. Is this a catfish?  This is a catfish. Oh, boy. That'll be good. Man, y'all, you start throwing a little rooster tail around. You catch everything. Nice jump, yeah. I'll stick him on this side. Oh, this might be another species. Nope, it's yellow. Sweet. Yellow bass. And there's no limit on these guys. He absolutely hose hounded it. There's no limit and no length limit on these. You do just want to keep the bigger ones. The smaller ones are just hard to fillet. I'm guessing there's a little school. There's another one. Got him. Feels like a yellow. They are running back here to spawn, baby. Gotta watch the gill plates on these suckers, too. They'll get you. We're loading it up. Oh, there he is. Got it. Crap. There's a good crappie. Good crappie. Good crappie. He just hammered it. Another hammer. He can fork. You are so good, man. Lake fork, man. Such a healthy fishery. And there's white and black crappie in here. I just throw in the regular old crappie jig. Oh, just had one right there. It's got him right there. It's got a crappie right behind the boat. Oh my gosh. Good one. Good one. Another hammer. Look at these guys. Absolute hammers. Caught him on the jig. Got him right in the chnute. Look at that, y'all. These are all towed crappies. So there's just a kind of a mess of them. Oh, there's another one. Got it. Oh my gosh, I'm on the juice. On the juice. Get away from that pole. Get away from that pole. Come here, baby. Oh, yes. These are just absolute hammers. Another towed next cast. Oh, man. Hello. Dangling, bro. Dangling. I'm on a hot spot right here. I can't leave. Let me fish this little hole out. Oh, there we go. There we go. He absolutely choked a crappie jig. We are getting the meats. Oh, that's a good crappie. Toads, baby. Freakin' toads. We've got some number five, and they're just huge. They're just massive. All right, let me show you guys the rig here. My yamper river, as you guys have seen in many, many videos. My creek fishing videos, a lot of crappie fishing videos. It's the ultimate crappie fishing pole. Super sensitive. It's really light. You can whip little jigs out with it like this. This is a 16th ounce jig head with a sickle hook on it. It bends out really easy. So if you get a cotton brush or a dock, you can just pull it out. When you guys sent this in to me, somebody around DFW that has like a crappie tackle store, I need to go in there, but I feel bad because I can't remember the name, but y'all sent this in to me. I've been alternating between this little lake fork. I think it's a micro shad is what it's called. Really good little crappie bait, and some other ones that you guys sent in. I'm going to give this color a shot because the other one I was using had a pink tail. It boogered up on me. Eight pound test line. Actually, I think this is six flora. Oh, golly. That's a good one. That's a good crappie. Come here. Come here, baby. Good crappie right here. Pulling that drag, son. Oh, giant. Giant. Come on now. Get up out of that brush. I believe these are just all hammers. They're all hammers, baby. Y'all absolutely hammering it. That one just knocked slack of my line. Purty fish. It's kind of working this jig through those trees. Comes through there a little slower than the rooster tail. There's another big crappie. Another big one. Come on, baby. Get up out of there. Get up out of there. Get up out of there. Oh, we have just found the hammers. We have just found the hammers spawning in the shallows, y'all.  So much fun. There is yet to be a small one. So for all y'all that are new to crappie fishing, 10 inches is the keeping length. This is just well beyond that. They are hammering this little lake fork micro-shad too as soon as I switch to it. It's been every cast. Well, we are going to be eating real nice. Pop it through there. Just get a little pop. Oh, there he is again. 16 ounce jig sinks so slow. Oh my gosh, this is a hammer. This is a hammer. Oh my gosh. These are just massive crappie. And they're pounding it. I mean, it's swallowed. It's swallowed. This one's got it so good. This is how you know you're using what they want right here. Look at the size. Look at the size of this crappie. And look what's down there. The pig, baby. That's a pig. Now the boys are bass fishing right now. They wanted to go to lunch, but I just told them I can't right now. I'm on a hot streak. As soon as they're done biting, we're going to go eat. Boy, starting to figure out the technique a little bit. There's another one. They're just all up in this bush. Get out of there. They're all hammers. They're all hammers. This is fun on this yamper. Fun on this yampe, y'all. Absolutely amazing rod for this. I think this is one of the smallest ones. No need to measure at all. Twitch it through there over those tree tops. He's not as big, but he's still nice. Got them crappies figured out. It's a black crappie. Beautiful. Only one I've had to measure so far. Almost 12. Y'all, I'm so excited because the last time I remember doing this, me and my dad were up in Canada, and it wasn't this hot where they were just biting just about every cast, but just catching hammers up there in the shallows when they were spawning. And it's just rare for me. I've never done it. It's just such a cool bite. I mean, it's just like bass fishing except miniaturized, and they are delicious. Oh, there's one. God, it's every cast. The crappie spawn a little bit before the bass. They move into the same areas, same shallow areas. I've been catching some bass in here as well, and they make those beds just like the bass do, but you can hardly see them with the naked eye. There's not even a need to throw minnows. You can throw those little underspins, those road runners, obviously a rooster tail. Seem to catch them on those and then just a simple old jig. So these jig heads, the hooks are designed where you can just bend them back.  I got to get another bait. Caught like eight fish on that bait. I tore it up. The baby shad, that's what this is called. It's the micro shad. I think I was calling it the micro shad. Lake Fork Trophy Lures. That's the tackle store I used to live in. They're making some killer crappie stuff. All right, I got a little lime green unit. Let's see if a little color change will get them switched back on. Oh, there's one. There he is. Oh yeah.  Yes, sir. Come here. Get around those poles. Ha ha. One more big one.  Nice fish. Golly. Golly. I've never been on a crappie bite this hot, like in the shallows. You know, I've been wanting to figure this out for months now. And to figure it out today, it feels so good. There was a moment though where it was just every cast. There's another one. It's like they turned back on or something. Come here, buddy. Golly. Oh yeah, baby. They're all big. Dude, they're all like 15 inches. They're hammers. Oh yeah, baby. Yeah, doggy. Let me show you how to dangle, son. At the massiveness of crappies. So good. And we got some yellow bass in there. And we got a catfish. We have done well. Caught all the crappie I could catch right there. Instead of going and trying to catch my limit because these are so huge, I'm actually going to just take these home right here. I am so excited that I finally got to figure out crappies in the shallows. And I'm going to expand on that technique more when I need more fish. You know what we got to do, man? We got to turn them in the golden crisps, baby. So let's get back to the house, get to cleaning them, and put them in some grease to feed the whole family. It's supposed to do right there. Okay, so when that happens, and you will do it, all right, don't act like you've never done it before. This is why I really like this clamp deal, and it helps you a lot easier instead of using your your thumbnails. And then there you go. I mean, that's real, real easy to do. Fat, crappie pork chop. Oh, no, almost dropped it. So I had a few 15 inches and the average size was 14 inches, which is crazy. Look at these slabs, y'all. I got a bunch more of these to clean. Look at the back paint on them. Woo, man. I think we're going to do, I think we're going to do Frank's Red Hot, at least half Frank's Red Hot. That's a recipe I've done before. And it is a classic. It is good. And maybe just some traditional for mom, because she likes that traditional. But anyways, we'll see you at the Rackley Family Fish Fry and get these recipes on these delicious slabs. If you're not a fish eating person, and you just want to try it, get into fish, this is going to change your life right here, y'all. But what I'm going to do today, instead of using the Frank's Red Hot, is I'm going to try the Texas Pete hot sauce. This is a new one that I haven't tried salt in the grocery store. I was like, I'm going to give that one a shot. And what that does, it basically gives you your coating to then batter your fish in the flour and then put them into the grease. This is going to be two fried recipes. But once with cornmeal, traditional, this other one is more like a hot wing. And it's absolutely delish.  And we have just beautiful filets like that. These are huge. And those crappies were so big. Another thing I could have done was throw them on a big green egg and actually grill them on a half shell. That's another recipe for the future. Don't worry, crappie time is not over. That is the nugget size right there. I feel like with that thickness, you put those in the grease and you make them all similar, and they'll fry up all the same way. You just want enough to cover fish completely. Already shook it up. That's going to be enough. And that's going to act as a stickiness to then you can then put it in the flour, just regular flour with a little bit of pepper. Ready? We're going to take these over to LSD's house. That's right. Sniff that cayenne, baby. It's going to be good and delicious in your mouth. Don't worry, it's not going to be too spicy, I promise. Full bottle should do it. That's it. We got mega crappies, dad. I'm excited about mega. Have I shown you pictures? I saw your bass. I hadn't seen the crappie. Okay. I caught those just down the way from where you caught your seven last week. No kids. I got to go catch some of these. You want to catch some crappie? And then I got one catfish in there too. A little bonus. A bonus whisker biscuit. This mixture right here, this is the traditional recipe for mom. She just likes that traditional stuff. But it is two parts cornmeal, one part flour, and all you do is just drop them on in. There's a little bit of salt involved, not much, and stick them in the grease. So it's time to take them out and the goldenness has been achieved. Sometimes crappies are so good you don't even need to catch them. But I'd like a little hot sauce. Oh, there we go. We lost the owl house. The wind is so terrible it blew the dagum thing down. Shoot, I'll just leave it down here. Crazy weather. I'm glad I was fishing yesterday and not today. It's traditional that the men do a taster tester first just to make sure there's no poison in there that's going to hurt the ladies. All right, dad, we should split one. We should. There's not a whole lot here. We've got some left for the ladies, but let's take a good chunker here. Split it. Cheers to golden crispies, man. Oh my gosh, that's good. Really good. That is really, really good. Now I must try. Oh yeah. Without even ketchup. Wow. That is what you're getting with the crappie. The flakiness. Oh man, golden. A little bit of pepper, a little bit of salt.  That is worth a serious dangle for. It's crappie time. Now it is time for that Texas Pete, y'all. I'm really interested in the Texas Pete and to see if it is different than the Frank's Red Hot, if it's better or worse. I think the Frank's Red Hot buffalo sauce, it has like a gooeyiness, like a stickier effect that really makes a good batter. So the Texas Pete seems a little bit thinner, but we're going to see no pepper in there, no salt. All the spices are included and it's going in straight flour. Spice to this. Little spice in it. I mean who doesn't like hot wings, first of all. Goes fantastic with your favorite light beer. I got some. Time for the Texas Pete. Oh man. Oh man. Oh man. Look at that. See I like that texture better myself. It's really, it's about the texture. What an incredible day on the water. That produced so much more meat than I thought.  It's enough for, you know, probably the four of us, but because they were so big, I've got two additional meals out of it, which is incredible. Just awesome fillets. The Texas Pete. Oh, it's time. It's time for a taste test, y'all. This is it. Oh yeah. We in business. Oh man. The flakiness, the flakiness with the flour, and it tastes like a wing. There's a wing aftertaste. Oh man. That is just too good. Look at the thickness on that crappie too. Mm man. Wow. Give that recipe a shot. I'll leave the instructions down below, but it's easy as you saw.  It's basically just that and flour. Delicious. I was so pumped to go out there and catch those crappie the way I did, y'all. I've been wanting to get on that little pattern for so long and try to figure that out. I finally did and now I want to go take it to other places.  Like try to catch a three-pounder or something like that. They're really a cool fish and they're obviously tasty. They're the tastiest freshwater fish in my opinion, at least down here. Walleye. Different category. That's where we're going to leave it today, y'all. I got to get in there and eat me some of those crappie. And if y'all want to stay tuned for the next fishing trip, fishing is going to be good for the next few months, y'all. It's going to be awesome. Stay tuned. Subscribe right here to the channel. Hit the notification button so you don't miss a single dangle and make sure to go ahead and hit that like button. I sure would appreciate it. I love you guys and I'll see you on the next dangle.


I'm Emily, I'm from the Chrome security team, and I'm here today to talk to you about whether certificate transparency is usable. If you're not familiar, certificate transparency is this emerging system for improving the WebPKI by making it possible to detect malicious or misissued or otherwise bad certificates. When I talk about whether certificate transparency is usable, I mean things like, can it be gradually deployed? Because we can't just flip a switch on the Internet and have it magically deployed everywhere. So can it be deployed gradually and provide incremental value along the way? I'm also talking about how much pain it imposes on the existing people in the WebPKI today, and also on end users, for whom we don't want to show lots of warnings and breakage, so we want things to generally work on the Web for them. So I'm going to go into some more background about what CT is and what I mean by usable, but first I want to give a couple motivating examples about why CT is important. You may be familiar with this incident from 2011, in which Google became aware of a number of misissued certificates that were being used against Google users, and these certificates had been issued by a root CA called Diginotar, which at the time was widely trusted in client trust stores. So fortunately, this attack didn't actually succeed against most Chrome users because of a feature called certificate pinning, but it was basically only by sheer luck that Google found out about the attack. And once it was discovered, the certificate was revoked and eventually Diginotar was removed from client trust stores, but it does go to show how important it is to find out about attacks like these. Maybe even just as important as preventing them from succeeding, because when we find out about them, we can discover CA misbehavior or other security problems, and then we can fix those and prevent attacks like this from going forward. So this discovery of attacks like this is basically what CT is designed to facilitate, and in fact it's already basically doing its job, even though it's not fully deployed yet. This is an example from a Facebook incident in 2016, which they blogged about, where they used CT to discover some certificates which were not malicious, they weren't mis-issued, they were an instance of a vendor managing some subdomains who issued certificates that weren't really supposed to be issued, so it was kind of an instance of this vendor falling through the security team's policies. But even though this isn't an attack, it was still really valuable for Facebook to find out about it, and it says something kind of cool and interesting about the process of CT deployment, because this was years before CT was fully deployed, and yet Facebook was still fairly easily able to get this value out of CT by finding these certificates. So hopefully that kind of sets up why CT is important and why we care about it. I'm going to go into some more background now about what it is, a little high-level overview of how it works, so hopefully, even if you haven't heard of CT before, you'll be able to follow the rest of the talk, and I'm going to talk a little bit more about what I mean for a system like this to be considered usable. So in starting to give an overview of CT, let's first talk about what the WebPKI looked like before CT. At a very basic level, an entity called a root certificate authority, or a root CA, issues a certificate to a server after the server proves that it is the domain that it's claiming to be. Then the server provides the certificate to the browser in the course of setting up a TLS connection, and the browser validates that this certificate chains to one of the root CA's that the client trusts, that's in the client trust store. If that validation can't happen, so if the certificate doesn't chain to one of these root CA's, then the browser says, this is no good, I can't validate this certificate, and will generally throw up a full page error telling the user that a secure connection can't be made to this server. There are a couple unfortunate properties about the WebPKI that I want to highlight. Obviously the root CA's are trusted third parties, and for the most part, they are completely equally trusted, meaning that with some caveats and exceptions, for the most part, any CA can issue a certificate for any domain. That's a lot of power that these CA's have, and there's a set of policies governing how they're supposed to wield that power and what they're supposed to do to be operating properly, but that good behavior is basically enforced by a combination of compliance audits and luck, and neither of those things work very well, and there aren't a lot of technical means built in the system to guarantee that we're going to discover bad behavior by CA's who hold all this power in the Internet. So the goal of CT is to allow anyone to discover what certificates are being issued, and anyone here can be a researcher, for example, who is trying to understand how CA's are behaving and make sure that they're behaving properly, or it could be a domain owner, like Facebook in the example that I gave, who is just trying to keep an eye out for suspicious certificates for their own domain. So I'm going to give a very high-level overview of how CT works. I'm not going to go into the details, but I think it's enough to sort of analyze the usability of the system. CT works with a group of logs, and these are logs that are operated independently by different organizations. Google operates some logs, CA's operate some logs, other organizations like Cloudflare is spinning up some logs, and these logs are publicly auditable, append-only records of all the certificates that have been issued. When a certificate gets issued, it gets submitted to one of these logs, and the log gives back in return what's called a signed certificate timestamp, or SCT. This process of submitting to a log can be done by any number of people. Sometimes the CA will submit the certificate to the log at the time that the certificate is issued. Sometimes the holder of the certificate will submit it, or it could be anyone else who happens to encounter the certificate and can submit it to the log so that it can be publicly monitored. This SCT, the signed certificate timestamp, it can be thought of as a signed verifiable promise that the log is going to actually log this certificate within some period of time. In the deployed system of CT, that period of time is 24 hours. So these promises, we have to do something with these promises, and the end goal of CT is that browsers wouldn't accept certificates as valid unless they come with these promises that the certificates will be publicly logged. So what happens is when a browser receives a certificate, it comes along with a set of SCTs from various logs, and the browser then validates the signature on those SCTs. And if the signature validates, then the browser knows that if the logs are behaving honestly, those certificates will be publicly logged so that anyone can see that they're out there. So this is kind of cool, but as I've described it so far, this is basically just another layer of trusted third parties on top of the existing PKI, right? These logs are just more, we're trusting them to behave honestly to actually log what they say they're going to log. CT wasn't really designed that way. It was designed for the logs to be untrusted. And so there are a set of protocols by which these entities called auditors can cryptographically check that logs are behaving as they're supposed to behave, namely that they're logging what they say they're going to log. If they issue one of these SCTs, these promises to add something to the log, they actually follow up on that and do the logging. And also that they're presenting a consistent view to all clients. I'm not going to go into the details of these auditing protocols, but I will mention that an auditor can be anyone. It can be a web browser. It can be the software manufacturer that makes the web browser. It can be a researcher, et cetera. And this is a very important part of CT, so I will come back to it a little bit later in my talk. Often when we talk about usable security, we tend to think about end users, things like can an end user figure out how to use a password manager? Or can a user make sense of this warning that they're seeing? But CT is not really an end user-facing system. And so you might be wondering, what does it even mean for a system like this to be usable? The usability properties of CT that we care about are that it can be deployed gradually. So we can have sort of a gradual ramp up. And as we go, we get more and more value, because we need there to be value that we get along the way. Otherwise, why would anyone do it? And we need it to be gradual, because we can't just take a system like this and just deploy it across the whole web all at once. Closely related to that, we want it to be a layer on top of the existing WebPKI. We don't want to try to replace the WebPKI wholesale. That's a pretty daunting task. And going hand in hand with that, that means that the existing stakeholders in the WebPKI today have to be sort of OK with adopting CT. They have to find the amount of work that they need to do acceptable. And finally, in Chrome, we care a lot about every warning that we show to users, causing warning fatigue, just making the web seem scary and broken and confusing. And we don't want to do that. So we want CT to be deployable without causing a lot of pain and confusion for end users and kind of getting in the way of them just using the web as they normally would. So because we want CT to be usable as this layer on top of the WebPKI, that means it has to be appealing to all the entities operating in the WebPKI today plus this new set of stakeholders, like log operators and auditors and monitors of the CT logs. And this zoo of stakeholders is kind of one of the main reasons why it's challenging to design a usable system like CT. OK, I'm going to now go into kind of the state of CT adoption today, what the ecosystem looks like right now, and what it says about the usability of CT overall. I'm going to be, this will be some qualitative observations, but I'm also going to be throwing some data at you. So I want to just say up front where that data comes from. Some of it is from standard Chrome telemetry, though unfortunately some of these metrics haven't hit stable yet, so some of them are from beta. But if you're interested, I will post the slides and update them with the data from stable when it comes in in a few weeks. We also have a separate data set of users who encounter certificate errors and opt in to send reports about those certificate errors that they encounter. We do have a CCS paper describing this data set, not about certificate transparencies specifically, but just about this data set in general, so you can check that out if you're interested. And finally, kind of independent of Chrome, we can also look at CT adoption by looking at how popular sites are adopting it. And so to do that, we look at the Alexa Top 10,000 list and also another list of popular sites, which is a little bit new, it's called the Chrome User Experience Report, and it's a public data set of 10,000 top sites as measured from Chrome usage. So in examining the state of the CT ecosystem today, we'll look at these three big usability properties that we care about. Starting with how CT is being gradually deployed and what kind of value we're getting from it even before it's fully deployed. Chrome has been the main driver of gradual deployment of CT. There are other clients that are supporting CT in various ways now, but I'm going to focus on Chrome kind of as a case study for what this gradual ramp up looks like. This is a roughly chronological order of the steps that Chrome has taken to gradually roll out more and more CT. We started a few years ago by requiring CT for the extended validation UI. I'll show a screenshot of that in a minute, but that's the green bar that you get when you visit PayPal or a site that has undergone extended validation to get this special kind of certificate. So we started requiring CT in order to show that special extended validation UI. A little bit later, we started requiring CT for certificates from certain CAs that have been known to misbehave in the past. So that was a way of kind of shedding some light on how these CAs were behaving by requiring certificate transparency for all their newly issued certificates. More recently, we added a way for sites to opt in to CT enforcement themselves. So sites that want more security benefits from CT even before it's required, they can opt in and tell the browser, hey, I always want CT to be required for my site. And coming right up in April of this year, we're going to start requiring valid CT for all newly issued public certificates. I say requires valid SCTs here. There's actually a lot of nuance hidden in there. There's a very complex policy, not very complex, but fairly complex policy governing how many SCTs have to be present, what logs they have to come from, things like that. I'm not going to go into those details, but that policy is also kind of an important part of the gradual deployment of CT. So the results of this multi-year process of CT rollout is that right now we have about two thirds of connections in Chrome are CT compliant and almost three quarters of requests. So this is actually quite exciting because it's still a relatively small subset of connections on which CT is required. So it's pretty exciting to see this much traffic already being CT compliant, even though it's not always required. When we look at popular sites, we see about a quarter of the Alexa Top 10,000 are CT compliant right now. And that's out of about a little over half of them that support HTTPS at all. And we see pretty similar numbers from the Chrome user experience report. One kind of interesting difference between these two data sets just in general, the Alexa Top 10,000 and the Chrome report is the Alexa Top 10,000 contains domains that are popular as third-party requests, whereas the Chrome user experience report is domains that users spend time on as first-party sites. And if we compare these numbers to the connection numbers, like two thirds of connections, we can kind of guess that CT adoption is sort of concentrated in the more popular sites where users are spending most of their time. So this is good, but the question is, is it actually getting us any value? There is a very interesting crop of tools that make it very easy to monitor logs and see what's going on in the CT logs. And because of these tools, we've gotten a lot of value out of CT so far. So some of these tools are used by researchers who have discovered mis-issued certificates or other types of CA misbehavior. And some of these tools are used by domain owners like Facebook who have found suspicious certificates for their own domains. So even though CT is not fully deployed yet, it is definitely deployed enough to start getting a lot of value out of it. And that's partially because of this gradual deployment and partially because of this crop of very usable, accessible tools for seeing what's going on in the CT logs. So one might wonder how much pain has been imposed by this gradual rollout? How much, what burden have we placed upon the existing stakeholders in the web PKI? And the two stakeholders that we care about are CAs and server operators. So CAs have had to do a bit of work to support CT over the past few years. As I mentioned, Chrome requires CT in order to show this EV UI. And as a result, most CAs started embedding SCTs into their certificates. So when you go and you buy an EV certificate, it generally will come with SCTs embedded in it. And there's a bit more work coming down the line for CAs in the spring when they'll have to start embedding SCTs in all newly issued certificates when Chrome starts requiring that in April. So this is a bit of work that they've had to do to support CT, but we think that's kind of appropriate. They are the trusted third parties and the holders of all trust on the internet. So it's appropriate that they should have to do a little bit of work. And it's also worth noting that the whole design of SCTs was sort of built to accommodate CA issuance processes. So there was a lot of kind of flexibility built into the design to make the system appealing to maybe not appealing, but acceptable to CAs. So now we wonder, what do server operators have to do in this new world of CT? Today, most server operators don't and won't have to do anything special to support CT. You know, as I mentioned, in the case of an EV certificate, you just buy the certificate and it comes with SCTs embedded and the server operator doesn't even really need to know about it. And we expect this to be the case come April when we start requiring it for all certificates. You'll just get your certificate, it will come with SCTs embedded, don't have to do anything special. So this is great because we can't get every site on the internet to do anything. We have spent like five years trying to just get every site on the internet to support HTTPS. It's impossible. But there are these sort of advanced modes that server operators can do. So there are some sites that choose to support CT themselves by getting their own SCTs and delivering them themselves on the TLS connection instead of having them embedded in the certificate. Today, most of the sites that are doing this are larger sites that are doing it either for performance reasons because they don't want to send SCTs to clients who don't want them or for agility reasons to be able to respond quickly to changes in the log ecosystem, or just because they are very invested in the health of the web PKI and they want to support CT and move it forward. So what's kind of cool here is that because SCTs can be delivered in these various methods over the TLS connection embedded in the certificate, that gives a lot of flexibility and deployment. Server can adopt CT without its CA knowing anything about it, and a CA can adopt CT without its customers having to do anything special. And for bonus extra credit points, a server can do a little bit more work to get a lot more value out of CT. So we recently launched this header similar to HSTS, if you're familiar with that, which allows the server to opt in to CT enforcement. So the server can say, I always want to have CT enforced on my connections. So for servers that really want the security benefits of CT, they can opt in and get those today, even though CT isn't universally required yet. So this is kind of a nice situation for server operators. By default, they don't have to do anything special, but there are these sort of extra credit things they can do if they want to do CT in advanced mode. Finally, we do care a lot about what end users see. And we don't want the rollout of CT to cause a lot of warnings, certificate errors, breakage of the sites that end users are using. You might kind of, it might not be obvious, I guess, why this is something that keeps us up at night. These are just some hypotheses of things that could go wrong when we put on our pessimism hat. One is just bugs. CA Software has bugs. The servers that implement CT themselves have bugs. This policy I mentioned that Chrome has for when CTs have to be required, when what logs they have to come from, how many there have to be. That's a complex policy and it's not trivial to implement it correctly. In general, this is not really specific to CT, but errors can multiply like this. If you have a single broken connection, that can break many hundreds of requests, or if you have a single broken resource like a popular JavaScript library on a CDN, that if that library breaks, that can break thousands of sites. And finally, we have seen incidents of intentional non-compliance where a site is subject to CT requirements, but chooses that they don't wanna do it for usually for domain privacy reasons. And that ends up showing errors to users. Fortunately, this doesn't seem to be a huge problem today. Virtually all of the time that CT is required, so the connection would fail if it weren't CT compliant, we see actually successful CT compliance. Similarly, it's very rare that we drop the EV indicator because of CT. Another way we can look at it is a slice of the overall pie of certificate errors, and as you might guess from the numbers I just showed, CT is a very small slice of that pie. It is kind of interesting to look at that slice though. About 15% of those errors caused by CT are not bypassable, meaning the user has no option to click through, and that's because the site has opted into stronger security settings. Of those errors where the user can click through, the click-through rate is a little bit higher than certificate errors in general, so that's kind of interesting. We can't take this for granted though. When we rolled out CT requirements for a large CA, there was kind of a spike of errors due to a confluence of events, and so this is something that we have to be vigilant about as we roll out CT more broadly. So overall, I think this is a pretty optimistic picture of the usability of CT. We do see the gradual deployment that we want to see. We see a lot of value out of it even early on, and not a lot of pain for existing stakeholders or end users. But I want to conclude the talk by just highlighting some of the open areas, especially as they were open research areas, especially as they relate to usability. I mentioned in my overview of CT that there are these auditing protocols for making sure that logs are behaving honestly. But it turns out that in real life, these are a little bit hard to get right and kind of hard to deploy in practice, and it becomes especially tricky when we think about end user privacy and data consumption. So I want to highlight this as an open, active area of development. Could be a whole talk in itself, but I've included some references here for kind of what the open problems are, what the current state of things are if you're interested. The business of operating a log also turns out to be kind of tricky. It has to be this high availability service that presents a consistent view to all clients at all time, and there's only recently starting to be some more transparency into how logs are operating, how well they're doing. As you can see from this, this is a monitoring dashboard for various CT logs. So there's definitely some open work to be done here in understanding what kinds of log failures can happen, how the ecosystem should react to them, how vulnerable the ecosystem is to these different types of failures. And finally, I mentioned this complex Chrome policy. You're not meant to read this, this is just to say it's a little complicated, and it might become even more complicated as more clients roll out policies of their own. So there is an opening here for some debugging, visualization tools, help the owners of certificates understand if and how their certificate is conforming to these policies and what they need to do to fix it if anything. So there's definitely some work left to do in these open areas, but overall I think CT is in an exciting state. We do see the gradual deployment that we wanna see, and it's really exciting to see so much value gotten from CT even before it's nearly universally deployed. So it will be exciting to see how this keeps up and whether we're able to continue this trends as we roll out CT more broadly this year in April. So with that, I wanna thank some colleagues and collaborators who helped with this talk, and I'm happy to take any questions. Thank you. Thank you. Questions for Emily, please. Hi, Emily, thanks for the talk. It's really great to see you guys working on this. I think the internet really needs this. I was wondering if you have any thoughts on the bandwidth complexity of CT. So if I'm a website, I'm Facebook, or I'm Google, or I'm Microsoft, I need to monitor my public key, and I need to look in this plethora of logs that CT supports. And some of these logs are really big. I can trust the monitor, of course, but now I'm introducing a trust at third parties. And if I really wanna be sure, I guess I really need to download the logs myself. So do you have any thoughts on that and how to improve that? So from the Chrome side, we tend to care, think more about the client bandwidth side of CT, which, like the web client side, which is also a concern. This is part of why servers like Google don't deliver SETs on every connection. They deliver it to clients who want SETs. From the log operator side, yes, I mean anyone monitoring the log needs to see every entry. The guy behind you who's running a log right now might be able to talk about that a little bit more. But these are mostly large organizations right now. So for Facebook to monitor the CT logs, I don't think it's a huge burden for them. Thank you. Hi, Emily, thanks for the talk. At the beginning of the talk, you mentioned DigiNotar and the compromise that kind of led to this line of thinking and said that people were safe, right? Because there was pinning at the time of the DigiNotar hack. And now some browsers are moving away from pinning as a mechanism and sort of towards CT as a replacement. Without pinning, you mentioned how there's the enforcement and then there's the detection and how these are potentially equally valuable. Can you talk through what would happen today if we have CT but we don't have pinning if there's another DigiNotar compromise? Yeah, so I did wanna have a section in this talk actually where I compared CT to pinning for that reason and also for usability reasons. Didn't have time. So I think there are a couple of things wrapped up in there. One is that we find in practice when something doesn't work in Chrome, that doesn't actually protect users that much. If an attack fails in Chrome, users are gonna switch to the browser where the site works. So that's one of the reasons why we focus on discovery. But you're right that there are definitely, so okay, sorry, let me just answer your question. What would happen today is, so the attack would work. The user would accept the mis-issued certificate. When the attack is discovered, it would have to be revoked in some way. And revocation is not a solved problem. That's something that needs to be worked on as well. What would happen in practice today is that the discoverer of the certificate would alert the browser vendors who would generally deliver a revocation via kind of update. And if the certificate was mis-issued, which is one of the scenarios that we care about the most, then action would be taken against the CA and eventually it might be removed from trust stores. So how long would people be vulnerable in this situation? Depends on a lot of things, but it could be for the users of a browser that is able to get an update with the revocation, for it could be six, 12 hours, but for something to be removed from trust stores, we're talking more about weeks or months probably. Thank you. I think we only have one more question. Sorry. OCSP. This is not my field. Has OCSP gone away? I mean. You mean SCT delivery in OCSP? Yeah. No, it's there. I just didn't talk about it, but yeah, there are three ways to deliver SCT's TLS extension embedded in the certificate and OCSP. Okay. Yeah, let's thank the speaker again.


Koreans don't care literally. Like literally. We cannot care less.    I just wanted to let out all the white people out there and all that. Thank you. Literally, do not care. Hi, I'm Molly Jane and we're here today talking to one of South Korea's most famous crypto bloggers, Spunky and his channel, BitGosu. If you can't get over 1,000 won this year, I'm going to get a new one. So if you speak Korean, you can go check out his channel. But if you don't speak Korean, stay tuned with us on Cointelegraph where we talk with him about everything crypto in South Korea. Alright, hi. Nice to meet you and hear you. Nice to meet you too. I guess my first question is super basic, but you'll obviously know is how big really is the Korean crypto market, you know, in both in terms of crypto and blockchain. I think the Korean crypto market, by a percentage of population, it's the biggest in the world. Because pretty much one out of three or four person has bought Bitcoin or held Bitcoin here before. So people are aware and there are insane amount of exchanges like Korean won, local pairing exchanges in Korea and they're all running a business. So it just shows that the hype and everything is really, really big here. But unfortunately, it's all based on speculation pretty much. You know, it's Koreans are known to be hardcore gamblers globally and people want some life-changing moments, ASAP and crypto. It just seems like the next ride that can make it come true. Is that for people of all ages? Or do you see this more in the younger population? I think it's for all ages. And Koreans are kind of like that in general. Me myself being a Korean, I'm pretty much a Dijon gambler as well. But there's a lot of excitement and Koreans are very impatient people. But crypto is very fast. So in every category kind of fits the culture, especially the trading side, not really the technical or whatever side, the fundamentals and tech. And I mean, people are not so interested in that. Yeah, I was going to ask about that because you say crypto is so popular there and in Switzerland, where we went actually last summer to do a documentary on their cryptocurrency regulation and culture there, they call themselves the crypto nation because of how crypto-friendly they are. And then Malta calls itself the blockchain island. Does Korea have any title they want to call themselves? I know there's a problem there with the interest of the population, then the government is not as much on board. I would say Koreans are true believers. They're true believers. I mean, it's not like there has been some life-changing tech that came out of this country in the blockchain space so far. I mean, globally there really hasn't been anything. But I mean, a big percentage of the population being aware of crypto and has bought some type of some sort of crypto before just shows that the Koreans actually do believe that this digital currency has a bright future. So I would call the Koreans true believers. True crypto-believers. So one of the big stories we broke last week, or we covered last week, I should say, is that some of the bigger South Korean firms like Samsung are looking at the Samsung coin. So do you think that there are other interesting projects in South Korea that are a bit smaller than Samsung coin that people don't know as much? Because they're not living in Korea? I mean, there's a new coin that's made literally every day in Korea. You know, there's around 150 exchanges in Korea in this tiny country? Yeah, there's like 150 exchanges. Every exchange is listing new coins, trying to lure people to come trade on their platform. And there are new coins coming up, new whatever services. Of course, they're pretty much all a scam, but they're trying. There's new startups coming up. They're trying to do something. They're trying to make a difference, trying to build something up. I mean, it's still very, very much ongoing. It's not as big as it was before towards the end of last year. But I mean, it's still alive.   So, since you've been in this space for such a long time, and as you say there, as a coin made every day, do you think that the crypto craze in Korea has calmed down a little bit since the 2017, 2018 Bitcoin price rise? Because I know there was media reports that people even committed suicide because of the fall in Bitcoin prices in Korea. So do you feel like that craze is kind of calmed down now or are they still in the thick of it? I would say there's like a trend. There's like, we call this self like the market meta. It's like a meta. Let's say like towards early last year when Bitcoin was first starting to retrace pretty big time. And there was like an altcoin run and like everybody was just going into altcoins. So it was like an altcoin meta. And after that, towards like mid 2018, the popular coins were like exchange tokens, like trade mining. I mean, I'm pretty sure you guys have heard of that. Kind of started with Chinese F coin, but like every single, there are like 100 exchanges coming out of everywhere, like left and right with these trading exchange tokens. So that kind of drove the next drive. Like it was the next meta. It was like the exchange token, the trade mining meta. And after that kind of dried out, it became an IEO meta, meaning like initial exchange offerings coming from here and there. So people started concentrating a lot on IEOs. So they're like, what's next IEO? What's going to be the next big one? Blah, blah, blah, blah. I mean, the trend keeps on changing. The craze is always there. It's just that people focus on different methods of like fundraising or like listing or some kind of pumping up. We at coin telegraph are always covering news pieces about the government in Seoul using blockchain for all these various administrative tasks, administrative things, trying to make it more paperless, more streamlined. Do people notice that? Or is that something we just cover and people in South Korea go on living without realizing that the government is like is testing these blockchain? Well, I'm pretty sure it's not the South Korean government. I think it's just everywhere else. Like everybody, I mean, it gets people's attention, right?  It's kind of also like a big trend. I mean, all over Korea, like I know a lot of big companies in Korea, the executives would tell their people like why don't we have like some blockchain R&D division or something like that, you know? Like it's like, it's typed everywhere and everybody's doing it, but why aren't we doing it? It's kind of that thing, you know? It's kind of, you have to be kind of, you have to have something related to blockchain to be cool in general, if you know what I'm saying. So I mean, for the government as well, I mean, they don't understand anything, of course they don't, but they want to implement this technology because it has like, its advantages like being very transparent, being like this, the whole hacking issues, you know, blockchains is you can't really hack that stuff. It's a technology that could be replaced to replace a lot of previous services or some kind of service providers that they had. So they're looking into it. I'm pretty sure it's not just Korea, but everywhere else also. So talking about the hacking thing that brings it up, because like, maybe you don't know, but I'm a managing editor here at Cointelegraph, so I'm on the breaking news shift, you know, 12 hours a day, multiple days a week. And one of the stories that gets the most buzz is whenever there's something about North Korea. North Korea is hacking everyone. North Korea is funding their nuclear weapons with crypto. North Korea had a blockchain conference and loved it. Like, is this just hype stories people like to read about? As a South Korean crypto blogger, do you every day feel the threat of North Korea hacking your crypto or is this just like, kind of a drop in the bucket? This is something I have to get out there. It's for you white people. It's very, very funny and interesting because Koreans don't give a s***.  It's not in our interest.  Koreans don't care, literally. It's always the white people that thought over Korean news, you know, but us, ourselves, we cannot care less.  We just, we care if our coin is mooning or not, okay?  No Korean ever fuzz from Korean news.   I mean, please, it's just you people that are always fudding everything. I just wanted to let all the white people out there and all that. No, it's super nice to know because, I mean, I published an article about North Korean hackers and it will get, you know, 10 times as many views as any other article I published that day. And not just... Yeah, when a North Korean article goes out like that, we just think, oh, wow.  Lucky him. That's all we think.  And we don't care. It's the only way we think when we see an article like that.  That's all we care about. He's just another guy. North Koreans hacking something is the same as like some random guy from Romania hacking something. It's no difference.  Please stop fighting, everyone. I mean, it doesn't matter. I mean, who cares? Let Kim Jong-un just hack stuff and make his money for his missiles.  Why are you scared? I mean, seriously, it's just the same as any other hacker hacking coins. And there's no difference. He's just another dude that's hacking. Yeah, it doesn't matter. No, I mean, personally, I just, I only care about the views and I care about covering the research into it. Now the US is, you know, there's the Russian hackers that are using Bitcoin. There's this North Korean hackers.  My question for you is that everyone is in the Twitterverse and the crypto Twitterverse are freaking out that Bitcoin's price is staying stable. You know, there's all this fud and Bitcoin is just You know what? I can explain this as well. You know why? Because Koreans don't care. Again, you don't care, you know? This Bitfinex bullsh** fud has been going around ever since I started crypto.  Like we are so sick and tired of this stuff, people using the same news to flood people again and again and again and again. It's like, like, whatever like hacking, like tether, like there's certain subjects that we found immunity. It's like, okay, it's going to go by again. It's another thing. I think Koreans fud to different things. It's not really these, it's honestly, it's not new news, you know?  And every time there is some serious fud, you know? Like I fudded a lot before, but now I just couldn't care less. So I think it's Asians finding a lot of immunity over these repeated same news that we just don't care, which is another reason why the price is more stable. Oh, that's just my personal perspective, though. I don't really care anymore. So to put it shortly, all of the big, big news stories that, you know, the Washington Post and New York Times pick up because the Asian market, the South Korean market is so big and important. And because you guys don't care, that's why the price is fine. We don't care. Literally, do not care. Because one thing is Koreans don't use tether.  We have 150 exchanges that offer Korean won, our local currency pairing with every cryptocurrency out there. We don't even use the Bitcoin pairing market, you know? We find even like the fees very expensive. All these global exchanges, their fees are like 0.25 percent or something. Korean fees are like 0.01 percent or something. Like, so there's no absolutely zero reason for us to use these international exchanges or like these Bitcoin or Ethereum pairings or like this tether bulls*** stuff. We just use our thing. So if tether goes to zero tomorrow, we cannot care less. That's all I can say. So you talked about how Koreans are, you know, it's gambling, it's about the speculative nature. But can you anywhere in Korea use crypto to actually buy something? Go to a store and buy something? Well, that's the funny part. No. No, nowhere. You know what? You know what was very funny? Like in the last year, December, I was holding like a very big event, but I was so sick and tired of all these crypto conferences, the same s***, repetitive boring stuff again and again. So I wanted my event to be very unique. So we called it a crypto festival. And it was just, it was a crypto food festival.  So I wanted to build that. And we researched like 20 different coins that provide like some kind of crypto payment solution. But nothing worked, like literally. They're just all s***, even like the global products. They're all scams, nothing's functioning. So I could not, we couldn't get a single like crypto payment solution to the venue to make this payment going. So we had to do like the old fashioned way and we had to like use Ethereum and stuff. But anyway, like we tried this and that and we're looking for successful, useful stuff in the crypto space at the moment. But nothing's working in payments. Like everybody talks about these credit cards and master cards and whatever partnerships trying to moon their s***. But nothing really working. So it's kind of very, it's very unfortunate actually. But we're looking for someone to actually make it work because since a lot of Koreans are holding crypto, since they are holding crypto, like we'll actually be willing to use it because our bags are just so heavy. You know, we're just so stuck. We're going to have to wait like five years or something until we make our money back anyway. So we got to do something with it, you know? So we'll be happy to use it if there's like, if it's useful somewhere, but nothing's working here and you can't find anything. And one other thing I wanted to comment back to the tether thing. This is what worries Koreans, okay? When the Korean bad news goes out, we're like, oh f***, the white people are going to f*** again. You know? That's our concern, you know? Like we don't care. Same with tether.  Like they're going to be like f***ing and like dumping, but like we're not scared, but we're forced to like, I don't know, like trigger stop losses or like sell or something because we expect the white people to sell because they f*** because they're so freaking scared and like weak hands and stuff. So that's another Korean perspective I wanted to get out there. So does anything scare Koreans in the crypto space? Oh, Koreans, of course. Like Korean stuff, it's like Korean legal issues. For example, there are no regulations in Korea. It's not like China. It's not like a lot of countries that crypto is becoming really regulated. And Korea, there's really nothing. There's like literally no law. So you can steal someone's crypto. It's not like you can do anything about it, it's completely the wild, wild west here. So when they talk about regulations and if it's coming out of like a serious voice, that's scary, you know? Or like they talk about taxes or like, oh f***, we have to be sell them. We have to pay taxes. Like, you know, that kind of stuff is very scary, you know? So, but when someone gets hacked or someone dies or some tether goes to, that's stuff we do not care. It's like it's when the Korean government is trying to put pressure on crypto users in Korea, that is what is scary. So it's like, it's a completely different perspective and fun. Thanks for talking about the white people and the fud and the... Okay, I'll make a last comment. Sure.  Sorry, my language is, I get very emotional talking about this because I've noticed. I've been, it's so many times because of these white people always fudding over Korean news that we do not care less about, you know. So when Kim Jong-un talks about hacking Monero or something like that, you know, give him a clap, you know, he's making some money for himself. So I don't know, it's like, then he's going to make more nukes and it scares us only, not you people, you know. So stop fudding over like scary Korean news because we don't care, we don't sell over that stuff. We only sell because we're scared that you people fall over at itself. You know, it's like it's the only reason. So just please keep that in note and Koreans are very strong people believing us, we're strong holders. Thank you. So here with us was Spunky, one of the most famous South Korean crypto bloggers. So who's your favorite crypto blogger? Let us know in the comments, maybe we'll be able to talk to them in the coming weeks. Do you want to documentary about cryptocurrency and blockchain in South Korea? Write your comment below.