All right. Well, I have a bunch of fun stories to tell and then some lessons to draw from them. I better keep an eye after I promise that I was going to keep us more or less on time. Here's the clock. Okay. I'd like to begin by saying this. Other than my children, and as you know, one of them is here with me in the audience today, I have never been prouder of anything in my life than to have worked with and been associated with Ron Paul. The cynic will scoff, but I mean it when I say that the man is genuinely a hero to me. Now, the biggest project I've worked on with him occurred after he left Congress, and that is the Ron Paul Holmes School Curriculum. It's a K through 12 curriculum. It's video-based and self-taught, which means that parents don't have to run themselves ragged. It gives students, wait for it, both sides of the story. How about that? Revolutionary. And it equips them to do things that no government school does, how to communicate effectively, how to manage their finances, how to run a home business, the sorts of things you would think they would learn in a school, but oddly enough, they don't. The website that I use for it, ronpaulhomeschool.com. Now, as I say, this talk is called Lessons of the Revolution. So here's the first lesson drawn from that homeschool curriculum. Politics isn't everything. Think about the enormous sums that have been blown by political action committees on hopelessly badly run campaigns. If even a tiny sliver of that had been spent to develop a homeschool curriculum that would educate thousands, tens of thousands, hundreds of thousands, possibly millions of people, think about where we'd be then. But it never occurred to anybody with all these billions of donor dollars floating around DC think tanks and political action committees, never occurred to anybody, maybe this isn't the best use of that money. How about a K-12 homeschool curriculum? That was Ron Paul's idea. Now, as I look back in anticipation of this talk, on the years 2008 and 2012, the years of the presidential campaigns we recall so fondly, so many fond memories came rushing back. Of course, we all remember the Giuliani moment, the Rudy Giuliani criticizing Dr. Paul in one of the Republican debates for having suggested that the United States might have been attacked on 9-11 for some reason other than, we're so awesome and they're just envious of our awesomeness. He just refuses to talk to people that way. He's not going to do it. And Rudy Giuliani piped up, ah, I hope the congressman didn't mean that. And you know how American society works. Somebody utters the truth by accident usually. Somebody else demands that that truth be retracted and the person sheepishly says, oh, I'm so sorry what I meant to say. Dr. Paul revolutionized the way American society works because he said, not only am I not taking it back, I'm going to double down on it. And the next day he brought the guy who had been the head of the CIA's bin Laden unit, had a press conference with him and said, here's a bunch of books on what led to 9-11 that I think Rudy Giuliani needs to read because he seems so ignorant and uninformed. Like whoa, you were supposed to say, I'm sorry I said this, I was so wrong. We were attacked because we're awesome. And no, no, he went on the offensive. Yeah, that's my man. Yeah, go after Rudy Giuliani. That never happens, but it happened that day. I remember the massive turnouts at these state Republican straw polls. I went to one of these in 2008 when I was living in Alabama. Dr. Paul beat all the other candidates put together in this straw poll because who was going to give up his Saturday afternoon for Fred Thompson? After all, right? But we all did it. We all did it for Dr. Paul. I recall the thousands and thousands of cheering kids who flocked to him wherever he went. I remember there was one university event and it was either Michigan or Minnesota. It was one of those M universities and I just can't remember which one. But I remember seeing him come out to this packed audience and he did this. Like I can't believe what I'm seeing. I can't believe this is happening. I remember the grassroots put together in 2008, I guess it was 2007, an event called Paint the Town Ron. And at night, we went around our towns and we hung up signs saying Ron Paul for president, Google Ron Paul, who is Ron Paul? So the next day everybody wakes up and it's all over town. Now I would like to tell you that as good libertarians, we very, very carefully distinguish between public and private property when we put these signs up. I would like to tell you that. I remember the Ron Paul blimp that flew over the United States spreading the newspaper is going to tell you about Ron Paul, they're going to put a blimp in the sky and tell you about him. No one else is doing that for anybody else. Or my friend Michael Morisco, who got on his bike and rode the entire length of the United States to spread the message of Ron Paul. And you think, wow, it's amazing that a cyclist would do that. He wasn't even a cyclist.  He was not a cyclist. He did this because he loved the man and he loved the message. Who was going to do that for Tim Palenti? You ever remember who Tim Palenti is? Whoever said, my life was changed forever when I encountered the philosophy of Mitt Romney. So I recall the joys, the friendships, these fun projects, the laughter. And yes, indeed, of course, also the heartache. But I also recall the blackout. So here's another lesson. The media is not just biased. The media has an agenda. Now, today that seems like, well, old hat. Yeah, I know I'm shaming you for clapping because it's such an obvious thing to say. I'm sorry. I hate to say things that are obvious, but it wasn't that obvious to everybody in 2007 as it is today. I think a lot of us were actually, as cynical as we may have been, we were actually surprised, weren't we? And just how far they would go to suppress the message of Dr. Paul. Today we're not surprised. Today, you're skeptical of, you know, seven masks and whatever.  But this was a guy who was shooting laser beams right between the eyes of the American establishment. He wasn't saying the top income tax rate should be lowered by 3 percentage points. He was saying there should be no income tax. He wasn't saying we should invade country B instead of country A. He was saying, how about we not invade these countries and get our troops out of there? He wanted to abolish every evil, every force for evil in American life without compromise, even when many Americans confused those evils as forces for good. And so the media hid him. It got to the point where John Stuart, remember him from the old daily show? John Stuart is not on our side, but even he was a guest. He said, when did Ron Paul become the 13th floor in a hotel? I remember there was a headline from Reuters in the 2008 campaign following one of the Republican debates. The headline was 2008 Republicans back war. No mention of Ron Paul being very ostentatiously anti-war, no mention. Then later that night CNN had their post-debate spin and they had Ariana Huffington and she said everybody on that stage supported the war and no one questioned her. And that's, that's Orwellian. That's, that's bizarre. And I already told you in the interlude about MSNBC putting a screen up about fundraising and the political war chests of the various candidates and they skipped over Ron Paul who was in second. So they, they skipped right from first to third. I mean, I don't think that was an accident. They had an intern. I mean, Dr. Paul is a very easy last name to spell. It wasn't that. There's a pattern developing here. All of us recall similar examples of this. So there's a lesson. You know, we're going to have to build our own things and fight, fight this fight ourselves. How about the way the official conservative movement greeted Ron Paul? Oh, the conservative, oh, they're all for lower spending and oh, they just love the Constitution. It's their favorite thing in the world. And then somebody comes along actually intending to implement these things and they treat him like the return of Godzilla. That's the conservative movement for you. He's a kook, they said. And a lot of folks who should have seen through that, a lot of folks who thought they were cheeky because they voted for Mitt Romney allowed themselves to be snookered. And now I'm not saying that we have to, they have to hold their heads in shame for the rest of their lives. We've all made mistakes in our lives, but that was a big one. That was a big one. You had the opportunity to support the Thomas Jefferson of the 21st century.  They could have, rather have Romney. That guy seems like he's got a lot of really good ideas and he'll stand up for me. Okay. Imagine Mitt Romney being in charge of COVID. Let's just put it that way. Okay. We all know how that would have turned out. And so those people, many of whom today now see the light. They, many of these people are fighting against the insanity and the lies surrounding COVID. And these people supported anybody but Ron Paul in those days. Well, they helped to give rise to that kind of Republican party. And now they're getting it good and hard. The one guy who would have had the guts to stand up to a Fauci and all the rest of them is the one you said, oh, he's not respectable enough for me. Respectability is what I value above all things. What made him non-respectable? What made him a kook? What?  All of that's correct. Monetary policy. He said, if you favor the free market but you also favor the Federal Reserve, there's some kind of disconnect going on here. Because the Federal Reserve, especially in its modern version, is like a central planning agency. And it's going to plan out and balance employment and inflation because it thinks it can do that with its various tools. Not to mention it pushes interest rates artificially low. And if you believe in the free market, wouldn't you think there would be negative consequences of a government-established monopoly artificially pushing interest rates to a level where they don't want to be? You don't think that's going to lead to any bad consequences? F.A. Hayek won the Nobel Prize for telling you that's going to set the business cycle into effect. You're going to have an artificial boom, and then you're going to have a bust that's going to devastate a lot of people. We got to talk about this. That's what Dr. Paul was talking about. Because of his knowledge, he was able in 2001 to go on the House floor and say, this tech bubble that just burst, they're trying to replace it now with a real estate bubble. And that's going to fare no better. How about that? Meanwhile, one of his opponents, just weeks before Fannie and Freddie went belly up, said that the idea that there was anything wrong with the economy is just carpeting criticism from left liberals. That was the intellectual level Dr. Paul was up against. And also, he shocked people. You're not supposed to go to Florida and call for free trade with Cuba. No focus group tells you to do that. You're not supposed to go to the reddest of red states, South Carolina, and say, we should legalize drugs. So he's a kook. No, no. He's an honest truth teller who doesn't measure every phrase he utters according to focus group results. So a lot of people now who are fighting the good fight against all the madness, they learned a lesson from the Ron Paul revolution, good and hard. You should have listened. You shouldn't have fallen for the propaganda. I'll never forget. I'll never forget. One night it was time for a Republican presidential debate. And Sean Hannity said, began the coverage by saying, well, tonight all eyes are on Tim Pawlenty. What kind of a lizard person are you? Why would anybody's eyes be on of all people in establishment bore like Tim Pawlenty? And then Sean Hannity professes to wonder, what could have gone wrong in the country? Oh, okay. Well, look in the freaking mirror. Maybe you'll get an answer. I might add, by the way, who are the two best people in public life right now in terms of elected officials on the COVID matter? Well, they happen to be two people who were created by the Ron Paul revolution, Rand Paul and Thomas Massey. We gave them to the world. So now why did Dr. Paul do all this? Why did he, why did he defy political convention time after time? Well, first and foremost, we know a good chunk of the reason. He's an honest man. He believes passionately in these ideas, wants them to be heard. But another clue and yet another lesson of the revolution comes from Dr. Paul's repeated reference to an essay by Albert J. Nock, I think from the 1930s called Isaiah's Job. Now, Isaiah's, I think probably he, I think Nock more wanted to refer to Elijah, but it doesn't really matter. Listen to the way Albert J. Nock adapts the Lord's instructions to Isaiah into a modern vernacular, and see if you don't hear something that sounds a little familiar, a little like maybe, maybe we know this story. So this is the Lord speaking to Isaiah through Albert J. Nock's interpretation. Tell them what is wrong and why and what is going to happen unless they have a change of heart and straighten up. Don't mince matters. Make it clear that they are positively down to their last chance. Give it to them good and strong and keep on giving it to them. I suppose perhaps I ought to tell you that it won't do any good. The official class and their intelligentsia will turn up their noses at you and the masses will not even listen.  Well, what's the point of embarking on a mission like that that's doomed to failure? Well, here again is Nock speaking as the Lord. Ah, the Lord said, you do not get the point. There is a remnant there. Remember Dr. Paul talking about the remnant. What did he mean by that? There is a remnant there that you know nothing about. They are obscure, unorganized, inarticulate. They need to be encouraged and braced up because when everything has gone completely to the dogs, they are the ones who will come back and build up a new society. And meanwhile, your preaching will reassure them and keep them hanging on. Your job is to take care of the remnant. So be off now and set about it. And that's what Dr. Paul did. He looked for this invisible remnant, gave them comfort, made them aware of themselves and provided them a rallying point. So if he sold out for mainstream respectability, he would defeat his purpose entirely. Those approaches repel the remnant, said Nock. But on the other hand, the truth teller who appeals to the remnant will find them. Now, it's true, Dr. Paul wants to make his messages appealing to as many audiences as possible. And so he'll emphasize certain things that will resonate most with them as their way of first getting into our message. He never gratuitously drives anyone away, but he accomplished this task not by the usual method, which is to water down the message and obsess over focus group results. He simply explained himself boldly and without retreat. And we've grown so unaccustomed to that. We're so used of automatons and robots talking to us that this immediately grabs the attention of the thinking person. Now, there are a lot of people who do not want their worldviews challenged. They want endless goodies. They want checks with their names on them. They want to be flattered. They want to be told, you're the awesomest of the awesome. And that's why your government is hated around the world because we're so awesome. Well, somebody who's at that moral and intellectual level is not going to understand Ron Paul much less support him. So it's frustrating and fruitless to appeal to people like this, said Nock. And here again, Albert J. Nock. Isaiah preached to the masses only in the sense that he preached publicly. Anyone who liked might listen. Anyone who liked might pass by. He knew that the remnant would listen. And knowing also that nothing was to be expected of the masses under any circumstances, he may know specific appeal to them. Did not accommodate his message to their measure in any way and did not care to straws whether they heated it or not. As a modern publisher might put it, he was not worrying about circulation or about advertising. Hence, with all such obsessions quite out of the way, he was in a position to do his level best. Now, I think he had such fundraising success as he did because the remnant had never been sought out by a presidential candidate before. This was an intelligent man who defied all political convention, taught the public about things they didn't even know they should be interested in in the first place, and had a record of consistency that impressed even the most hardened cynic. That got their attention. And now here's yet another lesson of the revolution. Although Nock spoke of the remnant as if it was a fixed number of people that you could seek out but not expand, Dr. Paul has shown that the remnant can be increased, not just found and inspired. And his commitment to the truth, even when it seemed to yield him only grief, seized the attention of a great many apathetic Americans and added them to the ranks of the remnant. Nock further described the task of finding the remnant as largely a thankless job. You're going to look in vain for tangible results. In any given society, the remnant are always so largely an unknown quantity, said Nock. You do not know and will never know who the remnant are nor what they are doing or will do. Two things you do know and know more. First that they exist, second that they will find you. Except for these two certainties, working for the remnant means working in impenetrable darkness, said Nock. But Nock lived before the internet. Ron Paul now knows who the remnant are and there are millions of us. He has a sense of their numbers. He knows some of the things they're doing and we all know some of the things that everybody else is doing. He knows he's had an impact. Nock didn't think this was possible. In his day it wasn't. But Ron Paul did that job. He did, I say, his job. He found and built up the remnant. And as it happens, this remnant is now that group of people doing their level best to resist the irrational and unjust commands being issued by their government. Here's a parallel. Pope John Paul II shortly after becoming Pope said he wanted to travel to Poland and offer public masses there. This was not something the communist regime would have put number one on its list of things that had favored. But there was no way they could stop it. And what mattered even more than what John Paul said, although he did say he did strongly suggest to them that there was nothing permanent about the iron curtain. But what mattered the most was how many people came out to that. Some of the largest crowds ever. And they look at each other and they realized how many of them they were and how few the ruling class were. And that sparked just the right kind of thinking. That's what Dr. Paul did for us. We all felt scattered, isolated. And then we all came out, looked around and realized there are a lot more of us than we thought. And I told you earlier that when YouTube took away the ability to downvote things, that was its attempt to prevent us from realizing what our numbers are. Because every time the regime puts out one of its propaganda videos, it would be overwhelmingly downvoted. So they just took that away. That says something about our hidden strength. And again, we should remember, if RFK Jr. can get a book to number one in terms of sales in the country, in the face of a complete blackout, the remnant is out there. Now, we may not be the majority, but there are a lot more of us than we thought. And when it comes to fighting the current insanity, I happen to believe that most of us who are against it are far, far more intensely against it than most of the people who favor it are in favor of it. Some of them are in favor of it because it's what everybody else believes. And so they just want to quietly go along. But I feel like all of us who are against it are against it with every fiber of our beings. And let's remember too, at a time when we may feel demoralized, that their side has the bootlickers, the yes men, and the automatons, but our side has the rule breakers, the individualists, the creatives. I wouldn't count us out just yet. It's with this strength that we have, this newfound strength recognizing ourselves as the remnant, this strength that Dr. Paul shared with us, that we will come out on the other side of this victorious. Thank you.


Sunday Night Baseball brought the drama again four to three bottom nine judges up And this one is brought to you by draft Kings when you download draft Kings use promo code John boy Matt Barnes who almost bought my parents house is pitching and he throws a ball outside and judge says Oh, okay, and then another ball way outside and jet says, okay, you're not pitching to me. Oh, I get it I'll just take the next two. Yeah, and go to first. Cool only get here on the team Don't pitch to me. Come on. Glaber get it done Glaber gets it done double down the line Judge the big man was moving for some reason and doogie bobbles it and judge goes first to third Old judgy five strides gets around the bases pretty quick for a giant So now it's tied up and this guy gets left hanging and Barnes is like damn Maybe I shouldn't have pitched a Glaber to they intentionally walk Gary to put the force on first up comes Rugnetto door with two outs now takes that for a ball takes that for a ball staring at the pitcher like come on Pitch to me takes that for a ball. Uh-oh as a strike takes that for a ball Uh-oh as a strike you're not happy about that at all So now we got a 2-2 count and no doors catching his breath and then he swings at that one Everyone thinks it's a swing and a miss but it hit the umpire But the catcher knew it Glaber thinks he scored the go-ahead walk-off run. They say no go back. That's a ball Full count and that's a ball. No, that's strike three should have been bases loaded walk One of the more egregious miss strike calls and look at the old guy behind home plate He knew it. No, no, no, no He's got good eyes He's old and science says your eyes get worse as you age. Look at this. It's just not close. It's just It's just really not close. I think that's the best way you would describe this pitch not close And Phil is arguing so the umpire says you're done Phil and throws him out So Phil Nevin the third-bent third base coach who's not the third base coach right now And see they're trying to stop Phil from going out because Phil's been really sick He got COVID even after getting the vaccine then had another sickness He lost 22 pounds, but he's still feisty as ever and the collar on his shirt looks like home plate So that's cool.   He's mad He got kicked out next batter the next inning sessa throws this pitch in the 3-2 count And they call it a ball and Gary wants it really bad and that's a ball but what happened to the last batter Yankees are gonna be upset and Hitting coach Tim says let's go.  And he says well he was attacking us like oh come on so Boone goes back to the dugout He's got to let know which coach is in trouble here and Tim's is like it's not me and Mendy's like me.  He's really fired up. He said he didn't say anything and the ump says well I don't care. I already did now. He didn't say anything.  You know my gosh Just a harsh. Oh my gosh from Boone and the ump says whatever one of your coach got ejected out care So Boone you threw me out. I didn't say a word man and Marcus Tim's just sitting on the bench saying like I think they meant to throw me out man and and Boone's so Fired up. He's blowing gum and this one was brought to you by draft Kings And if you bet the Yankees a majority of the money was on the Yankees in this game They lost because the Yankees lost and the over under they lost to and Ruby lost


And cabbage that's what that's it that limp you got going on there And what is an SI joint? Yeah, he's got it and you are not a doctor, right? No, but I've done chiropractic research for 50 plus years Yeah, I had I had a really strange friend and He started me out on it so it's been a long Long actually I hate to admit it's actually more than 50 years I just like but I used to work with professional mixed martial arts fighters And I used to I did a lot of like stand-up work and adjustments in locker rooms and stuff like that and and putting Joints back into place and things like that for fighters and But I used to I used to have just like a regional chiropractic school in my home actually in Iowa and but yeah, so It wasn't anything I really wanted to do. It was just something that I had a gift for I guess back then But now I don't I don't really do chiropractic.  I'm from Iowa Uh-huh okay from the Yeah, but that's the that's the sounding Iowa's were Is that Davenport, Iowa is with the origins. Yeah, Davenport, Iowa. You got it And my best friend my best friend graduated chiropractic from northwestern And so I've worked with those kind of chiropractors for years And we just we used to just do some strange research stuff But energy I I'm working mostly with energetic stuff now and uh It's great. I I know personally as a fact that what you're doing doc is like Is making some profound changes in people when you're doing emotions and chiropractic. I mean, it's just invaluable Let's get rolling. He's incredible. All right. Let's do it so Don Lynch in mexico dr. Jeffrey Benton in los angeles and the victim And the patient debbie dasher who's willingly giving her body As she is conscious over to science And it's going to lay on the table and let these mad scientists More do it. Thank you. And uh, let's see what gets created. So just to start out do you want to know specifics or just Would you like to use your gifts for my body? Yeah, I don't I don't want to know anything I'm just going to watch how your body reacts and feel it and and go with the flow here And if I pick if I pick anything up, I mean, I'll just mention it but that's fine All right, I'm gonna start doing my typical thing.  Not as well Okay, so if I go like this, does it feel better? No, of course It feels a little worse Which side? The left side Left side Bend this knee Solid Bend this knee Solid Hold this leg up That's all Hold this leg up He said Let's start with this side Hold this leg up Lift it up Good breath in Pull this leg up Up a little higher Lift it up That's really good Hold this leg up There Keep breathing Hold this leg up Get in there Lift it up Hold this leg up That's good Lift this leg up That's stronger Lift it up Hold it Higher Pull it up higher That's good It's strong to be here But if I stretch it out a little bit more Then it goes up Higher Up and down Left G max Up and down Push to the right Push to the left Now this side Right That's good Bend both knees Put it together Top and bolt down to the right Push against that hand And again push And that's good So that's like your Your core is weak I should consider that Like a pelvic concussion All this stuff So we've got What the deal is with that Bend the knees again Top it out to the right Hold Keep it there That's getting better Push to the right again That strengthens Lift your head up Even more like work up towards the camera And that weak So now follow my finger And then keep your head in that Looking to the right there Everything Everything Keep pushing here Take a breath in Push Keep looking in that right place And breath in Good Lock everything Left to the right Push it again And that is now locked Push again to the left That one is also locked Push Push against that hand That's not it That's not it Up to the left That's super strong Actually I don't even know what you need Push left Something stronger just like that So lift your head up again And that That goes in again And once again follow the finger Yes, move your head a bit Look out there again There it is, keep looking Push against that hand Hold on Okay That's like a double A double couple of concussions both ways Lock it out to the left Solid Lock it to the right Okay good Flip over Hold this on the In the back Hold the foot up Good, this way now No go Okay, well then we'll come back to that Hold the thumb up again Maybe your body will just process it Push in Can we hit that one? Can we hit this one?  Sure, go ahead All right So I think you're on the right track there about Abdominal stuff If you do that muscle test again That you just did with her right arm Feel that weakness In her body It's actually abdominals Lower left quadrant Now Just feel that Just take a deep breath Everybody just take a deep breath In and out We're activating the relaxation response Stop right there Take a deep breath Just a little bit One inch lower Go straight down the abdomen Stop right there Just feel this Now muscle tester Hold on a second Go down to the lower Right up there Right there Right in the middle Just a little bit Right in there Now just keep your hand right there For just a second Now Debbie just felt that shift I know she did Still moving We got something going on I would still say There's something like I'm getting right atlas still Nothing major Right atlas and what Yeah This could be the insertion of the UL That's interesting You could go to the UL Sequel valve there too Definitely abdominals Yeah this is TFL This is related to I think large intestine However Actually I'm not just Just a little bit more quadriceps Than TFL But it's still Abdominal More GI How's that? Right so us Right now Sailing That's nothing there Yeah That used to be We got something Deeper in here There's something else Some other Deeper issue Hey doc just keep your left hand Right words out Right words out Just a second Tell me what is this This is connected to the leg Well This general Spaces of college So this is A reflex Between Small intestine and large intestine So I I hear a lot of grubling It's good It's good too Yeah I'm going to energize for large intestine A little bit more and feel this Feel it And Debbie take a deep breath right there And feel the shift Alright check it now And that's solid on as well Actually back online nicely Just feel it No power No power on the left so is Yeah So you know I'm actually connecting both Val to Houston and he'll see for Val Yeah So if I was in one We're never going to squeeze This would be it This would be it This is what I feel It doesn't hurt them It really does Yeah This is not going to be good Yeah Really Good That's what we're doing Here Solid Super strong Push out that way That's a little Push out that way Put this thing on your forehead Why You have a TFL It's not firing up So it's just firing up Push out That's okay TFL is not firing up But don't do Chart Hey doc do you adjust knees and feet I mean I'm getting her right foot It was just on fire Her right foot From the first moment Yeah Do the other foot too That's right Yeah It's changing Okay So touch Put this finger Right there Opposite side Push out Put a ball Put everything on Push out There it is Push out The position there The large intestine already in beginning and end points What we're doing here Yeah I just saw energy Built a lot of lightness Push out Damn Yeah We did He's going to remind me This one was this one turned on, it was right. Okay. Right, so was. Then you put these two together. Right, well, yeah, that was left, which was rather cute, plus ice-cream, but then we did left TFL, which was beginning in and of large intestine meridian. Okay, that's what we did. Pushing out again, still on, pushing out, excellent. Wow. Other side, much better. That's amazing. Push out, good, let's go on, and this knee, push that way. So that's next, drop that down, and this knee, push that way. Okay, so quadriceps, start with this one first. This is related to our, like C1, C2. Yeah, moved on me, drop that one. That's one, good, solid, good. Keep pushing against him, good, push again, good, push towards the ceiling, again, this one, oh, this one powered up mostly, let's see a little bit more, not that side, the opposite side, okay, and push, breathe, push, solid, weak, quadriceps won't fire up, it's going to be fine.   Well, okay.  You mean on this side? This is the one that gets weaker, yeah. Yeah, yeah. But I'm feeling, it's like just up, it's just, it's, it's not the scapula, like maybe it's just above the scapula and a little bit to the left or something like that, like back in there. I mean, yeah. Can you go to the scapula or superior to the scapula? Superior. Superior. So, like up in there, right in there. Just put one finger right there. Just put one finger right there. All right. Where you're at. All right. And feel the shift. All right. Check it. See if it changed anything. All right. Go back and move, it actually moved a little bit.  And it's up and it's be towards her, go up and to her right, just a quarter inch, eighth of an inch, just right up, right in there. Stop right there. Just put a finger right there on that spot. She's having a shoulder gasm. Got weaker. Yeah. All right. So we're on the right track, actually. So let's see. And then can you muscle test yourself, Doc? Can I, can I, let me see if I can demonstrate something to you. So if you come, yeah. Okay. Just like right in there. Just kind of muscle, muscle test yourself right there. Okay. Check it. Check. All right. My muscle test yourself. Okay. All right. And now, and now muscle test again. This is a little weaker. This is okay, but this is a little weaker on my shoulder. Pull it out. All right. Now just a second. Okay. Now just feel this. I'm going to, I'm going to, I'm flipping your energy. Just feel this. Now muscle test yourself. That's weak. Okay. Just okay. I'm going to explain something to you. This phenomena that I discovered that, you know, I live and work in Mexico. And I've worked on thousands of people down here. And there's a phenomena that I found when, when I got invited to go up and work on people up in Colorado and stuff in New Mexico. And I found this so often up there. And I didn't find it hardly ever down here in Mexico. And that was that when I think it's because of like e-smog and all this stuff is that I call it the cross-wire syndrome. And you don't really get clear signals running through the, through the body. There's at the top of the, you know, somewhere in the system, you know, like the wires are running like this and electricity actually flows on the outside of the connectors. Okay. And if you have two of them like that, like that parallel, it's okay. But if you start to cross them at all like this, it messes up the clear signals get messed up. And like in the like the meters, like the electric meters that they're putting for you guys up there, to make that, that 12 or 24 digital display, they actually take your, their main lead, this is 110 and they run another wire across it and it picks up the 24 volt to run the, the LCD. Okay. And so that's what, that's how you get dirty electricity on the other side of that where, where it's looped. And the same thing is happening in the body. Okay. So like now, if you, if you would, when you send a pulsed energy through the bag of water that you are, when you send a pulsed energy, it's just like a pulsing thing, just like that, it will actually go to those points and the body senses those points and kicks in the relaxation response. The brain will go there. And then when you take that deep breath, it will actually fix the problem instantly. So now I picked that up on you and on her, both. So like when you're muscle testing, sometimes you're not getting a clear signal. And plus in your office there, it's over on your left side there. I'm looking at my left side be on your right. Okay. Like there's, there is definitely a field there. If you muscle test yourself here, and go over and sit like on your other little stool over there and muscle test yourself there. I mean, you felt the difference right there. I could. I mean, I do have, I do have a few things. I do have a radiation homeopathic and I actually have these, these filters, these ENF filters that go on the phone. So I can actually test, I can test Debbie and I've never tested her before on those. Well, there's, there's actually a way to fix the body. Yeah. So, so that it doesn't react to these things. Okay. But the first thing you got to do is clear that cross wire effect. So you get clear signals. Like when you're muscle testing, sometimes you get, you get mixed and sometimes it might test positive when actually it's not, maybe it's a little on the negative side. All right. So like on yourself, I mean, just for yucks, just tap yourself on top of the head a few times. And now take any breath and blow it all the way out. Tap around the crown chakra right there. Okay. Now stop tapping, stop tapping.  And, and now muscle test yourself again, sitting right there. You can do the tap Debbie right on the top of the crown chakra there. And then go back and muscle test that right, right side again, right on the crown chakra, right in the middle of the top, right there. And go back and muscle test that right side again. It's even worse. It's even weaker. Yeah. Okay. So, okay, now you're, now you're getting clear signals. Okay. So we get it. Let's see where it's, where it's actually coming from. Just once again, just muscle tester right there. Just muscle test. Okay. It's like mid thoracic, right side. So it'll be a corresponding spot probably in the back. It'd be like not at the shoulder blade, but right somewhere in the mid thoracic. I've got a spot. Yeah. Yeah. The veracity of muscle testing is affected by numerous things. I've been, I've, I've studied applied kinesiology for, you know, 40 plus years and it's an art and a science combined. Her shoulder got strong enough to like, it's got no power there. So the anterior, what is that deltoid? The anterior deltoid. Neck flexors. I think you're in the right track there. Energetic shift right there. It's still moving. Yeah. It's still moving though. There's a shift there. There we go. Yeah. That was good. There we go. So this muscle anterior deltoid related to the gallbladder boridium.  It's quite locked in today once. I feel a pain in my arm somewhere inside of me. And then, and I know it's connected to here and I'm not sure I understand, but I know it's going to. So this is like, oh, this right now, that's strong. Hold on to this muscle. So this is like a big, shrunk circle muscle. So I had one of these. You can't, you can't.  So, so there's the question is what's in there? So the question is, so there's something, so some sort of like energy residing in her right and her right upper arm. And then a shift in every other muscle in her body goes weak. Yeah. All right. So let me try something. Okay. All right. So it's all about balance and spin. Everything has torsion to it. So Debbie, just put your mind right on that one spot that he's focusing on. Feel that weakness right there. Go into that spot and pinpoint exactly what your mind down to a neuron. Go there. All right. And just feel weak. You got right there. Now just take a deep breath. Oh yeah, that was something right there. Okay. Now keep your mind right there. Okay.  And now I'm going to put spin right into that like this. Keep your mind right there. I'm going to come out from different angles like this and feel that resistance right there and release it. Breathe. Then another one from over here like this and breathe right there. Then another one from here like this. Okay. As long as I get you right there. Now put your left hand on your intestines right at the top, right just below the sternum. Go down a little bit. Like right in there. Stop right there. All right. Now just take a deep breath and then follow it to your left just a little bit. Like right in there. Stop right there. All right. Now feel this and feel that and then just a little bit more. Follow it to the left a little bit more and down just a little bit like right in there. Stop right there. Let's do one more for yucks right there. Go down just a little bit straight down. Like right in there. Stop right there. And feel that. So what I would, if I were there, what I would be doing is treating her anger and resentment and everything that she's built up in her digestive tract. Muscle test for her right arm now and see if it changed any. Not much. No. Remainter is physical. Can you do an actual shoulder adjustment on her? Nice. Nice adjustment. Your whole body is changing with that. Feel that. Serious.  So yeah. Yeah. I've had unbelievable digestion issues. Yeah. Maybe I could use maybe the dock with muscle test for me. Are you done with her or can I use her a little bit? Can I play with her? Or you got time. Yeah. I mean it's you got time. So all right. Just for yucks now, doc.  Okay. Now put your left hand, doc, or you can relax for a minute. Just relax. Everybody go calm and center. Just relax. Okay. Go calm and center. Okay. Maybe you want a muscle test with her left arm or right one? Well, this has been stronger more consistently. Okay. Take your left hand. Yeah. Put it dead center just below the belly button. Like an inch, like right down in there. All right. Now muscle tester. Okay. Use your palm, right in the middle of your palm. Put it right in that spot. Right there. Okay. Now, tester. Yeah. All right. All right. So now you can relax the right arm.  You have lighter arm rest. Keep your left hand there. Okay. All right. Now, just stay right there. I'm going to use you as a surrogate doc and let's see if we can change that. Okay. All right. So right there it is. I can feel it. I think you can probably feel that feel that resistance that tightness right there below your palm. Feel it. All right. Now just take a deep breath. Blow it all the way out, all the way, all the way, all the way, all the way and feel the shift. It's still moving. It's like a little wave. Okay. Muscle tester now. Okay. All right.  And now muscle tester. That's strong. Okay. Now, just a minute. You have to go to the exact same spot and use the back of your palm right there. Okay. You got it right there. Yeah. Feel it. All right. All right. Now, keep your left hand there and let her relax her right arm. Okay. You guys just relax. Just keep your right hand, your left hand there. Okay. Like that. All right. Now lock into her that energy in her body right there. You can feel it. This is the negative aspect, electrical aspect of that thing we just fixed. Okay. So we're just going to take this out too. Take a deep breath and feel the body change. Feel that shift right there. It's still shifting. Okay. Now muscle tester. Okay. All right.  Hey doc, now look at my hand. Okay. Now just take, let's see, which one, which one, she's blocked gallbladder. Which one, which finger is gallbladder? Which line? You know. All right. So what we do is we're not sure. So now just keep your hand right there. So just touch your fingertip like that and feel how weak she is. Feel it. Check her. Yeah. What is that? Just take a deep breath and blow it out. Okay. Here's a new twist to it. Okay. You're on the tip. Now go to the next joint down. Go to the next joint. Now muscle tester. Is that a ULIN thing? Yeah. That's weak. All right. So take that out. Fix that and feel that and feel that shift right there. So what hand mode is this? No idea. I just feel energetically. All right. Now just keep your hand there and go to the next joint down and feel her body. Yeah. Release that one too. Okay. So now these are all negative aspects of not only the positive negative aspect of the body, but also torsion. Okay. Now take your hand and turn it over back on the other side and keep that same connection. Flip it over and now muscle tester. Okay. And now go up a joint. Go up a joint. Test her. That's fine. Okay. Then go back to the tip and make sure you got a good one. Yeah. All right. Fix it. Take it out. Okay.  Take your other hand, put it on that same spot, but you got to face it the other way so your fingers are going the other way. So you're going like, you're going crosswise before. Now you have to go the exact opposite direction. I was facing her head more than crosswise. Okay. I was facing her head more than I was facing up to right. Oh, okay. Yeah. All right.  That was good. I couldn't see for sure, but yeah, put it down like that. Okay. Now muscle tester right there. Okay. Now go back to the position you're in and put your hand crosswise across the body like that. All right. Muscle tester there. Yeah. So we fix that. Take a deep breath, blow it out, and feel the shift. It's not quite done yet. Yeah. That's not quite just a second. Okay. Now do it. Okay. All right. So now do the, do the, this is like, these are like dimmer real stats on your lights. These are all frequency. They're all frequencies on different lines of energy going through the body. Now you actually touched on something just before and you actually put your hand above her body and we can treat her like that too. Take your hand away. Take your hand away. Like right there. Yeah. Yeah. Okay. All right. Now just keep it in one spot. Okay. Just a second now. Just a second. Just a second. Keep it, keep your hand one spot right there. All right. Muscle tester now. Yeah. All right.  All right. And go to that same spot above her. Go to that same spot above her.  Right. It's like right in there. Okay. Now do it. Now change sides on her body. Go to the other side of her body. Yeah. All right. There you go. All right. Feel that right there. Feel that one right there. Feel it. Check it. Getting mixed signals, sir. Put your hand on her body again. Put her in her spot. There. Muscle test. That one right there. I think he's back. Well, it's body as well as in. Okay. All right. Okay. We're back. Yeah. That was interesting. Okay. All right.  We'll get flowers and chocolate. No, you get an extended abdomen with shielding. Okay. All right. So same thing we just did to her. You need to do to yourself. But you know what, if you got, if you still got a couple of minutes, I want to show you how you can use your cell phone to heal your body. Okay. Yeah. Okay. All right. Get your cell phone. Yeah. I'll use your own cell phone or you can use Debbie can use her cell phone. Did I do your cell phone for you on the show, Debbie? You did. Oh, okay. Wow. My reality just is quite different. Whoa. That is unexpected. It's a big reboot. That was huge. Okay. Oh, man. Hey, Debbie, hold on just a second, just a second. Feel this, feel this. I'm going to remember in the show, I ran torsion around your head. Remember that? All right. Feel this. Breathe. Yeah, there you go. Now I'm going to run around your body. Feel like this. All right. Move your body around a little bit. Feel different. I'm so good. All right. Oh, yeah, you're like, you're looking at a good body for a minute. Okay. And now, Doc's got to use his own cell phone. Okay. Oh, he does need to use his own. Okay. Yeah. So we're going to adapt his body to the cell phone. Okay. We're going to use the animal brain to adapt the human body to the field of the cell phone. I'm going to go get my phone. I actually have two, but I have a main one and then a five one. So folks who are interested in having, I mean, so I just want to backtrack. We're at the end, but I am going to backtrack and say to people, I'm sorry, the lighting is so garish in here. So these are two people who have never met each other. Don Lynch at donlynch.net was on my podcast. And during that conversation, we talked about chiropractors and he said how rare it was to find somebody who really do body speak. And they said, well, I actually, I have one. Sadly, maybe like most people, it took me a year and a ton of money with people who got my body nowhere to finally find Dr. Jeffrey Benton, who I met at an event where he was doing a demonstration and I saw his work and said, dude, we have to work together. And that's how I got here. So Don said he wanted to work with Dr. Jeffrey Benton in Los Angeles and it's light touch healing center and Wilshire Boulevard. And so they are connecting. They've never met before. And we've never done this before. So you all just got to witness this. Okay. All right. Okay, back. Get out. You ready? Get a cell phone, turn it on. Yeah, they're both on. I have two, but this is the main one. Okay. All right. And I also have my R2L. I have my little cell phone. Yeah. Oh, yeah. It's even better. Yeah. Okay. And this one's got two of them. And this one's got one of them. All right. So yeah, just put, yeah, just let's just work for one. Hey, Debbie, can you muscle, muscle test the doc for me? Yes. All right. Okay. Hey, doc, you take your cell phone and put it away from your body right now. Take your cell phone, put it away from your body. Okay. Okay. All right. All right, Debbie, give them a baseline muscle test. It's nice and strong. All right. Is that a good test? Yeah. Is that a good test, doc? Yeah, he's solid. Super. Okay. I don't think he's solid. And so I'm going to see if I can fix him just a second. Listen, I like that. We're stronger than this side. The right was a little stronger than the left. I can also drink some water. That usually helps. All right. Just a second. Just a second. Let me let me see if I can help you just a second. All right, doc, see if you can feel this. All right. Nice. And then here's something a little unusual. Feel this. Equal but opposite spin right around your head. And it feels like this. All right, Debbie, get a baseline. Get a baseline on him. Do a baseline muscle test. This is still a little bit wonky, but this is better. He's got some, he's got physical stuff going on back there. All right. So let's do just use that one. All right. All right. So all right. Now just take, take your cell phone, put up your head and see if it changes just like you're going to use it. Put up to your ear and put it tight on your head and feel this. Deb, do your thing.   But he got strong, strong. Okay. So this is a classic case. Okay. So put, put the, the phone back up your head and Deb, when he has his phone up to his head, tap him on his crown chakra, like five or six times firmly. Five or six times crown. Yeah, firmly on the head. He's got to have, have a phone right up to his head though. Right on the crown chakra, right on the crown chakra, right at the top. There you go. Now just everybody take a deep breath, blow it up. Okay, Deb, stop tapping. And now muscle test his other arm. Well, whichever. All right. See, he's got it on his body. Yeah. Yeah. All right. Put up to your ear. Put up to your ear again. Feel it now. Yeah. All right. Oh, just keep it on the, keep it right on your ear. All right, Deb, let him go there and drop your arm down. Okay. Now doc, just feel that energy, how it's affecting your body. All right. When she's putting down, pushing down your arm like that, it creates a signal for your animal brain to activate and it'll go right to that point. Now just take a deep breath and blow it all the way out. The animal brain is there to protect the host body. And it senses that that, that bag of water that you are with its own electrical field has been interacting with the electrical field from the phone and it creates points of weakness. All right. Now put the phone back up, back, back to your head. All right, Deb, test him now. That's solid. I would say that's solid. Yeah. All right. Now put it on your thyroid, doc. Put it on your thyroid. Hey, it's stressing me out now. Whoa. Feel that. All right. But keep the phone right there. Keep the phone right there. Keep the phone. And now we're gonna, hey Deb, back away from a little bit. Back away. Don't touch them. Back away. All right, doc. Put the phone right on your thyroid. All right. Feel it. All right. Just feel it. Okay. Now just tap yourself somewhere like on the leg there. Tap yourself on the leg. Tap yourself on the leg or anywhere. All right. Now just take a deep breath. Take a deep breath and blow it all the way out. Blow it out all the way. Just like three or four taps. All you need. We're just sending pulsed energy through the body. Just stop tapping. Stop tapping. All right. Just relax for a minute. It'll feel like a little wave as it releases. It will be an actual discharge that will run through your body. And like right now, it's going through your right calf. That wave of energy is going through your right calf on the inside of it. It's going down towards your ankle. And it's in your foot right now. And it's stuck right there. Okay. Now I'm just going to take it out. Feel this. Yeah. A big yawn coming out of me for no reason at all. Yeah. All right. So now keep the phone right there. And muscle test and deb. We is strong. Yeah. See it's all about the animal brain being activated and gets activated when you can feel on a profound level. Yeah. And so if we can actually, you know, every day people get stressed out and they go home and sit down their favorite chair and they're in a safe place. And the animal brain senses a point of stress somewhere in the body or neck or somewhere. And it makes the body go like that. And it takes that point of stress, which is actually just a point of electoral resistance in the bag of water. It goes to that point and releases it with that cleansing breath. So my thing here is, is I'm showing you how you can use this in an intentional manner to change the way the body interacts with points of electoral resistance in the body. So like when you're doing like gallbladder, you're going through through lines of energy in the body, you can clear it in different ways. You can do it like we did with with your hand on her abdomen, and you can do electoral aspects. And then you can also use all these different lines of energy in a conscious manner and go through people's lines of energy like that. You can go really fast actually, once you get practiced with it, and you can go positive negative, and then you have spin this way, positive, spin that way negative, same that way, that way. And then it gets more complex beyond that, but that's the most basic stuff. Okay. So I know you have a patient. Yeah. So he needs to go, but I do want to end this for people who are watching this. Can you tell them, I'm telling you, I looked for a year. So this is making a difference. How can they find you? And what's possible with you? What's possible? Again, a lot of things are possible. So I mean, I know healing's possible just fast. So as you know, so contact me, the Light Touch Healing Center. I'm here on Walsham Boulevard,<PHONE_NUMBER>,<PHONE_NUMBER>, and Instagram LTH Center on Facebook, Light Touch Healing Center. Or my name, Jeffrey B Benton, B-E-N-T-O-N. Beautiful. So yeah, whatever's going on, emotional, physical, spiritual, etc. And then Don, how can they get ahold of you? Donlynch.net. Just look for me there, send me an email or whatever. You can send me an email and I got links and stuff I can send you for YouTube videos and any kind of activities I'm doing, doing free events and doing interviews all the time and stuff like that. But listen, I can tell you, I got 50-plus years in chiropractic stuff and research stuff and energetic stuff. And if you can find a chiropractor like this that can work on you energetically in detail, it's fantastic because the stuff will be lasting and profound.  If you can find a good chiropractor like this, man, stick with him. It's everything because I mean, I probably much like you guys, I was, I've been to on more than two hands chiropractors who had a routine, crack, crack, crack, crack, see you next week, crack, crack, crack over and over. And my body was not moving or shifting. I was so stuck. So this is what I call mad scientist, but it's bought someone who literally is a body whisperer and can talk to a body. And then, and thank you both so much for today. This was unreal and awesome. All right. Well, you're welcome. Thank you. Thank you. Adios. Adios. Thanks, Don.


Thank you so much for making it today. Really excited to talk with you all. The name of my talk is Managing Audits of Open Source Projects. And I'm Amir Monteseri, Managing Director of Open Source Technology Improvement Fund, or OSTIF, or OSTIF, or ASTIF. It's pronounced many different ways, but it's all the same company. So I like to start off with this research paper, Zero Days, Thousands of Nights. Is anyone familiar with this research paper, by chance? OK. Couple nods, couple yeses, noes. I was an excellent research done on the nature of vulnerabilities. It was one of the most thorough studies into the lifespan of vulnerabilities in different technology stacks. And one of the main conclusions from that paper was that the average zero day has a lifespan of about 6.9 years, which is over 2,500 days, hence the name Thousands of Nights. And what that research paper really solidified was that finding vulnerabilities often requires in-depth auditing, logic review, source code analysis in order to go several layers deep. One of the reasons for this is that with products that are more popular or have been around for longer, they typically have more eyeballs looking at them. But more so on the surface level. You have folks reviewing things. You could have some very basic reviews, but really finding those problems requires going deep into the code. And what is the next? Oh, yes. And what I'm going to talk about more today is that a security audit, an independent security audit executed well or correctly based on the experience that we've had doing it for over seven years now is a very effective tool for doing exactly this, for finding those deep-seated vulnerabilities. I also like to refer to this research that came out, I believe, in 2020 called Threats, Risks, and Mitigations in the Open Source Ecosystem. But the main takeaway from this research is that essentially almost no open source projects have been looked at from a security perspective, from that independent review perspective. And as you all know, as the ecosystem continues to grow, as new projects come, this number substantially grows, and that small portion of projects still remains the same. So to talk to you a little bit about open source technology improvement fund, OSTIF, we were founded with the mission to improve the security posture of critical open source projects. And the main value add of the organization is facilitating those security audits end to end and implementing a lot of strong controls that lead to a high quality bar and strong cost controls. So for example, we have found and patched a little over 50 severe critical or high risk vulnerabilities. And these would be bugs with a CVSS score of seven or higher. We've found and patched over 300 notable security bugs across different ecosystems and have coordinated little over 10,000 hours of security work. And one really cool metric is back in June when I gave this talk in Austin, that number 50 plus was actually 40 plus. So just in the last couple months, we've been able to continue finding and fixing these critical and high risk vulnerabilities very consistently and in a repeatable fashion. This is a new slide that I added from the June talk just to talk a little bit more about the systematic approach that we take and the refined process that we use to execute audits to a high level of success. Number one, connecting with the project. This is absolutely critical. Having that personal touch, engaging with project maintainers or contributors directly to really communicate those intentions that we would like to collaborate and improve the project's security posture. Understanding the needs of the project. So really listening to what the projects tell us about where their needs are, which helps identify gaps in testing and identify pain points and helps us for the next step, which is scoping and bidding in which we will collaborate with the project to build an RFP and have a document that we send out to all the different teams that we work with. We work with about over 30 security teams all around the world and all with varying levels of specialties, skills. So having that diverse skill set to draw from helps a lot too. So once we have connected a project to an audit team, there's typically what we call a pre-audit orientation. So we'll connect the teams, get everybody in the same room or in the same virtual room, and prepare. So talk about what the goals are. Reiterate those intentions to collaborate on improving the project. And allow for the audit team to hit the ground running when the audit starts. And then we have our audit kickoff, which is just a way to formally kick off the audit engagement. And part of these audits really has kind of three main objectives. So the next one would be threat modeling, which is a very excellent exercise to do. I highly recommend projects to look into threat modeling or even do a threat model themselves internally, just as a great exercise to think about risks, to document those risks, to help guide the project when findings happen, as well as define the attack surface of a project. Then there is the meat and potatoes, so to speak, the code review, in which code is reviewed for logic errors, vulnerabilities, as well as a tooling review. So we very much intend for our projects to not just be a point in time improvement of the project, but really help projects and give them tools so that they can continue to be secure and find new vulnerabilities. So examples would be helping projects integrate into OSS fuzz, working with them on their CI-CD pipelines for continuous testing, and really any kind of tooling that can improve a project's security posture, and also, again, give them those tools to help them moving forward. And then the next step in the process is typically to collaborate on fixes and improvements, typically instead of what some folks think of an audit where you find all these issues and then just dump that onto a project. We work with teams that collaborate with the project contributors and maintainers on fixes to report things as they are found and to collaborate on improving the software and fixing vulnerabilities. And then lastly, audit report and publishing. Transparency plays a very valuable role in our process, and we typically finish an engagement with an audit report that is then published to the public to review, which really documents all of the improvements and serves as an excellent artifact for the work done to improve the security posture of a project. And I can't stress enough the value that this transparency brings. And I think that was very much reinforced just now from Julia's talk about reducing the cost of open source via transparency. I would highly recommend checking it out if you didn't get a chance to earlier. And so as I mentioned, we've been around for quite some time now and have put together a very strong coalition of experts, teams, organizations. You'll notice a lot of these organizations are, oh, it's a little blurry, sorry about that, are Europe-based. We work with folks from all around the world to facilitate this community of security experts and people who care about security and open source. And so what it boils down to in terms of managing a audit for open source projects, there's really three main pillars that lead to successful engagements. One is the project engagement and involvement. Again, we don't want to do this in a vacuum and then dump this onto projects. We understand very much so that typically projects are very busy. They are stretched thin resource-wise and they need all the help they can get. So engaging with them directly, getting them involved in the process is very important. Two, you need strong audit experts. As I mentioned, we work with a lot of different security teams. And a big benefit of that is that we are able to really fine-tune the skills that these independent auditors have and what they can bring to the table and essentially marrying that with the security needs of the project. And three, a champion or independent organization to manage the process and facilitate the process is also very critical. Because as you all likely know, open source contributors and maintainers tend to be distributed. They're around the world. They're in different time zones. They have different goals. They have different schedules. And so having that single entity to really help move the needle and get this work done effectively has helped quite a lot. So a couple of lessons learned from managing audits for the last seven plus years is zero days was right. Based on our experience, a security audit in which you find strong experts to really go those layers deep, dig deep into the code, looking for problems, typically will result in those bigger or more severe vulnerabilities which we are able to then fix. And again, the value of transparency. As I mentioned earlier, I'll reiterate. Do you think that being transparent about the process, about the intentions of what we are setting out to do has been very important and helped us be successful? And then a strong presence to champion the process, as I had just mentioned, typically does result in better outcomes. Because you potentially can have audit teams and then the projects. But you need that independent presence to marry the two and move everything along. And then lastly, an ounce of prevention. Everyone has sure heard the adage, but proactively finding and fixing vulnerabilities is an extremely effective and efficient approach to securing open source software. This is a quick case study just to iterate an example of our work. We did a audit of CRIO. This is a little bit of the timeline of how that went. But as I mentioned earlier, it started with introductions, establishing rapport, meeting with the project representatives, the maintainers, the contributors, and then discussing the security needs with key stakeholders. Again, participating in these discussions, really understanding what their needs are and how we can help. And then we finalized the scope, sourced an audit team, and launched the security review. And about a month or two later, the security review was complete. And we had security improvements made and published a report. So as you can see, this process does take time because it is typically a pretty manually intensive process. But I can say from experience that the results are almost always worth it. So some results from that engagement. We found and fixed a high severity denial of service issue. And interestingly enough, this vulnerability also affected a similar project, container D. And we were able to coordinate with all the teams to get everything patched in a very timely manner. Also, we implemented 14 fuzzers targeting the CRIO code and integrated the project into OSS fuzz. So going back to that point that we're not just helping a project point in time, but we're also helping them and giving them tools and building with them tools that will help them in the long run. Also, there are five more findings and fixes ranging from low to medium severity. These are security related issues. And as the rise of supply chain security has kind of come up, especially recently, it seems in the last year or two, we have adjusted and also have teams that can do supply chain security assessments. So with this project in particular, its salsa compliance was evaluated. And they were given a roadmap and different things that they could do for achieving higher salsa compliance, increasing that supply chain security. Oh, I think I'm going to be early. OK. Let's see. Some more lessons learned from the CRIO engagement. We had learned from that process I mentioned, talking to them, understanding their needs, that they actually had intended on getting audit work done before connecting with us and found it very difficult to navigate the waters, which is actually another reason that we had founded, OSTF was founded in the first place was because there was that recognition that projects are resource strapped. They don't have the time to go out and find auditors to talk to different security teams, to basically do all of these things. And that is why OSTF was created to help and advocate for these projects and do this work for them. And due to a strong due diligence and scoping process, we got a excellent team to not only audit the main risk areas, as I had mentioned, but also implement fuzzers to continuously review and improve the project. And I can actually give another case study because this just happened, where in engagement we did about six months ago, where we did a very similar thing, implementing fuzzers, working with the project team to build these tools, we had just found out about what month is it now, September, about nine months later, that those fuzzers actually found another very high severity vulnerability that the team was able to fix. And so that I think is just another example of not only helping the project at that point in time, which is extremely helpful and useful, but helping them long term. Now I'm gonna talk about a couple of hurdles that we have experienced in terms of auditing open source projects and really just the space in general. It's come down to about three main hurdles. The first one, as I kind of alluded to a little earlier, is the level of coordination required. I put the picture of the cats because sometimes it feels like just that, herding cats. But there is a lot of coordination that goes into these processes. I kind of listed a number of things that typically happen as a part of that process of coordinating that. So I'll go from them very quickly, again engaging with the project and identifying who to talk to, working with them to understand their needs. And this is important because we've really seen that really no two projects are the same. And depending on where a project is, catering the security review to their needs typically results in much better outcomes instead of kind of having a boilerplate template, for example, or just telling them to implement one tool, we really work with them to understand their needs. And that takes time, that takes coordination, that takes meetings and resources to really put together. And then we mentioned a little bit collaborating and scoping the project, getting that proposal to different security teams to review and bid on, facilitating all of the introductions, sync meetings, issue findings and remediation, and lastly coordinating the report and publishing. So as you can see, it's a lot of coordination involved. And asking open source projects to do this themselves, I think is too large for an ask, which is why OSTF was founded to advocate for and help those projects. Another common hurdle is funding responsibility. Who is responsible for funding this kind of work? I have this picture of the credit cards here because the perception seems to be that it can be a case of credit card roulette where one person essentially becomes responsible for paying for everything, which is certainly not the case. But really it's a good question to ask, who is responsible for funding this kind of work? Is it the individual projects? Is it corporate backers, governments, foundations? A little bit of both, a little bit of all of the above. So this is a common hurdle to facilitating audits of projects. And lastly, industry perception. I actually had a great meeting this morning in which the person I was meeting with shared that they actually had some horror stories with getting audit work done. And unsurprisingly that was not the first time that we have heard something like that. Sadly, a lot of folks seem to have had less than positive experiences really doing this themselves, hence why we do what we do. Also, a lot of focus is on reactive security, responding to vulnerabilities after they have wreaked havoc. Lock 4 Shell comes to mind. Auditing projects is not scalable. A lot of focus is on automated tools and things like that. But I cannot stress enough how important this manual review and this manual process is. So while it may not be as scalable as, let's say, an automated tool, for example, it is an extremely important part of securing open source projects and a necessary part. Because as we had alluded to earlier, very, very few projects have been reviewed independently by third party security experts. However, that is also partially untrue. As I had mentioned, we work with over 30 security teams and over 100 researchers and they are typically hungry for more work. They want to do this work and improve open source projects. Another industry perception is that auditing projects is not effective. Again, some people may have had bad experiences. They had, we've heard a lot of feedback from folks that did bug bounty programs which essentially just turned into a lot of low level reports and ended up eating up more time of the projects of engineering time than it was worth. But I can say from experience and from looking at our track record, which all of our work, as I mentioned, is published and can be viewed, going back to our very first security engagement, we have a track record that suggests otherwise, that this work really is effective. And lastly, auditing projects is expensive. But what I say to that is, would you rather spend $70,000, which for my case study example was about the cost to proactively review and secure that project, or $700 million, which Brian Bellendorf mentioned on Tuesday was the cost to Equifax for the Apache Struts breach. So again, with that ounce of prevention, it really goes to show, especially in a case like this. Okay, and so in conclusion, security audits, and when I say security audits, I realize that there isn't a really kind of de facto definition for that, but security audits really have to have that independent third-party aspect. So I would maybe call them our third-party security audits or independent security audits are a must if the goal is to find fixed vulnerabilities, secure projects, improve tooling. Also, security audits can be done more effectively and efficiently when there is a champion, someone there to champion the process. And also, more funding in the audit space will make the process more efficient and effective. So as we do more of these, as we get better at doing them, as we have better relationships with the different teams who can do them, the process does become more efficient and we get better at doing what we do. So I'd like to end with a quote from Derek Zimmer, who is here in the audience and who will hopefully join me to answer some questions, but OSTF has had an incredible journey from a list of issues on a sheet of paper to a worldwide coalition of people and organizations working together to improve the security of open source software. And that is actually quite true. I do remember back, I think it was in 2014, when we literally had a sheet of paper as we were writing down these common problems that open source projects face and what we can do to help them. And I'm really happy to say that over seven years of working to solve this problem, doing it as best we can, we've learned tons of lessons along the way, some of them the hard way, but you know, if you gotta scab your knees sometimes to grow and I'm really proud of what we've been able to accomplish and continue to accomplish and just even being here in front of all of you find people today and everyone online and everyone at home is, can't tell you how grateful I am for that, that our work is actually doing what we set out to do, helping open source projects and yeah, I just couldn't be more grateful for the work that we're doing. So with that, I think I'm early, let's see five, 10, 15, 20. Oh, we have about 10 to 15 minutes of questions. So we can maybe turn this into a little bit of Q and A and I'd love to field any questions. I believe folks might have asked some questions online as well. Anything that you would like us to go into more detail on or all ears, but I guess I do talk kind of fast and concluded a little early, but it looks like we have our first question with Dwayne. Hi, Amir. Hi. Reminder for both of us, we need to catch up, but the number of years you've been doing this and acknowledging this question goes outside the scope of like the work that you're doing. Once you've gotten the fix, there are all these opportunities on the other side of, please roll out this fix, right? And the Equifax one in particular that we keep setting was a known and patched vulnerability that just hadn't been updated. So I'd be interested to hear after your experience working in this space, the opportunities you see on the other side of this equation to help people with their rollouts, their adoptions of these fixes once they're in place. Excellent question. Thank you, Dwayne. What immediately comes to mind is, goes back to that first step, that really that personal touch because we understand at the end of the day, these are not, this isn't software, these are people. People is what really drives all of this. So building a good relationship with the projects, with the project maintainers, being very open with our intentions of let's work together to improve this and make fixes has resulted in, I would say, much faster in terms of getting the project engaged to make the fix. And again, by working with folks who understand open source and understand the constraints that some projects might have, by working with them to actually make the fixes instead of just dumping a bug report, like actually walking them through the finding, recreating that and working together to make the fix has been very successful. Thankfully, we haven't had really any cases of let's say a high or critical risk severity that the project just said, we don't think this is a problem. I think that also is a call back to the value of transparency. I think because we know, and the projects know, the audit teams know that this is essentially gonna be published for folks to consume, people typically put their best foot forward because they know that the social aspect of it comes into play. Derek, is there anything that you could think of for Dwayne's question? Okay, we have a follow-up. I'll buy you a second, but just to be clear, what I'm talking about here is how we help the Equifaxes of the world get better at adopting the fix and struts once and for all. Or the cryo project is a good example. You found this great vulnerability, the cryo team fixed it, and now there's this plea that goes out to the industry, please, please update to the latest version and there's this long tail of people who are slow to update. And interested to hear about opportunities, the rest of us can take on to work the other side of the problem. I see, okay, thank you for clarifying. I do think as we grow, because like our website, for example, when we get the most traffic is when we publish reports. So I'd really like to think that these reports are being consumed on a large scale. And by doing things like uploading all of our security reviews to the open SSF, initiative to house a collection of security reviews for folks to consume, I think is just another channel to get it out there. But it's an excellent question. And it's not as high, I would say kind of on our kind of our focus because we're so hyper focused on improving the project and making those fixes, but by being just, by being vocal with the results. And hopefully, again, as we grow, I'd like to engage with more potential like media folks and folks who actually write about this stuff that can get the word out some more and have folks look out for our audit reports. But that is a very common problem, yes, is what to do after and begging the projects to fix things upstream. But I think the best thing that we do in terms of the scope of what we're capable of is just sharing that report for free. Again, we don't, this is all free to consume, will increase the chances that it's gonna get in front of more people and they can take that to the people that they would need to to be like, hey, are we considering this? You know, I saw this report and so I think the reporting and really kind of promotion of the work is what will help us there. Thank you, thank you, Dwayne. Billy, you have a question? Yeah, sort of in a similar vein. So beyond just like being responsive and available and having the bandwidth to sort of address these issues, what can open source projects do to just help the security audit process along? Like, what have you seen in your reports and sort of what can we do as contributors to help us? That's a great question. You see, do you have any, do you have an answer? I don't, I've got a question. Yeah, yeah, it's a fantastic question. A couple of immediate things that come to mind are that engagement piece, you know, as we build that relationship with projects, being responsive to kind of what our needs are because we do understand and really we have honed in this process to be as minimally disruptive to the project teams because, again, we understand that they're extremely busy and clear documentation. Oh, thank you, Carson. Yeah, I think for the folks online too, yeah. Yeah, come on, that's right. Okay, how do people ask questions now? We can pass the mic around. Yeah, but going back to Billy's question about what projects can do to help the process. Okay, so I'm gonna repeat what I said so everybody online can hear. It's very important that we understand your documentation that currently exists and it's very important that we can see what testing you're doing. So if you have a CI pipeline that is not transparent, that can lead to us doing redundant work trying to figure out what testing you're currently do so that we can identify gaps and work from there. Does that make sense to everybody? Okay. And I would just say, yeah, just really the engagement piece because we've noticed that the more engaged a project is, the more that they are involved in the process that typically has been leading to better outcomes. But I would definitely agree that documentation is a big one and some of the things like with the kind of the pre-audit orientation, so providing the teams with what they need, sometimes they'll need like a test environment, for example, set up or things like that. So just that engagement between the two. But again, we understand projects are very busy and so we try to do it in a way that is minimally disruptive but also can have maximum value. Thank you, great question, Billy. Do we have any other questions or something maybe you'd like to hear more about, more details about that we talked about earlier? Okay, we have one more. Oh, we do? Yeah, actually we have time for one more, perfect. Yeah, thanks for the presentation. I was going to ask in terms of sustainability or long-term, how to make sure that the results of the audit leave over time, do you recommend doing another audit in a number of years or what's the process there? Yeah, very good question. Generally, yes, it is good practice to, if for example, a project implements a bunch of green code or new features or things that potentially change kind of a lot of the basic nature of the project, that is an excellent time to revisit the project and do another audit. For my past life as an IT auditor, that was our guiding philosophy, which is you do risk-based audit schedules. So if a project, for example, is rated very, very high risk, you would want to maybe audit that every year or something like that, whereas if a project, let's say, is a very simple tool, has very simple functionality, not so much in terms of adding new green code or new features, maybe that can be revisited, let's say every three years or every five years. So it is something that ideally is an ongoing process. So we have had projects actually come back to us and say, we've done a lot of new features, can you come back and review them? Is there anything else that you could think of? No, but I would add that the way that we approach auditing is for longevity. So when we scope out a project, we typically don't want to do the fire and forget. One time we review your code and get a snapshot and declare it secure from that point forward. That's why we focus so hard on tooling, what testing is being done, improving the CI pipeline, writing tests for them if they don't have the capacity to do it, because that gives you the long-term impact of increasing their security on that long tail. But yes, if it's a very critical project, we would recommend revisiting green code whenever there's a significant new feature or something is rewritten. Yeah, and I would also add continuous monitoring. So that's where fuzzing helps a lot, the tooling that Derek mentioned, because that'll help you indefinitely, essentially, as those tools are a part of the project. So I think we have time for one more. Do you want to? Yeah, OK. We have a question from Steven. So real quick, can you talk about how foundations, organizations, open source projects can get involved with those? Absolutely, yeah. I can give you two examples of things that we're currently doing that seem to work pretty well. So we have, as part of our strategic partnership with Linux Foundation, we work a lot with the CNCF, which has very strong policy controls over with their graduation criteria. So for a project to graduate or to get graduation status, they need to undergo independent security audit. So essentially the way that works is anytime a new CNCF project wants to be audited, they just contact us and we do it. We do it on kind of an ongoing project by project basis. Another thing we do is with some of the larger companies where they'll give us essentially a yearly grant and with the goal to set out and let's say do five to seven projects and using that grant will basically go through them on a best effort basis. So I'd say those two are the best ways. And what we're exploring more is I think the yearly stipend model seems to work where we'll get a list of projects and we'll go through them to the best of our ability and put those funds to the best use possible and of course publish the results, which serves as a very strong, almost marketing tool to show that, hey, CNCF is putting a lot of money into security audits because we have all these audit reports to show for it. So and the way that can be done is to simply contact us. So it's just Derek and myself as the program manager. So please, we could just sit down, talk, and work something out. But we definitely have capacity for more projects and would love to bring on more partners. So wonderful. And I think with that, I give you a whole minute back. And I really want to thank everybody for coming today. And yeah, any questions, any follow-up, please let us know. I can just be reached out. My first name, Amir, at ostif.org. Derek is Derek at ostif.org. Or come find us. Unfortunately, we are leaving shortly. But yeah, please, if you'd like to continue the conversation, we'd love to. So again, thank you so much.


The large binocular telescope, LBT for short, in Arizona, was scanning the fireworks galaxy 22 million light years away looking for supernova candidates. They examined the star named N6946-BH1, a star 25 times more massive than our sun. Stars this size usually end in a supernova explosion, leaving behind a neutron star or a black hole. Here's a graph of the star's luminosity, invisible and infrared light over time. In 2007 Hubble took this picture of the star. In 2009 the star shot up in brightness to become over 1 million times more luminous than our sun for several months. The expectation was it was about to supernova, but it didn't. The star just seemed to vanish, as seen in this image from 2015. After the LBT turned up the star astronomers aimed the Hubble for visible light and Spitzer for infrared light to see if the star was still there. All tests came up negative. The star was no longer there.