Hey everyone, I hope you have been having a great experience at the cloud native security day Europe virtual event And I'm here to try and add to that experience with this session integrating security in the build pipeline Let me take a moment to introduce myself My name is Anirvan and I'm a member of the DevOps engineering team at Alliance Direct based in Munich Alliance Direct is the online insurance platform of Alliance operating in a few countries in Europe I have been working with cloud native infrastructures for almost 10 years and tend to automate solutions to make others and My life easier Also with so many security incidents happening in our daily lives. I Sometimes tend to get a bit paranoid about security in my projects. I Should also mention here that all the information tools strategies Phenions and demonstration presented in this session are entirely my own and they do not represent the views of Alliance Direct or any other Alliance entity Although we do a lot of cool stuff at Alliance Direct the contents of this session are not really aligned with them This session ends with a live demonstration of a CI CD pipeline with security tests enabled and Involves a cloud native setup I'll explain the tools that have been used here during the session and for the attendees who are really interested in trying it out themselves I have added the configuration files in a couple of GitHub repositories The build pipeline repository also has general guidelines about the base components that we are using in the demo and the commands to set them up. I Understand that for some beginners it might be a bit much to grasp But unfortunately because of some time constraints, I'll not be able to demonstrate Setting up the base components such as the Kubernetes cluster the autoscaler and the ingress controllers So we will first look at why we are here Understand the problem Analyze it find out reasons for them and look at ways to mitigate them We will look at how a vulnerability scanning workflow works How they plug into the build pipeline the options that we have in terms of tools Analyze different strategies to integrate security scans into the build pipeline and Finally, we will watch one such pipeline in live action. I Know that we all hate staring at PowerPoint presentations. Believe me. I know I really know that pain So I'm gonna finish up with the presentation as fast as possible and we'll dive into the fun stuff This is required as I really want to keep this simple and really want you to understand what we are doing and why we are doing it So why are we really here? What is the problem that we are trying to solve in general terms? We are trying to implement software security So, how do we do it? Generally, it starts with the business goals being defined Resulting in products to be launched which happens at the management level The architect designs the software as per requirements Developers get on the same page with the architect and they start creating some cool software With modern life cycle software life cycle processes Testing the software is really essential. We all we all know that once all of this is achieved The artifact is created and the product is released Generally at this point a security or penetration test is scheduled where vulnerabilities are detected or Sometimes unfortunately, there's really no security test done at all As the software has never been scanned before this list is quite long Now think about a cloud native scenario where we are talking about more than 50 to 60 Microservices and the amount of time it would require to fix those problems. That's huge, right? Now with product priorities and feature requests, it is quite difficult to devote dedicated time for such fixes As a result, it gets postponed or really neglected altogether and before we know There is a breach taking place So how do we approach the problem? You might have come across the phase shifting left on security This very very simply means that in the left to right process progress of Software development life cycle. We need to move the security testing towards the left That is early on in the development process The basic idea is to detect and fix security problems during development and not after the service is released So how do we actually go about addressing the issue? The final objective of any business is to create a trust relationship with the customers the clients and And the registered users to do this You need to be able to convince them that when they provide you with the data It is not gonna be compromised under any circumstances at present we are providing our financial insurance medical and Personal data online to service providers every day We would definitely not want to be associated with the service who are not able to protect our data To do this first and foremost thing to be done is to make each and every person responsible for security When you leave your office door open by mistake You're responsible for the safety of hundreds of your colleagues in the office building and you can compromise it by letting in an intruder This person can be an office administrator. He can be an engineer a manager or even the CEO of the company Similarly in the software product lifecycle each person needs to understand that they need to be responsible for security Whether it is via software design code creation software deployment or really site reliability Developers really understand features and feature requests very well, right? so start treating security fixes as features and Integrate them in the development process in large development teams instead of asking and expecting everyone to fix their libraries Use a pre-built library repository, which only contains pre approved and vulnerability free libraries To fix problems you need to detect them first and know how to make it part of the process so go for professional help in such cases or Really higher dedicated security personals Train the teams so that they first understand what they are doing and why they are doing it It's not only important to decide to shift left on security, but also to understand what to scan for Vulnerabilities are of different kinds and there are different stages when they can be detected and fixed The first step in this direction is to look for package or dependency vulnerabilities They include base operating system packages and also application packages such as Ruby, Python, Java, Node Or just any other programming language dependencies This is a stage, but the code is not involved yet. It's just the system on which the code is supposed to run Next we need to scan for vulnerabilities in code, which has not been compiled yet These are situations when problems in the code can lead to unintended code executions This is called static application security testing or S A S T because the code is not running yet another type of security scanning is the D A S T or dynamic application security testing in This stage the application needs to be scanned for vulnerabilities which exist when the code has been executed This might needs to be done against a running web application So we can really see that the attack vector is quite huge Next we will look at general vulnerability scanning workflow The CI CD tool is probably one of the most important component in the setup which orchestrates the entire pipeline The code repository is used as a source for our code and the image repository for image artifact storage The security tool is really not mandatory in most cases There is a central solution security platform or tool which coordinates the communication between the build pipeline and the vulnerability scanners It is also used as a visibility tool to visualize vulnerability reports believe me when you look at the command line and see all those vulnerabilities It's not really that helpful a dashboard can really help you here Pipelines can also direct commune directly communicate with the scanners The vulnerability scanners are the databases against which we compare our image packages If all goes well, we can deploy our artifact on the container orchestration platform For our demo, we will use a similar setup where we will use github as the code repository tecton and argocd as the CI CD tool harbour as the security tool and the image repository and kubernetes as the container orchestration platform There are few open source vulnerability scanners available such as claire and trivie which are really really powerful tools The default deployment of harbour ships with trivie as the default scanner We will fetch our application code and doc a file from the app repository Build it and push it to a test image repository We will then scan the image from the test repository for vulnerabilities If there are none to be found then the image is promoted from the test to a prod repository Finally, we will deploy the app from the prod repository We definitely wouldn't want vulnerable images to land up in prod repositories, right? If the image has vulnerabilities, the pipeline will stop at that stage and we can visualize the vulnerabilities in the harbour dashboard For our demo, our app is a simple nginx container built from a debian or oven2base image nginx is installed on this image and a test web page is added. So really really simple stuff The debian image has high and critical vulnerabilities which we don't want to be in prod Whereas the oven2 image only has medium and lower vulnerabilities which we definitely won't deploy it That that will actually be our simulation We will use tecton to create our build pipeline and argocd to run the pipeline and deploy it on kubernetes argocd is a cloud native deployment tool based on the github's methodology There are some tool specific terminologies used in the session, but if you feel intimidated Please feel free to use any other ci tool of your choice It is also a cncf incubating project harbour is also a cncf graduated project which is an image registry and helm repository It can also add pluggable vulnerability scanners to be able to scan the uploaded images Although we will demonstrate an automated build pipeline in this demo, this is quite far from a production build setup Advanced features such as triggering pipelines via events and passing parameters are not part of this demo I have kept the app repo with helm chart and the pipeline repo different to help you understand this better However, they can be modified to create a more sophisticated workflow Okay, so we will now start with our demo This is the harbour dashboard that we have already installed in our kubernetes cluster We have created two different projects one for broad and one for test Each harbour project acts as a docker image registry and also a helm chart repository We have already gone to the configuration page for both projects and enabled the option to automatically scan images on push If we go to integration services, we can see that trivie is already installed as the default scanner If we want we can add a new scanner like clare We have already set up clare in the harbour namespace in kubernetes if we check the pods We can see we have a clare pod running and a clare postgres pod which is a database where it stores the vulnerability database We also have a clare scanner adapter which helps clare to communicate with harbour If we Add a new scanner We name it clare We put in the address which is the service for clare and the pod There you can see we have added clare as a secondary vulnerability scanner For our demo, we will still use trivie For our demo, we have created couple of helm charts which will help us run our pipeline The first helm chart is called app deploy Which is actually a simple helm chart to deploy an application and create an ingress for it to expose it to the internet The second helm chart is called tecton build pipeline which Contains all the configurations to run a tecton build pipeline We have already built both of these helm charts And we have already uploaded them to the helm charts repository in the prod project in harbour If we check the build pipeline repository, we will find a directory called secrets Which are some kubernetes secret manifest which are to be applied to the kubernetes namespaces before our demo can be run They are just basic authentication credentials as some and some docker registry credentials Next, if we check our helm charts We will quickly go to the components that we have added here We have added some pipeline resources which have our git repository and the image registry We have added some config maps, which has the metadata for our build pipeline Like docker tag, the image name, the namespaces And the argocd server and the argocd application name We also have a series of tasks that we are going to run in our pipeline Which we have already discussed, which is the docker build task The security scan task, the image promotion task, and finally the argocd sync task We also have a service account which is attached to one of the docker credentials Which helps us to provide authentication for our pipeline We have a pipeline definition, which integrates all the tasks that we have already created And finally, we have a pipeline run definition, which actually runs our pipeline using tecton Our second repository is called example app, which has the configurations for the application that we are going to deploy The first directory is called app and it contains the docker file And it contains the docker file and the sample webpage that we are going to deploy We are going to start with the debian image, which is supposed to have the high and critical vulnerabilities and will be breaking our pipeline The second directory is called helm app and it has the helm chart specification To deploy the application and it uses the app deploy helm chart as a dependency The third directory is called helm pipeline and it uses the tecton build pipeline helm chart as a dependency and will be used to run our tecton pipeline In the build pipeline repository, there's another directory called argocd resources, which has some manifests for our argocd application The first one is used to add the Harbor registry information into argocd so that it can fetch help charts The example app manifest is used to create the argocd application to deploy to actually deploy the application And the third manifest is used to create the argocd application, which will run our build pipeline We will now go to the command line go to the argocd resources directory and We will apply each of these manifests if we now go to The argocd dashboard We will see both our applications have been created And if we go to the repositories page, we will see that our harbor Helm repository has automatically been added and the connection is successful The example app build pipeline gets its configuration from the helm pipeline directory of the example app repository the values file Of this helm chart has the corresponding values which helps the pipeline determine its status If we go to the argocd application We will see that all of these resources are ready to be created And it creates a dynamic name for the pipeline run With help of the tag that we have added in the values file In a more sophisticated workflow, we will not be adding this tag manually But it will be created when our automated build pipeline works via triggers and events So finally it's time for us to run our pipeline and see the output We will run the sync option And we will select the prune parameter here and we will run synchronize This will take some time. So I will skip the video here If we now check our pipeline, we will see that it has stopped at the security scan step And we will see the reason why because it has found high and critical vulnerabilities So in the meantime, we have gone ahead and we have edited our docker file to change the image from debian to ubuntu And we have also bumped The tag for the image If we go to argocd, we will see that the change has automatically been detected And the 001 pipeline run is to be removed And a new pipeline run with 002 will be started when we synchronize the pipeline So we will go ahead and run synchronize again And we will select the prune option so that the old pipelines old tasks are removed and the new ones are created If we now check our pipeline, we will see that it has completed successfully Because the security scan step Was not able to find high or critical vulnerabilities If we now quickly check our harbour dashboard and check the test project We will find our example app image here And if we go into details, we will see each of our tags with its corresponding vulnerabilities Here we can see tag 001 has critical vulnerabilities and 002 has medium and lower ones Which is why it allowed us to perform our deployment If we go further, we can actually get details about all the vulnerabilities that were found If you're curious as to what we did for the security scan step Just go to the tasks manifest file in the tecton build pipeline hand chart Go to the app talker security scan task and there you will be able to see that we used the trivi docker image And we ran the trivi command to scan our image from the test repository And we checked for high and critical vulnerabilities and we asked the command to fail if it did find such vulnerabilities So with that we have reached the end of this session I hope the session was able to help you get some understanding of how we can have better and secure build pipelines And optimize the software development process I have added some links about this topic. So be sure to check them out I hope to see you in another awesome event in the future. Thank you


Hi, I'm Mary Ellen and today I'm going to follow up with the personal safety and then I want to announce the winners of the two BK Beauty brush sets. I am not sure what happened to this video, but I had to delete 20 minutes out of the middle of it. So I will cover that at a later date. I wasn't going to put this video up, but I knew I wanted to announce the winners of the BK Beauty brush sets and I felt that some of this information may be helpful and hopefully I'll be able to figure it out before I film another video. When I have to do voiceovers, I put a photo in that kind of makes me smile and this was four plus years ago when I had short hair and found out that my silk pillowcases did not help when my hair was short and then I found out that they had silk nightcaps that worked. So anyway, so it always makes me laugh when I see this photo.  I've always been into personal safety, especially with the older patients I had in my nursing career. Not too long ago, Jim said, if I ever fall and can't get up, don't call your family, just call the ambulance. And I said, Jim, you have no idea how much an ambulance costs. Where we live in the state of Illinois, a regular ambulance is not chargeable to your insurance nor will Medicare pay for it. So after a little bit of searching, I found someone to talk to who provided ambulance for our area and that service is from like an hour from here. So I found a very, very nice lady and I said all I need to know is I live two tenths of a mile from a hospital. If I needed an ambulance to respond and the only thing I needed them to do was pick someone out of the floor and take them to the hospital for assessment and don't do anything else. How much would it be? And she said just to get the ambulance to your place, it would be about four hundred dollars, between three hundred and eighty and four hundred dollars. That is the minimum amount and you're responsible a hundred percent for that. So that's what a lot of this started. He did not want me to disturb my family that lives two blocks from here, if something ever happened, but I think maybe I've got them to change his ways. I don't know. I read, of course, I always read all of your recommendations and I did quite a bit of research on trying to find a safety device that someone could wear that if they fell and didn't have the ability to call for help that it would go ahead and do it for you. And I found one safety device and it was sixty dollars a month, so in twelve months, that's seven hundred and twenty dollars. That's not horrible. I mean, depending on just like everything else, what you're willing to pay. I did find out that Android has a watch and I think it is the Galaxy 3 by Samsung that it has the ability to do fall detection, but I don't I can't find out if it has the ability to make calls for help. So that's something you might want to look into if that's if you have Android. I did pay a lot for my watch just because I needed the stainless steel, but if I were to purchase it again, if I'm hoping to with Jim, I found one that is around three hundred and fifty dollars that will do everything that I would need a watch to do. The important thing for the safety is that it is cellular so you can add it to your cell service and that it has GPS GPS and cellular.  And like I shared last time, it's ten dollars a month to have the watch on to our cellular plan. There is no solution that is perfect, but my mind got to going about this. If you have someone that you are a caregiver for or you have caregivers for that person, as long as your loved one has the watch on, should they escape? Should at the home I would escape your home, that's what they call it. But should they wonder off? There's apps that you just have on your phone that you can find that person, which I think is amazing. It's not uncommon for someone to wander away from their home, somebody with memory issues. And I just think it would be just wonderful to have. I just I'm thinking what I do is I think of situations I've known of in the past. Potential situations that can come in the future. And I just like to share those with you. I do want to share a comment that I received from a viewer. Her name is Stormit 54. She said, I take care of an elderly man that wears a guardian medic alert pendant that has fall detection. It is connected to AT&T cellular. If he falls or pushes a button, a human will speak to him, whether he responds or not. We have it set up for them to call me rather than 9-1-1 and I'll make that decision. I will be called even if he says he's OK. But it has fall detection and has to be charged every two or three days. We paid for a year in advance. And I don't recall what the cost of the service was, maybe five hundred dollars. But that could have included the cost of the pendant. I'm going to put a I could not put a direct link for some reason. It wouldn't make a direct link, but I will put a link into the company and also the name of the device that she is speaking about. And I want to thank you so much for this information. Now, I would like to announce the winners of the BK Beauty brush. And these sets were given to me by Lisa J from BK Beauty. And this is a photo of the 101 brush that I demonstrated on my last video. I purchased this several months ago. And anybody who's watched me for very long knows that I never put on foundation with anything but my fingers, but there's just something about this brush that made it easy. And the brushes in these brush sets can be purchased separately. This is called the essential face brush set. And when I went to randomcomandpicker.com, the first person's name that came up was Landa Hale. And she wanted the face brushes. She mentioned those first. So congratulations to you, Landa. The winner of the complete eye brush set. And it's she named it for small or hooded eyes. And anybody can use these brushes.  The name that came up is Lucy Brown. Congratulations to you, Lucy. Be sure and leave a comment below and I'll let you know how to get in touch with me so I can get the brush set sent off to you. Now on to my noisy closing. I will tell you this is what my whole video sounded like. This is what the rest of the 20 minutes that I took out. It's exactly how it sounded. And hopefully I will see you all again in two weeks. But anyway, it is all good. Thank you so much. I appreciate you more than you will ever know. And I will see you in my next video. Take care. Anyway, I don't know about that, but Beesh ambulance. A regular ambulance and. Pick pick pick someone out of the floor to add the watch onto our cell. To have the watch to have the watch onto our cellular plan. Well, to have the one.


This unit is about the highest ranking unit in syntax, the sentence. We will proceed according to the following steps. We will first of all analyze sentence types, find out what types of sentences there are. Then we will draw a distinction between major and minor sentences. And finally we will deal with a phenomenon called ellipsis. So what sort of sentence types are there? Well in general we define two sentence types, so called minor sentences and major sentences. They can be distinguished via three central criteria. Criterion one is the availability of what you might want to call a subject predicate structure. So that's the first criterion. A second one is a test which is often used in linguistics, the so called substitution test. And the third criterion is a test which moves around elements within the sentence, the transformation test. So these are the three criteria which we are going to apply. In addition to these two sentences, to the minor and major types of sentences, there are sentences, there are major sentences that are incomplete. They are referred to as elliptical sentences and will be dealt with later. Let's first of all look at minor sentences. Here we have a first of all some examples. Down with Smith, this is an example where well you wouldn't have a subject predicate structure. Where is the predicate? There is no verb even in this sentence and what about the subject? It's simply not there. The sooner the better is another example. Well what can we do with this sentence? We cannot move elements around the better the sooner or something like that. It simply doesn't work. How are you is one of these questions we ask 25 times per day where we don't even want an answer. It's some sort of common phrase, some fixed phrase which we often use in order to open a conversation. But we wouldn't normally ask something like how is he? We can't replace any elements by other elements in this sentence so it's fixed. There is no, well here we have a subject predicate structure but we cannot transform this sentence in any way. We cannot substitute elements. And finally we look at Merry Christmas. Well Merry Christmas is one of these examples where you don't even know where is the verb again. So there's no subject predicate structure. You cannot rearrange the elements. No transformation possible. What would that be if we transform that into a passive? Merry Christmas is wished by me. No, you can't do that. And you can't even substitute any elements. You cannot say great Christmas. Well it works to some extent with some adjectives but not normally. So due to their behavior as fixed units that cannot be rearranged, that cannot be moved around. These minor sentences are often referred to as fixed phrases. Their use is mostly restricted to comment function or it is connected with specific communicative purposes. Let's contrast this with major sentences. Now major sentences typically have a subject predicate structure. That is, and sometimes they're even preceded by a so-called operator. So here's one example. The cat sat on the mat where the cat is a subject and the predicate is sat on the mat. The predicate may even contain some arguments here, an object for example. Now you can easily move these things around in questions like did the cat sit on the mat or the dog sat on the mat or a dog sat on the mat or a tiger sat on the carpet and so on and so forth. So here is another example where we have a mistake. John gave Merry a book. This must be. So here I prepared something wrongly. Gave Merry a book. And again we have a subject and a predicate. So it's just the same. Now here we have something with an operator. Has he done his homework? Subject he predicate, done his homework and has been moved to the beginning of the sentence. Inversion is the operation where we have an operator, a subject and a predicate. Well and we can even use our Merry Christmas. We wish you a Merry Christmas but now it is embedded within a major sentence with a subject and a predicate structure. Ellipsis. Now we have major sentences where elements have been omitted. So ellipsis means grammatical omission. In contrast to other omissions, types of omissions in language for example phonological loss or you can clip words. You can, there are various types of omission possible in language. Now in general ellipsis explains why some normally obligatory element of a grammatical sentence is missing. So here is an example. Let's take the following. If he works hard. If he works hard, I won't have to. And what is missing here of course at the end is I don't have to work hard. Well especially important in ellipsis is the principle of word by word of verbatim recoverability. That is the actual words who are missing must be implicitly understood. Thus they must be recoverable. Strict ellipsis then requires that when the missing words are inserted the meaning doesn't change. So if he works hard I won't have to work hard the meaning is exactly the same. Now depending on the type of recoverability, so we don't need this anymore. Let's wipe it off. We have several types of ellipsis which are here. Situational ellipsis, structural ellipsis and textual ellipsis. Let's use one example per type of ellipsis. So here we have the classical case got it. Now this looks like a minor sentence but it isn't because got it. We could say something like it's got the letter. We recover the words the letter. Or we even replace got by understood. Understood it. Did you understand it? So this is called situational ellipsis because the interpretation depends on the knowledge of a precise extra linguistic context. The second one is often used in headlines. We can have something like US so typical newspaper headline US heading the United States heading heading well for what can they had for new slump. So this sort of block language which is used in headlines is referred to a structural ellipsis where the interpretation depends on the knowledge of the grammatical structure. So the element that is missing here is certainly is or are depending on how you define the United States as singular or plural. So here the verb is missing. And then finally we have textual ellipsis where the interpretation depends on what is said or written in the linguistic context. So an example could be I am happy if you are and of course we know that the missing element must be happy. Well so ellipsis then is really a special case of major sentence where the missing elements can be recovered relatively unambiguously. Well let's summarize what we've done. The focus of syntax is then major sentences. We do not really deal with minor sentences but major sentences constitute the core of syntactic analysis. In present day English there are four types of major sentences. There are so called declaratives or declarative sentences. We have imperative sentences or imperatives. We have interrogative sentences or interrogatives. And finally we have exclamatory sentences or exclamations. There are also alternative terms used for these. Let's quickly write them down. Declaratives are also called statements. Imperative sentences are called commands. Interrogatives well that's known to everyone are called questions. Well and here we have exclamations as an alternative term for exclamatory sentences. Their precise internal structure will be explained in another unit.


Hey guys, it's Julia and welcome back to my channel and for today's video I wanted to do the spooky book tag. I haven't done a book tag in like a Year, maybe I don't I don't even know but I have much like a playlist full of them that you could check out if you want I've done a lot of them over the years But it's just a fun way to get like little prompts and then give recommendations and like I thought it was Perfect for the time of year obviously But yes, this was created by bookables. Nobody tagged me. I just thought I'd do it The first question is corn maze. What is a book that had you confused or lost from the beginning? So this one I altered some of these questions because I had some trouble finding books for some of them But the book resurrection girls, this was a thriller YA release that came out in 2019 I got an e-arc for it, but it wasn't necessarily that it was confusing It didn't pique my interest and then also it didn't grab you it wasn't engaging in my opinion Like that's why I DNF'd it but I thought I'd bring it up because like I was lost in the sense that like I gave up on it I DNF'd it, but yeah that that book I know a few people read and liked but I think the average rating still isn't great I don't know next up here. We have haunted house a book with a super creepy setting. I have misery here I love the setting of misery just anything and like an old like in a cabin in the winter by yourself Same thing with the shining Isolated cold snow just darkness in general That's like that's the perfect setting for me for a lot of these books Just like a lonely cabin and I'll be and you'll be good if you don't know what misery it's about It's about this author named Paul who has been writing these books and unfortunately He gets into a car accident and the person who finds him happens to be a big fan If you would say of his work and she kidnaps him and keeps him hostage for a while So this is a lot of trick or warnings. It's a heavy book, but I loved it I loved it so much. It was so good And it had that setting that I really liked as well. Next one is ghost boyfriend So this is like your eternal book boyfriend or whatever or book partner or whatever I So obviously don't really have book crushes as much anymore Like I I like characters and think they're sweet and all that but like I don't What's the word? I don't simp for any book character like too too hard. Anyways, not even not recently so I'll go with the classic which is a very typical answer, but it's Jace and Will from the Shadowhunter series. They will always be my favorite. They always have a place in my heart Young Julia love these books. I still love these books. I need to continue with them I still have yet to read Queen of Iron Darkness and Chain of Gold so Yeah, but Jace and Will are like some of my favorite characters ever Jace, Will, Jem, so many of them, so many of them are great characters caramel applesuckers What is the best Halloween book?  Is it gonna be a book that's based on Halloween? Is it gonna be a thriller? I don't know. I overthink shit, but I decided to go with something that's perfect for this time of year But not necessarily like my favorite Halloween book of all time, you know, but that's pumpkin heads very morale This is a really cute graphic novel about a boy and a girl falling in love and their little romance and it's it's adorable It's a pumpkin patch. It's all has all the fall vibes. It doesn't have as much It's in a pumpkin patch. So it does have the Halloween vibes as well But it's just really cute really atmospheric and if you're looking for a graphic novel, I'd recommend that one vampire and everything What is your least favorite Halloween trope? So I googled some tropes and like tried to narrow this down. This is also for movies as well I took it that way as well. The one of the ones I hate is the gasp They weren't really dead Because you'll see it over and over and over and over again It'll either be like a resurrection or will be they faked their death and they came back or they didn't actually die due to some unknown circumstances and then they tried to explain it and then Yes That's one of my least favorite another one of my least favorite This is my least favorite but like without this the movies wouldn't happen like without these tropes So many movies wouldn't happen and so many books wouldn't happen, but it's running into the dark basement when you're scared I don't know who thought that was a good idea But if it didn't happen in the horror movies, then we wouldn't get the interesting parts on screen So it makes sense, but it's not the best idea Pumpkin and everything at your favorite Halloween tropes. So for this I have like the evil clown the vengeful spirit I also really like the any type of trope that has a prophecy involved I also really like the alone in a creepy house or cabin like I mentioned earlier evil incarnate What is the most evil villain? So for this one, I decided to go with Pennywise I decided to go with Pennywise from it by Stephen King of because Pennywise just has so many layers It it itself Shapechips based off your fears for one of the kids in the book happened to be a clown So that's why you saw Pennywise the clown so much But no matter like what form he took or no matter what form The evil took it was still scary as shit So I Yeah, I remember I like one of these tabs in here is for like every death or something and there's so many of them Like it's I yeah next is a Ouija board a book that messes with things you don't want to be involved in For this I have dear wife. This is a thriller about a woman who is escaping her be husband and we follow another man who his wife went missing and We also follow the detective on the case trying to figure everything out And we also follow the women so we go back before like a lot of POVs but we get a lot of different sides and dynamics of what's going on and It was a really really great book I got it sent to me a little while ago, but it was really good and I want to talk about that one because Something that I don't want to be involved in is Well, I mean you don't choose to be involved in it But like domestic violence I rather not have to flee my husband or like go on the run because of my husband So Yeah, I don't know. I couldn't think of anything else. All Hallows Eve What's a book world that you'd love to be swept up into I have another just basic answer The Shadow Hunter universe. I've always wanted to be a part of it like so many songs as well remind me of these series and I get all of like The memories back from the books when I listen to some music and stuff and it's just so nice. I don't know Like if you're far behind on this series, it's so daunting to catch up So I understand like I'm even I feel daunted to catch up And I only have like a few books to catch up on but they're they're big books and yeah I don't know next is voodoo doll an author that you would like to take control over so they can write what you want type of thing For this one, I have Gillian Flynn. I absolutely love this author's work. She's written the grown-up she's written gong girl all dark places and sharp objects and Her work is so good so dark always has so many plot twists. I am dying for another release by her She released this short story like a few years ago and since then I haven't heard anything So I don't know she's releasing anything like if I had to I would love for her to write another book This next one is black cat What are some like red flags that you look for when starting a book this one? I wasn't sure about either But some things I look forward in like a fantasy if I'm reviewing it is like the info dumpy bits that happen in the first book So just seeing like how many of those there are and like how well I can grasp the information And like that would probably go into my review type of thing Not really like red flags, but I do look for trigger warnings a lot of the time Just I either write them down outside or I try to tab them or keep note of them somehow so that I can put them in my Reviews, so then you guys know What the books are gonna be about and stuff slut shaming is something I look for and why it contemporaries especially the ones with Like groups of girls you're gonna see so much slut shaming So if I see it it's going in my review So that's the types of things that I guess I look for I don't know I'd love to hear your answers to this question because I wasn't really sure Next is witches brew what book had like multiple components, but one foot together It was all magical and for this I have now entering Adamsville by Francesca Zappia This is a great book these things called fire starters and people start these fires And there's a big mystery and a lot of people believe the main character is an arsonist and there's a lot of It's just in a small creepy town and it's the perfect vibe Especially for this time of year and it's so so good It has multiple things happening in it like it's a contemporary, but it's a thriller But it's kind of a bit of a fantasy like a bit of a Another fantasy element in there like there's lots of things so all together it was beautiful I skipped one by accident, but full moon a character you would turn into on a full moon So I don't know if this was a character I'd want to be or that I'm most similar to or something But I'm also with Audrey Rose from the This is escaping from who do you need the third book the first book is talking about the Ripper But specifically book two three.  She's a badass. She's a feminist. She works at the morgue I Love her. She's phenomenal. So like if I had to be Somebody I'd want to be her the first book plays takes place in the Victorian era, too So like I would love to be back there in that time period, but Yes, I would love to be Audrey Rose and Not that I think we're so much alike, but I don't know I think she's a badass so and there you guys have it. That was the spooky book tag I hope you guys enjoyed it. I haven't done a tag in a while But I hope you guys liked it. Let me know your thoughts in the comments down below Thank you guys so much for watching and I'm gonna be tagging a few people You guys don't have to do it, but like if you feel I get sure Kayla from literature reads cam from we'll shop publishing Ali from hardback quarter Vanessa Starzy Rose and my reading is odd. So thank you guys so much for watching this video I hope you have a good week, and I'll see you guys next Tuesday. Bye


A massive wildfire is raging across an Oregon forest in the United States, advancing 8 km. An army of firefighters is battling the inferno which is fed by dry timbers and has burnt tens of thousands of hectares of forest. But there is hope as a spokesman for the Oregon Department of Forestry has announced that more than 2,100 firefighters, a dozen helicopters and airplane tankers and 22% of the blaze under control.