a few weeks ago. So here's the story of what happened. The CEO of a company called Inovex Downhole Solutions. Downhole means down the hole, so it's oil and gas. This is an oil and gas company. His name is Adam Anderson. Adam Anderson wanted to buy his employees a Christmas gift. So what he did was he contacted North Face and asked to get I guess some jackets. North Face jackets. You know North Face apparel. It's everywhere, right? Particularly in snowing and stuff like that. He wanted to get North Face apparel. And he wanted, on the North Face apparel, he wanted a company logo, which is like not for distribution out there, just for the employees as a gift. It turns out that he made this request in the past before of North Face and had distributed apparel with the company logo on it. Anyway, he ordered 400 jackets from them. And then he put back that his request had been rejected by North Face. Why? Well, because they had decided that it would be inconsistent with their ESG policy, Environmental Social Government policy. To have their logo, the North Face logo, associated with an oil and gas company, because oil and gas companies, as we know, are evil companies. Bad for the planet, destructive. Now, this happens. And you know what? This is going to happen more. But what usually happens is you have a company like just this, okay, I'll go find another company. And in this case, they did, I forget the name of the company, but they did find another company to produce the 400 jackets. But what is amazing about this is that Adam Anderson, the CEO, actually wrote a letter to North Face and made it an open letter, letter that was published about this. Well, he challenged them. He challenged them. Not only about the way they were doing business, but about if you will, the morality of fossil fuels. One of the funny things about the challenge was that he pointed out to North Face, that the jackets had polyester in them. And that that polyester was made of drum roll, fossil fuels. North Face, indeed, would not have a business without fossil fuels. They close, have fossil fuels in them. They wouldn't have a business without fossil fuels because people couldn't come to the ski resorts and need their clothes without fossil fuel.  There's no civilization without fossil fuels. What is amazing is he has a CEO who stood up and made the argument and made it published public and on Twitter, there was a Twitter storm about this, the pro and the anti and the whole conversation, which is brilliant. This is exactly what we want. We want the conversation. Indeed, I believe that if we had more Adam Anderson's, if we had more CEOs willing to take a stand like this, we would win. I think we'd win easily. But what's really even better than that, even better than that, right, is that Anderson attributes his views about fossil fuels to our own, if I can call him our own, Alex Epstein. He attributes it. He says, he says explicitly, he was inspired by Alex's book, The Marquise for Fossil Fuel. Now, I think this is amazing. And this is part of the way in which you change a culture. Is Adam Anderson an objectivist? Probably not. Will he ever be an objectivist? Probably not. But he was influenced by a particular idea within objectivism. And he has been influenced in a way, because of the way Alex presents these ideas, in a way that conveys important ideas about the world. The role of energy, the role of cheap energy, the importance and the standard. Remember what the standard is? The standard is human life, not human suffering, not nature, not the environment, not spotted hours, not the ice cap, whatever. The standard is human life. And Adam Anderson has internalized that and has made that part of him, part of his views. And then has the courage, I think because of the moral certainty that he has received from Alex to post a public letter explicitly advocating for these ideas. And this has gotten a lot of publicity. I mean, he said, I mean, in this letter, he says, for example, without oil and gas, there would be no market for nor the ability to create the products your company sells. He's telling Northridge. That's amazing. He writes, low-cost reliable energy is critical to enable humans to flourish. I mean, that's straight out of Alex. So this kind of points us in the direction of how we're going to change the world. What we need are dozens of Alex's. We need an Alex in every major field. We need intellectuals making the case, influencing business leaders. And I think business leaders are going to be the key in the future. And we need to embolden business leaders, giving them the intellectual ammunition and then embolden them to speak up. Because when a CEO like Aaron Anderson speaks up, it has much more impact than even if Alex speaks. The Financial Times even commented and reported on the letter. And even if they're critical of him, it creates a buzz. It creates interest. People say, where did Adam get these ideas? Oh, there's this book. Wow. That's a weird title. The market is fossil fuels.  What we need is more objective intellectuals doing more work independent or as part of institutes or part of the Ironman Institute or not. The Institute has played no small role in getting Alex to where he is today in my view. But this is how it grows. We need more and more and more people talking about these ideas, impacting decision makers, impacting people who have platforms like Adam Anderson. So a lot of people are now questioning this ESG and the way it's going to be implemented. And it's going to be this is great. I mean, this is this is one of the best stories I've read in a long time. And I'm excited. I'm excited for Alex. I'm excited for all of us that this is this is possible. All right. What we need today, what I call the new intellectual would be any man or woman who is willing to think, meaning any man or woman who knows that man's life must be guided by reason, by the intellect, not by feelings, wishes, wins or mystic revelations. Any man or woman who values his life and who does not want to give in to today's cult of despair, cynicism and impedance, and does not intend to give up the world to the dark ages and to the role of the collectivist. All right. Before we go on, reminder, please like the show. We've got 163 live listeners right now. 30 likes. That should be at least 100. I figured at least 100 of you actually like the show.  But but at least the people who like it, you know, I want to see, I want to see a thumbs up. There you go. Start liking it. I want to see that go to 100. All it takes is a click of a click of a thing, whether you're looking at this. And you know, the likes matter. It's not an issue of my ego. It's an issue of the algorithm. The more you like something, the more the algorithm likes it. So, you know, and if you don't like the show, give it a thumbs down. Let's see your actual views being reflected in the likes. But if you like it, don't just sit there, help get the show promoted. Of course, you should also share and you can support the show at your own book show.com slash support on Patreon or subscribe star or locals and and show your support for all, for the work, for the value, hopefully you're receiving from this.  You'll know what shows are on when they're on, you'll get notified. So, yes, like, share, subscribe, support, like share, subscribe, support. There you go. Easy. Do one, all of those, please.


Hi everyone. I'm glad to see everybody's in this room and we're gonna talk about a lot for really, really largely making all of my software, so I'm getting a little bit time jackalock right now. So we're gonna talk about a lot of DevSecOps functional safety, functional security. Okay, we are getting buy one get one talk by the way. Anybody knows buy one get one? So you're in this room, you're getting another talk as a parallel. I'm gonna pick up a lot to So focus on me or otherwise, otherwise we cannot get it done. So anyway, we're gonna talk about a lot of DevSecOps, but as well as we're gonna talk about what is really going on Automotive Industry. Anybody from Automotive Industry by the way? All this? Okay, great, great. I see three, four people out there, five. You don't think that you may not part of Automotive Industry, but in reality, you are supporting Automotive Industry, somehow. Because you are contributing the software community. So let's continue. One, two, three, it's not lit as illegal stuff. There you go. And this is me. I'm Hassan Yassar and I have been working in the software world almost 30 years, I'll say. It just keep moving. I'm a faculty member and also I'm contributing to the DevOps, DevSecOps. Anybody heard DevOps and DevSecOps? I saw somebody heard it. Anybody heard DevOps, DevSecOps? Yeah. So you're gonna hear a lot today as well, and which is kind of connecting the open source community as well as what we are doing for Automotive Industry. So I have been contributing many things. I'm also a faculty member at the Carnegie Mellon University, which is the Carnegie Mellon known as one of the number one CS department in the world. So I'm teaching over there for DevOps and DevSecOps course and software security course as well. So what are we gonna talk about today? Why you're here? So you're gonna hear a lot. What is the verification and validation for our safety? Our safety, we are in the car and our safety is playing a key role with respect to the software. So I'm hoping that after my talk, you may be a little bit cautious or comfort depends on which car you're in. You may be scared. You may not be scared.  I'll tell you the truth, right? So let's, we're gonna talk about why matters and we're gonna talk about what does the verification and validation means. We're gonna talk about how we can solve safety and security with the verification and validation. Then we can be safe and secure in a car. So let's dive in. Why matters? Why is important? Why we are talking about? When we look at the today's landscape Automotive Industry and it calls a software defined vehicle. Anybody heard about that term? Software defined vehicle, right? So almost every car it's going that direction right now. Start from Tesla. Everybody knows Tesla. It's a great example for software defined vehicle. Everything is software. Because of that movement and things are changing from this to this and this, it's basically what that really means. Instead of using a specific hardware, ECU, EC unit, electric circuit, electric control unit for a car, we are adding more software into it. In a typical car, as a kind of minimal level software defined car, we have about 68 computers in the car for each of the dedicated functionalities in the car. When we look at the software, we are talking about 80 million line of the software that we are running on the car. That's really scary. Anybody, you know how many line of software you're writing web pages? Depends. You don't know a lot because it depends on the backend component. We have 25 layers typically. We may have a million million lines, but in the car we have 80 million lines of the code we are talking about. Another interesting note is basically when we look at the bill of materials, it's going to get more by 2030, which is we are very close. Seven years, 50% of our car will be based on software modules. Now I asked at the beginning and I said how much you are in the automotive industry, but you are. As Linux Foundation members, as the group of people you are in this organization, you are contributing somehow. You're not realized that, but you are contributing somehow. That means you are somewhere in this bill of materials. You are not working for Volkswagen or BMW Mercedes, but you are contributing indirectly. What you are producing as an engineer in your open source, in your modules, in your organizations, somehow you are sharing your information with Stack Oriflow. Anybody in Stack Oriflow? Of course, we do a lot. We are using it. We are exchanging information. It is actually contributing into the big organizations. What is the really reasons people are going in that direction? Because it is saving so much money and also the control. Let's look at why. It's another why important. The goal is the automotive industry going to solve their defined vehicle. It's saving the life and saving an environment. Because when we go in that boat, yes, we have a lot of cars at the pass. Now, when we look at the modern cars today, it is getting much, much, much safer because we have so much sensors in the car. Previous talk was talking about a lot of adaptive systems for looking for the cameras and analyze quickly, give some warnings. I'm really happy to drive a car. It has collision detection on it because it's going to help me. If I'm slipping in the car, I would like to get some alert from the steering wheel. If I'm looking somewhere else, car should yell at me. Something like that is really affecting. Now, it's much, much, much possible using a software. That software is going to help us to drive much faster and much efficient ways as well as safer. I'm sure you saw so many stories people are slipping in the Tesla car. I saw that pictures. In California, this is happening a lot. People are slipping in the Tesla. Yes, it's wrong, but it's a safety people that are believing in it a lot because software giving that confidence for the people to be safe and secure. Another important thing I would like to highlight here is the preventative maintenance. What does it really mean? How many of you stopped in the road because of the car got failures in one of the mechanical parts? I did when I moved to the first time in the U.S. 1995 and I stayed in the road many times and I got pulled and pulled over the cars. I had a Ford car. Anybody from Ford Company? No. Okay. Ford is a different name. I don't want to say it right now, but I stayed in the road because of malfunctioning. I don't know when it's going to be expiring some of the parts, which I have no idea. It's just happening and transmission is gone. Brake is gone. Something is happening. With the software, it's basically monitoring how the function of the unit is keep changing and it's giving us a feedback as a preventative maintenance. We are getting alert from the car manufacturers. Based on your driving patterns, you're going to run out some brakes and some other parts, it's happening good software defined components. Now, software is becoming our life as safety and also the helping for effective driving. Another interesting thing I would like to talk about environment sustainability, the most of the cars, it is giving us a more full efficiency, either electric versions or the gas gasoline version. Truly it doesn't matter because you see a lot of improvement in the gas consumption as well because software is becoming key elements for monitoring those, giving the right routes and effectiveness of the environment. It's great. What's the problem? The problem is this. How much we are trusting the software car is a safe and are we building secure? Two things is important. One is, how do you know that we are building? Yes, it's great. It's working, but since we're using a lot of software in our components, in our car, it's getting more and more and more. Think about 50% of an 80 million line of code. Think about the sacred spec of the car that we are driving. Now we can ask the question, are we building the safe car? Since growing a lot, you think everyone's going to do it because time now there's another pressure for the market. Market is going to pressure a lot, get more and more and more building up the software. More means we're going to do a lot of shortcut in the security. What it really means that everybody is going to have a higher demand of driving those cars. It's going to get much cheaper. It goes back to the VEP technologies. Like VEP became our life with a lot of vulnerabilities keep increasing. We have a lot of demand building a function out of this. Also another thing we can ask ourselves, are we building the car securely? There's two different questions. Are we building the safe car? Are we building securely in the car? Based on the attack, this is another 2022 data sets. You see that when we are going to more software, we are getting more attack vectors for the cloud server. What this means, we are using a lot of software. It's connected to the cloud environments such as AWS, maybe on-prem, on-prem cloud environments. Many other things will be part of the connected because it can attack surface. Now it's not the car we're driving as fully mechanical that I own as a driver, as the owner of the car. Now car has connected to many other endpoints. Maybe mobile phone, maybe the data center, maybe another car, talking another car, you guys heard about, there's actually GM is working closely, building up mechanisms. The car can talk to each other. They can give a respect of when they do the red line crossing and it can get so basic, putting more safety into the car, but also we are creating more connection for other environments. It's becoming more connected vehicle. Over there updates and Wi-Fi, it's creating an attack vector for adversaries. So that's a great side of the safety and security, but there is another side of safety and if you don't do the right job. So what are we going to solve this problem now? How can we address the safety and security? So to address these two questions, we're going to dive into the verification validations. Anybody heard the verification validation? If you are in a regulated environment, you should know about the verification. I'm just going to give you a quick feedback on what the verification validation means. So verification, this is a definition for a myTriple. I'm not going to read everything, just going to give you a quick idea what the verification validation means. And this is the kind of a standard everybody's truly following. Yes, it may be changing based on where you are in your compliances, but the source of the verification validation comes from myTriple, 10-20, 10-12 documentation. Verification is basically helping us build the product correctly. How are we building the product correctly? Then we can validate the product. Is the right product that we are building? There's a two different concept verification. How are we building the product which goes back to my questions, are we building securely? Then we build a safe and secure product, which is the validation pieces. How do we assure that? And we're addressing the vulnerability that is keeping cruising for 80 million lines of the source code, will depend on each other. So we have to use verification and validation a lot, a lot in our new generation software, because now it's affecting our human life. Yes, web application may not be affecting human life. Sorry, I'm pointing on to you. I promise I'm not going to ask a question, but it's affecting our life. If you don't do that, now as an automotive industry, as an engineer, as a part of it, we're going to think about how can we apply verification and validation in our code. Let's move on. There's another graph I like sometimes hard to explain. So we kind of look and say, like we say, are we doing the right things, fighting with malware, doing the right stuff? Then validation is, did we build up the product? It's working or not? Or malware perspective can keep in your stuff? Right. So now, how are we going to build up verification? Well, let's go into the why pieces and why is important. The successful verification evaluation is going to help us eventually build and safe and secure systems. It's going to save a time, money, and to find that problem as early as possible. Verification evaluation is not just for compliances. If you look at the compliance perspective, it's going to become a checklist. So change your mindset. It is not a checklist verification evaluation. It is the process to help us to get a better product. If we put yourself in a compliance auditor perspective, it's going to become a checklist. When you become a checklist, you do a lot of shortcuts. How many are developers in the room? How many engineers? So as an engineer, if anybody asks you, have you ever done this work? Typically, yes, I've done it. Your world is becoming a checklist in auditor perspective. We trust you as a developers, but we would like to see a result of your code as test results, as a result. Yes, we love it. But auditor has no idea what they're asking. They're asking, are we building the product? And you, as a developer, you say, yes. But as a developer, you should say, go take a look at this output. Here's my artifacts that I'm going to show you what that means. It's going to change a lot of perceptions. Let's continue. There's, as I said, verification validation. Verification analysis is based on process requirements, activities, and methods. Same thing is also true for validation. One is focusing on how are we doing well. The other one is what the product looks like.  That depends on where you are in the system lifecycle. You can apply those techniques and activities. So I'm going to show you how you apply those techniques and activities with the DevSecOps concept of open source component. Again, you can take the picture. And if you guys reach out to me, I'll share the slides as well. So don't worry about taking the picture. Send me email. You will see my email at the end. I'll send prompts to everybody with the slides. So validation analysis is about getting more testing. That's the questions auditor is asking. Did you build it correctly? Show me your functionalities. Have you done the secured analysis as engineers? Yes, I did it. I did it. I did it. And then auditor says, check, check, check, everything is good. But actually, it's validation based on the test. How can we do the test? We have to generate an artifact software and wire them so we can build up the validation as we are going through. And then record is actual product. That seems a lot of testing. The successful and safe card is recording a lot of testing. There's many, many techniques we'll talk about shortly, but it's recording a lot of product mindset. Let's move on. This is a little bit heavy graph. And it's based on how architecture is really driving our safety and security. So that means if I am building up an architecture, think about the systems level now, everybody has to think about what is my architecture looks like. I can create a specific test cases on every phase of my life cycle based on architectures. You may be thinking new modern world of engineering, it's omitting architecture. It's not correct. Architecture is the source of everything. Either we might be using a framework like open source framework. We always use some other red code. We always engineer thinking about how it can be architected. It's becoming more and more and more important because we are dealing so much connected complex systems. That means we can build up a lot of test cases when we are in any phase of design, we can build up our test cases. Because going back to validation, testing is the key point to validate our product for a safety and security. Again, remember that. If you do it late, like I don't want to be a target, somebody is testing my car while I'm driving for a safety. I don't want to be in that car.  No, I have to do more testing as an early, right? That's what we should do. Let's continue. So this is another long list of verification and validation activities. I'm not going to go every line. This gives you an idea. There are activities listed by IEEA documents that we have to follow verification and validation activities. There are many activities, requirements, design interface, traceability, all these activities that we have to do. Now I see because I'm going to skip too much. We'll talk about more. Here's another set of activities. It's a lot. So I didn't count it maybe more than for the activities that we have to do, build up a success of verification and validations. Now that's a problem. How are we going to do all these 20 activities to address in a short time frame? So everybody's thinking engineer builder, QA builder, tester builder, that probably you're thinking, right? Because if you look at the configuration audit, who's going to do the configuration or who's going to update check? How do I know that the update is working successfully on this thing? So it's becoming very challenging when we look at those activities. Let's continue.  And again, if you look at IEEA, we'll see a lot of detail activities and subtests and how you can do. I'm going to mention two of the key activities as part of secret analysis. If you are told about the secret analysis, we have to look at the owner's definition about the systems. We have to use the CIA to react. Anybody know what the CIA? Confidentiality, integral availability, not the three letter agencies. Confidentiality, integral availability, it's the source of the security. So we have to think about our car, our systems as individual component. One is a system level. Another way we're going to think about every component, how are we addressing the three key security analysis? Confidentiality, integral availability. Like confidentiality means today's car, it's very connected our personal information, PII. We're using connecting our phone to the car, our data goes to somewhere else. Maybe somebody's when we rent the car and you're connecting your phone, all your call inside the car, your phone number is in anybody deleting your profile when you're done with the rental car? Yeah, you should. If you don't, then you should, please. Still, there's a lot of, and I was in the, Robin and I, we were in the software Divine Valkyrie Conference in Berlin. The privacy, unfortunately, it's not addressed well. That means we are not doing a lot of verification validation probably. There's a privacy concern on the growing software world in the car industry. That's a sad news, but we're going to get much better eventually. When we look at the risk analysis, this is basically every test we do based on the risk. Based on the risk, we will look how the system is going to behave under certain conditions, maybe environmental conditions, maybe software security conditions. We see a lot of hazard situation like maintenance perspective. That's what we predict if maintenance is helping a lot to solve risk analysis. These are the couple examples. Let's talk about how we can get all this giant list of activities and make it effective working with our auditors and we have to use infrastructure. That's the connection with the software development perspective such as DevSecOps and the connection with the open source community. So far, that's auditorial perspective, safety and security. Let's connect how we can build up safe car. This is a quick definition of DevOps and DevSecOps. Again, I'm going to share the slides. DevOps is a basic set of practice and process, including all stakeholders. It's not just Dev. It's not just operational. It's requiring all stakeholders. If you remember the verification and validation activities, it is requiring all stakeholders in involvement. How can I get all stakeholders in involvement? I have to change my processes. Most of the organizations who are going to the software defined vehicle, they are using agile principles. They are using DevOps principles. If you look at the Tesla is a great example as an agile enterprise. They do all automation automatically, checking all this and they are using DevOps and with the SEC pieces is about adding a secret into it. You're using it like Renault and Ford, Porsche, Volvo, all of them are using DevOps principle to achieve those automation testing integrations. Otherwise, we cannot achieve the verification and validation. Otherwise, we cannot address the secret and concern. So if you are in the situation, start to learn about it. Start implementing. Let's take a look a little bit more. I'm going to give a little bit idea, just a quick reminder when you talk about the software development lifecycle. There are four environments where we write the code as developers, where we integrate the code multiple 50, 60 computers for integration pieces. Then we do the more testing in the staging. Then finally, we go to the production that car is working in the cell. So based on that four things we do all the time, but we can look at the environment until there are four environments we work and then based on our flow. Now we are talking about software, right? Software, we write the code, go into the testing. If you get more closer to the dev environment, then we can solve the problem much easier, much quicker. I'm going to show you quickly. Another one is the key concept you might be hearing a lot as infrastructure is a code. IAC means everything what we do, what we're writing, we can script it. So we can build up automations. It's not just the writing the code. We can set up our test environment, test harnesses, build up many cases like a digital team is one example. Most of the car manufacturer are building the digital representation of the ECE unit and then using the script and sharing with others. If you're an OEM, if you're a one of the contributor to the one of the components, you can build up the visualization part as scripted and share it together. Another topic is the key as a continuous integration, which we are integrating our code, not just the code. We are adding other elements with the code which is infrastructure, the app code and documentation together. So why I'm saying it, because you will see how the verification and validation goes together based on this concept. So if I'm building my code as an engineer, I can write the script along together. I can keep the word. If I'm a vendor, if I'm a contributor to the community, most likely using Docker containers. Docker containers are a perfect example for IAC because you're scripting your environment based on the base operating systems, you're adding your configuration, you're sharing with others. If you're a contributor to the community, somebody already using your Docker container as a base image in their environment, you don't know because you don't know what's happening because somebody might be using it. This is an example for IAC. Same thing for Kubernetes. Same thing for CloudFormation template or Azure Resource Manager. There's an example of the automations that people are using it a lot. And when we talk about all the students, we have to integrate our environments with the repository management because everything is a software. We have to put in our source control with our IACs, with our integration, we can build up automation. That's what basic DevSecOps is about and integrating all the send wire elements. I'm going to go quickly. When we combine the verification validation with the DevSecOps, verification validation is really based on all activities we do. And then using the engines behind it, which is automation engines using the DevSecOps, using continuous integration, continuous delivery to help you to build up the verification validation analysis of your code that you're writing about. So we're going to dive where we can do met those activities shortly, in which phases I have to use those activities, which one is verification, which one is validation. I will show you quickly with respect to the lifecycle and also the engineering perspective. So there's a problem here. Anybody knows what's problem? Especially here. Can somebody guess me with a short break? All right. You're open source community. You're in the Linux Foundation open source summit. I'm sure you heard many, many security, many components. Let's take a look. Here's the problem. We are building a components, but how do we know that? Our components we're using because open source is the one of the key drivers for DevSecOps environment. What you see here, almost every tools for continuous integration, code review, testing, building, all or open source, like GitLab. I know you have the paid version of the GitLab, GitLab or GitHub actions. GitLab run as an example for the CI, or Docker open source for deployments, or using any parameters for a monitoring open source, or I can name it 500 tools, but it's all our open source. Tecton. Anybody's in Tecton? Tecton is another great ones for a continuous deployment, which is making it much easier to deploy. There are many tools we are using it here to build our infrastructure. So now there is a connection with open source. Yes, we can do a lot of verification and validation, but we are using a lot of open source to build up the infrastructure, writing a code in it that we are driving. So now the problem is, how do I know all this component that we are writing and using infrastructures actually build it securely? If you don't build up the security infrastructures at the beginning, you cannot do all the verification validation successfully, because attackers will use your Docker container, put the malicious code into it, your engineer, you're going to use his Docker container, you trust on him, but actually it's his container modified from a third party person, then we are putting it in our cart, and we are trying to be as safe. Is it a problem? Now, how can we do that? So we have to build up a security infrastructures, including software build of materials, look at the configuration, build up the components, we can build up a security infrastructure, then we can build up verification validation on top of it. Are we good so far? All right. Okay, let's continue. So we have to really build up a certified ECU in a DevSecOps pipeline. What that means? We're going to create a pipeline, each of the ECU units that we are building, again, each of the ECU is the specific functionalities of modules. It can be OEM, it may be a contributor, and it may be one of the environment that you might be using. So we can build up infrastructures for each of the ECU and we can certify architecturally, which is verification elevation, and also we can look at our infrastructures, eventually, make sure that it's correct. So another representation of infrastructure, these are more example for the open source, like study analysis on our cube, container scanning BME Aqua, maybe other type of scanning tools. You might be using malware scanning here, there's a lot of open source version available. You may be dependency analysis, like the dependency tracker, or the SC analysis of the GitLab, you might be using a other approval, which gives you an ability using all open source, but we can make sure that our infrastructures configure securely. We can put a lot of audit generation from pipeline. That goes back to my questions. If I'm a developer, how can I generate the validation of my result of testing the pipeline build automatically for you? As if you're auditors, don't do the check. And if your developers say, here's my result, go figure out for a DevSecOps environment, you will see the test results. Let's look at maybe this one is all together. So I'm going to give this one as another note for all of you. And when you look at the typical DevSecOps environment, open source libraries are everywhere in our software lifecycle. Open source means that we are acquiring the component from third party. We are creating the code in our base container images, and we are releasing the code based on the Docker container or Kubernetes. We might be using Kubernetes cluster somewhere else. We have to monitor third-party libraries. It's basically within the lifecycle and also part of the product. Since the software ecosystem is growing in automotive industry, we are using it to save time. We don't want to reinvent the wheel. There's a lot of standardization or modules happening a lot in the software world for specific automotive. That's the reason you are here. You're going to use some of the analysis that you presented maybe as the image analysis. We use image analysis, the third-party libraries in our code. In short time, it's available because you don't really write the code as an engineer. You just google it, go the stack overflow and copy it and use it, saving time. Great. But how do we measure all this dependence in our lifecycle? It's becoming part of our lifecycle. Where we build the pipeline also we use in the product perspective. Let's take a look how we can giant list of VNV activities throughout the lifecycle time check. We have a couple more minutes. When we look at the verification validation, I'm just going to pause a couple seconds. All DevOps, DevSecOps, it is not changing how are we building the systems. It's not changing. It doesn't say forget architecture, forget the design. Just go write the code. No. We have to have a feature. We have to think about the requirement here to understand architectures. If you don't know what the user is asking from you, how we can architect your systems? If you don't know what the future are working on, how are we going to build up your components eventually? Don't confuse the phases of system development lifecycle with the process as a waterfall and agile. The phases of lifecycle is true for years and years, but we build up the wrong processes to achieve those requirements. That's a process. The phase is the same, either using agile or a scrung as the one of the techniques or the Kanban or the save. Still, you are doing these phases in a feature-based, important features about the functionalities, features about the specific functionality you're working on it. That's why I said Tesla is an agile company. A lot of automotive industry are using the very agile centric DevOps centric, but it's focusing on the future. They're not dropping any of these phases. It's important. That's the reason if you try to drop any of these phases, you cannot do verification and validation activities correctly. You're going to do some assumptions. With assumptions, we're going to build up unsafe cars. You will see a lot of things. I'm hoping if not, but based on the trend I have been seeing it, we miss a lot of fatal accidents eventually because we don't do proper verification validation. I hope we will not, but if you don't do it, you might be seeing it. Let's take a look. Quick things. I'm just going to run through with the lifecycle perspective where we have to the verification, where we go to the validation, how the interaction looks like. I'm just going to list the activities that we think about the verification, about understanding are we building the right product. Usually, you're getting requirements and your feature requests. You can all this analysis that I listed. You can the trace it, but now you can all analysis pieces when you have your requirements as available. Because if you do analysis at the beginning as a plan, you can do all this activities eventually. If you don't plan your analysis, you cannot do the rest of the work. So you're going to plan analysis and upfront in the future request. When you get in the requirements, you can the further creating analysis of your work based on the test, based on acceptance test, based on secret analysis. So basically you are doing a lot of preparations as you are building your functionalities requirements. You can put the verification activities in your specific phases in your lifecycle. If I'm writing any cases, like using a JIRA or GitLab, issue tracking systems or anything, so GitHub, then I can think about what type of analysis I'm going to do. Let me create a potential test cases that I have to do. Test case is our driver for the validations. That's the connection pieces. When we get into the design and architecture, we can do all this test planning, test design during our architecture and design we can do. If you don't plan your test cases when you are architecting system, you're going to pay a lot of money to build up your test environments. It's going to delay your deployments. Eventually, your manager will say, we are running out the market. Let's do something quick. That's happening a lot. You're going to do a lot of shortcut. And eventually we're going to fail miserably because most of the testing, if you don't plan accordingly, you can fail on your tests because it's going to cost more money for you. Just going to say one word for agile practice. If you are following scrum or agile or if you're creating a sprint or a case that you're writing the best criteria for your case that you're writing as advocates and stories, you have to follow the criteria called as invest. Anybody have an invest criteria when you're writing the case? Yep. So invest one of the letters. T is a testable. If you're writing a story in your requirements as an engineer, you have to think about how can I test those requirements. So basically we are writing testing right away in our analysis and design. Let's continue. When we get into the development phase, now we see the validations because when we basically we can shift left from validation to product, put into our life cycle so we can do early validation for the specific components. Remember one is building the right. The other one is did we build the right? So we can look at the static analysis result on the development phases when we're writing the code. We can look at the vulnerability. Let us get some validation of vulnerability that has been addressed correctly when we're writing. Why we are trying to get validation early? If something is not right, we can go back and change easily because we are so close to the architecture and design, so close to requirements. We can go back, change easily and look at what we are doing right. If you separate those activities, you're going to pay a lot of money down the road, go back and change it. So basically we can do a lot of work in here for validation. We can create a static analysis result. We can do functional. We can IAC build up a lot of test cases, test it and test it and more. Eventually when you do all this activities, you will be creating a digital replica of your car eventually. That's what Tesla has. Tesla has a unique digital replica of their car in their car and everybody has a digital presentation or using in the cloud and wireman and you can see that. So let's continue. When we do the integration still because of the verification validation of certain analysis and risk flow, we can measure it. When we get into the final phase of delivery, we can do more acceptance testing. Now we are getting more validation based on what the verification requirements looks like. So it's all integrated. Let's make a quick deploy. I'm just going to quickly skip a little bit of time and for data, it's about the pieces we can collect data in everywhere because data is our result that we are generating for the validation perspective. Every actions you do in your life cycle generating data, either test result, test cases and specific attack vectors, specific vulnerabilities, you will be generating all this data so eventually it can feed all to your requirements and verify. So overall, we have the continuous verification validation in every phases of life cycle. How are we going to do? We're going to use DevOps and DevSecOps based on our open source tools and techniques we're using it. So basically it has to be our life cycle. Everybody has to involve. All stakeholders has to be involved. Business, security, quality, tester, name it, just a quick replica. Then we can think about verification validation of life cycle. Eventually we can drive in a safe and secure car. That's it. Here's our workflow and which is another way of seeing our verification validation workflow. This is you as a customer that's your expectation is being a safe and secure car. But this part is done by the manufacturer which is a car manufacturer. We can set the specifications, look at the how are we doing well and we can build a product. We can verify and validate. If your customer, which is us, if somebody's kind of got four of its, if something happening when we die, think about that company that's going to buy that car and then car is going to get pulled over. There's a lot of recalls for a safety and it's going to cost so much money for organization. Then it's very hard to change the brand of the company. It's going to cost more money. That's it. I'm going to say here's my information. You can download it from the website. As an SCI, we have been publishing many, many other articles. I know we have one minute. I made it. Here's my contact information. If anybody has any questions, we can talk about this. You can take and send me email and I'll send the slides copy as well. I hope that we can be in a safe and secure car eventually. Now you have a job. Your job, think about security as you're building, as you're writing the code because it's affecting our life in some of us which we don't know. Thank you for attending my talk. Any questions? Yes, a couple questions. Yes, please. Hello. Thank you for the talk. I am actually new to Automotive Grade Linux, but I've seen the pain and the friction while working in the embedded industry quite a bit in terms of certifications. And quite painful for a good reason. Everyone wants to be safe. And my question is, are there any open source standards or methodologies to testing that are out there we can read about? There are. And something we can widely follow in other industries as well because Automotive Grade Linux is the standard in terms of testing safety. Great. Perfect. So there is actually, that's one thing maybe I can think about here as a continuous verification validation means the industry are learning. And if you look at the Tesla example, Tesla does continuous verification validation, which is for certifications continuously. They're not getting certification every car, but they are doing incrementally. What that really means incrementally, if I'm building any capabilities, any functionalities, and I have to show a delta of functionalities and also the testing, instead of sharing the whole giant set of requirements, I have to share the incremental version of it. The thing about here is an example, and I'm talking about maybe this one. If I am doing some testing here, the next time, next iteration will be different. That means I have to change only the incremental pieces for a compliance perspective. We can get the certification quickly. Yes, organization does. There's a compliance as a code for open source version. Send me a lot, send it here. It's information that's available at this of compliance as a code. You can put your compliances, which is a certification into your requirements. When you look at the certification, it's about the verification validation analysis. That's exactly what they're asking, but we are getting a customized version for a specific automotive industry or healthcare. All are coming from my trickle source. So short story, we have to determine incremental, and also there is a cultural pieces as well. If you build up the culture with your certifiers, and then they will trust on you based on the incremental changes. That's another point that we can think about. Any other questions? Yes. So functional safety with optimized boot time is like two contradicting requirements. So do you have any suggestions on how we implement functional safety also having some boot time optimized? We always get requirements that functional safety test needs to be done at boot time, but then it increases your boot time. Any suggestions? Regardless, safety is always the priorities. That's kind of like we cannot trade off the safety. And better way to explain to the people about what the consequences are, but based on my suggestions based on what I've been saying it, there are some risks we can do. If you'll mind the risk analysis, I'm going to go back here quickly for a risk perspective, and I know I'm just browsing the screen, based on what things we can tolerate it. So I really suggest for a safety cannot be a risk situation. Separate those, and then you will get a balance of which one is required based on the risk. Risk can be hazardous, but how much is affecting our human life? If it's affecting human life, we cannot make an in-circification. We can't. We have to follow. I hope that answers your question. All right. Anybody have any questions? Yeah. So actually, I'm from automotive industry, and I have a question that, you know, in automotive, there are a lot of regulations, specifications, ISO 26262 and ASPAS, and all this kind of homologation, those kind of a lot of regulations. But on the other hand, I think there is a more fierce computation in the speed, or say the delivery speed. So how do you think, for the automotive industry, can balance the speed and this kind of? Actually, the automotive industry are taking a lot of advantage of the speed. They're not contradicting. The problem is, when we try to apply those certifications, we are applying as a waterfall tank. We are trying to get more papers. We are trying to get more manual process. That's actually contradicting the speed. If you're able to get those certification requirements as part of our life, that's what the verification analysis is, we can get much quicker. But usually, certification or certifier are outside our cadence. It's kind of a ping-pong ball. We're just saying, here's my product. Go certify. Get back to me. Because it's not working like that. We have to work as a team, working together. If as an engineer, if you know what your requirements look like, you will do it. If somebody tells you, two months later, you have done wrong, it's going to get close to you. What you're going to do is a shortcut. That's the problem. So if you look at the software, they find the vehicle, look at all the standards from Deloitte, to many other things. Renault has a great standard. Porsche has another one. We are getting more automation in there in a while. We can use a lot. So it's not actually contradicting. It's really helping a lot. One of the principle DevOps giving traceability, visibility, makes it much easier for it to certify it except that's what the Tesla does. I think we are done. We can talk outside so I'm available. We can talk more. Thank you.


Welcome to Access to Trader, the number one community for those who are committed to taking control of their trading in order to achieve success, profitability, and longevity. Thank you for joining us. Here's Dan Shapiro to help you find your edge, master your process, and own your future. Hey, guys. Good morning, everybody. Welcome to another edition of the AccessToTrader.com weekend update show. So I woke up today very, very happy. It wasn't that I bought something new or I'm looking forward to taking a vacation or getting a new car or anything that many people, unfortunately, and again, I'm no different than anybody else. You don't realize it in the moment, but things that we can buy a lot of times, materialistic things a lot of times subconsciously, they give us that extra boost. It almost validates what we want. And I woke up this morning and I didn't have anything on my mind. I didn't want anything. I wasn't looking forward to buying anything. I was just generally happy that the first time in my life that I could honestly say that I have food in my refrigerator. I have a roof over my head.  I have two wonderful kids and we're just alive. And I started really thinking about the surreal events in my life and going back to the worst, I mean, the absolute worst part of my trading career, which was two years after the internet craze. This is two years after the greatest experience that most traders would ever see in such a short period of time. And from 2001 to 2003, and a lot of you guys know this, but I didn't make a single penny, not a dime. And I was working for a hedge fund in South Florida. And I was the absolute worst trader on the planet. And there was no second. There was no second. There was no third. I was the absolute worst. I didn't have a single, I think, winning month, even winning week for two years.  And the thoughts of, and unfortunately, again, and I'm not embarrassed to say this now, but it was there was a lot of demons in me back then that thoughts of suicide were very, very real. And I had to overcome that. And through all that time, God was always there. A lot of times, you turn around and you don't really appreciate when you have a very, very strong belief that somebody or something or whatever a series of events, something is with you, that's always going to help you. That's always going to look out for you. And life is just one big test. It really is. And unfortunately, right now, I know a lot of people look in the world. We're talking about it always from the market point of view. And we're talking about it from the point of, wow, look how great this market's acting, despite what's going on in the world. But people are going through some serious issues. I mean, 35 million people are unemployed right now. They don't know what their future has to offer. And unfortunately, we don't know. We're not promised tomorrow. We're not, I'm not promised 15 minutes after I record this video. So I think the way we look at life, kind of especially growing up in our society, everybody in your early 20s, you want the new watch. Okay, now you have the new watch, now what? You want the new car. Okay, now you have the new car, now what? You want your first home. Okay, now you have your first home. Now what? There has to be, there has to be a higher purpose, right? There has to be a higher purpose of happiness. And when I woke up this morning, I really felt, not for the first time in my life, because I'm very, very appreciative, kind of what I've been through and where I am right now, but the first time in my life, I could actually wake up and turn around and say, I'm pretty happy right now. You know what I mean? I'm pretty happy. And I think the blessings of God. And again, I don't want to turn this in this whole crazy thing, but I think what a lot of people lose track of is that blessings are all around us. You could be struggling right now, whether it's your marriage, whether it's your finances, whatever the case may be, in God forbid, maybe your health, but there's definitely things around that you are being tested. Our characters are being tested. Our resilience is being tested in every single level, different ways. And I do want to say, I'm not a perfect person. I could always be a better father, better husband, sure, better trader, right? But I have to say that, I think that us collectively as human beings, we have to believe that there is something there out there for us, that no matter what happens, that we're gonna be okay. And if you are going through hardships right now, just understand that half faith, if your trading career is not progressing as fast as you'd like it to be. Again, take time. Take time. Again, I'm not perfect. Not even the closest.  I don't have all the answers, but I'm trying.  So if you are having a very bad time at this juncture of your life, half faith, God will be there for you. As long as you continue to believe and as long as you continue to have resilience, you are going to be okay.  That's the best way of saying it.  Try to smile. Sometimes things do get hard, but try to smile. And the most important thing is, just keep on pushing forward. So I wish you all the best for your families, for your future and for the rest of your life. So God bless. So let's talk about the markets. Really good week. Friday was a very slow, painful day. Literally everything that we were watching pretty much triggered, it feels like after three o'clock, after 3.30, by then I was already, I lost interest. But it's amazing about this market. And the scoreboard is really not going to paint the full picture. You had the Dow Jones Industrial Average losing 2.7% for the week. You had the S&P losing 2.3%. The Nasdaq did very well. And again, the scoreboard won't paint a picture. If you look at the final numbers, the cues, right? The Nasdaq 100, they were down 1.2% of the week. But if you look at where these beta names are, where they close, they either, a lot of these names either broke out, or very, very close to breaking out. And it really does show you that, and I kind of titled this during the middle of the week, it's the George Costanza Market, right? Nothing that you think makes sense, well, it makes sense right now. And the amazing part of what we're seeing right now is the incredible resilience of the bulls. And when you look at where the market started for the week, kind of giving that last gasp of really, really aggressive run-up into this linear regression line, and came Tuesday, that we talked about a potential rollover. And again, that's exactly what happened. We had a 500 point day. On Tuesday, we've been watching these videos all week. You kind of see the chronological order of what happened. This was great about the YouTube platform, or any recorded platform. You kind of see my journey, you kind of see my thought process kind of every day. There is no Monday morning, quarterback. This is what should have happened, and this is what that happened. This is what we're going through. So this is what we're going through. If we're living in a real life, you have to be trading in real life. And the most amazing part is the bulls really could have, I mean, really gotten decimated. Two days in a row of selling, and the bulls did, again, an incredible job. That's the same thing they've been doing now since this whole corona mess started in the first place. And they had every reason, every absolute reason to rule over. But again, just like we've been seeing since the March, what was it, the March 23rd lows, the bulls keep on fighting back. The money flow continues to be there. The option flow continues to be putting traders in a position for deep out of the money bets, speculation bets. So the idea that fear is in the marketplace is completely false. Because again, when you're taking bets and you see fully guys who watch option flow regularly, you see, I mean, there are people taking hundreds of thousands of million dollar bets, ridiculously out of the money. And these are all bull market tendencies. These are not bear market tendencies. Bear market tendencies don't have 80, $100 bets, for example, on Amazon with a two week expiration. They don't have $60 out of the money bets with two weeks of expiration on Tesla, right? You don't have these things in a bear market. And the most amazing part is now that we're slowly but surely, and again, I don't want to get in the whole politics. I'm more of a conservative person. Again, maybe it's a selfish thing to say, but again, me being home doesn't kind of change my life, but I get it. I've been saying this nonstop, people need to work. So I am going to try to be a lot more sympathetic with that idea. I get it. You need to work, you need to leave your house. So the fact that states are opening up slowly, is there an optimism that the economy, forget about the health ramifications of it. The fact that the states are opening up, is this giving a lot more leeway, a lot more leash to the bulls. And I think it does. And I think that the prospects of more and more states slowly, responsibly opening up is going to give the bulls a lot more fuel to the fire. And it really is amazing that if you are a bear and you've been kind of shorting this market for the last two months or so, now you're really at that point that we discussed three, four days back. At what point do you call this more than a bear cat bounce, right?  And what we did on Friday was actually exceptional, really, really exceptional. Not only did we hold this rising 20-day supply, okay? Excuse me, rising 20-day support. We reclaim the five-day moving average. And if you kind of go back to three days ago when we talked about the bears reclaim the five-day moving average, right? And we confirmed we went lower. The bulls reclaim the five-day moving average back, right? On Friday. And if we confirm that, then we're gonna start heading back to this 228 level on the Qs. And if we start breaking 228 on the Qs where they got rejected several times, then we start going to 231. And anything above 231, guys, we're going to all-time highs. Again, keep this in mind. The economy's pretty much still shut down. 30, 35 million people still unemployed, right? Or filing for unemployed. Businesses, small businesses are constantly going away. And that's the most, that's the most saddest and depressing part. It's not that Dick's Sporting Goods is closed. They're new. You're talking about candy shops. You're talking about shoe repairs, yogurt stands. Small mom and pop businesses that unfortunately are not gonna survive this. I think that's where the biggest problem is. Of course, the airlines eventually will supply. Some will go bankrupt, but again, bankruptcy in the corporate world means restructure, reorganization, okay? Bankruptcy in real life. If you have, for example, hot dogs stand, I'm just saying anything. You're not coming back from that. And that's where I think a lot of people are disconnecting Wall Street from Main Street. There's going to be a lot of casualties, unfortunately, with this coronavirus. And it's just not gonna end when everybody, for example, goes outside through your local Starbucks. This is gonna be a multi-year recovery if they recover at all. So before we start talking about and laughing, ha, ha, ha, the airlines, the cruise ships, they're gonna go bankrupt. Well, I mean, nobody's really laughing about that. But they're gonna survive because they're always gonna reorganize. They're always gonna work with their creditors. Unfortunately, Mom and Pop, who can't afford to pay for their restaurant, okay?  So those are the people we really have to, obviously, share a prayer for. Again, really, really good aggressive market this week. I thought Beta did very, very well, both long and short. I know a lot of you guys, a lot of you guys that do trade Beta. And again, when I mean Beta, first time you guys, if anybody's listened to this broadcast, Beta is the most aggressive stocks in the market, the stocks with the biggest average to ranges.  And again, just to give you an idea how strong this market is, when you woke up this morning, woke up Friday morning, you saw the news, the China trade wars, right? And there's no bigger group that is a casualty of any China trade war, or these chips, right, the chip makers. And when you look at the video, what it did on Friday, from the time that it opened down like nine points. And what you saw in the video do, and again, they're reporting this week, was absolutely phenomenal. When you see companies like, you know, AMAT, right? You kind of have companies like AMAT that coming out with earnings and they get destroyed. And you look at the video just to see how, what the difference between beta darlings are compared to an average stock that, again, maybe some people invest in, but you don't really trade AMAT. You know, you trade the video, like we trade on the video all the time. So when you look at beta, right? Cold stock versus an average shoe stock in its group, it's apples to oranges. And it really does show you the strongest stocks kept on rising to the top in the videos of the world. Netflix broke out, right? Big, big, it's been a big mover all week. You know, we caught this Netflix several times this week, really, really strong move. Amazon, again, continues to see very, very strong, aggressive, bullish option flow. Okay, we're literally like a day away from taking out the previous highs last week and has a legitimate shot back to the 2450s. Tesla, with everything that's going on, the CEO downgrading his own stock and evaluation, it's literally one day away going back, going back to this 840s level, just needs to confirm this five-day moving average where we've got stuff now twice and back-to-back days. So if Tesla reclaims this five-day moving average, okay, it's gonna skyrocket again. If you look at Apple, for example, look at the run that Apple has been on. I mean, just absolutely, it's up, you know, 10 out of the last 12 days. And again, it's just one day away of reclaiming the five-day moving average and snapping right back. Look at Alibaba, even again, if you turn around, and this is a nice setup here for Monday, if you look at Alibaba, you know, through all that's going on with China, with this, that, and the third, again, all it needs to do, you can see here visually, okay, you don't even need to understand the dynamics of the PS60 theory. Just visually, you can see, you got rejected here, got rejected here. If it reclaims, it goes back to this range here, which is the 208 level, and if it reclaims 208, it has to move back to 212. So we're getting a lot of really strong bullish names. Chipotle, you figure again, you know, the restaurants, you know, most names are closing down, they're making money on the deliveries. Look at the move, this is a genuine V-shaped recovery on Chipotle.   So it's an amazing, amazing market, the stocks that have the big, big runs. Again, look, you know, is there an inevitable, that a BYND, for example, BYND, and a stock like Tullo, if you look at BYND now, three days in a row of lower highs, I'm still waiting for that one big back test next week. I think it could happen. You have one, two, three days in a row of all lower highs. It just needs to reclaim this area here. Bears need to reclaim, confirm, and you should get a move somewhere around this 122 initial move here. So I'm kind of watching that. Tullo, the same, had a big, big monster run. Again, you know, first inverted hammer, this is obviously a sell signal, if they could just start reclaiming this number here. I mean, it could get back down to 161. So there's definitely levels of interest for me, not only from the bullish side from this week, and there's some phenomenal setups, but from the sell side as well. Tullo I like, BYND I like obviously, if they confirm, Roku, Roku looks like next leg down is coming up, and this thing actually triggered the proper way on Friday after I left. The most ironic part about Friday's session, it was dead, it was completely dead. Everything was sitting in the middle of the ranges. People were waiting for Trump to speak at noon, and nothing was really going on. But you kind of saw a little bit of progression, kind of a slow drip for the bulls back to the upside. And then after three o'clock, if you were just able to keep your eyes open after a long week, and we're around after 3, 3.30 in the last hour, 45 minutes a day, you caught some of these pivots, other than that is just a very, very slow day. But again, Roku looks like there's some value to the downside as well. So we're getting a good back, you know, we really are getting a good mix of long setups, going into tomorrow's session, short setups, and the most important part is, again, business as usual, we're just sitting there waiting confirmation, again, do I have all the answers in the world? No, I'm just living life like everybody else. Again, I'm the king of the idiots. I'm just like everybody else, again, I've just been doing this for such a long time that you kind of know the ramifications of what happens if you try to guess, if you try to pretend you're smart.   Hey, I think I was born to that analogy. So the idea that we need to be perfect as traders, as parents, as husbands, as friends, as father, right? We don't need to be perfect. We just need to be patient. We need to wait for confirmation. And from that happens, you know, obviously you need to strike with extreme confidence and a lot of conviction. That's what trading is all about. So let's talk about Friday's session. Again, painfully slow, like really, really slow here. So here's kind of my notes Thursday at the Friday session. So I wrote, I got 2.30, this was speaking Thursday. I was 100% convinced it was a bull trap. And then by four o'clock, the keys reclaim supply. This is why, again, Wall Street and the market is the greatest reality show that's not on television. Again, you just don't know what to expect. Your ideas and your perception of what happens next changes on a dime. And just like that, I turned bye-bys by Thursday night. And seven o'clock in the morning, everything again, gapped down on the China trade war. So again, I go, I'm clueless. I go, I'm absolutely clueless. Friday in the morning, I go, look, I'm clueless. It's Friday. You know, I don't need to press. I don't need to reinvent the wheel. Very, very solid week. Let's just wait. You know, let's just wait what happens. And you know, nothing happened really basically for the first five hours of the day. You know, BYND, I was looking at levels to the downside. Nothing happened. JD, I was looking at levels to the upside. Nothing happened. TULO is looking for the downside. Nothing happened. Tesla was looking for the downside. Nothing happened.   And this is already, this was after, this was after I was already gone. So, 2385 rejected three times pre-market, it needs a strong new base to wake up. So, here was Amazon. And this is why, I really like Amazon going to this week. So, here was the 2385. It was right over here. You see these channels here? One, two, three, right? So, all three of them got rejected 2385. And it finally got above this 2385. Nice move here all the way to the 2410, 2411 area. Again, I think this whole range just needs to confirm on Monday. And there's going to be a macro range above here, right? If they could just confirm the macro range here, which is the highs from April the 11th. And we have a shot to go back to 2450. So, this is a super setup just needs to confirm. So, if you are holding, if you are holding Amazon overnight, it does look really, really good. And then, there was no pivot to the downside on Tesla. So, I go, hey, look, here's the upside of Tesla. Never triggered as well. Zoom, I caught for a fractional trade and nothing big. Again, at this point, I was already completely lost interest. I was just so exhausted. So, Zoom, and again, continues to be a monster. 7180, 72 needs to build. So, here was Zoom. Here's a 7180, right? Here's the 7180, 72. And kind of popped up and had a nice pop. It was much stronger after I sold it. I just kind of wanted something for Friday. Nothing, you know, I had a couple of trades on Tesla. The funny thing is, I had two trades on Tesla that had stalled out. Lost, I think, $1.40 combined on both of the trades. There was nothing really going on. I just kept on stalling the area where I thought there was gonna be a sneaky, sneaky pivot never got there. So, I caught some ZM. I lost a little bit of my paper cuts on Tesla. Nothing really going on for me on Friday. Then I kind of just lost interest. Take on the way up. And again, this is kind of my point that everything triggered after I left. So, Bobo203 needs to build. And I like Bobo for this week. So, here was Bobo203. Again, 203, 203, 203. It took out 203 finally after I left. Obviously, went to 204.5. I still really like it. Roku got slammed. They said, 11380, if it builds below, can flush. Here was Roku. Again, this is all towards the end of the day. So, if all you guys caught this thing, God bless. I didn't. So, 1380, right? Here was a 1380. And it went all the way down to 1240s. Again, I still like Roku for this week as well. And then again, I just kept on riding. I go, it's so far as a big snooze fest.  I go, look, it's still valid. If it gets down there, never got down there. And then again, ironically, and I go, it's still valid, right? Something valid. I go, something has to give here. And ironically, nothing gave. So, there was nothing. It was a big dud on Amazon. Nothing happened with mRNA. Yeah, and then I wrote, yesterday's high. It's 23.91 needs to build. Obviously, this is where Amazon put up a bigger candle. I go, look, take on the way up. It's slower session. Just take on the way up. And that was it. And that was it. But again, no complaints. Again, you're trading journey, there's no area in your trading journey that says you need to put on 35 trades a day. It just doesn't work that way. Number one, you're not getting any value. Number two, you are gonna be burning mental equity, something that's very, very important that a lot of people just don't acknowledge. I think it's almost like a taboo conversation.  And I think a lot of people look at it as soft or look at it as a weak attribute, but everybody goes through it. And I think you have to acknowledge how important your mental health actually is. Going into this week, again, some good setups indeed. I like Amazon. ZM continues to be really, really strong. I like Facebook. I think Facebook looks good. Reclaim this area here just needs to confirm. BABA looks really, really good. It just needs to confirm this whole linear aggression line supply. Apple as well, right? Apple as well. It needs to kind of reclaim this 310 area as well. And I think the stocks that had big runs, you could get a back test. I like too low sneaky area through maybe Friday's low and it starts confirming here. You could get a big drop and BYND, which has had a monster, monster run. I think it's getting tired. I think it just needs to reclaim these two channels here and then maybe you can get a move down to the 122, 124 area. So again, guys, I just want to share. I just kind of wanted to kind of share of like my, not enlightening, but kind of where I am right now, mentally, I'm just happy. I'm just happy just to be alive. I'm just happy to kind of go through this journey with everybody else. I'm incredibly humbled to sit here after 20 years of doing this. And it's just an amazing, an amazing journey. So I wish everybody a lot of love, man, a lot of love, a lot of happiness. Don't give up on God. He or she is not giving up on you. And at the end of the day, when everything is said and done, the most important thing is just a smile on our faces. Guys, have an unbelievable rest. God bless you all. Love you all and I'll see you on the field tomorrow. Take care. Congratulations for putting in the time to take control of your trading. You're one step closer to owning your future and achieving the success you desire. Want daily trade ideas directly from Dan? Straight off his personal watch list? Unlock our free PS60 vault where you'll get nightly updates on pivot opportunities we're watching for the next day's session. Click the link in the description to get started today.


Welcome back to Commvault Connections 2021. This is the CXO power panel. My name is Dave Vellante joined by Reza Mora-Kabadi, who's the CIO of Commvault. Isabel Geese is the CMO of Commvault and John Gallagher. He leads global enterprise infrastructure at Synchrion and folks, welcome to theCUBE. Thanks for coming on. Thank you. Thank you for having us. Thank you. So John, we heard you this morning, great job. You guys are in the industrial logistics business. So supply chains are all a hot topic today. It's got to be challenging. Maybe you could talk about what you're seeing there, but specifically, how are you thinking about data management in the context of your overall IT strategy? Okay, thank you. So in terms of data management, Synchrion has 100 sites globally. So if we were to rewind by say 10 years, we had data residing a lot out at those remote sites. So over the last few years, we've basically consolidated a lot of that data and also centralized. So we brought that into our data centers that we now have, which is a very centralized model. So that makes it a lot easier to understand where all of that data resides. So in the decision pie, as it relates to data, it sounds like cost efficiency is pretty, ranks pretty highly. How does that impact your data management strategy and approach? I mean, is that like the number one consideration? Is it one of many factors? How should we think about that? I would say cost is one of many factors. So obviously cost is key, but you don't want to introduce unnecessary risks. So you've got to keep cost at the forefront, but that's just one of the factors. Obviously data protection is one of the factors, ensuring that data is protected and safe, and also understanding exactly where that data resides, making sure that data is encrypted. So I would say that cost is just one of the factors. So Isabel, good to see you again. I wonder if you could talk about how you're seeing your customers and what they're thinking about, how they're thinking differently about data management today. Are they changing the way they manage data, given the escalation of ransomware, the compressed, I call it the forced march to digital over the last 18, 19 months, but you've got new threats, new business dynamics. How is that affecting organizations? It does, it does affect them a lot. We see a lot more, actually I host a lot of virtual coffee talks with our customers so they can share best practices and a lot of CIOs now work end-in-end with CISOs. And they have a readiness plan because they know the question is not if they're gonna have an attack, but when, and how to recover from it is critical. So all the security team is really looking at the prevention, but they know that if they can't stop it all, then they have a plan of end-off to the data team for recovery. I see a lot more thoughtfulness because not all data is created equal. So which one is in the cloud and you can recover which one you need fast for minimum business, sorry, minimum business disruption and you keep on prime and which one you cannot lose and you have a boss. So we see a lot more planning, a lot more collaboration across all verticals. We have also new services to help customer before the attacks to design and plan and also helping them post-attack to recover. So very much end-to-end and as you see in the keynote right now, it's all about the people enabling them to do the business while de-risking the business too, so. All right, thank you for that. So Reza, I look at the fact that your CEO is CIO. So you must have some interesting conversations there, but and you could be sort of tap Sanjay's brain how did you handle this kind of thing? And that's a nice collaboration, I bet. But what advice can you give to other CIOs who are grappling with cyber threats, data volumes and just the ongoing pressure to do more with less that never changes, does it? It doesn't and you're absolutely right. And I obviously as part of my job, I tracked the benchmarks about the budgets and everything else before the pandemic used to track about like 3% growth year over year which is a hard to kind of do a whole lot with them. What I can tell you is not for a CIO, not two areas of the areas of investments are not created equal. From my perspective, the biggest areas of investment for somebody like me in my position should be data and protecting the data. So that means that you have to find ways of on the budget side, find ways of shifting money, whether you reallocate resources, whether you reform or reorganize differently, automate, simplify, et cetera. My background is operations. So when you talk about people process technology outside of things, I leave the technology to the people that are really good at it and I focus on people on process side. And for me, that's about, again, efficiencies and finding ways that you can reorganize.  And the last thing I said is prioritize initiatives across the board and it's like part they're in crime in these things. And we don't always say yes to her and what she wants because we need to be transparent that's where we put our money. So, Reza, I want to stay with you for a minute. I want to talk about data sprawl. It was interesting, John, during your session this morning I was sort of laying down some of my thoughts because I feel like data sprawl, it's like social change. You can't fight it. You can maybe, you know, for a period of time control it but data is out of control. So how do you address data sprawl in an organization both from a management perspective? There's obviously risk somebody said this morning, we used to keep, I think it was the CIO New Jersey. We used to keep everything forever, but that's risky. So how do you deal with that, Reza, from an organizational and management perspective? Yeah, I mean, again, I'm going to have to agree with you. As I said in the morning session, I like it. It's a natural phenomenon for a company to go through it. I've seen it in companies that are 150% of people and I've seen it in companies that have tens of thousands of people. It's like a foundation onto what entropy is in thermodynamics. It's a natural order of events. If you don't apply structure or organization data is going to go haywire and everything else. The only way, the best way that I know when the pendulum is here and everybody's doing their own thing is to push the pendulum on the other side at least for a while to centralize, pick a few of your brightest people that know the data in and out, put them in a team and say you're responsible for making sense out of these things, identify sources of truth for us and architect them differently. But start with executive level metrics and board level metrics and push them down. So, I agree with that, that I think the people who have the data context are in the best position to add value as to whether it's data quality and how to get the most out of that data. But the problem is, John, I'd love to pick your brain on this, especially you're in EMEA, you got all these different regulations and data silos, which I believe are a byproduct of how we organize. But anyway, you have a lot of the considerations to deal with, whether it's GDPR or data sovereignty, et cetera. How do you approach that? So, one of the first approaches we took when we moved over to Convolt with our data protection was to reduce the number of products we use for the data protection. So, we had six products through various acquisitions that we've done over the last 10 to 15 years. We've now reduced that six products down to one single product. So, it means that all of your data is managed through a sort of single pane, which definitely gives you a much better insight. And also, just going back to the cost that you mentioned in the previous question, obviously going down from six products to one product, we managed to strip around $500,000 out of our costs over three years. We also moved data, like I said, into the center and it allowed us to also concentrate the teams. So, also the teams became more efficient because less people were dealing with that data as well. But yes, you are right around GDPR. There is definitely compliance to be considered and you just have to make sure you're up to date on all of those compliance regulations. So, it's interesting, Bresa, to hear you talk about, Isabel, she's got needs, but I would say, Isabel, that you probably know in your team, you know the marketing data better than anybody, but there's got to be federated governance. You've got to enforce policy in this data sprawl world. So, anyway, this is sort of a side, but Sanjay, Isabel talked today about as a service growing like crazy, and given your background, I wonder if you can share any insights about how and why you think customers are going to be looking towards SaaS. I mean, the whole world is becoming sassified. You had some data on that this morning from Gartner. What are your thoughts? Yeah, no, absolutely, you're right. I experienced this first sense coming from Salesforce. And yes, Sanjay mentioned in the keynote, by I think 2025, 85% of business will be delivered through SaaS apps. And that's very simple, look at the work today. The market dynamics, the business changes. You mentioned the supply chain issue. We're talking, you know, all the line of business people of the business executive have to change fast. And the fastest way to do that is SaaS because it has speed, agility, and you get the value faster. Problem being, then it becomes very complex for IT because you have workloads in multiple clouds, on-premise, multiple apps, and what Convo stands for and what everybody should look at is being able to enable all this innovation, but at the same time, removing the complexity for IT to protect this data to recover it. And that's really where we're focusing our attention. SaaS is unavoidable. It's all about business agility, but it doesn't mean that you should compromise on data management. And I think, you know, we have to wrap here, but I think the model, you know, again, Isabel, you're coming from Salesforce. We've contextualized our operational systems, whether it's, you know, the sales cloud, the logistics cloud, it's the lines of business actually have a good handle on this. And where I see the role of Convault is that notion of federated governance. You've got to have centralized policy, but you've got to programmatically automate that out to the lines of business. And I think that is kind of where the future is headed. And I think that's really kind of Convault strategy. I'm hearing a lot on automation, cloud-like services and pushing that out. And so I see a new era in data coming and you guys talked a lot about this, but Isabel, we'll give you the last word. Put a bumper sticker on the panel for us. Well, absolutely. I mean, you said it's not left for no workload. Sorry, it should be left behind. And that's why, you know, you need a single architecture. I think businesses is changing fast and it's exciting. And as long as, you know, you got a great IT team with a great plan to have your back as a business leader, every company should really embrace all the change and innovation. So thank you, Dave, for giving me the last word. Yeah, go thank you guys. I really appreciate you coming on the, theCUBE been a fun day. We got more here at Convault Connections. Keep it right there. We're going to come back right after this short break. I know you and I are going to wrap up and summarize the day.


Hi, I'm Alexander, founder of comparedandmiercat.com where we compare the miercat. Hi, it's Hobbies, you know? What, lately we get many people looking for insurance. People looking for comparedandmarket.com.au. Why can't I find you cheap insurance? To find some fairy miercats, go to comparedandmiercat.com.au For finding cheap car insurance, go to comparedandmarket.com Cheap car insurance, miercats, two very different things. Listen to the jingle. Listen to my market.com