a shot for London head coach Arthur Smith will be making his return to Nissan Stadium for the first time since becoming the Falcons head coach. So sorry he is not he's not the only person returning to Nashville today though lots of players and coaches on this falcons team will be returning to Nissan Stadium we got lots to talk about today but the main question for this Nashville team or for this falcons team excuse me or Tennessee Titans my lord I can't get anything out today I'm so sorry something's happening it must be the Halloween and me the main question for the Titans today would who be who would be under center would it be Will Leviss or Malik Willis and head coach Mike Babel has announced it will be Will Leviss thank you for guys for joining us through for the Falcons pregame show sorry I had a hard time getting all that out I my apologies it's Taylor Bismore and Derek Rackley back again here in Ticketmaster Studios thank you guys for joining us man thank you for helping me out a little bit there that was a rough go so sorry about that but Halloween weekend a little it's scary sometimes it's spooky right yeah spooky a little bit but we also have some spookiness in this game yes a little bit spookiness and a lot of NFL players tend to dress up for the Halloween weekend and one of our players he tapped into the Joker looks like he's been tagged as throughout the season CP is in the Joker costume today with the purple jacket the mask he's got Joker in full effect today how fun is that so for those folks that don't know what we're alluding to earlier in the season when the Falcons released their first depth chart of the year they put him down as the J as the Joker and then shortly after that he released a photo on Instagram of the Joker and basically just a picture of him kind of embracing this newfound role that the Falcons have tabbed him with well today was kind of the first time you got a chance to have a little fun with it it is Halloween weekend here in the NFL so he comes into the stadium in full Joker costume but I did tell Taylor when we saw this video beforehand that's one big looking Joker is it he is such a large human and if I see this guy coming down the the tunnel in that costume I'm running for my life that is like a scary sight the tunnels are usually lined with security guards those probably like the first time the security guards were a little bit more scared than anybody else I mean truly terrifying stuff but everyone's getting into the little bit of the fun and even some of our players have started a new show Bud Dupri has a new show called Bud Brought a Buddy he brings on a new guest every single week and if you haven't seen or heard about it yet take a sneak peek right now what's up dirty birds it's Bud Dupri I'm your host of Bud Brought a Buddy and today I have a very special guest for my first episode on Atlanta he's the mayor of Atlanta you know been here whole career alongside Uncle Dre you know he deserves the title you know it's the one and only Mr. Grady Jarrett my boy appreciate you for coming man thanks for having me bro appreciate you coming hey Demetri come here real quick man give my boys water don't don't touch it Grady don't touch it oh first class service first class service you good all right bet all right bet let's go okay cool cool all right so man you know each person that come on the show they got to do a phrase okay okay and uh I just need you to say it for me to start the show all right what's what's the phrase uh I'm Grady Jarrett what's up Atlanta I'm Grady Jarrett and I'm the bud I'm the bud I'm the buddy that Bud Brought all right bet I'm looking at you I'm looking at oh about right here okay yeah yo what's up Atlanta it's your boy Grady Jarrett I'm the buddy that Bud Brought and we about to get into it hmm one take shout it man now but we'll get into some good stuff man you do a lot of great stuff in the city you know since you've been here uh we came out of the same drag class 2015 you've been balling on the field I get your hard time about your swag on the field a little bit man but you know my goodness your play out your play out there is your swag my swag actually is really good I wear the proper cleats that a defensive tackle supposed to wear yeah health purposes you want me out there some low top vapors that ain't gonna happen I can't hold no double teams doing that so uh you know what I'm saying I tried it before end up having some fee issues man so I gotta wear the weight proper cleats you feel me but I'm still swagging my though now you do we're speaking of swag we're gonna come back we're gonna we're gonna we're gonna have a section for okay so you for the sweat later we'll have a section for that so Taylor I love the fact that bud brings on Grady Jarrett and they get into a little bit of a sparring match and if anybody doesn't know what they're talking about with the sweet the swag on the cleats is bud probably wants to wear something a little bit more sleek a little bit more stylish low top style and Grady's basically telling him I'm not gonna wear that I'm wearing something that supports my ankles something that's a little bit more rigid because I gotta hold up the double teams there's 650 pounds of man that are pushing against me that I gotta fight against I'm not worried about how swaggy my shoes are looking I'm making sure that both of my ankles don't go this direction although Grady did say I do have swag with the cleats that I wear yeah I mean he brings swag every day and like the outfits that he brings into the tunnel and on traveling stuff but I love that he tried the cleats first like he tried to have like cool cleats and then he said they hurt my feet so I had to go back to the originals I love that that's great I'm actually I want to go finish watch the rest of the rest of that feature yeah I mean it's a pretty long one um go watch it though it's so fun it's like 30 minutes long of them just being friends being buddies so bud brought a buddy it's comes out every single week and he will bring a new buddy I think AJ Terrell might be coming out next week so we'll see all right who he continues to bring throughout this season but uh but came from Tennessee was a free agent this year came from Tennessee previously with the Steelers prior to that so let's talk about how many of these players from this falcons team and coaches too have come from this Tennessee team it's just been a crazy overhaul from Tennessee to the falcons yeah I mean you look at the players you look at the coaching staff even the personnel department there's a lot of familiarity with the Atlanta Falcons and the Tennessee Titans organization Michael Pruitt bud Dupree obviously John U. Smith was one that just recently came over as well but you think about some of the upper uh as far as a personnel department a coaching staff Frank Bush Jerry Gray even their general manager Rand Carthon spent a few years here as a pro scout assistant GM Anthony Robinson who was the director of college scouting the last four seasons he's now up in Tennessee there's a number of players coaches and front office staff that have got familiarity in these two organizations but quite frankly once you've been around the league for a while there's going to be a lot of this like every single week you're going to find players coaches personnel that have experience at the other organization or they work with somebody at some point throughout their career yeah well I think it's interesting about that list though all of those players that are on that list it will be their first time returning to Nissan Stadium since they left Janu is the only player on that list that has played the Tennessee Titans prior after leaving them he played them in Gillette Stadium against uh as a patriot and played against Tennessee then but everyone on that list will be returning to Tennessee for the first time since leaving as a player really cool stuff but speaking of Tennessee let's talk about this Tennessee team and what they have we have a new quarterback Anderson are making his rookie debut today in Will Leavis out of Kentucky great start huge start for Will Leavis yeah it's a it's a big spot for him obviously Ryan Tannehill gets hurt in the London game a couple of weeks ago there was really no chance that he was going to come back and play in this game they have not put him on IR yet but we kind of figured okay who was it going to be is it going to be Malik Willis is it going to be Will Leavis Mike Vrabel has said that it's going to be Will Leavis it's going to get to start however he said that there's going to be times when Malik Willis comes into this game they're going to use packages that use his athleticism but if you remember back to last year Malik Willis he was drafted by the Titans but didn't get off to a great start in his NFL career he played in eight games got three starts through zero interceptions had or zero touchdowns had three interceptions that's part of the reason why Tennessee looked at a guy like Will Leavis and actually traded up in the second round to get him actually the first pick of the second round so we're going to get a chance to see the former Kentucky starter who comes into the NFL Taylor with I think what you would say a lot of NFL prototype type stuff he's got the build six five two hundred and thirty pounds big time arm right somebody that they felt like had a big upside in the NFL if you go back and look at his college numbers I wouldn't say it would blow you away it was probably like a sixty five sixty six percent passer the reason why I say that is a lot of time when I look at college quarterbacks that I think are going to be successful in the NFL I'm looking for a guy that completes 70 plus percent of his passes in the college game why do you say that well because in the NFL the windows are so much tighter it's so much more difficult to complete passes so you got to find somebody that's got precision that is accurate in college if he's going to have a successful transition to national footballing not saying that Will Leavis is not going to have that but he also had some interception issues when he was in college at Kentucky as well so what does Atlanta get a face don't know nobody really knows right this is going to be his first start he's going to have a whole lot of nerves I'm sure they're going to have somewhat of a pared down game plan for him not going to have the entire field at his discretion and as I mentioned he's probably going to come off the field on occasion in lieu of Malik Willis and have him run a couple of different series of plays so don't know what they're going to play for I'm wondering if Atlanta turned on some Kentucky film he did play in one pre-season game but he ended up getting hurt so he didn't play in the last two pre-season games so somewhat of a wild card for this Falcons defense yeah it's going to be really interesting to see what he's able to do in the NFL pocket let me say this I say I think I've told everyone in this organization this story because it changed the way I saw NFL quarterback David Ragon the offensive coordinator for the Falcons said in the media availability that scouting a quarterback is one of the hardest things to do in this league you cannot emulate an NFL pocket in any way form or fashion so when you draft an NFL quarterback when you draft a quarterback and you put him out there you just got to figure out what he can do in that moment there's no way to kind of emulate it until you get in the game and you get real live snaps and you have 300 plus men just barreling down at you at every single snap so it's going to be a big challenge for Willevis and we'll see how often Malik Willis comes in today yeah oddly enough you know I mentioned the completion percentage deal in college to your point sometimes you can throw that out the door as well you can find a guy that completes 70% of his passes in college and somehow some way it still doesn't translate to the national football league so I think it's a great point that you talk about as far as scouting a quarterback a lot of people would kind of had scratching their head a little bit with Anthony Richardson coming out of Florida because he wasn't necessarily your prototypical NFL quarterback but why did he get drafted so high because he's got tremendous athleticism and he's got what they call upside which that's what every NFL is looking for what can this guy turn into what can he morph into down the road you never know what's going to happen look in San Francisco they got a guy named Brock Purdy who was the very last draft pick in the NFL and he is balling for the 49ers right now you just never know sometimes exactly so with this with Willevis starting in Malik Willis probably coming in and changing around a little bit and doing a little bit of a wash machine situation between the two of those quarterbacks who can they lean on with not having a ton of touches on this ball who are they going to be able to lean on today in terms of receivers well they've got the Andre Hopkins is the guy but the the question mark is how efficiently is he going to be able to get the football with a couple of things with the Atlanta Falcons defense in the way that they're playing this year Atlanta's got the number three overall total defense in the national football league and even though they had issues getting after the quarterback to start the season they're getting after recently eight sacks over the last couple of weeks against their opposing offenses so they're starting to feel more confident on that side of the football they're starting to get that push so yeah you rely on a guy like Deandre Hopkins but you just don't know what you're going to get out of the quarterback because he's new he hasn't seen a whole lot of football yet and this pass rush is feeling confident right now this those are the three things that are kind of working against this Tennessee offense they got a good tight end as well and Chigacanquo who is a guy that can kind of control the middle of the field tough breaks tackles as well that's probably going to be a guy that you see will let us go too early security blanket for a quarterback but Deandre Hopkins one of the best wide receivers in the national football league if they can get the ball into his hands exactly I don't know if Deandre has much patience but hopefully he can find some today with the rookies or not rookies with the rookie and Malik as well so we'll see what he's able to do as the game progresses but speaking of these rookie of not I keep saying these but of the rookie quarterback a lot of interception issues when he was in Kentucky in college how can this falcons defense who got the interception last week thank you Richie Grant I really appreciate you listening to the pregame show it's really really great of you um what can we see from this defense today and expect from them going against a rookie yeah I mentioned it will levice 43 touchdowns 23 interceptions his last two years at Kentucky and what's going to be different is like I said the windows that he saw in Kentucky are not going to be the same windows that he's seeing in the passing game in the national football league so what do you end up having to do guy like Grady Jarrett bud Dupree that we just saw on bud brought a buddy and that is kind of hard to say bud brought a buddy he titled a show for his own podcast or whatever you want to call that's difficult to get out so we're gonna have a conversation with him about that but those two guys right there they can have an impact at the line of scrimmage pushing the pocket and when they don't get Grady Jarrett's been one of the best defensive linemen since he's come into the league as far as creating push and then realizing when he doesn't get there getting his hands up in the air deflecting passes if not even deflecting it is just obscuring the vision of the receivers that are trying to find the football coming through that mishmash of the line of scrimmage and that can end up deflecting passes away as well so those are all the reasons but then it's the anticipation from the defensive backs it's Jesse Bates it's those guys in the backfield seeing when he is gonna if he's gonna make a throw they can anticipate they can sit a little bit and that's when you try to dive underneath somebody and pick off a pass exactly I'm glad that you brought a bud Dupree though because he was questionable going into this game today was he gonna be inactive was he not and let's see what the inactive say today for the Falcons he's not he's gonna be active today he's playing he's suiting it up with Grey Jarrett in different cleats that's a different conversation though for a different time but nothing crazy right now Tay Davis is on concussion protocol so he will be inactive today but it's pretty much what we've seen throughout the season so far yeah I guess the only asterisk if you will is Pat O'Donnell he was recently signed by Atlanta because there was a late illness to Bradley Pynion the punter they weren't sure whether or not Pynion was going to be able to play obviously we're seeing that Pynion is going to play in this game so that's why Pat O'Donnell is listed inactive here but it was kind of an emergency situation for Atlanta they had to make sure that they had somebody on their roster had Bradley Pynion not been able to go and as you mentioned Tay Davis was out all week in concussion protocol but outside of that we mentioned this over the last couple weeks Atlanta has been very healthy knock on wood at this point in the season that's what you want you got to have the availability of all your best players if you want to win the national football league so hopefully this trend continues for Atlanta that we said see that injury report is very uneventful right and that's a good thing to be an uneventful injury report but for the Tennessee Titans they got a little banged up last game which was week six for them they are coming off there by now Ryan Tannehill is the story of the day for the Titans he will be inactive today working through that ankle injury also Josh while will be out as well he is dealing with an on concussion protocol as well Roger McCreary was out this week at practice with a hamstring injury so he will also be yeah he came started the week in practice he ended up getting injured on Wednesday he was out on Thursday tried to go a little bit on Friday but was just not enough for them to be able to say that he's going to be good to go in the game he's a starting corner so we'll have to make some adjustments in the secondary on his behalf and of course one of the bigger news over the last couple of weeks was the Tennessee Titans trading away Kevin Byrd to the the Philadelphia Eagles and he's been one of the best safeties in the national football league so there's probably some questions up in Nashville about what direction is this organization going when you trade away one of your best and most consistent players so that's a good thing for the Falcons and of course their passing attack when you don't have a guy like Byrd in the secondary to go against he's been great as far as picking off passes throughout his career very smart seen a lot of football he's no longer in a Titans uniform that's right well let's just go ahead and get to the keys to the game of how this Falcons team can come home with their second road win of the year these keys are presented by Wells Fargo what's your first yeah let's start on defensive side of the ball and let's just tackle tackle tackle and why do I say that because the Falcons are going against a guy named Derek Henry that we haven't really had a chance to talk about much in this show and Derek Henry I believe is one of the most physically imposing running backs in the national football league now he's not necessarily having a great season if you look at statistics just a few touchdowns on the ground and he's got 425 yards rushing this year but he's one of those guys that can take over a game plan if you let him now they've got another guy in Tajah Spears who's more of your kind of scat back if you will he's got the quickness he's got the escape ability somebody that can put his foot in the ground and make somebody miss in the hole but Derek Henry has been the story for the Titans organization ever since he came into the league he's got that ability at 65, 240, 250 pounds that he can run you over and then he showed a couple weeks ago when he was in London that if he gets out into space he still has top end speed I believe he had a 67, 69 yard run in that game so he can get out and outrun people if you let him but the thing that you do not want to do against Derek Henry is number one let him get through the line of scrimmage with a head of steam and number two miss tackles against him because he will make you pay if you miss tackles because of his size because of his physicality his ability to run behind his pads so tackling is going to be at the forefront of this Atlanta Falcons defense all game long. Yeah and one thing to know about Derek Henry as they told him the Tennessee Titans told him we're not trading you away you're staying with us throughout the rest of the season so he's going to be a Titan for the foreseeable future as well. Yeah and again I talked about Kevin Byrd you don't want to trade away your best defensive and then your best offensive player because you're in rebuilding mode and yes even though Derek Henry is aging as they're running back it's always a conversation that you have in the national football league when he's healthy and when he gets a steady dose of carries he can make a defense pay for sure. That's right so we'll see what the defense can do against Derek Henry and they might be leaning on him a little bit more depending on what Levis and Willis are able to do today so we'll just keep an eye on that but what's your second key to the game? Yeah it just kind of leads me into that second key and it's going to be pressure the quarterback because we know we're going to have somewhat of a green quarterback it's going to be Will Levis to start we're going to see Malik Willis as well so what do you do to disrupt the game plan? Disrupt those guys their timing get in their face make them feel uncomfortable. What you don't want to do is give them clean pockets give Will Levis a clean pocket early on to where he gets a little bit of rhythm even if that isn't a check down a shallow crosser a speed out something that is more high percentage throws just don't let him get comfortable early you pressure him early and often now what's going to happen is you're going to get him to start running outside the pocket that's going to eliminate half the field and that's going to be advantage to the defense so let's find a way to get pressure on whether it's Levis or Willis early on don't let those guys get comfortable and when Malik Willis does come into the game because he will at some point don't let him use his athleticism to get out on the edge right we don't want him to get outside of contain and get down the sideline especially if Atlanta's playing some kind of man coverage and the defense of players are turning their back to him that's the one thing that an athletic quarterback can make you pay for is if you give up contain play man coverage now you're going to get some explosive runs by that quarterback right so we need to shut down Derek and we need to rattle the quarterback we just kind of need to rattle everyone and shut down everyone right so what's your third key to the game today and on the offensive side of the ball let's not be rattled and let's fix the turnovers right ball security is going to be so huge I've been kind of harping on it the past couple of weeks I'm sure every coach in the national football league but more importantly Arthur Smith and this team they have worked on it this week it has been a focal point but whether it's interceptions or fumbles it's got to be fixed again you look at all the teams where Atlanta is at around the turnover margin Atlanta sits minus seven in the turnover margin right now the five other teams that surround them in the turnover margin right because we're towards the bottom of the league four out of the five have losing records it's one of the statistics where you almost cannot overcome and if you want to be a winning football team you want to play in the postseason you want a chance to win your division this is an area that has to be fixed immediately it's got to be a zero turnover game it's I could sit here and say oh maybe it's just one no it's got to be a zero turnover game because when you play on the road you're always fighting crowd noise you're the visiting team you're fighting an uphill battle to start when you turn it over you're making that even more difficult you're giving more momentum to the opposing offense to these young quarterbacks that are going to be in the game you're going to give them more chances to get the football back and you're going to get the crowd back into the game working against you the turnover thing has to be fixed this week fumbles and interceptions a lot of that's on Desmond Ritter because he's been the focal point of that but that doesn't mean it can't be somebody else fumbling after a run or after a catch everybody on this team that touches the football it's got to be ball security let me see this for the offense to last year a big issue was drake london fumbling that football when he would get it and he'd catch it he'd start running and then boom it would fall out of his arm somehow some way it was just inevitable it seemed like he worked so hard on that during the off season and I don't think he's dropped a ball yet I don't think he's fumbled one yet I don't don't quote me on that I'm not sure but what the Falcons have been doing this week during practice if you pay attention to what they do at practice on twitter or through the ajc or whoever you follow they have been practicing their ball security throughout the entire week with every position group on the team it's been a huge focal point this week and they're hoping to keep that ball in their hands when they have it for younger players taylor it's another one of those areas the differences between the college game and the national football league is that pros are so much better at number one securing the tackle but number two stripping knocking punching the ball out while they are making the tackle they have perfected it that's the reason why they continue to stay in the national football league because they're so good at creating havoc on the defensive side of the ball and creating turnovers so unfortunately sometimes as a young player you mentioned drake london desmond ridder you've got to learn that again maybe the way that you carry the football in college maybe the things that you did as you were trying to run the ball inside the pylon you thought you would be able to score and you didn't think somebody was going to come from behind you and they were going to rake the football out that's what happens in the nfl you hate to have to learn this way but you have to learn which means make the mistake and let's not do it again yeah exactly so we'll see if though they'll be able to hold the ball throughout the game while they while the offense has it but before we get into this game today we wanted to take a moment to share what the falcons did earlier this week which is called hometown huddle every single player on the 53 man roster went out into the communities within atlanta and gave back to the community take a look i can get special for the lana falcons as a team to go out and show and support the community um because every single sunday every single week in the fall they show up for us um so it's the least that we could do to go out and just give back uh put a smile on anyone's face kids adult teenager doesn't matter uh just to show our support for them it's a great initiative for us so a lot of times we have guys that are very experienced in giving back to the community and so hometown huddle is a great day where every single player can get involved give back um seeing um what's going on in our community and the different needs in our community and so we're we're downtown today this group along with 20 other 19 other locations and so it's just a great opportunity for all of them to see our community and give back to arkeblank does a great job but you know with this team and just all the foundation organization he has toward community and just bringing people together um with love you know just give them back time and effort you can do anybody can do that you know i mean so a day like today um don't take it for granted let's say thank you for everything that you've done and everything that you're going to continue to do for the children and the children of this city and all around this so just we just want to say thank you from the bottom of our hearts thank you if you're involved in a community you spend time in the community you know it's going to be too strong it's like everybody runs it's stronger together we can do always more and so i feel like uh personally though uh just i mean i've always tried to find my work at fun time in different ways to affect the community because i know that i wouldn't be who i am without you know support with my community but i actually got to go to one of the sites and i mean we laughed we shared i mean it just felt like a big family it was such a great afternoon we went on tuesday which is their player day off and they they spent their day off giving back to the community and it was such a blast yeah it was a focal point of my career as well given back on tuesday's whether it's going out into the community uh business organizations schools even use your golf tournaments where you get to play with different people that are fans of the organization of the team uh and three words come to mind when i see that use your platform and that's what's great about the nfl is they have the ability players have the ability to use their platform their fame if you will to give back to people that are just so happy to see them to bring some happiness to somebody that's maybe struggling at a point in their life and just showing up and seeing the jersey and seeing oh i recognize that face that's desmond ridder right there the amount of glow that you can bring to somebody else's face by using your platform is what's special about this league so fun like i said it felt like a big family and big families have family traditions yeah and one something that we did earlier this week was we went down to the locker room and asked the players what country song was their favorite but before we show you guys i want to ask you what's your favorite country song we're in nashville one in rome jimmy allen okay freedom was a highway okay that's a good one i'd sing it right now but i do a bad job i would love to hear you sing it but maybe when we're done maybe yeah off air off air but um i got a whole list so i won't even bore you with that i got a whole list i got my cowgirl boots on i'm like living my life with nashville but hope you guys enjoy the game we're gonna leave it here for now and uh go ahead and take a look at what the player's favorite country songs are add those to your playlist bye guys what's your favorite country song my favorite country song is really like a little three-way tie could eat my top three for real oh where corn don't grow by weather jenny can you sing it no i won it by a hundred haze country rose that's my favorite country song love you like i do i don't even remember what that's about what's the one song and it's like uh oh wait wait wait dirt row anthem one of my favorite i changed i changed my answer i prefer the research it's uh something in the orange by zack bryan can you sing it uh 23 by chase beckham she's a good one right there she got the best of me yeah that's the song i like yeah she tells me you're never coming home to me i'm just a man to me or all i am tenancy whisk i could sing the hell out of tenancy whisk i ain't gonna do it for y'all but i could sing the hell out of that that's my top three


Trollan Toad sent me Epic Yu-Gi-Oh mystery boxes. What's up guys we're back with another Epic video and today I was sent 6 awesome mystery boxes from Trollan Toad, you guys will be able to buy these if you're interested so keep watching and see if there's something you would want. But first we have a giveaway, I'll be giving away this ghost from the past 2 display, all you have to do is like this video be subscribed turn on notifications. Let me know what you think about these mystery boxes, do you like them more or less than like regular mystery boxes you see because they're a little bit different than like normal ones. Alright, let's go right into it. And if you are interested in these, Rhymesal has also opened these on his channel And we are doing a mystery box battle because he did one round with them They sent out six to me and six to him for a second round for him So we're doing a mystery box battle. So make sure to go check out his video as well when we're opening these up There's also a link down below if you guys are interested. I think these costs are on a hundred and thirty dollars So they're a little bit expensive, but I'm gonna show you guys why they're so expensive So let's open this thing up and these are from Troll and Toad. You guys have heard of them many times Let's see what they have inside. So very cool presentation. Look at this This is the mystery box. So there's a box and then there's a mystery box So I should probably should have pulled those out already So inside this there's a single card that is like of great value because there's a big range Of course, there's gonna be better and there's gonna be worse But there's one card immediately that we see and then there's some packs So what we're really looking for is the big card. So let's see if you haven't seen Rhymesal's video This would be cool Yeah, let's open them up and a solemn judgment first edition I'm talking about big value cards They even have a little bit of a stand here, which is actually really cool for like displaying stuff So you can pull this off first edition solemn judgment now these cards are not like necessarily in mint condition I don't know what condition they're gonna be in in general. Let's see if we can open this thing. How do you open this? There we go. Okay, it's like a magnet. Okay, let's see what condition it's actually in all right So now you see why they're kind of expensive because there's really strong cards in here So solemn judgment is a great card, you know in general for collectibility or playability So it's sleeved up like that Surface oh my goodness. Look at this thing. Okay. There's a corner ding. So there's that Surface I was about say did they send us a mint condition one? Okay in the back is pretty messed up So this I'd call is like a moderate play. I don't know what the value will be it'll pop up on the screen So we're gonna see like how many of these we actually make our money back at 130 dollars This is still a nice card to play in like a deck So I might be throwing this into like one of my goat format decks or something like that because I mean it looks great on The front I mean which is all you need when you're playing it and then I think the aren't the packs like where are they? Oh, they're in the rest of the box. They're down here. I found them. Don't worry. There are packs Okay, there's like three or three to five. I think it's not a lot of packs. It's mostly based on that So these packs okay, not the best pack so battle bag monster league not good That's one of the worst packs number hunters is okay And then secrets of eternity is probably a little bit less than okay So not great pack selection. You're really looking for the singles here Let's open these up real quick before we get to the next one And yeah, of course So if you do want to buy him the links down below, of course, you don't have to or anything They did send me these like as an advertisement and stuff like that So just FYI, but I am pretty excited to open them. Let's see what we can get the Chronomaly soul monolith and the number 54 a Lionheart secret rare very nice I don't even remember this card Lionheart. Okay, pretty cool stuff So we've got five more mystery boxes the list that of the cards you can pull is pretty insane Like there's some really really good stuff the conditions vary I think Rhyme style got mostly like near mental light play on his stuff And then like I think he had a mod play on one of this so we just got a mod place So Muffer lion we got the pendulum shift the Cagna melt a branch of the burning abyss Skilled blue magician super rare. All right in the spiritual beast Rampenga. All right. All right battle pack monster league I've opened a lot of these in my day back in the day when I first got back in the Uthio This was everywhere. There it is the Arkansas razor backs Very cool herald the purple light with a little bit of a nice foil there We got the lions alligator and the card advance. Oh, we missed one victory Viper Okay, so the packs not too great on that one I did see some better packs like range so we might get some good ones And I'm just basing this off of rhyme sounds video plus the list that I saw so I don't know a hundred percent What we're gonna get or anything there was a very long list of cards So let's pull this out so we've got this and then we've got the packs Let's do the packs first because the packs are like let the less exciting part But wait 50% of you guys are not subscribed to the channel according to this graph So go down below and click that subscribe button. Okay. We have another battle pack three. That's not great We've got number hunters and that's the same packs. All right, not not a lot of variance there That's all right. We're really hoping for that card to be insane. We're hoping for it to be a great single I'm actually very happy with solemn judgment. That's a good card plant food chain. Wait. Oh, there's our our foiley guy The disc blade rider swan mirror and the friller or abacca very nice. Let's go to number hunters What's the best card in number hunters? I don't know. It's got to be a number, right? I mean there could be another card, but I'm guessing numbers number 85 crazy box nice Give me puppet gear changer photon servers and photon Alexandra Queen at secret rare. Yeah, make sure you guys check out rhyme cells video Hopefully one of us pulls something awesome.  I don't know. All right. Let's see what our next one's gonna be the reveal I'm excited. What's it gonna be? Oh, uh, oh a call of the hot and look at this. We're in the trap cards. All right That was okay. Can you put these back in the way? You can right? Is it just turn the lights? I think we just break it I think we just broke it. I don't know what we did. Oh, no, there it is. Ah blinding. All right. I'm pretty sick Let's check out the condition. Let's see if this one's nicer than the solemn judgment Let's get this thing out of here. It's a little bit of a tight sleeve But you just got to be a little careful with it. They're very nice first edition Pharaoh servant Okay, a little bit of a ding right there. I would say corners a little bent up there Pretty nice surface though. Definitely a better back than the last one, but probably like mod play ish Maybe LP you could say that I mean personally it'd be mod play, but I'm a little bit strict It's usually so but still not terrible first edition called on and this is a good card See like this is the kind of stuff you're gonna get you're gonna get those nice old school cards Which is cool. All right for more boxes so far I'd say we're doing okay like we're not doing insane. We're not doing bad I'd say we're doing okay. I'm hoping that we can get a couple other packs It's like he got a few like cyber dark impact and like he got some that were like generation force and stuff like that So I would love to get some of those packs. So let's start off with the packs again. Let's see what we can get we have Okay same packs same packs all right, so the variance impacts so far is is not existed It doesn't exist. It's literally the same packed. All right. We got the water judgment We have the mech Lord army of Grinnell. I've seen that card a lot Royal firestorm guards is cool Nordic relic and the shut no G shut and doji very cool number hunters Let's go the stoic challenge. I always love an opening good opening a good mystery box though Curry vault the chronomaly soul model if you guys know I open them all the time the chakra Okay, and then the box of friends like this all the friends in a box. You love to see it pretty cool Okay, secrets of eternity. Can we get a ghost or an ulti? They are in this set possibly so let's see if we can get one Performing power friend donkey. This is where we pulled our first ever ghost here I cannot speak today. We're trying smart fun Well, I cause I streamed for like four hours and then I recorded with with the chaotic meatball So a lot of talking today by the way check out the twitch stream if you haven't yet We have been going hand. We did a lot of go format the other day So if you like go format check it out raid raptor nest and gigabyte. That was actually a lot of fun playing go format All right, third card. We are halfway through after this. What can we pull? Can we pull the blue eyes by dragon? Here we go from LLB I think there's one in but here potentially not in this but like in their whole set of stuff Oh It's the Odin the one we've never been able to pull we've technically pulled it It might have been out of a mystery box, but we have now pulled this card. Let's go This is actually sick Odin father of the Acer. I don't think it's the most expensive card or whatever But for me personally, this is awesome. Let's see what condition this go shares in I'd be pretty surprised if this is in great shape because you know go shares that just tough stuff for him This guy's 4k attack. He's such a menace when he gets in the field Okay, the scratching. Oh, it is scratching for a bit. Wow. Look at that. You can't even tell the ghost That's what I love about him. You go with the right angle. You don't even know their scratch But then you go there. Yep, it's definitely seen it that this is what his uh His blue eyes look like when he got it from he got a gold gold ghost rare from ghosts from the past or no gold Sears haunted mind different. Okay back is very clean. So this is one of those ghosts It's super clean, but the foil just has the scratches, but overall a pretty sick card I don't know what that's gonna be valued at probably not too much to be honest Because this is just not a very expensive card, but it's a very cool card. I like it. All right fourth mystery box Let's see. I don't think I would say so far the closest we've gotten to making our money back was the solemn judgment I think it's 130 bucks. I think that's what he said, but of course when you open the packs It's like they have no value anymore unless you pull something good. That's just how it works with packs Let's see. Oh, yes. Oh look at these we got four packs this time and they're all good We've got crimson crisis. That's awesome generation force first edition. That's cool unlimited lord of tachyon galaxy and unlimited They're storm a ragnarok. We pull the Odin. Can you imagine? This is what you're looking for You're looking for this kind of stuff when you open the box So it could either be those kind of bad ones or you could get these, you know, which is a lot better So makes a little bit of a mystery box and you know, it is a mystery box. All right, Garmar We got the mizuho car curd cash cash got the six-strike triple impact Nordic relic a drop near Nordic relic It brings them come on. We've got the resonator engine stardust phantom and Nordic relic Lava teen. All right, Lava teen. All right, nothing too great there, but that's okay I mean this with this it's like just the value of the packs in general So the pack value here is pretty solid maybe 40 50 bucks worth. I mean, that's definitely good I mean, that's a lot better than before those other ones were probably worth like 15 at max No, I'm probably 10 honestly memory loss high tide on fire Island McVanity beast. We didn't do a Patrick go Go Gigas and the Eagle shark. So no pull there. I always thought this looks like a Pokemon guy I don't know why he just reminds me of Pokemon generation force first edition We could pull the Leviathan dragon number 17 at ghost rare. That would be insane if we pulled out of the mystery box Let's go gravel storm. We can knock that out and Odin at the same time fly fang damage vaccine max We got the aqua jet spear for soldier vision kicks explosive origin sea Lancer and Oh a Sam Bella summoner. Okay, just a regular rare or regular common I should say final pack crimson crisis. Even if we get nothing. This is still a cool variety packs I like it. We've got the mysterious triangle the Trojan gladiator bees hydroviper soul slash Summon reactor SK verdant sanctuary searchable by terraforming just kidding prevention star debris dragon That's a good card for Edison though. Very good vengeful servant We pulled this as a secret rare recently. So pretty cool to see this card very nice. All right on to our fourth box What will be inside so far pretty good stuff? Let's see if we can top it with something amazing. We have oh This is sick elements of hero chaos and eos I have no idea what this value is, but I think I need this for my binder my binder with all You know the ghost rare's ultimate rare's and secret rare versions of everything I don't think I own this card. So this is actually really cool It's not it's like the lowest rarity of the card and I just don't have it So that actually makes it sick. Oh wow check this card out service looks amazing in the front. Oh Just a couple of scuffs. Wow Lightly played at least I mean like at the least I should say you could argue Maybe it could be like borderline near mint But personally I would call it like the LP maybe LP But this is definitely going in my binder as a placeholder until I get like a minty one because I don't have it So that's actually sick first edition elements of your chaos neos. I don't know the value on this at all I haven't seen the value of this in like three or four years. So it could be great I really don't know two more mystery boxes. That one was a lot better I feel like in terms of the packs and then I like the problem I don't know if that card is actually as good as some of the other cards we've pulled But I definitely like it. Let's see what packs we get. Hopefully these are the nice ones Come on be the nice ones Not the bad ones. No, it's not the nice ones So maybe the nice ones are like one every three or four or something like that because so far we pulled four out of five So maybe it's one every five or something. I don't know photon Cerberus I know he also got cyber dark impact, which we haven't gotten that yet dashed the dust lord make equipped Ogoneer and comic heroes King Arthur and by him I mean round style and that was in his first video Oh, no, we got two monster league. Oh, no, all right monster league are pretty bad We definitely don't want those seven completed. Very cool miracles wake There's our little shiny guy in zektipede and premature burial with a mech lord army of Grinnell There it is one more pack. What is this card on the front some sort of insect card? I don't know what it is, but it's pretty cool mask of weakness. Okay. Love to see that Freya spirit of victory All right, shiny break of the magical warrior always a good card scapegoat always a good card and Gorgonic Golem honestly a couple card good cards in there on to our second allow this one's just falling open The other ones were like very tight I don't know what's going on here. Maybe that means there's something amazing. Here we go. Yo, whoa Okay, this is a good pull elemental hero air neos ultra rare not the ulti ulti is insane But even the ultra is like two hundred dollars or something So this might have officially made our money back on that one.  So elemental hero air neos first edition from the storm not storm strike of neos different guard Okay Air neos ultra rare service pretty good a little bit of scuffing right there, but not much Back has a little indentation right there. Yeah, so maybe like mod Probably I probably wouldn't say LP with this But like pretty clean for a mod play though if you do call it a mod play But first edition elemental hero air neos literally has never been reprinted It only has the ulti and the ultra version in the same set. That's it So this is super super cool to actually pull very excited about that actually very very cool card We've had a nice variety so far we have two dm cards fought one 5d's card and two gx cards So a nice variety going on there does that mean we're gonna get 5d's for the last one even it out We'll see in the final mystery box Let me know what you think about these in the comments and of course there will be a link if you do want to buy Some of these there's other cards like this as or other boxes with cards like this inside them So if you're interested check it out Of course check out rhyme styles video as well if you want to see like more variety like you think six And you're still thinking about it. You're like, do I really want these go check out rhyme style See if you like his pulls and then uh, he has the same link as well So I think we might have gotten the good packs. Yes. We got the good packs. Oh look. We got an abyss rising cool Cosmoblazer. Okay. It's different tournament pack five. Let's go in the storm of ragnarok. See there's some good options Okay, so out two out of our six had good packs in them. So keep that in mind I don't know what rhyme styles ratio is gonna be but you can watch his one the 10 opening or 10 box openings And then this and you can kind of figure it out We got a grand rim hero challenger night watchman deep sweeper Mermail this long advanced heraldry art stoke prophecy House dustin. Oh, there it is game of thrones mogmull and mecca. See Poseidon very cool. All right, cosmoblazer The ghost train here also does not have a reprint. It has a ghost and ulti and an ultra from the same set So if we pulled that it's very expensive even the ultra rare So we would love to see the whatever this card's called. I can't remember. I have it in my uh, I think it's I forgot it's in my it's in my blue eyes deck brother of the fire fist We got brotherhood zero zero rock. We got the tensin zw ultimate shield star drawing brotherhood of the fire fist gorilla and An x y z xc's tribe arrivals. Okay, let's go storm a ragdrock go shroud and still has never been pulled Can we pull it? Well, it's never been pulled by me. It's been pulled before of course, but not by me We have top runner card curry cash cash worm jet eclipse token stampede scrap chart divine wind of mist valley Barrier resident start us phantom an hourglass of courage a classic. Okay, nothing there on to the tournament pack five We get a fool in here. This would be insane because this is not any I mean, there's only three cards It's one out of 18 is a super rare. So let's see. Let's go like this. I don't know. Is it the first card? It probably is the first card. Let's just do this just to be safe dock designator jowl in the spiritual is pretty cool card and Trap of board erasers So, okay, unfortunately, we did not get a flow, but that would have been cool in the final box Make sure to check out rhyme sales video and of course if you're interested check out the link Let's go. Let's see what we can get in the final box so far. We have two dm cards one 5d's card two gx cards Here we go. We have a Catapult turtle first edition metal raiders as if we don't have enough metal raiders around here I love metal raiders though. Fortunately catapult turtle probably not my favorite But I do think the artwork's really cool. Let's see what the condition is. All right. Let's check it out in this sleeve metal raiders first edition Surface looks pretty good. Maybe a little whitening down there. Not too bad Uh, let's see what is going on right there like a little dot. I don't know what that is back is definitely a little scuffed up So yeah, we got a little scuffed up on the back front looks pretty good Yeah, this personally I always judge as mod play, but it's not that bad the front looks pretty good So catapult turtle I'd say overall the conditions of the cards are between mod and light play I didn't I don't think we got a near mint card out of these So keep that in mind when you're buying it if you're looking for minty cards Maybe not the best thing if you're looking for some old cool cards This is your thing because you're going to get one every single time which is nice So thanks to trolling toad for sending me those that was a lot of fun to open those up And of course if you guys are interested check it out Make sure to go check out rhyme sales video for a little bit of more perspective on what you can expect to get and all That kind of stuff like that and of course great entertainment from rhyme style themselves If you enjoyed videos like this make sure to subscribe to the channel for more epic videos Shout out the tcg trust regards to info show tomatoes use daxter jt cho Clayton Fitzgerald 87 brett palmer puffins of doom Ernesto d yonda stanley mimig echo enimus junior broding john knolland and and then a thai show Thank you guys for supporting the channel. See you guys next time peace


Alright, it looks like it's about time I'm going to get started. My name is Joe Conway, and I work for Crunchy Data, just like several other people here. I'm going to do a talk on MLS Postgres. So the first question is, what is MLS? How many people here in the audience know what MLS is? About half, maybe. So the idea of MLS is multi-level security. So within the database we want to have multiple security levels that we can screen or the rows with. And when we talk about security level, we're talking about two different concepts actually. And I'm going to go into this in more detail, but it's basically a sensitivity level and a category. A sensitivity level is kind of like the top secret versus secret versus confidential kind of thing for the military. Whereas category is a way to classify a particular piece of information so that you can only disclose it to people who need to know it regardless of their level. The technologies I'm going to talk about here are Postgres, obviously. Specifically, roll-level security, which is a new feature in 9.5, written mostly, I think, by Stephen Frost in the back of the room, but with help by other people. And we're also going to use a customized version of SCPG SQL. I'll just tell you up front, SCPG SQL customizations that we're doing at the moment are not available publicly, but it is our intent to publish them as open source one way or another over the coming months, let's say. So some of the stuff that we're doing will probably get pushed back into the main SCPG SQL and Postgres itself, and some things may not get accepted for whatever reason because not enough people are interested in the specific feature. If that type of thing happens, then we'll have our own open source repository for it. We'll also be talking about Red Hat Enterprise Linux, specifically the networking SE Linux and some custom SE Linux policy. And again, the custom policy part is not open source yet. I'm going to very briefly show you how we install our own custom policy and we can talk about it a little bit, how that's done. But I'm not going to go into a great deal of detail on that. So in terms of some caveats, this talk is covering putting up a development system, not a production system. So some of the things I'm doing on here you wouldn't want to be doing on a production system, just keep that in mind. I'm also going to demo what I'm basing the talk on is a system that's in permissive mode. Get into that a little bit more, but basically that means SE Linux is in a condition where it's not actually enforcing the rules for the entire system. Although as you'll see that we have set it up so that the rules will be enforced within Postgres for the purposes of testing the system. And this whole thing is a work in process. A lot of other people have been involved in this. It's not something that I've done. I've been involved in it as well for about the last six months. But as I said, Stephen Frost is a major part of this. There's other guys, the crunchy Adam, Mike Palmiato, Jason, that have all been involved in it heavily. We've had input from both Red Hat and Lockheed Martin. And there's undoubtedly other people that I'm not mentioning here. So in terms of the agenda, I'm going to cover the components, RLS, SE Linux and SCPG SQL. And then I'm going to go through an implementation. So literally bash script and code that's necessary to make this whole thing work. And then I'm going to show you what it looks like in the database once this is all set up. Now as I said, there's a lot of slides to this. I have an hour to deliver the talk. I'm going to probably need most of it. So I'll be going through some of these slides fairly quickly. If there's a question that you have on something and I'm not able to get to it during the talk, feel free to find me after the talk. I'll also mention, since other people have brought it up, there is now a wiki page on the PostgresSQL.org wiki that has all the different conferences. And we've added a link for this conference. And then on that link you should find eventually as the authors put them up the slides. The role level security is a new feature in Postgres 9.5. You can enable this on a per table basis. And it's enforced basically with one or more policies on a table. And the policies use either a using expression or a with check expression. And the difference is basically the using expression is looking at the old row and kind of filtering what you can see. And the with check expression is looking at the new row and preventing you from doing something that you're not allowed to do. So the with check if you violated throws an error whereas the using just filters the rows out. So what does this look like? This is not an MLS version of it. This is just a very simple version of RLS just to get you familiar with the concepts. So if I create two users, Bob and Alice, and I create this table, insert some values into it. And in this app user column I'm going to put Bob and one Alice in the other. And now when I alter the table to enable row level security and I create a policy that's saying that this app user column has to equal the current user. And then I'm going to grant select on the table. So now when I log in as super user, I see both of the rows. But when I log in as Bob, I only see Bob's row. When I log in as Alice, I only see Alice's row. Any questions about that? So security enhanced Linux. How many people here are familiar with SC Linux in about half? So SC Linux is a mandatory access control system. It's, that's different from discretionary access control. And that discretionary access, the classic example is that I as a user, logged into a system, create a file. I can modify that file so that it's world readable, world writable, world executable, right? But with a mandatory access control system, the sysadmin has control over who can actually do what with that file. And that's what SC Linux is going to do for you. It's enforced in kernel space. It's managed via, again, a policy. And it's actually many, many policies that are in something called a reference policy. Red Hat distributes Red Hat 7 by default with SC Linux on an enforcing mode and targeted. And the difference between targeted and MLS is that targeted specifically aims at controlling access to just certain services. But the rest of the system is kind of as if SC Linux weren't even there. It tries not to get in your way. MLS is different in that it's not only going to enforce the policies, it's going to enforce them across everything. And it's also going to enforce them with multiple levels. And it can be customized with your own custom policy modules. Here on the slide I provided a link to something that was put together by one of the guys at Red Hat. It's kind of a silly looking coloring book. But it's actually a really good kind of tutorial to get you familiar with SC Linux. So if you want to know kind of quickly and easily what SC Linux is all about, that's kind of a good place to start. So the MLS reference policy is based on something called the Bell Lopagula model. It was developed, I think, in the early 70s. People write papers on this kind of thing. You could go on and on about what that means. But kind of boiling it down in a nutshell, it means that you can read down and you can write up. So if I have top secret clearance, I should be able to read classified or unclassified material. But if I'm logged in top secret, I shouldn't be able to write something below my level because whatever I write might be top secret. Now Red Hat, by default, modifies this so that instead of write up, which would mean that if that would mean that someone who, for instance, could only read classified information would be able to write a file that was top secret. But by default, they've actually modified it so that it's write equals so that you're always basically writing at whatever level you're effectively logged in as. This context is something that's kind of part and parcel with SC Linux. This is how it works. There's a five segment context with a user, a role, a domain, a sensitivity in a category. So the user is actually the SC Linux user as opposed to say the OS user or the database user. Now we're going to have a way to map, and I'll show you that later, between the Postgres user and the SC Linux user that we want them to behave as. But it's distinct from those other types of users. A role in SC Linux, unlike in Postgres, a role in SC Linux is more like a grouping. In Postgres, a role can be a login role, right? So sometimes the terminology can get a little confusing. A domain is a type of a file or an action. I'll show you an example down here. We'll get to that in a minute. Sensitivity is something that goes from low to high. So you have levels, by default, S0 through S15. You can actually rename these things. You could call it unclassified, classified, secret, top secret if you wanted. I've seen it written as system low to system high. Basically you could rename this as anything that makes sense for your environment. And categories is compartmentalization that I was talking about before. So that gets into need to know or specific projects. So if you have a bunch of people who are, you know, able to read at a certain level, but they're not involved in a particular project, you don't want them necessarily seeing that information. So in terms of the level, the security level is the combination of these two things. And there's some examples here on the screen.  This database user S6, DB Client R, DB Client T, which is the type, and S0 means they're at the lowest level. Here's an example of a context that might be associated with an object. So system U, object R, SEPG SQL table T. So this is, we're labeling this thing as a SEPG SQL table. And we're giving it a range of levels and a range of categories. So both of those things are possible as well. And to go into a little bit more detail, S0 through S15 represents a range of sensitivities. And that's hierarchical. So if you've got level S15, you should be able to read down to S0. Whereas this category, you represent a range of those with a dot instead of a dash. And I actually heard a talk by one of the guys at Red Hat who said that was accidental. And the first ref policy, apparently he meant them to be the same, but it somehow got published that way and they decided to keep it. But in any case, this means that you've got that span of categories, but they're not hierarchical in the sense that a higher number includes lower number. Any questions about that? This means that you are including this entire range of potential categories for that user. Exactly. And if he has C1023, it doesn't mean that he automatically has access to something with C1, right? So in terms of the way SC Linux makes an access decision, it takes a context label for what's called the subject, which in this case is going to be our Postgres user. It takes a context label for the object or the target, which is going to be our table or our row or whatever. There's a permission involved. What is it we're trying to do? And then the first thing it needs to look at is this type enforcement. So the type part of those labels are compared to see if this type has an allow rule on that type for the type of action I want to do. So that's the first check that's going to happen. And that happens in targeted mode as well as in MLS mode. But what MLS has on top of it is that it looks at the sensitivity in the category. They use the term dominate. So the sensitivity or the classification level, the subject must dominate the object. So in this case, if I've got this example where S5, C1 to C5, it dominates S3 because it's higher in terms of classification level. But in terms of the category, it actually doesn't include the same category. So you would not get access based on this example. So SCPG SQL is a Postgres extension that gets chipped with Postgres. Postgres itself supports a command called security label. And basically, it is just a place to store a label. But Postgres doesn't really manage anything to do with that label. It depends on what's called a label provider. And SCPG SQL is one of these label providers. It's possible that other label providers could be used. I'm not exactly aware of any others that even exist. Stephen, do you know of any other label providers besides SCPG SQL? Yeah, the security label here. So we've customized this with additional functionality, which is basically, we've done this user mapping of the database user to an SE Linux user. And we actually tried to use the security label on a roll to store that information and have SCPG SQL access it. But because of limitation, the way Postgres bootstraps on authentication, we actually couldn't do that in 9.5. So we ended up creating an external file for that mapping. In 9.6, though, there has been a patch that was accepted and committed that will fix that problem for us. The subject for the person logging in is going to get a context transition, which means basically their context is going to be calculated based on their Postgres user, which is mapped to an SE Linux user, as well as the label on the network connection that they're connecting over. We'll see a little bit more about that later. And then we've created these functions, check row label and create row label, which we're going to use in conjunction with this RLS in order to do the row filter. So in terms of what SCPG SQL itself supports by standard, it supports labeling of schemas, tables, views, columns. We've added this custom support for rows. So what does that look like? SCPG SQL check row label. The object context is basically passed in as the first argument. So that's going to be the row security label. The subject context is derived, as I said before, from the SE Linux user that the Postgres user's mapped to plus the labeling on the network that they came in over. And then the permission type is going to, if you don't specify a second argument, it's going to default to select, but you can specify a second argument and basically say I want to do a delete, for instance. And that's an example I'll show you later. And then the access decision, whether or not you get the access is made by SE Linux. So what does this look like? When I do this SCPG SQL get con, this is getting the context of the current user. So my current user logged in is at level 5, S5C1. And if I select that function using this context as if it were a label coming from a table, here I've got something that's labeled as S0 and I'm trying to select it so that comes back as true. So I'm going to get, this function would actually give me access to that row. But this label here with S6, which is above my level, is going to come back as a fault. Any question about that? So here's another example using the second argument and doing deletes. In this case, what you'll see here is if I'm logged in again as S5C1 and I'm going to try and delete a row that's, even though it's below my level, that's going to be not allowed. And if I try and delete a row that is at my level but doesn't have my same category label, it's also going to get denied. But when I try and delete a row that's exactly the same as what I'm logged in as, I'm able to delete it. This SCPG SQL createRowLabel is what we're using to actually label the rows as a new row goes in. This function I created here is just to facilitate writing this query a little bit more compactly just to show me the label on a particular table. So in this query, you see that I've got Table T1 and its label looks like this. System U object are SCPG SQL Table T. And you notice that it's got a full range of basically levels and categories associated with it. And that's so that we can put rows of any level or category into this table. The S contact is the subject. So that's my logged in user. In this case, I'm logged in as CVS5, which happens to have an S5 C1 level. And then the security label on the row that would get created if I were to insert a row is going to look like this. It ends up being a derivation of both of these two things. I get the users, the SE Linux user from the logged in context. My roll and type are inherited from the table. And then my security level is going to actually also come from my logged in user. Now, this is something that in your own environment, you might need to tune and have this work differently. This is the way we needed it to work for the first project that we're working on with this. But there are conceivably other ways you would want this to work. And so you would have to make the changes to make that happen. And this is just another example of a security label that gets created if with a logged in user that is at a higher level. So this one is S6 instead of S5. I'm going to show you that we have to create a column in the table. And that's a consequence of the way row-level security works, which is a result of a long, I think, discussion that happened on the community list, on the hackers list about how row-level security should work. If you built that in somehow, it would be much less flexible. I think was the bottom line to all that. Do you have any comment on that? Okay, so in terms of the implementation, I'm going to take you through a bunch of screens that show how I set all of this up. First thing, download and install Red Hat for CentOS 7.2. This whole talk, if you wanted to try and replicate it, is based on doing a GNOME desktop configuration when I was doing the installation. So in terms of the packages that I got right out of the box, it was based on making that selection. And then I'm going to install some additional packages. The extra packages that are needed for this, at a bare minimum, you don't necessarily need this Apple release, but it does enable you to get some things that aren't available by default that are useful if you're building your own stuff. So although I don't go into it, the talk was already too long and I was going to go into more about building from source in this environment, but there really wasn't enough time for it. But Ccache is something that's very useful if you're doing repeated soft source code builds, and that's only available if you've got Apple installed. So we're going to install all the Postgres Development Group 9.5 RPMs, and then we're going to install a bunch of RPMs for SE Linux. In terms of the networking, you need to configure the interfaces for this. In this case, I'm going to have an admin subnet, and then I'm going to have a subnet per security level that I want to have. So I'm basically modeling this off of what you would typically see in the military where you've got unclassified, classified secret and top secret. But again, these could be anything you need them to be. You have to set up routes. We'll go through how to set up NetLabel, SSH, and Firewall. So the recent versions of Network Manager actually have this useful feature that you can create multiple IP addresses all on one interface. So for setting this up, I had a system with one network card, not five, and it was convenient to just set it up with separate subnets all on the same interface. This is the way you would do that. It's fairly straightforward. The trick is that doesn't automatically install the routes for you. And if you don't have the routes set up, you won't be able to get to these networks. So you need to set up routes. Now we're going to get into NetLabel. NetLabel is a module that allows us to say that anything that connects on a particular subnet is going to get a context label that we were just talking about before based on the subnet. So I'm not going to try and explain in detail every one of these commands, but basically I'm adding a default address for each of my subnets. I've got 4.25.20 down to 8.20. On my admin subnet, this is the command that's going to add this label. So systemUObjectRNetLabel peerT, S0 through S15. So the full range, you're high to low, because this is my admin interface. Whereas my lowest level interface, 5.0, is going to just get an S0. And then similarly, 6.7.8 are going to be labeled as 4, 5, and 6 for the purposes of this talk. So you can think of 0 as being unclassified, 4 as being classified, 5 as being secret, and 6 as being top secret. And then I also did a label for a catch-all for anything that comes in, for instance, routed through my firewall from external to facilitate having someone else help me debug all this. So once that file is configured, you use system control to enable the service. So I'm going to enable NetLabelService. I'm going to start it up. One little bit of advice here is if you do edit that com file for NetLabel, you need to run this NetLabelConfigReset afterwards, otherwise those settings won't take effect. This is one of these pro tips that if you don't know about, it can trip you for a while. So after you run that, you can start and stop the NetLabel service, and then it will pick up the changes that you made. Now SSH, we need to change SSH. By default, SSH runs the service, and I'm not sure I know the exact technical detail for why we need to switch it to running off of sockets, but I believe basically the service shares one socket amongst all the connections. And when you run it as a SSH socket, what happens is each connecting client gets its own socket, which therefore can be labeled by NetLabel, and that's how the NetLabeling happens. Basically, in that mode, what happens is you're using X and NetD to spin off SSH every time someone connects. So it's not necessarily as efficient as running it as a service, but in this environment, it's probably not your top concern. So in order to enable this, I'm going to go into this LibSystemDSystemSSHD socket. I need to add this SE Linux context from net equals true into that file before I start up this service. And then the comment I made here is that I found out the hard way that if you do this and start up SSHD in this mode and NetLabel is not configured correctly, you can no longer SSH in. So I had to actually go rescue the box that I was working on remotely and bring it back to my house because I locked myself out the first time I went through this process for putting together these slides. So the next thing we have to do is swap the enabled service. So I'm going to disable the SSHD service, and I'm going to enable the SSHD socket, and then I'm actually going to stop the old one to start the new one. Finally, if you want to be able to connect to this box over these subnets that you set up, you've got to have firewall rule in place that allows it. So this is how you do it on Red Hat 7. Depending on the system you're on, it might be very different. So I guess a lot of this presentation, this presentation is Red Hat 7 specific and that is using all the system D stuff and the firewall command, make it permanent, add service postgres, is really all you've got to do and then reload the firewall and suddenly you can connect remotely. Any questions on all that? So now SE Linux. As I said earlier, Red Hat 7 defaults to the targeted reference policy and enforcing mode. And certainly at the beginning, if you're going to turn on MLS, you're going to want to be in permissive mode until you get some of the kinks worked out. So we're going to edit the ETC SE Linux config file, set SE Linux to permissive, and set SE Linux type to MLS. And I'm furthermore going to use this set and force command zero, which basically says put SE Linux in permissive mode for the rest of this. When you do switch from targeted to MLS and for a variety of other reasons, you end up having to relabel the file system. What that means is when we were talking about those contexts on the object that have a specific user role, type, or domain, well when we were in targeted we didn't have levels. Now we're going to have levels. So everything, every file on the file system has to be relabeled with a new context based on the policy that you're now using. So this auto in your, right in your root directory, if you create a file called .autorelabel, basically the next time you reboot, every file on the file system is going to get relabeled. This dash F into the autorelabel. This was another one. It took me a while to figure out why we were doing this because I kind of inherited this from the other guys in the group who had inherited it from somebody else, and actually we didn't understand why that was necessary and with a little digging through the source code, figured out that what that does is when the relabeling happens, the underlying commands that do the relabeling, if you don't have them in dash F, which is force, if there's a context already on a file, it doesn't try and change the security levels. Or if you want to force everything to be completely relabeled based on the policy, you need that force. The other thing I've done here is when I first set up the system, as I said, I installed it with a GUI, and at this point I disabled the GUI by setting the default to multi-user target, which is basically just a machine with no GUI. So after I reboot, I can use this sestatus command to see what things look like. Now, as I mentioned, we have a custom policy module that we developed and will eventually get open sourced. I'm not going to go into a lot of detail about it right now, but we've got it set up so basically you just do make, make, install, and our custom policy will get installed. After doing that, and that's basically what we're doing is we're creating these custom roles for Postgres. So we now got a guest role, a DV staff, a DV admin. I think DV admin R actually exists in the reference policy, but the rest of these are roles that we're adding. So now I need to create users, SC Linux users, that I'm going to later map to my database users. So this is the command SCManage user. I'm going to add, I'm specifying that these roles should be associated with this user, and that this range of levels should be associated with this user. In this case, this is Postgres underscore U. I've got a database owner. I've got a staff, guest. And then actually in my examples later on, I use these dbsu0, dbsus4, dbs5, dbs6.  I also need to create some default context files so that when I log in, basically this does a mapping of if I log in and I've got this context, it's going to map me to this context. So it's one of these for each of those roles I just created. Finally, I'm going to initialize Postgres. So with the default Postgres development group packages, there's now a Postgres equals 9.5 setup command that you can use for init to be. Then I'm going to enable the service with system control, start it up, and then just basically check to make sure it's running. So I can use system control status, and I can also just try and list the databases and make sure everything is actually running the way I expect. So now I'm going to configure access to Postgres with the pghbacomp file. And here what I wanted to do is I just wanted to comment out all the existing lines and then add my own. So here I've got local connections, local host connections, and then on all my subnets, I could have done separate lines for each of my subnets, but I was kind of lazy here and just did slash 16. So basically they're all going to require an mv5 login. I created a password for the Postgres user, and then I'm going to reload Postgres using the system control in order to make sure that this takes effect. So now I'm just going to connect and create some roles to make sure I can do it. This command is just going to pipe these create users into psql using the Postgres database user. Is everyone familiar with this GearDoc style? This is a Linux conference. Okay, so at this point I'm going to build and install the custom SCPG SQL module. We've renamed it for our own purposes the crunchy SC Linux, but it's basically SCPG SQL with our additional changes to it. So if you change the directory where you've got the source, this is the way you would typically build the source code of your own that's an extension of Postgres on a system that's been installed, let's say from RPM. You need to have the development RPM installed in order for this to work. So if you say use pgxs equals one and make, and make install. Now I'm also going to have to tweak postgresql.com. There's some general settings. So first of all I need to tell Postgres to listen to the subnets that I created. I'm going to turn row security on. And I'm going to add my custom module to shared preload libraries. This is one that has to load up on Postgres start up. And then I've got some SCPG SQL specific settings that I'm going to set. So I'm going to enable user transition, which is what inside the customizations allows us to say, this user is going to get a specific context based on their SC Linux context and based on their network label. I'm also going to set a default SC Linux user as a catchall. And then this force RLS is what's going to enable me to actually see the effect of SC Linux decisions even though I'm in permissive mode. So installing SCPG SQL, this is exactly the same way you would install SCPG SQL if it were unmodified. It's a lot different than other extensions. I think because of where it hooks in so early, I've not really tried to chase down exactly why it has to be done this way in single user mode. But basically you have to do shutdown Postgres and then loop through all the databases and install the SQL file. It comes with the extension, kind of the old fashioned way that used to do six or seven releases ago with Postgres when you're installing stuff. And then once that's done, I'm going to start Postgres back up and check the status. And then one last bit of custom configuration is, remember I told you that in 9.5 we were unable to use the security label on the roll, which is where we really wanted to stuff the mapping between SC Linux user and Postgres user. Because of the way Postgres starts up when you authenticate, that was not possible. The patch has gone in and then we'll be in part of 9.6, so we'll be able to fix that later on. But for now we've created this external file that we've just put in the data directory called scpgsqlusers.com. And this is where I'm doing the mapping that says the Postgres user is the Postgres underscore U SC Linux user. And user one is dbs0, user two is dbs4, user three is s5, and user four is s6.  You can see I did that on my admin network, logged in as Postgres. So I'm going to create these four demo users, one through four, and you saw that I just had these maps. So this one's going to be mapped basically to a security level zero, four, five, and six. Now finally we get down to the part where we're going to use all of this stuff together. I'm going to create this table T1 with columns a and b, but it also has a security label column. And that security label column is going to default to this createRowLabel function run over the table, table's OID actually. We're going to grant permissions on that table to all the users. We're going to enable a row level security. And then we're going to create a series of policies. So we're going to create a select policy that says checkRowLabel using the security label column. And I don't need the second argument because I'm just doing a select. We're going to create an insert, and the insert policy is going to use a with check, and it's going to use the createRowLabel. So here we're going to make sure that basically that the row label that would be created matches what it should be. For update we're going to say using checkRowLabel, so in other words I should be able to update rows that I can see, but I also have to make sure that the rows that I can see are at the right level. That the rows that I'm changing are at the right level. And then for delete, I'm going to also have the checkRowLabel, and I'm going to say I need delete permission based on the row label. All based on a C1. The sample data that we start with to see the table, we've got these four rows. One of them is at S0 level. We've got an S4, C1, and S5, C1, and S6, C1. Any questions about all that before I get into the actual showing you how it works? I know it's a lot of information. So the first thing we see is that if we try and log in on an S4, remember this 6.20 network is my S4 subnet. And if I'm trying to log in as the S0 user, user1, on a subnet that's at a higher level than I am, I'm going to get an error. Now this admittedly is not the best error message. We probably need to do something about fixing that. But the bottom line is because I don't have the privilege of, I don't have, as the S0 user, I can only see on classified stuff. I shouldn't be logging in on a classified network. If I log in as the S0 user on the S0 subnet, now you can see I actually can run a command. So I'm going to run this getcon command just to see what the label came out as. So as I log in as the S0 on the S0 subnet, you can see that I'm, my SELinux user is dbs0, just like I would expect. dbclientr, dbclientt, and S0 for a level. Now interestingly, if I log in as the S6 user, this is the user who has top secret, but I'm on the S0 subnet, my user is still going to get marked as S6 to match the user that I logged in as but I'm only at S0 because I'm logged in over an S0 network. So now if I'm an S0 user on an S0 subnet and I select from that tail, remember there were four rows in there, I'm only going to see the one row that's at the S0 level. And if I'm logged in as the S6 user on the S0 subnet, probably not surprising to you now, I still only see one row because I can only see the S0 row when I'm logged in on the unclassed network. Now if I log in as the S6 user on the S6 subnet and I query from that table, I'm going to see all four rows because now I'm on the subnet that is classified for S6 with the user that's classified for S6 and I can see all the rows. So now what happens if I try and do an insert? As an S0 user on the S0 subnet, I'm going to do an insert and you can see the security label that I got was S0, probably expected. Again, if I'm doing this as the S6 user on the S0 subnet and I insert a row, you notice the row still gets that S0 label. Again, because I'm logged in over this unclassed network, the only thing I can create is going to be at that level. And if I log into the S6 network and do the insert, I get an S6 label. If I do an update, as the S0 user on the S0 subnet on an S0 row, everything works as expected, as the S6 user on the S0 subnet S0 row, I can also do an update. And again, the S6 user on the S6 subnet S6 row, I'm able to update that. But if I try to update as the S6 user on the S6 subnet, I can see that S0 row, but if I try and update it, I'm going to get a violation because that row is not at my level. I can, however, change the actual label to match my security level. In which case I can update that row now. Now finally, I delete if I'm doing a as an S6 user on an S6 subnet and I delete the rows. In this case, I'm trying to delete all the rows that are greater than 9. 4 seed rows were all less than 10. All the rows I've inserted, which were 3, were all 10 and above. But you notice I only delete 2 rows. So I was only able to delete the 2 rows that were at the S6 level because I'm logged in at S6. And this query shows you that that 11 is still actually there. I can query it and see that row. So if I want to delete that particular row, I need to log into that S0 network and then I can delete it. And that's it. Any questions? We've discussed that internally and that's I think a matter of round to it to some extent. We have people that are working on some script work that will help simplify some of this. And as we repeat this process over and over again, we'll automate more of it as we go. Like I said, this is a working process. There's still a lot of work that should be done with it. And that's definitely something that would help.


Hello, and welcome to this introduction to the STM32G4 series training session. It describes the feature sets of the various lines available in the STM32G4 microcontroller series. The block diagram for STM32G47X devices is provided here for reference. The STM32G47X line offers a variety of communication assets, a rich set of analog peripherals, a practical crystal-less USB 2.0FS interface, USB-C power delivery functionality, up to 107 GPIOs, and multiple low-power modes to maximize the battery life. The mathematical accelerators offer trigonometric functions and digital filtering computation and hardware, leaving the CPU unloaded for other tasks. HR Timer with 184 picosecond resolution is designed to control time-sensitive applications such as digital switch power sources and lighting applications. To speed up the CPU performance in time-critical routines, the CCM memory supports code execution with zero-weight states. On top of those features, a particular focus is done on embedding security hardware functions such as 256-bit AES, PCROP and TRNG. The block diagram for STM32G43X devices is provided here for reference. The STM32G43X line offers similar functionality as the STM32G47X line with a reduced number of peripheral instances like analog and communication, excluding the HR Timer and FSMC and reduced memory spaces. There is still a rich set of analog and communication peripherals, hardware accelerators, crystal-less USB 2.0FS interface, USB-C power delivery functionality, up to 86 GPIOs, and multiple low-power modes to maximize the battery life. The timer set is oriented for motor control applications. To speed up the CPU performance in time-critical routines, the CCM memory supports code execution with zero-weight states. This slide lists some specific features of the STMG4 microcontroller, rich set of analog peripherals, CCM RAM memory for boosting fast routines, mathematical accelerators, Cordic and FMAC, high-resolution timer with 184 picosecond resolution, and rich set of timers to support a wide range of industrial applications. There are additional specific features, memories features with focus on safety, firmware update and external memory support, embedded bootloaders supporting most popular communication interfaces, and low-power features to save power in battery-powered applications. The STM32G73X line can be encapsulated in a wide range of packages. AES encryption is available in selected configurations. The STM32G43X line can be encapsulated in a wide range of packages. AES encryption is available in selected configurations.


Hey, Psych2Goers, and welcome back to another video. Are you always feeling the blues, but you're not sure why? Happiness is proven to be a subjective rather than an objective topic. As the famous saying goes, happiness is a direction, not a place. So for each, the road is different. Science has no surefire formula to attain happiness, but, interestingly enough, science plays a huge role in the research conducted on what makes you unhappy. Causes for unhappiness are often mutual and easily distinguished. They're subtle troublemakers that creep up on you without notice, and before long, you're in unhappy waters. It doesn't take a genius to work out that tiredness, stress, and loneliness are lead causes. Recognizing these is half the battle. There are many other subtle things that can slowly make you feel unhappy, and you might not even realize that it's affecting you until it's too late. Please remember this video is not designed to diagnose any mental health condition associated with the feelings of sadness. If you are experiencing persistent unhappiness, sadness, or episodes of feeling low, be sure to seek professional help right away. With that said, here are eight subtle things that slowly make you unhappy. Number one, social media. Facebook, Instagram, bring any bells. Do you find yourself scrolling through social media for hours on end? If so, it could be contributing to your unhappiness. A study conducted at the University of Michigan by psychologist Ethan Cross found a direct correlation between time spent on social media sites and feelings of dissatisfaction, loneliness, and isolation. Other studies are blaming the compare and despair envy effect of social media sites for sparking jealousy and suspicion in relationships. Oh boy, social media is everywhere and is filled with messages about how we should look, feel, think, and behave. Considering digital detox to resist and focus on your own mental well-being can be helpful in reducing the negative side of it. Two, overanalyzing situations. Do you spend ages worrying about whether you've made the right decision? Researchers have linked questioning decisions with stress and unhappiness. In 2011, Dr. Joyce Erlinger and her team at Florida State University identified two types of decision makers.  People who consistently overanalyze situations end up over time experiencing episodes of unhappiness. Number three, having too many choices. Isn't it always nice to have options? But as they say in life, too much of anything is never a good thing. So is the case with choices. A 2010 research paper from Stanford University's Department of Psychology discovered that having too many choices makes us miserable. Scientists at the university looked into the cultural ideas surrounding choice and found that freedom and choice are less important or mean something different in various cultures. Some people find that having too much variety can then be followed by uncertainty and regret about whether they've made the right decision.   Do you hold long debates in your head? Most people have a form of self-talk in their heads which can also help guide them and offer positive affirmations on a daily basis. But what happens when you experience negative self-talk? This can slowly have an impact on your well-being and unhappiness. The reason for such harsh negative self-talk is because as children it's taught that being tough on yourself is motivating and the best way to force yourself to be disciplined and get things done. But it's important to take time to be kind to yourself and not put such high expectations on yourself. Learning how to be realistic can work towards building a more positive sense of self-worth and happiness. Number five, being materialistic. The saying goes that money can't buy you happiness and apparently research supports this. In fact, some research has shown that very wealthy people actually suffer from higher rates of depression. Studies also stated that other research has indicated that a desire for wealth and material possession is linked to a need to mask their inner discontent. The constant pursuit leaves one desolate and dissatisfied. Number six, having a poor relationship with siblings. Are arguments the only form of communication between you and your siblings? Do you find it difficult to get along with them and have a good relationship? A 2007 study in the American Journal of Psychiatry found that men who had very poor relationships with their siblings during childhood are at significantly greater risk for depression in adulthood compared to those who get along better with their brothers and sisters. However, in 2012, psychologists at the University of Missouri concluded that teenage siblings who argue over two topics in particular, personal conflicts and fairness issues, are more at risk of suffering depressive symptoms, low self-esteem and anxiety. Researchers believe that good sibling relationships in childhood could help children socialize and relate to their peers during the course of their development. So, not having a good relationship with your siblings could also be contributing to your unhappiness. Number seven, having a wandering mind. Are you an avid daydreamer? Can you count the number of novels you've written in your head to date? It's perfectly normal to daydream throughout the day. But a 2010 study from Harvard researchers identified mind wandering as a major cause of unhappiness. According to the research, only 4.6% of people's unhappiness could be attributed to what they were doing, 10.8% of it was caused by what they were thinking about at the time. And people consistently reported being happiest when their minds were on what they were doing. The findings are backed up by the age-old philosophy that living in the here and now leads to greater happiness. If you feel like your wandering mind is contributing to feelings of unhappiness, then now might be a good time to engage in some mindfulness exercises so you can practice on working on being in the present. And number eight, negative work environment. Feeling overwhelmed at work? Researchers at the Department of Clinical Medicine at RS University found a link between workplace depression and our environment. They concluded that the work environment and the feelings of being treated unfairly by management can most dramatically alter an employee's mood. Furthermore, the researchers found that perceived unfair treatment led to higher rates of the stress hormone cortisol. Overall unhappiness and depression appear to be caused by management behavior and work environment rather than work load. We hope we were able to give you insight into some of the things that may be the root cause of your unhappiness. Do any of these apply to you? What other things do you think are making you unhappy? Let us know in the comments below. If you found this video helpful, be sure to hit the like and subscribe button and share it with others out there navigating the murky waters of unhappiness. Thanks for watching and we'll see you real soon.