Thank you. Hi, hello, everyone. Welcome to our talk. My name is Raul, and here we have my colleague, Victor. We are both software engineer at Sousa Rancher. And today, we're going to talk about how to enforce a secure supply chain on Kubernetes. And let's start by defining what's a supply chain. A supply chain is everything that's needed to deliver your product. If we think of software and Kubernetes systems that might involve your source code that you probably are using source control, so you push this source code into source control, you probably have a built-in pipeline that will take this code alongside the dependencies. We create an artifact, which is a container image. And you will put this image into an OCI registry. And then this image will eventually be on production inside a bot on your Kubernetes cluster. So that's everything that's involved in your supply chain. And as you can imagine, there are many threats. We took this image from the Sousa security framework. And if we start from the left side of the image, first thing we need to make sure is our source code is never compromised. Imagine someone gets access to your source control and pushes on malicious code. This could eventually go into production. And then we have the built-in integrity, which is the part we are going to focus on today's presentation. We want to make sure that what we build from our source code is what we actually see in our production environment. And in terms of Kubernetes, we want to make sure that the image we build from our source code is what we actually see in our production cluster. And the way we want to do this is we're going to sign our container images when we build it. And then we're going to verify the signature inside a mission controller inside the Kubernetes. So before deploying a pod, this mission controller will verify the signature of the containers. If the signature is satisfied, it will allow the pod. If not, it will reject it. As you can see, there are many threats there. If you go to the salsa security framework, you can see a real-world example for all attacks that happened last year. I'd like to talk about the F, which is a compromised, modified package. There's a company called CodeCop. And somehow, the Google Cloud Storage credential got leaked. And someone pushes a malicious image. And then people started using this malicious code because they didn't have a way of verifying this image. They could have been prevented if they were using some kind of provenance check, like signing images and then verifying these images. OK, so let's talk about signing. And for that, let me introduce Sisto, which is a combination of open-source technologies that includes Cosign. That's the tool that we use for the actual signing and verifying container images. Then we have Fulgio, which acts as a certificate of authority that will issue certificates that we can later use for signing. And then we have RICO, which is a transparency log. It's a transparency log where all the signature will be stored, so we can later verify them. In addition to container images, Sisto also supports signing binary blobs, any OCI artifacts, such as Hemchart, Watson modules, many more formats. And we're seeing a lot of adoption in Sisto, especially in the open-source community. Even Kubernetes itself, they started signing all their active start innovation 124, which means that you can verify not just your images, but also third-party images if they are using Sisto for designing. OK, so let's start about signing. And for that, let's talk about Cosign. There are two ways of signing. One is the traditional way, which is using a keeper. You can use Cosign to generate your own keeper. Or you can bring your picker if you already are using and exiting other PKI. That's totally fine. That's supported by Sisto. It also has a KMS support for Google Cloud, Amazon, and Microsoft Azure, and also Harsicov Vault. So that could help you to store your keys. But there is another way of signing that's the keyless way. That doesn't really involve it. I mean, it's not really keyless. You still have ephemeral keys that are generated by FUGIO. And then the signature are stored into the RICO transparency log. Yeah, we will get back to this keyless workflow later. Let's start seeing the traditional way. How you would sign using a keeper. As you can see here, we are using Cosign to generate a keeper. You need to introduce a private key. And then it will generate a public key and a private key. And you need to keep this password and the private key secure. That's your impossibility. You can use a KMS provider that might help you. But yeah, you need to keep it secure. And then for verification, you need to distribute the public key, which is not ideal. We can see here, for verification, you need to provide the public key. Then you need to distribute the public key to everyone for verification. So now let's talk about the keyless mode. First, still experimental. Hopefully it will be ready for production soon. And it's using OpenID Connect for identity. OpenID is an identity framework built on top of OAuth 2. And it allows third party application to identify the end user using our authorization server, or our IDC provider. And the way it integrates with CISTO is that you request a certificate to Fulgio, which is axed as the certificate authority, passing an IDC token. Fulgio verifies your identity and creates a certificate with your email address. Then you use this ephemeral certificate to sign your container image. And this signature is starting the record transparency log. So anyone can query later this transparency log to verify that the signature is there, and no one has modified anything. It has support for automated environment, so it can be integrated in your CI CD environment, as we will see later. So let's see an example. This is how you would sign using your terminal. You type a cosine sign, and then the image. And as you can see here, it starts generating the ephemeral keys. And then your browser will be open. So it requires some human interaction. You will see something like this. You need to log in with one of these OIDC providers. In this case, we chose GitHub. Then once you log in, if you go back to your terminal, you can see that the signature was successfully pushed to the OCI registry and also transparency log. You can see the T log entry created with index. You can use this index to query a record. It provides a CLI, so you can query this transparency log to see the entry. And also, if we go to our OIC registry, we can see that the signature is also stored there as an artifact. How can we verify? As you can see here, we don't need any public key. We just need the email address with this subject. And then the issue in this case was GitHub. So there is no need to distribute anything. Just an email address, which is a public key. It also has a great support for CI. It has automatically discovery functionality for GitHub actions at Google Cloud at the moment. That doesn't mean that you cannot use another CI. You can use any CI. You can pass the identity token to Cosign providing a flag. But for GitHub, as you can see here, we are not even requesting the OIDC token. Cosign is clever enough to take a token. I'm running inside a GitHub action, so I will fetch the token, pass it to Furshu, and then all the certificates will be generated for us. And then the way we verify this is the issue. In this case, it was a GitHub action. And then we have the information about the workflow. So we need to check which workflow we trust. In this case, it's the one we use for generating this. OK, so we now know how to sign and verifying images using Systo. Let's see how this fits together in Kubernetes. How we can verify this inside of a mission controller. For that, I'll hand it back to Victor. Yeah. So yeah, Raul here has given us a primer on how to sign and verify with Systo, which is a vendor neutral effort from the Linux Foundation. So everybody is welcome to use it. And yeah, how do we make it work inside of a cluster? Well, let's see a cluster. Here we have a cluster. We can see the blue part, the blue box, which is how a Kubernetes cluster would be. We have the happy users there to the left and then ATCD to the right, which once the request combined and so on, the info gets saved on ATCD and gets taken by the reconciled loops of Kubernetes and things happen. And Kubernetes provides us with one thing, which is called the dynamic admission control. We can just use a dynamic admission controller. For those that don't know, maybe here in this conference, you are not so used to Kubernetes. A dynamic admission controller allows us is to connect some webhooks to the path of a request. So we have the webhooks there for mutating and for validating. And with those webhooks, we can just change the request or validate it. For example, let's say that you try to put a pod in the cluster. So then it's a JSON request. The JSON request that specifies some keys and values on the pod, on the JSON, and so on. So then the user sends that JSON request to the QAPI, goes through authentication and authorization for that user, and then it arrives to the mutating admission part. There, we want our pod to have an annotation with prod, because that's what we want. No, we want our cluster to have everything annotated with prod for a specific namespace, for example. And that's what we do here. We are there on the webhook. We wait for the request to arrive, and then we change it and add the prod, annotation prod. Then we go to schema validation, which there is where the JSON gets checked again and see that the JSON is conforming with the schema. And then we go to the validating admission part, where we have other webhook, where we check that the annotation actually is prod and not maybe test. And with that, yeah, it passes on and goes to a DCD, and we have our pod, or our happy user has our pod. OK, this is the concept of dynamic admission controller. We need a specific one. We need one to enforce the signatures and verify the signatures. In our case, we're going to use Q-warden, because it's the one that we are used to, and it's the one that we are building. So yeah, it's the same. You would have a project. In this case, it's Q-warden, which is a policy engine. There's other policy engines, maybe you know of others. And in our case, the policy engine has policies, and those policies are written in wasm. We would talk about wasm later, and why it's important for designing and verifying and simplifying things. And in the case of Q-warden, it's written in Rust, mainly, and also the controller is written in Go. And the policy server, being Rust, needs some libraries. So they work with SixTor. In our case, for Rust, we didn't have any SixTor crates, so we built a SixTor crate. And we contributed it upstream to the SixTor organization, and now it's taking a life of its own. So if you are into Rust, please check the Rust crate for it. And we are talking about policies being wasm. What does that mean? Maybe you know about other policy engines that work with OPA or Rigo and so on, which are domain-specific languages. But being wasm has other benefits besides that. For those that don't know about wasm, wasm is small. It's just a binary instruction format. So imagine it as an architecture. You compile against wasm, and then you get a binary, and then the binary is super small compared to other architectures, and then you just run it wherever you want.  Because it's a VM, a VM that comes from the browser world. So it's quite secure. It has very little things open to the outside, and you can just connect to the outside using a POSIX way of working, POSIX-like syntax, and so on. It's also polyglot because being just an architecture, you can compile a lot of languages. You can compile REST, Go, Swift, even Rigo policies, and so on, OPA policies. This is great because it allows you, I mean, maybe you don't know about OPA or maybe you don't know about Rigo, but for sure you know some language, no? And maybe you have your colleagues knowing a language already. Then just keep using the libraries of that language. Keep using your pipelines in whatever CI you have, and so on. And writing policies, either in Rigo or whatever, it's pretty simple because you just take a JSON object, check for a value or two, and then return true or false, or maybe change a bit the JSON. So it's not like rocket science, in a sense. So it's doable. And by using all of that, you can just integrate it in your CI CD, and so on. One thing that is important here for signing and verifying is that wasm modules, the wasm binary, those are first-class citizens in OCI registries, the same as container images, or the same as Helm charts. So now you start seeing that everything kind of starts becoming together. And apart from that, being just a binary, a wasm binary, you can just run it outside of Kubernetes, which is great because just getting a Kubernetes cluster is just to test a policy, just to see if something in one JSON, nah, just run it outside, no? It's very simple, and that's it. And personally, maybe this is a bit off topic. But personally, I start seeing, there's some talks there that talk about the complexity of computer science. It's like, everything gets more complex, and more layers, and so on. With wasm, being that it's already secure and contained, you maybe can reduce your layers, the amount of layers that your whole stack has, which it's nice. And it's picking a bit of steam everywhere, and so on. So coming back to signing and verifying, and making your whole cluster secure. Raul has talked about how to sign and verify images with six stores, Cosign, CLI. Well, if you know how to verify and sign contained images, you know how to verify and check the policies, because they are just an artifact in the registry. So in this case, it would be Cosign, Sign, and then Cosign, Verify. You would go through the whole thing. Of course, it's difficult to explain. We don't pretend to explain Cosign and Six store in five minutes in a presentation. Not used to get the whole thing, but it's doable. And in the case of our policies, we can just check them outside of the cluster with KWCTL, Verify, which is a CLI that we provide. For the policies of Q Warden, we have a hub, there in hub.qwarden.io, where all the policies are marked as signed or not, and then you can just check those things. So far, only the Q Warden devs policies are signed, but I suppose in the future it will expand. OK, we have signed our policies. How do we ensure that the policies, how do we check the signatures inside of the cluster? We configure Q Warden for that. Q Warden being help charts and so on. You just have some configuration that you put in a config map. And in this case, it's pretty simple. You can get it with our little utility to get the thing. And here is where we start seeing patterns, because this seems somehow simple, but there are some best practices that you need to follow. Here, Raul has talked about issuer and subject. But here, we are going a step forward and saying, OK, if it's something from GitHub Action, then we can just look at the owner and the repo. In this case, Q Warden. Everything that comes from the Q Warden organization in GitHub would be checked and verified and that's it, because there's little details on how things work that may come to bite you. So that's why having best practices, it's a good idea. OK, we have our cluster deployed. We have signed our policies. Now, we are verifying all the policies. All the policies that end up in the cluster are verified. So if we use them now to check other things in the cluster, we can start trusting them, because we are building our own just chain of trust. And now, we need all the images inside of the cluster to be verified and trustworthy. We can do that with a policy. In this case, we are using this policy that we have written with the RAS SDK, but you could just write your own and use whatever language that you want with the SDK that we provide, and that's it. This policy seems simple. It's a policy that looks on the pods for containers listed there, so it's going to be containers, init containers, and fmerial containers. That's all the things that could go inside of a pod. And you get the JSON request, and the policy decides, looks at the signature of the container, and maybe it says, no, I don't know this person, this organization, rejected. But then it can be fine, and then it approves. But ah, there's a trick there. Imagine that you are just verifying an image up example with a tag 1.0. The tags are mutable. Are they? No? You can just push today a tag 1.0, but tomorrow you can push again the 1.0 and rewrite it. So then you should not trust the tags themselves, never. What you need to do is check for the signature, and check for the signature of the digest, which is the checksum of the image. And then what you do is mutate the JSON request that contains the pod, and append the digest, the checksum, to your app example version 1.0, and then the checksum. So you know that you are instantiating only the things that you want to instantiate, and nothing gets changed below. OK, we have talked about the policy. Now how does a policy get instantiated in the cluster, a keyboard and policy? Well, it's a custom resource, cluster and mission policy. They're in line three. You have the spec, spec.module that points to your policy wasm module, which is kind of like a container image. You remember because wasm modules are at the same level as container images, the rules then we are putting it for pods, for operations create an update when you change a pod. And mutating through, because we want to make it change the digest, and then some settings. In this case, the image has an asterisk, so it would try to, it would check for all the images that end up in your cluster. And in this case, it could be the GitHub action and so on, but we can also use the issuer and subject. Here we are looking for the subject that comes from GitHub actions. You can see the whole URL. Imagine if we get an asterisk after github.com big quad, then only that user would be trusted, and everything that comes from that user would be trusted. Here we are only trusting a specific tag from a specific pipeline that comes from GitHub actions and so on. So we do a kube control apply of that policy. We wait. It's a CRD, it's a custom resource. We can just do a kube control get and see the list of them. And once here at the end of the ride, we see status active, then that policy is protecting and enforcing. What happens if we try to instantiate a pod with untrusted images? This is a pod that comes from somebody, and it's not signed. Then you can see there, we are going to do a kube control apply, and it's going to be saying, pod nginx not accepted. Verification of image nginx failed. No signatures found for image. It's not signed. It's not going to get into the cluster. It's just going to get rejected. The user is going to get here a one as a return code, and that's it. And for the case of a pod that has container images that are signed, well, we do the thing. It's transparent to the user, and that's it. And you can see, if you look at the specific pod, you can see now that it has the digest appended. The last line, maybe it's a bit smaller, but yeah, it's just the URL of the container, 0.1.0, and then the digest appended there. OK, what's next? We have talked about SIGSTOR. I mean, there's a lot of problems with the secure supply chain. We need to check it and verify the supply chain. We have talked about SIGSTOR and our own images, but we have not talked about dependencies. How do you handle dependencies? Well, what you need to do is append a server bill of materials to your container images. That server bill of materials will contain just a list of your other image layers that you are depending on, what are the projects that are there, libraries, and so on. And that's partly already in cosine and SIGSTOR, and we intend to put that also in Q-worden. Also, we need to sign and verify everything. If you get something from this talk, please be the SIGSTOR vendor neutral coming from the Linux Foundation and how everybody depends on something. We don't have our own stack on our own, and we all depend on some dependencies. And those dependencies need to be signed and verified if we want everything to be secure and we want just to trust the whole stack and forget about it. So if you're interested in this, think about signing and verifying. With cosine, it's quite easy and simple, so it's doable. And for us, in Q-worden, it's expanding the CI integration also for Q-worden and SIGSTOR upstream because it's really nice when you can just take the OIDC tokens that come from inside of the CI, for example, in GitHub, or from your cluster if you are passing the OIDC token by exposing the token inside of the node and so on. But it would be nice to have the same ability for, I don't know, GitLab because it's open source. It's open. It would be nice to have it for other CI schedulers, drone, tecton, and so on. And that's one thing that should improve. And yeah, with this, I think that's it. If you're interested in SIGSTOR and secure supply chains, please come by and stop us later. If you're interested in Q-worden, have a look there. You can see the information there, the Slack channel just to ask some questions and so on. And now we are open for questions. So if you have any questions, please feel free. Yep. Yes. So the question is, OK, I have used Notary before for signing images. How is this different compared to SIGSTOR's workflow? It's a complex question, no? What did you need for Notary? At the end, you were signing your images, no? And you were giving your users some public key to check. What would happen if your private key got compromised? You would need to revoke your public key somehow, no? It's kind of like this private key cryptography thing. How do you ensure that the users end up with the revocation certificate at some point because they could just not care about the revocation certificate and then you are in problems and so on? SIGSTOR, it's a difficult topic. We can talk about it later. Let me just put here the whole diagram. SIGSTOR works by delegating the trust to the transparency lock and by using a key that is fmdrl. So you only have the key that you had, the private key and so on. In SIGSTOR, you also have it. But you only are going to use it for the 20 minutes that you're going to sign things and then it gets discarded. And it cannot be used more because the signature goes into the transparency lock, which means that people in the future could just see that with that key you only sign a specific moment that allows you to sign and not later and it would not be validated. So that's one kind of attacks that are not there. By doing all of these dance with the full certificate authority and so on, you can delegate some trust into your OIDC, into your OpenID Connect service. Maybe your organization is big enough that has an OpenIDC service. Maybe it's an open source octa or things like that. Or maybe it's GitHub or maybe it's whatever your organization uses. Or maybe you are super small and you don't have that capability on having that infrastructure. So you can delegate to GitHub OIDC and delegate all the things. And then at the end you trust in GitHub. But if you are small that you are building also on the GitHub builders, you are already trust in GitHub. So what's the difference? And you are using GitHub as a source for. So you are already trust in GitHub. So you are not shifting so much trust. But it allows for an open source. Everything is distributed. It's not so centralized. And you have a lot of dependencies coming from different parts and big players and small players. And this way of working allows for small players to be signed because you need all the dependencies to be signed for the whole security of the supply chain to be there and so on. We can talk about it. I'm so sorry if I'm just expanding too much. We can talk about it and we can, if you want we can sit. And we can go through the whole diagram on what it means for SIGSTOR to do this. But it would take some time. Yep. No, no, no. It's making us as Raul has said, I need to go back. The signature is stored into the OCI. He registered as another artifact. So there is no additional overhead of existing image. It's just this new artifact, which is quite small to be honest. Yeah, it's gonna be a JSON with some strings and that's it. So what, four kilobytes? Yeah. I just wanted to show this one. No, one less. But we don't have the, yeah. You have the image here. This is in the OCI registry of GitHub. You have here the image 0.1.0 and then you have another tag which ends in .sig. And the first part is the checksum of the image of 0.1.0. And that's it. Another tag on the image and it's super small. Yeah, you have a point there. So the question is, okay, you are trusting on the whole thing, but you are also trusting on Fulsio and Record, which comes from SIGSTOR and they are services running on the web and they are registry authority. Fulsio is a registry authority plus a certificate authority. What happens if those get compromised? You now have a new vector for a compromise. Okay, yeah, that's a good point. First, Fulsio and Record, which are the transparency log and the certificate authority. The code is open and you can run your own for starters. Second, all the utilities can be redirected to your own Fulsio and Record services. Third, we go back to, okay, if I'm small enough, I cannot run my own certificate authority. Then I'm gonna delegate, but if I'm small enough, maybe I'm already delegating on a lot of things. I take things from GitHub anyways or I build things on GitHub or I build things on AWS or whatever. And if you are big enough, then maybe you just deploy your own Fulsio and Record and so on. And maybe you say, yeah, not even that. Then I can just go back and go back to the public key and private key authority, the way of working. And then you don't need Fulsio or Record and so on and you have the escape hatch if that's what you would prefer. So that's possible. For sure there's something. If the six store guys would hear us, they were gonna say, yeah, you're missing this and that, that actually helps. But yeah, that's it. Any more questions? Okay. Then, I think that's it then. Many thanks. Thank you.


Hello. Hey, welcome back to our Steve Dorex of Corbin. You can follow us on Instagram, Twitter for more juicy content. Thank you to everyone who's been on Patreon. Follow us on Twitter, subscribe, like, button. And welcome. This is episode six. Second to last episode, unless the last one is seven and eight. That's right. And if you haven't seen the other, our episode reactions, please go watch those. They're all out already. If you're seeing this on YouTube, obviously, you're going to see a very cut-up version because of copyright reasons. You can use about five to ten minutes of each episode of picture-in-picture. If you'd like to see the full uncut version of this episode and others, you can head over to Patreon. Patreon, Patreon, the uncut versions there. Comment. And this episode is called... How to circumcise with a handmade gun? No. Oh. Uh... It's called... Piarchutiaiapa? Hai. So Piarchutiaiapa is love. Chutiaiapa? I'm guessing... Maybe it means... Idiot for love? Chutiaiapa. Fool in love? Idiot in love? Fool for love. I think it's maybe a fool for love. I don't know if... We haven't had any, so I'm not... Yeah, they've been... Lovely lack of predictability in that regard. I haven't been any. Alright, second to last episode. Let's see why he didn't get shot in the balls. Yep. It'd be funny if they don't explain that. Here we go. Flatnicks. I like the start of this episode already. I want to kill my friend. Huh?  You can owe me by giving my girl's farm back. Yep. I don't want your ring. I want you to do good by my girl. We won't leave him. Next time. He's been great. We've seen him before. Might have been in another series, I think. Everybody uniformly, the casting's been top just great. Has there never not been in a Raj and DK? No, there hasn't. Most TV series out of India are incredibly well cast. Oh, it's called It's Love as a Bitch.  I don't know if it's true or not. Did you bring something to eat? Talking about the newcomer Sachin. Yeah. Maybe he'll make something of himself. You know, I'm curious about why we're still following the story of the kids. Of the kids, me too. Why is that important? I thought we would have had some explanation of that by this point. I assume it's going to interieve in some way. I feel like somebody's going to get caught in the crossfire. Nice shot. I disagree. Okay, problem here. Why is he telling him? To see if he'll cooperate. And he probably figured he was going to find out anyway at some point. I never heard monkeys when I was going to school. Oh, yeah, no. Or peacocks. We don't have monkeys here. Wait, peacocks. Depending on where you live. Yeah, not wild. Not wild, but some folks have them. But yeah, no monkeys anywhere around North America. Bless his heart. No. No. No. I love you, ma'am. Dare you do this. Well done. Dude, this is not an office for narcotics. Why are they going the wrong way? Everybody's going to be trying to steal from everybody in the end. Yeah. Very, very spy now. Who's that? Looks like he tore up a bill. Crap. Doesn't that happen every time you're watching something? They bust out some to drink and you instantly need... Alright, sorry, technical difficulties because I was getting a drink. Very important. Thank you. Thank you. I think it's really clear. I think it's very clear. I think one of the cards he's holding is he's gay. This? Yeah. A darsh? A darsh. I think he's not letting that out because he needs to make his dad proud first. I think that's... I think that's one of the cards he's holding. It's hard to tell. There's so much that everybody's holding, but I think that's one of them. He's always drinking out of a straw. Yeah, he is. I wonder if that's something he came up with. One peg. One peg. Just one peg, dear. That's all. I love it when my wife gives me a one peg. Chunky monkeys. It's going to be like a conversion of errors. Everybody's trying to get it. Check the PCH. Yeah. On parts of it. Bro, you have a lovely wife and kids at home. Yeah. I'm beginning to think he's not the best guy. Where's the setup? Did he do that so that she would not want to do anything to hurt him? Maybe. Because I was thinking, why is he there?  Yeah, I think that was like a setup for stuff to come later.  I think so. I've never said I hate school uniforms. Absolutely despise them. Me too. Not a big fan of school, period. Yeah, don't go to school. You guys are not going to school again? No, I'm not going to school.  Dirty handwriting. Dirty handwriting case or not? Dirty by? Exactly. You'll be happy if you tell my story, right? Come on. I'm sorry. What? The plan to make a drawing wasn't just for me. There were three of us. There was also your boyfriend in it. No, no. Is this true? Boys. Boys will be boys, am I right? Is that Johnny Depp's hand? You know Johnny Depp's hand? He has a lot. Head-fielding. If you play football, you'll become a hero. If you play school, you won't get anything. Let him play. Why are you still wearing a pettipant? Can you see my ring? No, no. That doesn't mean that. We'll kill that tiger's son, Jannam. I'll kill him.   I'll kill him. You have to catch him alive, got it? Yes. He's not a kid.  I'm done eating.  He doesn't like the way he treated the kid. Guddu, man. Set her down. Yes, man. What happened, sir? I got slow. They're going. It reminds me a little bit right now of Bardem and no country for old man. A little bit. What to do? That was interesting. Okay. Each of you will submit an apology to the school and to Jocena. And bring your parents next week. Yes, sir. My parents won't be able to come. I don't know where they'll study today. What do you mean by where they'll study? I mean, sir. And what about your mother? She died a long time ago. Sir, she... What are you saying? That I can't come back? I don't know. Because I've fixed all the details to the head office. You're lying. I know everything. I called my man to the head office. I don't know what's going on in your mind. I'll find out soon enough. And when I get to the root of it, you'll see. You'll find out a lot. So, who comes home to eat? To eat? Sometimes I cook. Sometimes my brother cooks. Or we go out to eat. By the way, did you come to any house nearby? First, Nannu used to help in the shed. Nowadays, it's not the same. And it doesn't make any difference to anyone at home. I'll help you. And not you. I'll help the three of you. When they fought with me, I became very lonely behind those girls. I'm on the road. I do such things. George, George, George of the jungle. Strong as he can be. Watch out for that tree.  But you started it this time. You killed Babu Tiger. Yes.  He was your brother-in-law. Babu Tiger was also your brother-in-law. So, you think we should work together? Yes. How much will it cost? 50-50. And you took Gulab for his cold air. Still, it won't be bad. Did you call to sell it? Yes. I could have done that on the phone. But I didn't want to touch it once. Wow! Ew! But now I pray to God to fix my brother's water from the river. So that he can see his enemies being killed by their business. Wow! He's really not done a thing. Getting ready for a tropical storm, Hillary. I like the whoosh! It's like the dawn soundtrack a little bit. It was a little bit. Amitabh Bachchan's dawn. No, we need 50 kilos. This is 10 kilos, right? Yes. So, we need 10 kilos, 10 kilos, 10 kilos, 10 kilos. 8, 8, 10 kilos. 5. He's stealing it for his girl, right? No. Nonchalantly walk away. His friend is going to get caught because he always outruns his friends. Nice shot! Very Keystone cops. Interrogation time. I just need 50 kilos of raw material. 50 kilos of raw material? That's it? No. Why? There are so many finished materials in the factory. So, why did you need 50 kilos of raw material? They supply Ganchi Kumar. No, sir. But I just stole his stuff. Who? Sir, Ganchi's people. You work with them, too, right? But I'm different, sir. What's the point of this story? You're explaining, right, sir? What? Love. Love. I know. I know. I know. So, all this for a girl? Sir, for a girl whom I love. For her. But you're in jail for 3 years. And your love isn't over. What do you do for a person's love? You work for me. You all right? At the college time, my girlfriend went to Bombay to celebrate her birthday. What? Till when did I go to Bombay? She had left Delhi. Oh! To celebrate her birthday with me. After 3 days of her birthday, I went to Delhi. She thought I forgot her birthday. After 2 years, we got married. What happened? What happened, sir? What do you do for a person's love? Let her go. Sir, but... Sir, what's this? Vigils? Normal, sir. He doesn't want anything on the book. So, he had to let me go. So, I can't read anything. Yep. And then he's blushing. Oh! Fart! So, you didn't lose anything, Kajal? What? Oh! The eyes are open. Phantom of the Opera. Kill them all! Yeah! Get your spanner! Oh! Again! It goes by and you're like, what? There's one episode left. There's one episode left. I didn't expect us to still have a lot of cards close to the vest. Didn't? No. No? Or the kids not... No? No? No? No? No? No? No? Well, no, the kids not crisscrossed in some way. Yeah, that's the one that's confusing me. I mean, I'm all for a side story, but I feel like it's all going to converge in some way. And it may. They're just not going to do it in season one. It's something I probably should have asked when we interviewed them. Do you think they always go into a series expecting or knowing there's going to be more seasons? I did asked them that. You did I did I wasn't listening. Yep.  They want to plan they want to know you have a full Multiple season idea in your head when you pitch it and then if they green light it's very very rare They're gonna green light just a single season. They don't want to put all that time investment work. Yeah, unless it's got a huge name um So, yeah, this is even though as is typically the case. I'm sure it's the same in India as it is here in the States most shows They know their green lit way before you ever hear the news. Yeah way before you ever hear the news Yeah It's usually months if not a year ahead of time and everybody's just being quiet about it And sometimes they'll you know, they'll they'll make it seem as if it's bigger news than it it is So, yeah, this is definitely it'd be interesting green lit for have so many other multiple seasons projects going right films and TV shows That we already know. Yeah, right. He is one. Yeah, you're used with podcast, right? Yeah, and and they they said they didn't get specific about it But they said they're really itching to get back to doing a feature film. So yeah, but But it won't surprise me if a lot of the proverbial cards that are being held close to the vest We don't see a lot. Yeah, I think we're gonna get something But it's gonna be left with you definitely wanting more It's pretty seamless Feels like one long episode Every episode has felt like the last one in terms of the flow the pacing except they'll actually the first one Yeah, I'm wondering if it's the next episode the last episode of the sea is season is gonna Kind of kick it up a notch a little bit because there's a lot that needs to be resolved a lot I Just don't know I'd be interested to see because I haven't really looked Um, how people feel about this series because I didn't want to yeah me too I don't want to get spoiled But how they're feeling about the fact that is it is slower at least in the the episode the Six right that we've seen Um outside of the last one like it just it feels like You thought there would be more happening each episode in terms of like action or right or violence or whatever and they're Doing a more story driven, which is wonderful. I I'm enjoying it obviously Um, but I'm wondering how it's being received. Yeah Um other than that so you guys can let us know because obviously I feel like it's gonna be like almost like a comedy of errors at the end in terms of everybody's gonna be trying to steal Yeah, I feel like everybody's gonna be trying to steal something's happening with the kids. Yeah I still want to figure out why she was so turned on why he murdered somebody. Yep Is it just that she was like, oh, you're doing something even if it is murdering was it that or was it that she was thinking I can get an in to ganchi's Gang which will be good for my dad And they won't screw with him I think she didn't think that ever screw with him I think most of the farmers felt as long as i'm providing for the government the gangs aren't gonna touch me. Yeah So, yeah, there's a lot. I I don't think I don't think we're gonna get I think we're gonna have a more things unanswered than answered Yeah, probably the last one and it also wouldn't surprise me If reviews are mixed Yeah In terms of people not liking it because they thought it was gonna be more fast-paced I don't think you definitely not like it because of the acting no or the writing filmmaking aspect of it But if it's not what you want in terms of pacing I could see that. Yeah, it's interesting though. It's a very different kind of show. Those of you who know this show will know The pacing on this I was expecting the pacing to be a little bit more Uh Using American television examples. I was expecting the pacing to be a little bit more better called solid raking bad And we're getting white lotus Hey, I guess a little bit a little bit, right? Yeah, yeah, uh great series if you haven't seen all yeah, all those All three of those but uh, I want I want HBO to do an indian series.  They decided to call it Because AT&T bought them and anytime you get AT&T involved. It's never a good thing Uh anyways, uh, so let us know what you thought about this episode If you watch this on youtube, you saw a very cut up version If you'd like to see the full uncut version of this episode and other including the last episode that we're about to get to Head over to patreon. I'll put the link in the description below in the pinned comment and on to the final episode


25 years ago, not a single planet outside the solar system had been detected. But remarkably, we now know of thousands and have studied many in surprising detail. ESO's observatories in Chile have been at the forefront of this enormous expansion in knowledge and their state-of-the-art instruments are continuing to discover and study the extraordinary diversity of exoplanets. This is the ESOcast, cutting-edge science and life behind the scenes at ESO, the European Southern Observatory. Looking up at the night sky, people throughout history have wondered if there are planets and especially planets bearing life beyond the solar system. Astronomers have also asked themselves these questions and many more. Are planets common or very rare? Do they resemble planets in the solar system or are they totally different? Frustratingly, until very recently, observational techniques were not advanced enough to be able to answer any of these questions. But in 1995, this changed overnight. The first exoplanet orbiting a sun-like star was detected. The monumental discovery was made by Geneva-based astronomers Michel Mayor and Didier Kélo around the star 51 Pegasi. The exoplanet named 51 Pegasi B has around half the mass of Jupiter and travels around its parent star in just over four Earth days. But this was only the beginning. The initial trickle of discoveries became a flood. Thousands of exoplanets have since been detected in a huge variety of sizes and orbits. Many of these discoveries have been made by ESO's observatories in Chile. But the hunt for exoplanets is a challenging one. These alien worlds hide in the shadows, giving off little or no light of their own. Any light that they do emit is swamped by the overwhelming brilliance of their parent star. However, advanced observational methods can be used to spot these elusive exoplanets. The weak gravitational pull of an exoplanet in orbit causes its parent star to wobble back and forth. This tiny motion causes a small shift in the star's spectrum, which extremely sensitive spectrographs, such as ESO's harps, can detect through radial velocity tracking. Harps, installed on the ESO 3.6-metre telescope at the La Silla Observatory, is the world's foremost exoplanet hunter. It's the most successful finder of low mass exoplanets to date. In 2010, the instrument discovered the richest planetary system yet. The system, located over 120 light-years away around the sun-like star HD-10180, contains at least five exoplanets. There is also tantalizing evidence that two more planets may be present in this system, one of which would have the lowest mass ever found. Planetary transits can also be utilized by astronomers to indirectly detect distant worlds. When an exoplanet passes in front of its parent star, as seen from the Earth, it blocks a small fraction of the star's light from our view. This creates a dip in the brightness of the star, which can be measured. In addition to determining the size of an exoplanet, planetary transits can reveal the composition of an exoplanet's atmosphere. The atmosphere around a super-Earth exoplanet was analyzed for the first time by astronomers using the very large telescope. The planet, which is known as GJ-1214b, was studied as it passed in front of its parent star, and starlight passed through the planet's atmosphere. This starlight revealed that the planet's atmosphere is either mostly water in the form of steam, or is dominated by thick clouds or hazes. Directly observing an exoplanet is a monumental feat, but one that was first achieved by ESO. The very large telescope obtained the first-ever image of a planet outside the Solar System. 2M-1207b is five times more massive than Jupiter. It orbits a failed star, a brown dwarf, at a distance 55 times larger than the Earth to the Sun. ESO's telescopes are equipped with state-of-the-art instruments, but to remain at the forefront of exoplanet research, ESO has recently commissioned two new instruments for the VLT. Sphere is able to find and study faint planets masked by the glare of their host stars. And in the near future, the espresso spectrograph will arrive at the VLT, where it will surpass harps. The European Extremely Large Telescope, which is currently under construction in Chile, will take the hunt for exoplanets even further. Once operational, this 39-meter telescope could detect Earth-like planets and possibly evidence of alien biospheres. The search for planets outside the Solar System constitutes a key element of what is possibly the greatest question of all. Is there life elsewhere in the universe? Over the past 20 years, our knowledge of exoplanets has advanced dramatically. But the quest for Earth-like planets and those that harbour life remains one of the great frontiers of astronomy. Are we alone? We do not know, but the answer is almost within reach. Transcribed by ESO, translated by —


What's going on everybody? Got Kyle and Shawn here relating sports cards and we are ripping a full case personal This one will be for Chris G. Got a full case of 2022 23 tops. Finest you wave a soccer. Good luck here, Chris Let's see what we got my friend finest full case Alrighty good luck here Chris eight boxes of finest soccer. Oh, we got a train look at this All four of them stuck together. I think they have been coming out like that pretty funny All righty box one if they put them in too hot or something. I don't know but Chris And guys just two breaks to go tonight got contenders optic Contenders optic with tend to go to your random team styles to get two teams first spot purchase And then we've got flawless with just four to go Yeah, right Chris. That's kind of crazy. Don't see that very often seen a few times at this product, but Overall, definitely don't see that very often Good luck. Good luck, Chris Price footballers muderich to 250 we got matisse delete Matisse delete What's happened the last all taco bell earlier deleted? Huh deleted it. Yeah, let's just delete There's a rookie of siratos augs and droplets And this one is the man ronaldinho on the insert. I really like these inserts the man Ronaldinho he was the man Was the man for a little there Alrighty guys, I appreciate everybody helping us fill up today. Just got two breaks to go Thank you. Thank you guys. There's a prize footballers of holland and to 200 chi haverts 299 Hope everybody's been enjoying if you guys haven't enjoyed the stream. Please do hit the like button For the old stash and trash appreciate y'all There's a josco guardio on the auto there for life's egg Better defenders in the world. There's a a dork Pete's feeling himself tonight. We sacked him 11 times. Roke him on Pete's feeling himself today. Callie Mendo rookie refractor and that one is yesen oddly Um to 125 on the green speckle rookie Val Verde, there's a rookie is andre shell drop. We just raised tomorrow three o'clock. Let's go There's a prize footballers of gavi and green moments to 99. This one's filipo and zaggy Green lava. I think it's the first color I've seen on one of these moments Zaggy, let's go raise Paxton erinson There's a sush and nice to 99. We got a green fusion footballers fusion. Um, sorry, that's a 30 to 30 hung been sown Nice one there footballers fusion to 30. I love those fusions look like a color blast almost Yeah, because they have the regular one and those are like the short print. They have the little color on them Yeah, so this is the regular prize footballers and bop in and that's the short print. Um, this one's the 275 trends That's like really really cool. I like it Got in the wbc insert event two of my favorite inserts recently Like in those this one is the 250. Um, tamori now one is for ac Milan and auto is going to be Pedro can call base sporting Come on chris Let's see a monster Let's see a monster Refractor of de bala lucasus itch So you're still recording, right? We're gonna have to finish this. Yeah As is and internet went out All right guys, um, we'll we'll upload this later. Um, I'm gonna keep recording if you guys are watching this back later um The times it's 12 30 the end is 12 30 right now. We are doing a personal for chris g. Yeah internet just went out on us. Um We're gonna keep on going here guys It never stops. Yeah, we're gonna keep on recording. So we're gonna keep on ripping. Yep There's a rookies inzo fernandez rookies insert for chelsea box two I find a way to talk to chris Let me see if I can still get his email up Alrighty guys, it's gonna keep on ripping here again. Um internet went out if you guys are watching this back I think it's gonna be posted in the morning, but this is a personal for chris g Internet went out. So Get laying the tech email and maybe Alrighty guys, again, this is um for chris g Our internet went out on us Yeah, I'm gonna let him So I think he gets the regular email. So prize footballers alvarez mudrich I knew it too, man. I didn't want to start Refractor scott olson rookie Um club bruce. I saw it the other day. It was um, it said for the gaming shop So the address was different this one said for this one Damn it. I shouldn't have opened shouldn't have started this. There's a prize footballers carvalho Blue to 250 men fish to pie There's a rookie auto fabio blanco for the brah um for barsa rookie fabio blanco Um chris we're gonna sign us in the email And if you are watching this in the morning apologies apologies Internet did go out on us. Um rookie of duet for stodd and blue to 150 manuel noir Matisseule rookies willy on alvarez rookie valentine carboni rosegold Prize footballers of messy and rosegold is going to be the 75 consolo ramos benifika Manuel garte Ain't saying not to keep ripping so we might finish this box Not too righty, so we'll finish this box. I think and then we'll um We will end the recording We'll finish for you tomorrow chris. I apologize man. Guardi, y'all there's a moments of patrick clover Yeah, I feel it. I don't know jimmy gittins prize to 99 koti gakpo for liverpool barberry There's a auto joe gomens for liverpool liverpool joe gomens finjerman sesco Yeah Yeah, you got traded to uh, 299. This one's tibocortua. Wow Real madrid jeremy docu been very good for stod hi hovertz and rookies dijon kamari All right, let me make sure we're gonna stop here. Um Yeah, it said two hours Alrighty guys, there's still six to go on this one. Um, let me step away while this is still going I'm gonna call lane real quick. Make sure This is what we want to do Yeah So again guys if you were watching this back and we upload it later um our internet did go out on us We are trying to figure that out. Um, I'm stopping for just now to see what we want to do about this since we aren't live Um, we sent it. We're sending email to chris. See if he gets back to us. Um But yeah, we're gonna wait just a second here before we keep ripping Appreciate everybody. Um I guess we're done for the night after this though, but uh See what chris says here Whoa, air email just came in And go back or back It can Restart the stream without ending this video. Let me see I think I can restart the stream without ending the video Because we're lot we're back Yeah, I need to restart the stream. That's why the internet is working. I just hit restart Hey, what's up chris? All right, we are back. I'm sorry my man I'm sorry my man. Uh internet went out on us So I did the first two boxes On the recording still going so we're gonna record. Um We're just gonna upload everything after this. It's gonna be a long recording, but we got six to go chris My bad man. Sorry about that. We are back though Someone broke the internet. That's right chris. That's right No, we saw an email about um spectra maintenance and I was worried that that was gonna happen It might go down on us and it did but it came back pretty quick. So we'll keep on going here Right. All right. Let me make sure everything's looking good Still four to go on flawless. We're gonna get that going guys patriots jet Steelers and commanders all rights Thank you chris. Let's keep on going here. I got six to go Six to go on this one my man Good luck Sorry about that man. Sorry Old spectrum messing with us again But yeah, this recording is still going. It's already 15 minutes on the first two boxes and I was kind of just sitting here figuring out what to do, but we'll get that whole thing recording going for you Right box number three There's a prize footballers moot rich. There's a prize footballers to 150 alessandro del pierro Iwata Hey, thank you lane Thank you, sir for help your help Here's a rookie shell drop and purple shimmer is asugo to 199 sporting Marquinhos prize footballers of holland and blue is going to be the 250 um, jorney spiel of spillers For club bruge. All righty guys. So this is a personal for chris g chris g There's a auto rooney bar g nice rookie there for kopenhagen Like he'll be on a bigger, um european club here soon kai osaka rookie shell drop the mts tail Nolly Let's throw back Get hot prize footballers del pierro airling Levandosky, there's filipo and zaggy moments Jimmy butler man started something today Say benzema this one is another jorney spiel years to 150 rookie for club bruge orange Come on now Orange auto is going to be jude bellingham 13 of 25 boom There we go chris Take that for your ray almadrid now 13 of 25 on the jude Very nice one there. We'll mag that for you chris We'll take that we will take that my friend. Let's go We'll mag that for you, sir. I know you're liking him on your uh ray almadrid now Jayden sancho very nice man very nice And waiting for a nice one for you chris. That was a banger Very very nice my friend Sterling got a fabio carvalho rookies He is tearing it up man. He is very very good He is very very good. All righty guys box number four for you chris We're all attached together Appreciate you sir. Good luck. Let's keep it going. Let's keep it going. Let's see him again Let's see her uh holland. Let's see messy and again guys just for to go on flawless For to go on flawless can get that going next Now the patriots the commanders these steelers And the jets that is it. Yeah, I'll fix it just go to the home page Right there. It'll be right on the front. Yeah It's the first two. Yeah I'll fix in a second. There's a footballer's ramos Yeah, you can always find it there if it goes past the Just goes past the time. I didn't fix it in time. There's a rookies. Are you're emory psg? The man is louis figo figo the man Should be harry. Yeah We should still have some time for some more personals sesco. There's a rookie issak. Um, yohansen Issak yohansen that one is to um, 299 There's a blue to 275 Memphis the pie and auto is farin torres Barça good luck chris Very nice hit on the jude man to 250 uh graven birch Tommy abraham Of course, of course, Harry. Appreciate you. There's a public tory rookies Yes, all things look pretty good, man. They got I got some dogs. There's a hungman's sone and this one is a 75 rose gold fatalu There's a grease man and gavi gavi on the moment silver And guys for to go on flawless got a link in the chat there Four teams are the patriots the jets the Steelers and the commanders. That is it rose gold It is going to be man. Well garte to 75 rose gold Raphael layout Auto is going to be david turnbull for the uh for sporting or for itself Hey, good luck, minnesota Good luck, my friend Martinelli. There's a green warren zaire emory green lava psg jamey gittens kdb and kamari Alrighty chris. I got four to go for you a little far back here four to go Good luck, my friend box number five. Nice hit on the belly ham. Let's see some more Alrighty guys. Let's end the night with some flawless flawless pyt Four to go on it. Let me fix the um schedule real quick so we can see it on the schedule Yeah, super time.  I was like you're not even showing it There's a rookie refractor vantonio nusa club bruce filipo and zaggy moments What a premiere I never even know what kind of chrono i'm drinking they all look the same Premiere the light the regular Benzema we got a rookie to 275 adley AC Milan Come on super for chris There's a timo verner auto that one's going to be for leipzig timo verner Another belly In ketia. There's a green lava arnaud danjouma 299 totem Rookie's insert fabio carvalho lever pool like a mio A mio for your tooth for teeth brushing. I don't know hungman. So we got the 299 serginio dest Come on super for chris Rookie luica lewis refractor and moments filipo and zaggy a lot of nzagi nzagi gold Come on now. Gold is a rookie. It's gonna be um ferried ali Doe for fronkford number 250 on the gold rookie Not bad there. We'll take a rookie on the gold For fronkford rookie auto is going to be fatawoo for sporting fatawoo Refractor of gabriel hasus Last pack in box five Nunez and rookie's kittens Valentin carboni righty three to go Righty chris Three to go three to go super time And four to go on flawless guys four to go on flawless Patriots commander stealers and the jets That is it purple Hovick purple is going to be the 299 usman d'embele Matisse tell There's a moments that one's going to be frank reichhardt Ka fu there is a 275 jou cancello Fractured finger Did you see that thing? No, I didn't see it. That was bad Do Right here say auto. This one's going to be elias akamak. That one is for barcelona silver auto The wrong way. Yeah bicep tears terrible for uh jude on two man. That's got hurt He's gotten terrible rookie runy bargy refractor And a warren zyder emory rookie's refractor prize footballer is gavi 38 man Say rookie carvalho and purple is graven birch to 199 purple shimmer Um, we got some mosaic football coming for a personal, but we did our breaks of mosaic already today Just flawless left for breaks. Um, we got four to go on flawless On su fati to 125 barcelona Yeah, we did a couple breaks earlier and we got one personal coming up in just a minute Refractor is jude soon sub bell. Nice young player for titan on there And jude soon sub bell Come on super rookie of nicolas zalewski There's a messy refractor And rookie's inzo fernandez It's who to go miss chris two to go. I said brawny's playing this year He's trying to play crazy. You know, I don't remember what happened in like heart failure or something Ever it was I guess Righty guys two to go Two to go and four to go on flawless Good luck. Mr. Chris. I don't like seeing him in the golden stages. It was weird chris paul There's a prize footballer's 299 levendoski marquinhos purple shimmer rookie of gorna duoth and purple shimmer is defan besetich to 199 on the rookie for liverpool bobby clark There's a prize footballer's rinaldo throwback young rinaldo and bluto 275 to mori. It's a green wave auto 299 is going to be joe gomez for liverpool vendor for liverpool Bulpato For what you go on flawless guys.  Let's rip some flawless tonight rookies of fatalu sporting Sandro tonali another orange Come on chris another orange footballer's larson It is rookie orange antonio nusa for club bruise not bad there Nice young rookie for club bruise to 25. That's the book in 25 to 25 That's a clean-looking orange hailing Not bad there my friend Let's see that super still rookie of cast for tangestat moments of zidane Prize footballers moussiala illin jr. Four two go guys patriots jets steelers and the commanders There's a ray of a tate Celtic Silver auto got some really good rookies still available some fun chase March and odegaard silver refractor to ecateke and mahalo mudrich refractor rookie The in last one here mr. Chris box number eight Hope everybody's having a good night still got nine to go on contenders optic as well full case Here random team stop when we get that going as well get two teams first spot on that one That's the top tier team once on the bottom Larson we got a bordo came a vignette in 99 true green Hazard there's a moments in zaggy I've been zaggy in here new low key season I'm down Moussiala this one is the 275 Malik Tillman That's the only uh marvel show i've seen in like the last like two years they keep putting them out But that's all that one is pretty good. Oh my goodness red dual auto chris It is dual auto of gunduan and jauk ensalo on the red to five I have not seen many dual autos that one is consalo and gunduan for man city and bayern Former teammates long time former teammates will make that for you chris to a five on the dual gunduan and consalo for berry That is sick. It's the second dual i've seen out of here Very nice Say purple rookie to 299 bobby clark liverpool silver amini goiri Pool is sick. We got a hugo eca tk rookies insert Last half of the box. Good luck chris Gold is going to be usman dembele the 15 nice one there the winger for uh barça Out of france nice true golden bailey Hey, so another nice one is uh footballers fusion. That is jamal musiala Good-looking one there. I thought that might be orange, but it doesn't look numbered It's like a base prize fusion. There's a 250 aldi on the blue vapor rookie Three to go. Thank you chris. Appreciate the order Nice hits. There's a more ever jr. That one's for uh, benefica Two two packs left rookie jed spence refractor and this one is evan nielsen 225 green speckle Our last pack rookie ten long go refractor and rookies insert fatalu All righty there mr chris. That'll do it for your um one full case of finest soccer Some nice hits there bellingham orange auto and the dual auto red to five Appreciate you chris as always my friend. We'll get those right out to you


Hello, in this lecture we will define payroll deduction. According to fundamental accounting principles, while the 22nd edition, the definition of payroll deduction is amounts withheld from an employee's gross pay, also called withholdings. When we're thinking about the payroll deductions, we're typically thinking about those payroll taxes, federal income tax, FICA taxes, including social security and Medicare, but of course we could also take out the deductions from the pay of benefits such as a retirement plan or a insurance plan. So it would look something like this, we would have the gross pay, what the employee actually earned, that not being what will actually be received, because we will have the deductions from that gross pay, including the FICA taxes of Medicare and social security. Then we're also going to have the federal income tax that we're going to have to withhold. These are all federal taxes, two being the FICA tax, one being the federal income tax of that federal