Hello everyone, welcome to Options with Doug, streaming live daily on Bookmap Discord and the Bookmap YouTube channel at 1.30pm Eastern Time. Before I get started, I need to go through the Disclosures. General Disclosure, all Bookmap, Limit and Materials, Information and Presentations are for educational purposes only and should not be considered specific, investment advice nor recommendations. Risk Disclosure, trading futures, equities and options involves substantial risk of loss and is not suitable for all investors. Past performance is not necessarily indicative of future results. The focus of my presentation and the focus of the Options-Doug chat channel in Discord is options, order flow, the impact of options markets on stocks and futures, and the influence of market maker hedging flow on price action. I have a two-step process for trading and the first is planning and I use positional analysis. I look at how traders and market makers are positioned in the options market and how those positions change from day to day to develop a thesis regarding the expected trading range and volatility for the day as well as the directional bias. And the second step of my process is execution. And I look at real-time order flow in Bookmap and real-time market maker hedging flow and spot gamma hero to confirm my thesis and for setups for entries and exits. And questions and comments are welcome. I will be watching the chat in Discord, Options-Doug chat channel in Discord as well as chat and YouTube. And Floyd's garage says, hello, I can hear great, hear good, thank you. Glad you're here, glad, glad audio is okay. All right, my agenda for today, what I want to cover, first of all, go over news items, economic data, events and earnings for today and the rest of the week. Then I'll go through my positional analysis and then I'll review a few setups from the morning and then we'll take a look at the live market. All right, let's get started. First of all, news items. Today there were a couple of PMI releases, manufacturing PMI at 9.45 and 10 a.m. Eastern time and both were less than forecast, less than the previous numbers and less than 50 indicating contraction. And then tomorrow, Friday, the jobs report, the monthly employment situation report that comes out on the first Friday of the month is tomorrow at 8.30 a.m. Eastern time. All right, let's get started with positional analysis. And I'm going to start with the S&P 500. First of all, this is the ES futures and book map, the S&P 500 futures. And before I take a closer look at this chart, I'm going to step back and take a look at a larger time frame. And this is SPX in a 30-day one-hour chart and showing that it looks like price is now heading back up to recent highs, which the recent high was 42.31. So it appears to be breaking out of the range. The 41.50 to 42.00 range. Let me point out a couple of some levels here on the chart. First of all, I've got the lower and upper edge of the expected move for the week, shown with the dash purple lines and the dash blue lines, showing the lower and upper edge of the expected move for the day. And note SPX is trading above that level. Here are other levels on this chart that I want to point out. These are from Spot Gamma. These are the Spot Gamma key daily levels. And they're provided to Spot Gamma subscribers for a variety of platforms here. Again, we're looking at thinkorswim. So first of all, here's the 4000 put wall. That's the strike with the largest net negative Gamma that can be expected to act as support. And that's not really in play today. And then the next level is the 41.50 level. And that is the absolute Gamma strike. And then above that, at 41.70, is the volatility trigger. And that is Spot Gamma's proprietary Gamma flip level. Below that level, market makers position on the Gamma curve is negative. In a negative Gamma environment, they have to sell or trade with price to hedge their delta exposure. So its price falls, they have to sell. And then above that level, like price is trading now, SPX is trading now, market makers position on the Gamma curve is positive. In a positive Gamma environment, they have to trade against price to hedge their delta exposure. And that tends to subdue volatility. So negative Gamma environment market makers trading tends to enhance volatility. And then on the other hand, in a positive Gamma environment, like the current environment, market makers trading tends to subdue volatility. And then the next level I want to point out is the call wall. And that's the strike with the largest net positive Gamma. And that can be expected to act as resistance. So those are the primary daily levels. Now let's take a look at another thinkorswim chart just to get an idea of the levels that are in play for today. So this is a one day, one minute chart showing the same levels. So again, SPX is trading above the upper edge, the expected move shown here. Also trading above the volatility trigger. So in a positive Gamma environment now, let's take a look at Bookmap. And in Bookmap, I have two columns of notes here for levels. First this is Spot Gamma Cloud Notes, again provided to Spot Gamma subscribers for a variety of platforms. For Bookmap, they're provided in the form of Cloud Notes. And this is showing combo levels, SPX and SPY, combo levels converted to an equivalent SPX level and then converted to an equivalent ES number. And right now it looks like Spot Gamma is using an eight point difference between ES and SPX. And I calculated a seven point difference today. So there's a slight difference. In my combo level here, the C3 level, one point lower, and this is my column of Cloud Notes here. So in my column, I'm showing the SPX levels, also the SPY levels. So there's the SPY 422 call wall that is expected to act as resistance today. So again, that's the SPY call wall converted to an equivalent ES number. Here's the upper edge of the expected move for the day for ES, a little bit different than SPX. And then I'm showing other SPX and SPY levels as well. So let's take a look at some levels that were in play for today and primarily SPY levels. So the SPY 417 level acted as support this morning and price reversed higher, just in between the SPX 4170 volatility trigger level and the SPY 417 level. And there was a pullback just below the SPY 418 level, then a brief pause between the SPY 419 volatility trigger and the SPX 4200 level, and then price has taken off again. And now it looks like finding resistance at the SPY 422 level. And we'll take a look at the live market in a few minutes and we'll see that options traders have been fading this move. Since about noon a little bit before, they've been taking negative delta positions as the ES, SPX, SPY approach the SPY 422 call wall. And keep in mind ES and SPX and SPY are just different versions of the same product, the ES and B500. So that's why I have all these levels shown on this chart. All right, so shifts in levels for SPX the volatility trigger did shift lower from slightly from 4175 yesterday to 4170. And for SPY the volatility trigger also shifted lower slightly from 420 yesterday to 419 today. The put wall did shift higher to 415. And then most significantly the call wall shifted lower from 425 yesterday to 422. So I interpret that as somewhat bearish. The ceiling potential ceiling for the S&P 500 has moved lower at that 422 call wall. All right, let's take a look at and again we'll look at setups and the live market in a few minutes. So those are the levels in play for today. And really the primary levels are the SPY levels, the 417 support, the SPX 4200 level that SPOTGAMMA noted as a pivot level this morning. And then meaning they would be bullish above that level and bearish below. Another way of looking at that is mean reversion around that 4200 level. So that would be just the opposite. And actually a weekend, let's go back to the. So here's the 4200 level and it seems to me there has been some mean reversion around that level. So maybe now this if the call wall levels move up tomorrow, maybe this this may be a bullish breakout. We'll see. All right, so that is the S&P 500. Let's take a look at NASDAQ. We'll go to the NQ futures and book map. There's a bullish day here and Q trading above the upper edge, the expected move for the day that's shown in my cloud note columns here. All right, let's take a look at a QQQ chart and we'll take a and think or swim and we'll just take a look at the levels in play for today. And primarily QQQ is trading well above the volatility trigger. So in a positive gamma environment, although it started the day in a negative gamma environment, negative gamma notional, and then the also trading above the call wall, which should act as should have acted as a resistance. All right, let's go back to book map now. So bullish day here in the NASDAQ and the support level this morning was the NQ 14250 and the QQQ 347 and then here's the QQQ 350 call wall and again prices trading above that right now. All right, so shifts and levels for the NASDAQ shifts and levels for the NASDAQ for the NDX, the put wall did shift lower from 13,750 to 11,000. And then for QQQ, the volatility trigger did shift lower from 349 yesterday to 346. And then most notably, the call wall shifted lower from 360 to 350. So I interpret that as somewhat various as well. So for spy and QQQ, the call walls both did shift lower. All right, so Floyd's garage and YouTube asked, so when goes above a gamma area? It will act as support. I'm not sure I understand your question. So the put wall, I expected to act as act as support call wall, I expect to act as resistance and then a volatility trigger or absolute gamma strike can act as support or resistance. All right, so those are the levels in play for today. For the S&P 500 and NASDAQ, I've talked about shifts and levels again, primarily the shifts lower in the call walls for spy and QQQ. Let's take a look at the Vantemodel now that will give us an idea of how market makers are positioned. Today, I'm going to take a look at the Vantemodel for spy. Spy, by the way, started out the day fairly negative gamma notional at minus 846, and we'll take a look at that in just a minute. So what this chart is showing is market makers delta notional or delta exposure on the vertical axis against price on the horizontal axis. Again, we're looking at spy and there are two curves on this chart. First, the light gray curve is showing how market makers delta notional will change with changes in price only. This is showing is above around the 422 level, which again, remember is the call wall, that market makers will need to sell futures to hedge their delta exposure and that could contribute to somewhat of a mean reversion back to the 422 level. And then this purple curve is showing it adds implied volatility to the equation showing how market makers delta notional changes with changes in price and applied volatility. And it is predicting that market makers will have less delta notional to hedge as predicted by the delta only curve. Then on the other hand, if price decreases, then market makers will have more delta notional to hedge. So in a negative gamma environment with price decreasing and implied volatility increasing, market makers will need to sell futures to hedge their delta exposure. All right, let's check where spy is trading now. Let's go back to this chart, the ES chart. So we see that spy is just under the 422 call wall. So let's go back and look at the Vana model and actually again, so spy traded up from the 417 level now up to the 422 level. So let's see where those levels fall on the Vana model. So first of all, this morning, so here is the 417 level. What I'm interpreting, what I get from this chart is from that level, there was somewhat of a Vana tailwind for spy for the S&P 500. So what this means is that this curve works both ways. So if price increases, market makers can buy back short hedges. Their delta exposure decreases and they can buy back short futures. So that provides a tailwind for price up to a certain level. So at the 422 level, this Vana model definitely starts to flatten. So here's the, this line right here, this is 422. So price has already gotten that Vana tailwind this morning and it looks like that is, that may end and as price increases, market makers will have to start selling futures to hedge their delta exposure. So again, this is showing that there was a Vana tailwind as market makers were buying back short hedges as price increased. So let's take a look at a chart of VIX just as a proxy for implied volatility and note that it has been falling all this morning. And Truman asked, is the right axis on the Vana model, the IV level? So the vertical axis is delta notional. So remember, market makers want to remain delta neutral. So as what these curves are showing is as price moves down or moves up, market makers delta notional will increase and they'll have to sell futures as price increases in a positive gamma environment or sell futures as price decreases. Blow around, you know, we look at the very bottom of this Vana model in about 423. All right, so Floyd's garage asked, do you look at SKU? And I, yes I do. And right now SKU is trading higher than it has been in quite a while and that provides a very good advantage for selling that, you know, that's kind of a measure of tail risk. And that to me, the way I use that is it provides a good advantage for selling far out of the money, far out on time options and then buying shorter term options. For example, selling far out of the money out in time like September puts and then buying short term 30 day put spreads to hedge those short puts. So that's how I use SKU and it is providing a very good advantage. And that SKU started to increase right around when the, I guess the, I don't know if I would call it a crisis, but the regional banking issue started in March. That's when the SKU started to increase. So that's how I use SKU. All right, so that's the Vana model. Let's take a look at one other thing. And I'm going to go to the gamma notional and spot gamma, gamma index. And this is for SPX, SPI, NDX, and QQQ. And the spot gamma, gamma index is a proprietary measurement of gamma. And that ranges from minus four to four. So slightly positive for SPX and negative for SPI. And then not much significance for NDX and QQQ. It's a little bit easier to read gamma notional. So these numbers are showing for SPX, market makers position on the gamma curve at the beginning of the day was slightly positive. And then more significantly negative for SPI. That's why I looked at the SPI Vana model today. Okay. And then also somewhat a little bit negative for QQQ. All right, let's take a look at setups. And first of all, I want to point out that today the move higher in the market seems to be pretty broad based. In recent weeks, the large cap tech stocks have been the primary drivers of price higher. And this is a heat map for the SAP 500 and showing that it looks like almost all sectors except utilities, which were strong yesterday, are contributing to the rally today. So more of a broad based rally today. All right, let's take a look at spot gamma hero here. And this is actually, let me just go back. So what this chart is showing is price in terms of the SPX and then hedging impact, options trades and hedging impact or hedging pressure, hedging flow for options trades in SPX, SPI, XSP and ES futures. Combined signal for the SAP 500. And let's take a look at some of the individual components of that before I take a closer look at this chart. So first of all, let's take a look at SPX. So we know this number is the notion of value is negative minus 731 million. Let's take a look at SPX. And that's positive 700 million, SPI negative minus 1.78 billion, and then ES futures positive, 295 million. So that nets out to this chart for the combined signal. I'm going to zoom in on the, just on the morning session here and remember the setup that I talked about briefly for the SAP 500 was a long and around SPI 417. So here is this divergence in hero. Hero starts to rise about 945 and then the SAP 500 follows about five minutes later right before the 10 AM data. And then also a secondary entry. If you waited until after the data was reported was at 1025. All right, so let's go take a look at book map at those two long setups. So 955 and 1025, we'll go back to book map. I'm going to zoom in on the, let's go until noon. So the morning, morning session. All right, so here's the first setup at around 955 just before the data. And note the aggressive buyers coming in here, large green volume dots, aggressive buyers come in as options traders are taking positive delta positions. Note the rising cumulative volume delta that is this dark blue line. And then eventually buy stop orders start to help the field to move higher shown by this rising yellow line here. And then here is the pullback and secondary entry. And note the shift in order flow there. Pink dots and then aggressive buyers starting to come in. And all that time, cumulative volume delta continues to rise. And then after this second pullback or this pullback at around 1025, then stop orders start to help to fuel the move higher shown by these small green dots. So this setup is something that I call a hero kickoff. And we'll go back and look at the hero chart in a minute. And it seems like with this setup, options traders seem to initiate a move. And then they, like the kickoff team, football team, they leave the field. And then the other, the offense or defense, in this case the offense, comes in and takes over. And they take the price higher. So in this case, the aggressive buyers shown with the cumulative volume delta, all the green dots as well as the stop orders start to move price higher as the options traders, the kickoff team leave the field. So that is a hero kickoff. All right, so that's the S&P 500 setups this morning. And price continues to test the 422 call wall. All right, so those are the setups this morning. Pretty good clear setups looking at order flow and hedging flow. All right, let's go take a look at, and what I mean by the hero kickoff is note the really the choppy action after those first two setups. You can see that after around 1045, hero is really choppy up and down. But price continues this steady uptrend driven by aggressive buyers and also by stop orders. So again, a hero kickoff there. All right, let's take a look at NASDAQ now. And just like the S&P 500, this is a combined signal for NDX and QQQ. And again, the components are QQQ and NDX. And let's take a look at this closer. So this is somewhat like the S&P 500. Pretty similar setups. The long setup was a little bit more clear right after the open here. This divergence long. And then price responds right around 938. Then a pullback entry right around 950 or so. And then another entry around 1030. So there are three long entries, 938 and around. Actually, this was more of a continuation. Let's just take a look at 938 and 1030. So let's go to the NASDAQ chart now. And again, I'm just reviewing setups from the morning showing the key setups. So let's go zoom in on the morning session. So here's the first setup at around 938. And again, the NASDAQ found support between NQ250 and QQQ347. Note the very clear shift in order flow as price moves lower, aggressive sellers, and then aggressive buyers come in. And actually they come in a little bit before price starts to increase, giving you a clue that price was going to move higher. And again, we know that options traders were taking positive delta positions. And then here's the second setup just before 1030. Again you can see the same shift in order flow. And we know that options traders were taking positive delta positions. And what that means is market makers have to buy futures to hedge their delta exposure. And again, the shift in order flow, the green volume dots, aggressive buyers coming in. So those are the two long setups in NQ this morning. And targets, it looks like to me NQ is well above targets that I would have used. I trade the SP500 this morning. So they're 350, call wall, QQQ, call wall, first target, NQ, upper daily expected move, second target, and now NQ continues higher. Let's take a look at a couple of stock setups and then we'll get to live market. So the first one I want to take a look at is Apple. And note that Apple, the 180 level is the call wall. Let's take a look at hero. And I study a steady uptrend in Apple up to the 180 call wall driven by call buyers. That's shown by the rising orange line. We can also take a look at the notional value. So they're buying calls, that's positive 99 million. And they're also selling puts, that's positive 8.1 million. And it looks like the call buyers are really driving price higher there. So when traders buy calls on a stock, market makers have to, they sell the calls and they have to buy stock to hedge their delta exposure. And that can drive a price higher. And it looks like, again, that price has reached the very obvious target at the 180 call wall. Let's take a look at the total signal. And it has somewhat, it was sloping up pretty sharply in the morning and then has still rising but just gradually and now has leveled off. All right, so that's Apple, call buyers, driving price higher. Here's Nvidia and let's go to full screen. So the call buyers are back. So the rising orange line shows that traders are buying calls, taking positive delta positions. And they're also selling puts, positive 472 million and positive 135 million, 136 million for puts. So they're selling puts and buying calls. Let's go take a look at BookMap, go back to Apple again. Apple 180 is the call wall, the target. And so far, traders are having trouble getting price above that level. And SecondWins ask, is 423 the call wall on spy? No, it's 422. All right, so that's Apple and here's Nvidia and it made it kind of reverse what it did yesterday. So made it up to the 400 call wall. Every bullish price action in Nvidia, notice all the green dots here, aggressive buyers. We'll take a look at Kimlet to volume delta. It should be a straight line up, looking at this dark blue line here. Straight line up from the opening. So traders are buying calls, selling puts and aggressive buyers are in here. So the call buyers are back and Nvidia and driving price higher. All right, let's take a look at the live market. We'll go back to the SAP 500. And now it looks like price is trying to get above the 422 call wall. And then the next level of resistance, that is the 4232, which SpotGamma was noting as somewhat the same level as the 422 call wall. It's not quite the same level. And then there's also this 4226 combo level. And above that is the SPX 4250 level. And note that larger traders are fading this move with iceberg orders that shown by this falling light blue line. So there's a larger, actually that was canceled. So they're canceling, but this is showing that iceberg orders, sell iceberg orders. But so far, the buy stop orders and the aggressive buyers are winning. Let's see what options traders are doing. So we'll go back to hero for the SAP 500. So it looks like they're kind of shifting to more positive delta positions. And then prices responding, or they may be responding to price. Let's just take a look at a, let's change the rolling window to 30 minutes. So I'm just looking at the past 30 minutes of data, and this provides more clarity. So about 1250, one o'clock traders started taking positive delta positions in the SAP 500. Let's see what zero DTE traders are doing. And this is very similar. So it looks like zero DTE traders are having a large impact on options traders, trades today. So these are, these are options that expire today. So traders are again, taking positive delta positions right now and options that expire today, and that may help to move price above the 422 call wall. And the reason I'm looking at that shorter rolling window, shorter look back period when this is a cumulative signal for the entire day and when this is somewhat flat, like it is now, it helps to change that cumulative period to a shorter time frame. Let's go take a look at NASDAQ now. And if anyone has any other stocks that they want me to take a look at, let me know. So here's NASDAQ. Looks like they may be starting, options traders may be starting to fade this move. Let's take a look at a, we're on a 30 minute. So this is the one day. Go to the 30 minute. Let's zoom in a bit. So so far, I would not read much into this. Overall, it's been bullish since around 1250, one o'clock, the same as the SAP 500. So let's go take a look at the book map. Let's go back. So so far, very, very bullish here for the NASDAQ. Note the buy stop orders, yellow line, continue to fuel the move higher. Now it looks like some larger traders are coming in with buy iceberg orders. Cumulative volume Delta continues to increase. Let's go back and take a look at at hero. So so far, the definitely the best trades were just to get long in the morning and hold a runner. Whether you bought calls, bought shares of QQQ or spy or bought futures. Let me just do a quick stack check on. And I'm just looking at a chart on another screen looking at tech stocks. I'll continue to rise. So now it looks like options traders are starting to fade the move in NASDAQ. And let's check on the SAP 500. Same for SAP 500, I'm going to go back. So we still need the 30 minute rolling window period to give us more clarity. All right, let's go take a look at book map. And again, if anybody wants to look at any of the stocks that I have here, just let me know. So we know that options traders are starting to take negative delta positions. So trading the SAP 500 has taken some patience today, but it has paid off if you got long in the morning. Spy trading right around the 422 call wall. Let's check the NASDAQ again. So a little bit more pronounced move lower and the negative delta trades. But note here, when they did that, they really didn't get paid. So they started taking long positions again. So this may be indicating just another chance to get long. So right now it looks like stop orders, CVD starting to level off, and now some larger traders. Excuse me, larger traders are starting to sell at $14,500 with iceberg orders. So BlockWizSBXES is at a call wall. With today's strength, do you see indication that it can act as support and push higher so far? So let's go back to the SAP 500 now. So that's a hard call today. So the SAP 500 has rallied strongly all day. And 422, the Spy 422 call wall is a natural resistance level. And anything beyond that, it's also almost 230. The RTH close is in an hour and a half, 90 minutes. And I would have to see how levels shift tomorrow. So that'll be the key for tomorrow. So if the call wall for Spy moves higher, then that would be a strong clue for higher prices tomorrow. So that's what I would be looking at. So again, for today, I don't necessarily see that much of a move higher. The money has already been made. If you got long around 417 or 418, Spy 417, 418, again, the money's been made. Those were the trades for today. Let's take a look at NASDAQ. So it looks like that 14,500 level, NQ14,500 level, has been acting as resistance. We'll see if that lasts. Let's see what options traders are doing. So for NASDAQ, they continue to fade. And you're welcome for the scripts. All right, so Florence Garage asked, could you repeat that? What would you be looking at for tomorrow? And I'm looking at shifts and levels. That's always what I look at. And if I expect the S&P 500 to continue higher, I would look for a shift higher in the Spy call wall, specifically. The SPX call wall is still up at 4,300. So I would look for a shift higher. Let's just take a look at. So this is the Spy absolute gamma levels. Going to zoom in on this. So here is the Spy 422 call wall. So if what I would look for, for a continued move higher, is to build call positions above that level. So I would look for a build in calls above that level, and specifically for the call wall to move higher. So what this chart is showing is absolute gamma levels. Orange bars are showing positive gamma or call gamma above the zero line. And the blue bars are showing negative gamma or put gamma below the zero line. So if I expect or tomorrow I will be evaluating this and I will be able to make a better judgment based on shifts in the calls above the call wall level. And again, specifically for an increase in the call wall. All right. So Block Wiz asked, he said he was able to put them in book map for NQ. And for one question, individual stocks like Tesla, AMD, do you manly put the levels? So let me show you what I do for stocks. Let's go to Tesla. So for stocks, I have an add on called price lines. And that is available in the book map marketplace. And I fill out a spreadsheet. And every day I can shift the levels. I used to add all of the levels for all the stocks that I follow. That just got too time consuming in the morning for all these stocks that I follow. So I just look at the hero chart for the gamma levels, spot gamma levels. But I just have the line shown here on the chart. So this is drawing, putting the labels. I just like to see where the round numbers are. And so this is just showing the round number levels. And then I mark the 5s and the 0s with red instead of yellow. But for SPI and QQQ, I do add the gamma levels. So just for those two stocks or ETFs. So let's take a look at SPI. So SPI, for example, I do have the call wall noted here. But I only do that for QQQ and SPI. And I do this manually. So I look at the levels from spot gamma every day. So for the SPI and QQQ, they're shown here. So I just change those in my spreadsheet. And you can use your own cloud notes or just do that manually. All right, so again, looks like the S&P 500 is up against resistance. That may be it for the day. The money's already been made. Great move from the 417 to 418 level higher up to the 422 call wall that appears to be acting as resistance. And options traders are fading the move higher in NASDAQ and the S&P 500 starting to take negative delta positions. So at the SPI 422 and the NASDAQ 14,500, in Q14,500. But again, the money's already been made, I think. Nice move higher in both indices. And then traders, again, remember traders were back buying calls. And we looked at two examples in Apple and NVIDIA. All right, tomorrow, remember the employment report at 8.30 a.m. Eastern time. That's all I have for today. I want to thank you for watching. Thanks for your questions and comments. And I will see you tomorrow. Thanks again, bye.


Can you please give us an update on your most recent news release about what's going on in the rare earth or actually in the critical mineral list? Okay. So as of the 1st of August, China has effectively banned the exports of germanium and gallium to the West. Some sort of revenge move against the US and the West cracking down on the supply of key semiconductors or chips to the Chinese industrial empire. A lot of this has to do with longer term strategic goals. In the short term though, it's quite oriented towards the saber rattling that the Chinese have been indulging in towards Taiwan because of course Taiwan is the world's largest producer of semiconductors. So the number of factors going on here, but what we effectively have is some sort of revival of the Cold War where battles are fought not on battlefields, but in tit for tat measures, expulsions and in this case, the Chinese think that export bans are the most effective moves that they can take to punish the West for restricting the flow of semiconductors to China. So would you mind giving us more of an update about what's coming out from the US government right now that's happening with for instance the gallium and germanium please? The US government does not want to admit that the Chinese have got them into some sort of stranglehold at the moment. The US felt that it could take actions against semiconductor exports to China and with impunity and the Chinese have responded by restricting exports of some of the most critical inputs to the semiconductor industry because gallium arsenide for instance is a very important input into chip manufacturing and so the Chinese are saying to the US and to the West really, you restrict the flow of chips to us, we'll restrict the flow of metals that go into the chips to you. So you won't have any chips to export and one of the problems is the industry in the West rather than governments industry has not built up stocks of these critical metals. This is a lesson that we need to look at across the whole critical metal space. Industries that use the critical metals are not filling warehouses with stocks for a rainy day and a rainy day is frankly right because they now have a situation where the Chinese have signal like a month ago that they're going to chop off the exports from the first about August and they've done it and most of these companies could not get in stocks within that time. They have no fat and so we're pretty much going to see a situation within weeks if not months that or rather months if not weeks where they are going to be shutdowns. They're going to be shortages because it's not a situation where you can come up with gallium and germanium out of nowhere in a difficult situation. The Chinese dominate like 98 percent of the gallium market. They have something like 66 percent of the germanium production. The rest largely coming from tech. So Canada is the big player for once in a critical metal and that is a tech byproduct production of germanium from trail smelter in BC. So take her in a very strong position because take of course to try and fight up Glencourt at the moment but you know germanium is not as difficult a situation because art is a non-Chinese production of science and from what I hear are groups like Traffa Goura. Traffa Goura have a big zinc refinery in Tennessee. They're looking now to start byproduct production of germanium as well. A lot of these metals not just these two but others have been sent to tailings by many large refineries and smelters because the price has been too low for too many decades but now it's going to be not only strategic imperative to extract these metals from the waste flows of these refineries but it's also going to be worthwhile from a price perspective. It's early days yet of course because it's only a few days since the ban came in but I would expect that we're going to see the prices of these two metals rise quite significantly and that is going to change the dynamic for the metals. So it's going to be more profitable for Western companies to actually reduce them. That creates an interesting new dilemma for the Chinese themselves because the Chinese have really rung an alarm bell. The West has heard the alarm bell and the West is responding by trying to up production. There's going to be a lag and it's going to take months. But at some point the West will become self-sufficient in gallium and germanium and at that point the Chinese have no strategic hold over the West. And so if in a situation that a shooting war begins with Taiwan the Chinese are not going to have as much leverage over the West as they would have if they hadn't taken this measure. Does that make sense? It does. And for everybody out there to access your most recent report called Let the Cold War Rebegin, go to your website, go to the following website and or reach out to Christopher Eccleston from Hellgarten Company. Thank you so much for joining us today. We appreciate it. Thank you very much.


I got set up with an organized team in Toronto and it kind of just helped me just fall in love with it, to be honest. The whole idea of just working, working every day to get better, I kind of just liked it and competing as well with other people. I just get some type of joy out of it that I didn't get anywhere else. Carlton beats teams in the States. I was like, why would I go somewhere to lose to these guys when I just come here and get better with the best things that you can't do. It's like working hard and staying disciplined. It'll make it easier if everybody was like, yeah, they're going to win a game, they'll do it, but having people say, I don't think so this year or this is going to be the year they'll lose, definitely gave us like the panic that we needed to go out there and compete. I'm giving it literally everything I have. It felt like I could have passed out at any moment, but you know, I'm just like, this is the last game of the season. I don't want to leave here with any regrets. So just gave it whatever I had.


Doctors fail to diagnose cause of woman's itch until it's too late. When a woman began suffering from a strange, mysterious itch, she went to see the doctor several times. After getting medication for scabies, there was no sign of improvement. She didn't find out what it actually was until much later. 30-year-old Liam Crosley of Leeds, England, was only married to his beautiful wife Lucy Crosley for a few months when the 29-year-old newlywed woman died. Following her untimely death, her widowed husband is speaking out about the tragedy that took his beloved all too soon. Hoping to increase awareness about a little-known disease, Liam Crosley is raising his voice for his wife who tragically succumbed to bile duct cancer, also known as cholangiocarcinoma, shortly after the two were married, according to Daily Mail. Shockingly, the first indication that something was wrong started roughly 18 months before Lucy's death when she began to suffer from a severe itch. She was in London training for her new job and called me to tell me about it, Liam recalled. She was not one to make a fuss, so I knew it must be bad. Lucy, who was then 27 and had just landed her dream job in a lingerie company, went to the doctor several times to have the troubling itch evaluated and treated. However, after receiving medications for both the treatment of scabies and an allergic reaction, Lucy was unable to get any relief. In fact, there was no sign of improvement at all. A couple of months after Lucy Crosley first noticed the bothersome itch, she had already been fired from her job for taking so much time off sick as her condition only continued to deteriorate. When she began to complain of a tightening across her chest, which turned out to be referred pain from the liver, Liam took her to the hospital where liver function tests were performed. The results were insane, Liam explained to Daily Mail relaying that Lucy's bilirubin level was 395 when it should be 17. Although Lucy was kept in the hospital under observation for more than three weeks at that time, doctors still could not find the cause of her failing health. The following month, Lucy Crosley was moved to another hospital where she saw five different consultants.  Doctors had determined what was wrong, but it was not good news. The itchiness that Lucy was experiencing was caused by a growth blocking her bile ducts, resulting in bile being secreted under the skin and causing irritation. This blockage was happening because Lucy had bile duct cancer. The moment doctors told Lucy and Liam the devastating news, Lucy broke down. I was holding her hand as they talked to us, and as soon as they used the word cancer Lucy broke down and cried into my shoulder, Liam recalled. Sadly, the news only got worse from there. By that stage, the cancer was too advanced for surgery and medical professionals could only offer Lucy chemotherapy. But there was one thing the couple wasn't going to let this cancer stop their wedding day. Already engaged when they got Lucy's diagnosis, Liam and Lucy decided to move their wedding date forward, and the two were wed just a couple of months before tragedy would strike their lives again. Although Lucy remained hopeful that the treatment would be successful, she was rushed to the hospital when she fainted just months after her wedding. Doctors discovered that she was bleeding internally as the tumor squeezed a vein in her liver. Sadly, specialists said there was nothing left to do to stop the cancer. Later, when Lucy underwent emergency surgery to have the vein biopsied, she never woke up from the anesthetic. I felt so helpless, there was this woman who I wanted to spend the next 40, 50 or so years with, who was now gone, and there was nothing I could do to save her, Liam explained, remember the emotion he felt when he lost his wife. Now, he wants to help others by sharing Lucy's story because, had her cancer been caught sooner, perhaps her outcome could have been different. Although bile duct cancer was once a relatively rare disease, its occurrence has risen sharply in recent years. Professor Simon Taylor Robinson explained why we might be seeing such a rise, explaining, we know that exposure to certain chemicals produced as a byproduct of waste incineration may be associated with this cancer, it has also been associated with industrial spillage. With the increased prevalence of the disease, the first world cholangiocarcinoma day took place February 17, 2016, when six charities from around the world united to organize it. As Imperial College London points out, the failure to diagnose bile duct cancer quickly enough often means that surgery is not possible. In fact, only 5% of those diagnosed with bile duct cancer are alive just one year after their cancer is found and diagnosed.


What you're gonna see is in the Western world you're gonna see people Starting to suffer because of an agenda they don't quite understand They can handle the heat They can handle changes in the weather The ancestors have been handling changes in the weather for a long time and as we'll talk about we're better suited to handle those Changes now than ever in all of history But they're gonna expect it to suffer they're gonna be expected to sacrifice for whom? For the quote climate For people in Africa supposedly who might have a too hot for the residents of the Maldives Who might be flooded although they haven't been yet, but might be maybe one day who knows For Some vague notion of it's gonna get warmer It's gonna get hot you all gonna boil to death in the name of millennial hysteria panic Armageddon type thinking and most people unfortunately Accept that Until it really starts biting it still till it really starts hurting their pocketbook until they realize that they are expected to bear the cost of theories and ideas and Consequences that they don't really understand and that are being pitched and being articulated by You know elites in the country by the wealthy and primarily the educated in the country that Will only bear a small part of the cost of this because or Maybe that's not right. They'll bear a cost that they can afford to pay the cost To them. It's a slight hit To the lower middle class in the working class It's a devastating hit and This really drove the yellow jackets if you remember in France, it was a cost of gasoline a Cost of gasoline because of new restrictions around climate change that the French government is imposed and these people saying look we We live in a country we drive a lot You're wiping out our profits You're wiping out our livelihood. We can't survive if we have to pay this much for gasoline for our trucks for our tractors for traveling and You high-falutely intellectuals in powers. You might not feel it You don't drive that much, but we do this is a livelihood and as The Western world adopts more and more and more of these kind of suicidal high-cost low-growth or negative growth policies more and more and more of its poorest I mean when we're not talking about the welfare poor we're talking about the working Middle-class low middle-class working class people people who work for living They're gonna start looking around saying wait a minute. Why are we being sacrificed? For whom and for what? We're not buying this And this is why you get the rise of kind of right-wing populism all over the world Why you get the rise of the working class are going from being leftist to being rightists? Because you know people on the right, you know have lots of problems But at least on many of these environmental issues at least so far They seem to be better and the popularity of populist rightist movements is Growing among the lower middle class among the working class because of this and that's why by the way the the right is Moving left and economic issues Because that's what its constituency this new constituency this working-class low middle class wants them to be pro welfare state pro you know Govern intervention They're not a capitalist that they much more close to the socialist But on social issues and certainly on environmental issues they tend to be more on the right So it's this complete realignment of our politics We saw this in America with with a lot of people used to vote Republican now voting Democrat A lot of people used to vote Democrat primarily working-class people voting Republican post Trump We saw it in the UK. We're now the North the industrial North the working-class North Used to be the stronghold of labor the stronghold of the of the socialists It is now the stronghold of Brexit not because those people change their minds in terms of the economic policy Now because they change their minds in terms of the role of government in the economy but because they changed their minds about immigrants because Because they they didn't identify with the left with regard to immigrants and they don't identify with the left with regard to environmentalism although The conservative movement has moved so far to the left on environmentalism. I'm not sure there's a difference between left and right in the UK on that issue I Am I'm starting to like the idea of Liz trust trust I think her name is as being the next Prime Minister. She at the very least admires Margaret Thatcher and claims that she wants to have policies like her. I say give her a chance. I mean the other guy Sunek I think Is too much of a moderate middle-of-the-road stand for nothing guy trust at least claims. She's gonna rule She's gonna govern From a Margaret Thatcher perspective. So that's let's give her a chance. She says that let's see Okay back to Holland to the Netherlands Did you know did you know that the Netherlands have a hundred million hundred million? Cattle chickens and pigs. I mean how many of you've ever I know how many of you've lived Being to the Netherlands being to Amsterdam or driven around the Netherlands. I mean the Netherlands a tiny country I know it's the size of Rhode Island. Maybe it's a little bit bigger than Rhode Island. It's a small country flat much of it Below sea what is sea sea level? That's where they have dykes Justin says he's in from the Netherlands. Is he in the Netherlands or is he from the Netherlands? He's trying to have it both ways Netherlands has a hundred million Cattle chicken and pigs Justin how many people live in the Netherlands? He's from the Netherlands, but I guess you don't live there anymore. Justin. Where do you live now? So now there's this tiny right Netherlands is tiny Danny's also from the Netherlands so Danny What's the population there the 17 million chef said you have basically you have what? Six Cow's chickens and pigs to every human being in the Netherlands like I always make fun of New Zealand because there's so many more Sheep than human beings when you see it is nothing as compared to As compared to the Netherlands where it's not cheap it's cattle chickens and pigs, but a hundred million God. That's a big number Anyway, it turns out that When the cattle chicken and pigs Poop is that the technical term when they poop and the manure Is sped around and then if they when they urinate on that manure What happens and I hope nobody's eating dinner right now, but what happens when you do that when you urine you combine urine and manure What you get is ammonia Which is a nitrogen compound? Deficates that's a that's a that's a good one when they defecate and then they piss on that what they defecated something like that Anyway, what you get is this nitrogen compound and ammonium, right? Unfortunately, this you know this excess nitrogen this nitrogen By the way very good for the soil. I think it's a good. It's a good fertilizer, but it runs off into the rivers and lakes and supposedly damages sensitive natural habitats Who is natural habitat? Okay Netherlands is sixteen thousand square miles. I don't know how big that is, right? So you get the some onia and it runs off into the into the rivers and Sensitive, you know, it supposedly damages sensitive natural habitats now. I wonder is it the natural habitat of human beings is The natural habitat of snails Is it that I don't know who's natural habitats it is, but it's natural habitat It turns out that there's a court ruling that says that In order for new housing units to be built in the Netherlands in order for them to be new developments The economic real estate development in the Netherlands this Nitrogen has to be cleaned has to be reduced and I guess the government has passed a law that you know This has to happen the courts have appellated no new construction until this happens So the government has decided that they are going to they demand that the farmers shrink the size of their animal light livestock Population by 30% 30% All right, sorry, so Netherlands is 10 times larger than Rhode Island It's still smaller like I've driven through it. I've driven from Amsterdam to Brussels. How long is that two and a half hours?  So yeah, I mean, it's I don't know For our drive in every direction five hour drive in every direction and you cover the whole thing It's also by the way has the highest Density What did I read this? Right as a highest livestock density in in in the world in Europe in Europe. All right Yeah, it's wow Puerto Rico is is double the size of Rhode Island Yeah, well, you can do you can do the whole of Puerto Rico in a day. You can suck them never get the island in a day Anyway, so the farmers have to reduce the the livestock by 30% in order to reduce the flow of nitrogen a few reduced the flow of ammonia and the farmers are saying And I have to do it now Not in 10 years not by 20 30 have to do it now and they're like you people are nuts the fact is The fact is that you will destroy our livelihood We can't survive under those terms and That's what the demonstrations That's the demonstrations now You know, this is consistent Across Europe you're gonna see more and more of these kind of things You know Netherlands is a farming place They say more than half of livestock farms are either gonna have to shut down or they're gonna slim down significantly and The government is just saying tough You know, we've got we have to shrink by 30% you guys do it you guys You guys are responsible for for the nitrogen you have to do it. I'm sure you know The farmers are saying some industry they should participate. Is anybody really challenging the whole idea of doing this? I also wonder sometimes why is the Netherlands? Why does it have so much livestock? What if that has to do with government policy? That would be interesting It would be interesting to dig deep into kind of the agricultural policy in the Netherlands and how much of it is really This is the comparative advantage and and note that Netherlands is a is a an amazing country I don't know how much of the history of the Netherlands, you know, but but the Netherlands were really the first Country I'm stemming the first city. Well, not the first the first in the modern times To really be based on trade based on Free trade Based on letting people, you know make money. It was the first environment in which Making money was viewed positively in in the Christian era I you know the rich was celebrated if you look at Art Dutch art from the 16th and 17th century You see merchants being painted you see still lives that that present as these glorious You know layouts of stuff People were in compared to people everywhere else in the world including elsewhere in Europe was super rich Emstam was the place that had probably the most freedom of speech most of the Radical books that were published in Europe were published in the Netherlands and then distributed to other countries from there often through a kind of underground of Forbidden books That's better for all of Europe, but the hub was the Netherlands. I mean Amsterdam is this amazing amazing place I know some of you can't get beyond the prostitutes, but Prostitution is legal in in many places in Europe. There's nothing unique about Amsterdam in that respect Amsterdam has this unique feature of having the prostitutes sit in windows so you can choose them in advance. It's weird fairly disgusting But kind of weird in a you know interesting kind of way It's it's worth going to see because it's so strange, but as time is definitely Was the bastion of kind of free thought free publishing free speech? Not that it wasn't repressive.  It was the first place to completely embrace globalization from a trade perspective and and with a positive attitude towards it not as We're gonna go to these countries and get as much gold out of them like the Spanish and Portuguese basically went and Their primary focus was on war materials and particularly gold and silver The Dutch were traders and they they were the facilitators of trade throughout the world so what happened in the end is that Spain in spite of discovering all that gold got poorer and poorer and All the money all the gold Actually flowed to the free markets of the time relative free markets of the time and that was to Holland in England They got super rich a Spain and Portugal got relatively poor Just interesting natural resources don't make you rich Tell that to Putin and the Russians they still haven't learned that this Anyway, I digress why did I got into the history of the Netherlands because Netherlands is a beautiful country an amazing country But I wonder why it's so agricultural. I wonder if there's some Something in the regulations something in the way Agriculture is regulated in the Netherlands that makes it maybe it's subsidized Maybe they don't allow corporate farming. I you know, it's just interesting anyway massive demonstrations thousands of farmers in front of the Hague are all through this year So this started in February and he's been continuing and yet You know, there's There's little Little that the government is willing to do and a lot of farmers are gonna go bankrupt A lot of farms are gonna shut down and the remaining farmers are gonna are gonna have a harder time making a living It's interesting that 70% of the product that is that is grown On these farms including the chickens the beef and the and the and the prigs In the milk and the cheese 70% of that is for export and And part of the thing that the environmentalists are saying right is the attitude that we export 70% we export the goods And we keep the rubbish wait. We keep the pollution but of course, you know you manufacture manufacturing has waste But manufacturing bring in brings in capital it brings in livelihood so I Mean this perspective is that's always the case The waste is where the stuff is made, but there's a big push now for agriculture to be local Not to export not to import food should be local Part of the big move against globalization and global trade so Farmers are protesting and again, we're gonna see more and more of this because The environmentalist movement is not interested in human beings It's not interested in our prosperity. It's not interested in our livelihood It's not interested in making our lives better. It's not interested Ultimately in making the word cleaner for us or safer for us What they want to do and and you can see this in Germany, and I think the most the most I Mean the most strongest expression of this The strongest expression of the fact that environmentalists don't care about human beings.  They don't care about any of these things and the biggest indication of that is That they're anti-nuclear Because think about it right now There's that big there was a heat wave that went through Europe and a lot of people died of heat stroke By the way, I think it's like five times more people maybe ten times more people die every year Because of exposure to the cold then due from exposure to the heat It's even though a lot of people died this year because of the heat in Spain and in France In other places around Europe many many many more of them will die if there is a You know really really cold front and a real blizzard cold for human beings is far more dangerous than heat But what is the solution? To heat and and look even if even we do everything in the environment is safe And let's accept all their models and let's accept that the world is heating and we have to stop using fossil fuel Let's say we stop fossil fuels tomorrow Their models don't predict that we're gonna get a lot harder So what about all those people who are going to die from the excess heat? Do they care? Of course not They don't care one aorta. They don't care about human beings Because they did they would be the biggest pushes the biggest cheerleaders for nuclear power For massive investment in nuclear power in nuclear power in enough nuclear power To be able to provide a conditioning to every human being on the planet earth At least in Europe where they live the Europeans of them I Mean the solution to heat waves is a AC It's a see everywhere. Let's get electricity cost down. Let's make them cheap and let's make the electricity ubiquitous. Let's make it electricity so abundant That everybody has as much as they want of it and then everybody has a see So why is it then a problem of the globe warms a little bit or a little bit more? I mean as I've said before people live in Las Vegas in Phoenix, Arizona in Tijuana and Guadalajara, Mexico places that are hot really hot so innovate in the production of electricity not solar and wind intermittent Unreliable don't work at night Which is absurd Thank you for listening or watching the Iran book show if you'd like to support the show We make it as easy as possible for you to trade with me. You get value from listening. You get value from watching Show your appreciation. You can do that by going to Iran book show dot com slash support I go to patreon subscribe star locals and just making a appropriate contribution on any one of those any one of those channels also if you'd like to see the Iran book show grow Please consider Sharing our content and of course subscribe Press that little bell button right down there on YouTube so that you get announcement when we go live and for you Those of you who already subscribers and those of you who already supporters of the show Thank you. I very much appreciate it


Hello, everyone. Thank you for coming to the talk. So about four weeks ago, the NPM package manager released a public beta of our provenance feature using the six store project. And today we're going to go through and talk about what that looked like, what we learned along the way, and what we hope to see in the future for provenance in the open source ecosystem. I don't think we could fit the dozens or maybe hundreds of people who participated in this release on this stage. So unfortunately, it's just me here today, but I wanted to start out just by saying that this work would not have been possible without the six door open source project. It's key to the NPM provenance feature as we'll describe later in the presentation. But this particular implementation that we've launched so far is for the NPM package registry and works on GitHub actions. We are working with other partners to expand this across the open source ecosystem. And then of course this work would not have been possible without the work that happened beforehand with the in total project and also the salsa specification, which really inspired this concept of build provenance build integrity and supply chain security. Okay, this is what it looks like. It's a very short talk. No. So NPM build provenance ties an NPM package back to the exact source code exact commit in the exact build instructions that make up that package. So here this is the example for the six store JavaScript package. And this is what it looks like if you go to the NPM registry and look on the website. So this feature is powered by when you build on a cloud CI CD platform in this example that's GitHub actions. And we also publish the information to a public transparency log for monitoring and auditability purposes. So we're going to talk a little bit about what is provenance, what we built, and then what we learned along the way, starting of course with what is provenance. So the somewhat visceral analogy that we like to use is you're walking down the street and it's a hamburger lying on the ground. Are you going to eat it? Maybe you would maybe you wouldn't but the first question you're going to ask is, where did it come from? Right, you want to know the provenance of the hamburger. So that's exactly the case for open source projects as well. We already have this concept of maybe looking for social proof. How many stars does the project have? Are there other companies we respect that use it? Maybe we're looking for a privacy policy or a security policy. We're trying to determine the trustworthiness of open source component. Today in open source, there really isn't a connection between what a package claims it contains and what it actually contains. I'm sure someone can put in the read me. Here's a link to the source code. Here's how I'm building this, but they can't prove it. And so the reason we undertook this work is to have these verifiable links again back to the source code and the build instructions. Fortunately, we did not have to invent this concept ourselves. The salsa specification has evolved as we've been working on this project. This is the 1.0 specification that came out about a month ago. It's been a busy month by the way in open source supply chain security in a very good way. You can see it for yourself if you go to salsa.dev. But these are the different levels for build security. And so if you're unfamiliar, the salsa framework is an attempt to take the problems of supply chain security down to a framework describing the sort of concerns that you might have and giving you sort of a capability model to say, crawl, walk, run, how would you increase the security of these different elements? So for build L1 is that any sort of provenance exists. Again, this could be a link in a read me. It's just, you know, someone says this is the source code. It's better than nothing. The other thing is that it runs in some sort of trusted environment. This is something we're going to dive much deeper into in a little bit here. And then L3 is where it really starts to get interesting. We are saying that not only does the provenance exist, but it's verifiable. It's very difficult for attacker to forge. And this is really what we want to get to. It's not enough to say, okay, yeah, it's probably the source code is probably built in this way. It's going to be able to independently verify that people are doing the things that they claim to be doing. I like this slide for a couple of reasons. So this is just a different view of provenance. So of course, there's the nice shiny box on the NPA website. That's great. But if you look on the transparency log, this is what you will see in terms of provenance. All the same information is there. The package, the hash, a link to the URI, the source code. The entry point is the build instructions. But it's just, you know, this is the programmatically what you would interact with to receive this information. And then the reason I like to show this slide is because it's showing here again how we're building upon existing standards that have been developed in the community. This is an in-toto documents. We're using the 0.2 version of Salsa. We will update to 1.0. We just haven't had enough time to undertake that work yet. But we're not trying to, you know, come up with this on our own. We're really trying to leverage the standards that are part of the Linux Foundation, part of the OpenSSF, and bringing together this concept of provenance to be an industry-wide capability. Okay. In detail, what does this look like? If you own a cloud CICD platform, or if you own a program language package manager, how would you provide this functionality? I'll admit it's a little complicated. And I forgot to mention on the earlier slide, my role in all of this was as a part-time program manager, even though I'm an engineering by training. So I'm going to do my best to walk through the description of what this looks like. Going back in time a little bit, before we undertook this work, a lot of cloud CICD providers were adding in a OIDC token to uniquely identify a workflow, a build that was happening on their platform. The reason they did this wasn't for provenance. It was so that when your build was finished, you could assume into a cloud provider and do a deploy. But what we, the ecosystem noticed is that a lot of the information contained in that OIDC token is exactly what we would want for build provenance. So we, with a few exceptions, and so we worked with the GitHub actions team to add in that additional information. And then the other thing that we wanted to be careful about was ensuring that this was as easy as possible for people to adopt. So the NPM publish command already existed. What we did is we added a flag to it, dash dash provenance. And so when you include that flag, it will query the cloud CICD provider to get this OIDC token. It's signed by the cloud CICD provider, so it's non-falsifiable. That token is then sent to the six-door Fulcio project, along with a public key. That's a very important step. So once the build completes, you generate this short-lived public-private key pair. You use the private key to sign the build and then you throw it away. You take the public key and you send that along with the OIDC token to the Fulcio component of six-door. That returns to you a signing certificate and burned into the OIDs of that X509 signing certificate are all of the build provenance properties that we care about, along with the public key, along with a hash of the build artifact. All that information is uploaded to a six-door record. That's the transparency log to ensure that these open-source builds are happening in the open and they're auditable and monitorable. Then we send it to the registry. The registry validates the provenance attestations and then it makes it available to end users. Admittedly, it's a little bit complicated. There's a lot of different moving parts here. The real value of the six-door project is that it's creating this distributed source of trust that's independent of a specific cloud CICD provider. That's independent of a specific programming language package manager. This architecture is going to allow the concept of provenance to propagate through the open-source industry. That's our hope and dream. This is the first step towards that goal. Often we get questions about this approach. Again, it is a little bit complicated. Are we getting anything for that complexity? Yes, we're getting quite a few things. A couple other programming language package managers tried to deliver this concept of provenance in a different way. Instead of looking at the workload identity of the build script, they were focused more on human identity. I don't want to say that approach is wrong in every case, but it becomes very difficult. First, you have to strongly authenticate humans. Maybe you want government-issued IDs, and then how are you validating those? Then you ensure that the humans are securing their account. Maybe you have to enforce multi-factor authentication. Maybe now you have them require that they use pass keys if your platform supports that. Then you have to determine the human was a member of the project that they had permissions to do this action and then determine their intent. Was it malicious or not? No, skip all of that. We're really focusing here on the build workflow. We don't really care who's pushing the button. They still have to authenticate into NPM and have the permissions available to publish, but the provenance accesses themselves don't really care about which individual human is running this workflow. That simplified the process considerably for us. As I mentioned earlier, we're no longer maintaining durable keys long-term. You're generating a short-lived key pair. You're signing the build, and then you're throwing away the private key. This is in contrast to people provisioning a long-lived API token for their project. If someone leaves the project, they have to rotate it. It's just much easier for us to have the entire key lifecycle live within a single build instead of trying to worry about how long should this key exist? What is it still valid? What if someone leaves the project? That sort of thing. And then third and very important, we're distributing trust. The NPM registry already was signing packages that were uploaded to it. However, in the event of a compromise, if someone compromised the NPM registry sufficiently, they could gain access to the signing service. They could upload malicious packages. They could sign them. That sort of attack would be very difficult to detect. Now that we've distributed this trust between SigStore FullCO and NPM, even if you compromise one of those systems, you can't forge the provenance. So you could forge provenance certificates if you compromised FullCO, but then you wouldn't have an authenticated NPM user to be able to submit them. Or you could break into NPM and put your malicious package in there, but you wouldn't have any of the provenance certificates from SigStore. So by making use of these two separate systems, we've made it much more difficult for someone to sneak malicious code into these public good instances. Okay, what did we learn along the way? I already touched on some of these a little bit, but we needed to figure out sort of what our first toehold was in this problem space. So we narrowed it down to the specific Cloud CISD provider GitHub Actions in the specific package registry NPM. That is not the long-term goal. The long-term goal is that this works for many Cloud CISD providers and it works for many programming language package managers. To that end, we've been working on taking the idea of build provenance and codifying it. So you can go to the SigStore FullCO project. You can look at the docs, and we outline exactly what a Cloud CISD provider needs to have in order to be considered for providing build provenance. The whole point of this is that over time we're going to add support from our ecosystems. This is going to become a new capability in the broader open source ecosystem. So again, some of the pushback that we've received, people are like, well, okay, but why do I have to use a Cloud CISD system? I've always built on my laptop. Well, it's complicated. So my first answer is you can build on your laptop, but you can't do that with provenance, right? If you are just getting started in open source, if you're just starting a new open source project, you don't have to publish provenance on day one. We are not requiring provenance on the NPM registry. However, as you grow, as your project grows, as more people come to rely on it, you should really strongly consider having higher trust signals, just like you would go and update the README, ensure your project has a license. As you get larger and larger, ensure that you have a security policy, maybe you want to have a vulnerability reporting system. Adding provenance to your project is a step of maturity as you grow. And it's not that I don't trust any of your individual laptops. Sure, you're all fine people, but in aggregate, we have thousands, tens of thousands, hundreds of thousands, millions of laptops that are participating in build systems for open source. Long term, this isn't a sustainable way to have trust in our ecosystem. Oh, no. Okay, the emojis didn't come across, but the second thing we learned is that machine identity is greater than human identity. So imagine a robot with two hard eyes, and then there's a human below it crossing their arms saying no. I touched on this before, but it gets really messy when you start trying to figure out how to strongly authenticate a human and determine their trustworthiness over time. People join projects, people leave projects, their accounts are compromised if they're improperly secured. An important fact about build provenance is that we aren't saying that a package doesn't contain any malicious code. We're saying that we know exactly what the package contains. It's still up to you to go and audit that source code, to audit those build instructions, to ensure that they don't include malicious instructions. However, now that we have this link, we can do that. And then we no longer need to worry about how do we strongly authenticate users? What if they're in a different geopolitical jurisdiction? We don't care. The source code is what matters. The build instructions are what matters. And having a link to that is giving us this new security capability that didn't exist before. So the last thing we learned, and an area where we still need to improve our story, is that it's great that we're adding all this extra information, but provenance is really only as valuable as its verification story. So today we extended NPM audit, such that when you run this on your project, it will go through your dependency graph, and now it will additionally check if there's any build provenance for those packages. It will ensure the validity of that build provenance and then report on it. Really though, if you think back to that in Toto documents, probably you're going to want to write some sort of stronger policy. As an ecosystem, we haven't really defined what this looks like, but maybe you want to ensure that your dependencies are coming from certain organizations. Maybe you want to ensure that the projects that you're using have a common build workflow, or at least known build workflows that you've had the opportunity to audit. So today our story on how we verify provenance is a little weak, but this is an area that we're looking to do further work in so that we're not just publishing additional information, but we're actually validating it before the deploy, which is the goal here, is to ensure that the code that we're deploying is more secure. Okay, I snuck in a fourth question. How can you get involved? I'm so glad you asked. You might remember this slide. So again, there's a lot going on here. If you own a cloud CI CD system, we would love to talk to you. I believe that I can say publicly, because the full CEO repo is public, that our friends at GitLab just landed some support in full CEO, I think one four, maybe one three. So stay tuned for future updates about other platforms that might support provenance. Of course, if you own a package manager for a programming language ecosystem or otherwise, we would love to talk to you about how to add in this capability. But speaking of bugged slides, the OpenSSF was supposed to be in the middle of this. So another way to participate, of course, is to participate in these conversations that are happening out in the open. The OpenSSF has a working group securing software repos. I find them a bit confusing, but there by repos they mean programming language package managers. And again, these specifications are happening in the Salsa organization, in the Intodo organization. These groups have public community meetings. And then last but absolutely not least is the six-door project, of course. So we reached our 1.0 release a few months ago. So we're done. No, we're nowhere near done. There's quite a bit that we want to do to extend this. As the Salsa specification evolves, they're very interested in not just build properties, but also source control properties. Think about where all your commits reviewed, where all your commits signed. You know, we would love to figure out how to get that into the Intodo specification as well. Support those sort of properties as well. There's a ton of work to do here. And we would love your help. And just a final thanks to all these projects for all their support in helping us launch this feature. Yes. I think there's a microphone next to the projector. And then what I learned is near the bottom, there's an on-off switch that might help. All right. So you mentioned that all, that it's not, the provenance isn't validating the contents.  Well, it's not validating again, because NPM publish is just uploading a tar ball. So I can build on my laptop, upload the tar ball from anywhere, and then publish with provenance. And it works just fine. So that tells me that the only thing provenance is determining is where I published from. And so I'm curious if you could elaborate on the value of knowing where I published from, since the GitHub actions logs expire or can be deleted, like, that's not really useful for investigations. Are you aware of any NPM incidents that provenance would have prevented? Okay, there's a lot in that question. So let me start with why you can't build on your laptop. So there are a couple of different modes that FullCO supports. One is users authenticating from their laptop through like an OIDC web login flow. This is really popular for a Git sign, but people want to do commit signing without managing their keys for a long period of time. The providers for build provenance are not those, though. It's only Cloud CICD systems. And the reason for this is because we don't have a way today to attest to the security of your laptop, but we do have the ability to say, okay, this Cloud CICD system exists. It has these security properties. We know it's using a fresh VM per build. We know that these build instructions are what's executing. When a laptop, we don't have those guarantees. Right. What I mean is I could make a publish workflow on workflow dispatch. I could dispatch it with a tarball URL, and then in the GitHub action, it would publish that tarball, whose contents come from anywhere I choose, and that would mark correctly as having provenance on npm.com. So I can build from anywhere I like, currently, as long as the publish is done in GitHub action. So I'm asking, since that is literally the only thing it's guaranteeing is where the publish happens, what's the value there, and what incidents could that have prevented? Yeah, so then when you went to the provenance for that package, you would see when you linked to the build file that it was just uploading some tarball and saying that, yep, here's my log. The log of that expires after three months, and I could manually delete it, so that link wouldn't work. The build logs would be deleted. The build script would not. You could manually delete it from the repository, and then we would remove the provenance from the website. But on GitHub actions, the log expires after 90 days? That's correct. So does the provenance disappear after 90 days? No, you're differentiating between the build logs and a link to the build scripts. The build script lives in your software repo. Right, so it's a file that you commit, yeah. In terms of incidents that this would have prevented, I do not work on the NPM team full-time. And even if I did, I don't think we talk publicly much about our instance. We did recently publish a threats and mitigation page, and I was going to include a slide to that effect. Broadly speaking, what we're looking to do here is make it easier to detect that malicious behavior has been added. And that is one of the common threat vectors of NPM is people are embedding malicious code, either in their build instructions or in the package itself. But I don't have a specific instance to refer to. You had the slide up with, do you want to go back to the flow? Yeah, and so I'm familiar with the full CO recore flow in other attestation situations. I see the provenance attestation getting uploaded to recore and also added to the registry. Is there a reason for the duplication of that attestation? That's a great question. Couldn't you just get away with having it stored next to the package? Yes. So I think there's actually, this is kind of glossing over the fact that there's two separate artifacts here. There's the signing certificate from full CO, which has the properties burned into it and is an X509 certificate that you can validate. And then there's the attestation documents, which also has the properties in it. But offhand, I don't know the way that that's validated. So I believe what's happening is that it's Crofts referencing the properties in the signing certificate with the attestation document to ensure that they are valid. So you kind of need to keep the signing certificate around in order to ensure that the provenance attestations are valid. But then when you're interacting with it, not everyone wants to pass the X509 certificate, so it's a little bit easier to interact with the Intodo document. I thought there were maybe some other questions behind you. So in the unlikely, well, the undesirable event that the cloud provider has the security issue, do you have the knowledge to be able to invalidate that period of time's provenances and say, actually, don't trust these ones? Yes. We do have the ability to invalidate provenance for a specific package if there was some known security issue in that period of time. So we don't have the ability to add provenance if it doesn't exist, but we do have the ability to take it away. That's certainly an ability we would not use lightly because it has the potential to impact everyone sort of like supply chain security. But in the provenance attestation, you know the cloud provider that was used and the time period that that build was done. Yeah, that's correct. Okay, cool. Okay, I'll be here. Thanks, everyone.


Okay, you know, I didn't know if I was going to make a video about the Mario movie. I figured it was a movie trailer I've never reacted to a movie trailer in a video on my channel But it is Nintendo and it actually is a pretty big deal It's Nintendo's first real stab at making a Nintendo movie unless you count and I do the Mario movie from like the 90s Which apparently I was the only one that actually liked the live-action Super Mario movie But they're trying it again But animated this time with illumination making the movie in tandem with Nintendo Apparently they said they've been making it for seven years and they revealed it today in a Nintendo Direct and at New York City Comic-Con now again. I really I don't think I was gonna stream my reaction to this because it's just a Movie I talk about video games But I started to realize this could really be the start of something big and It could it could lead to a whole Nintendo cinematic universe with Zelda and Donkey Kong and did I really want to miss the start of it and fill my reaction? What if it's bad think of the memes now? Yes, but we just watched it live and um Wow, I actually like it I actually like everything I am seeing here the animation looks fantastic the voice work is actually pretty good I've been going on and on about this ever since they revealed they were making this movie and gave us that ridiculous cast of characters But every single one of those characters those voice actors those people that they are hired to be in this movie have not done Character work before it's sure they've been in movies Jack Black was in Kung Fu Panda, but he was Jack Black Yeah, he just did a Jack Black voice done. Well I've done awesome and Seth Rogen was in sausage party, but he just did Seth Rogen I gotta tell everyone like he's all that these actors have only ever played themselves Whether it's in a live-action movie or a voice-acted movie, so I really didn't know how this was going to go I thought maybe they're gonna do a Jumanji thing where a bunch of these like actors these people and the Real will gets sucked in to a Mario universe, but then again It's illumination and all they do is animate it. So surely it had to be fully animated, right? So what what were they gonna do make these actors do voice acting for the first time? So they are doing character work. Yes, actually, that's what's happening and it works the animations really cool The story looks pretty much as you would expect You have Bowser going around different kingdoms I'm guessing because they're in this snow area that probably has an actual name. I'm a bad Mario fan Roasting all of these adorable little penguins very great animation with fun interactions It's already very a funny story as you would expect because I've seen the Minion movies and they are funny But I was so nervous to hear Jack Black speak for the first time has Bowser and he crushed it. I Do not The very first line he delivered didn't sound like him at all Open the gates. I could barely even tell that was Jack Black It just kind of sounds like a badass Bowser voice the next line He delivered had a ton more personality in it But it was very in tune with an animated movie version of what I would expect from Bowser and the The way they've animated the face to be your fun charming and character You know that goes in tandem with having a more natural sounding voice, but it has the Bowser grunt I do not Jack Black has taken inspiration from the character and how he breathes and talks and he's worked it into an actual Understandable dialogue, which I appreciate that a lot then the next voice that I was wondering how this was gonna work was toad and Keegan because toad is It's like it's just a bunch of these Nostral noises But Keegan even did a great job at taking the character at toad and Turning it into a voice and putting that that raspy element that that long drone of toad into the talk into the speech So again there We have a great Voice-acted version of toad from an actor who usually doesn't do voice work But these actors are taking inspiration from the Mario universe and implementing them into the characters, which I love And then you got Chris Pratt now How is the one we were all worried about right like what was he gonna do like I don't think he could do an Italian accent That would seem a little weird. I mean Charles Martin a does do an Italian accent, but Chris Pratt doing one I just don't think as a society. We're ready for that So there was talk of him doing a Brooklyn accent instead and having Mario be from the streets of New York and I Did react to this live and my chat and I had a little bit of debate about whether or not this is a Brooklyn accent I don't want to act like I'm any kind of professional here Just because I've moved an hour away from Brooklyn and I've been there a bunch lately But I don't know it's just it's not that thick I guess maybe it's slight But when you have a slight accent on somebody whose voice is as recognizable as Chris Pratt because he's literally in Everything always it's just kind of gonna sound like Chris That's just Chris also the delivery of the voice line. I feel was a little flat It's not even got that much excitement in it like he's going to mushroom Kingdom and he's just going Mushroom Kingdom here. We come And that's I think to be Expected like I've seen a lot of what Chris Pratt has done and I yeah, I kind of I kind I kind of just expected this I think it's a little bit more as my someone in my chat said uncanny Valley 2 because you have the whole Mario universe here You have characters like toad, which is not a humanoid character. I mean kind of but not really it's a creature It's a thing you have Bowser is a thing penguins are a thing all these things are talking with these very Animated cartoony voices even so much to as to try and incorporate the video game versions into the voices And then you have Mario who's changed. I mean visually this is on the animation the animation has made him look more human They've changed his face. It looks more like a Cartoonie version of a real guy not like whatever Mario actually is so now all of a sudden you have that character in this world Which is already a little uncanny Valley, but then you just give him a normal speaking voice Just a normal Chris Pratt speaking voice So it feels immediately jarring But then something that we went back and we talked about and we thought of is this trailer shows This Mario landing in the mushroom Kingdom for the first time he even says where am I because look he's like never been There before all right. I think we're on there's something. Yeah, he's never been there before that is actually how Mario the games started with Mario and Luigi coming through a tunnel and entering the mushroom Kingdom for the first time And they're not from there. They they land there. They they live there now, but that's not where they started So I do think there's merit here to the story and we're gonna find more about this later But maybe this is like a human character Maybe he's from New Donk City or maybe he's from the real world and it just like things are kind of more normal there And they just kind of talk like humans and he's been sucked into the mushroom Kingdom And now he's a human in the mushroom Kingdom and as much as this voice is jarring to me right now Or maybe to a lot of people for anyone that is worried I think when you see that and if that's the case and the pieces get put And I it seems like it is because you see him landing in and being confused and go in a mushroom Kingdom for the first time I think when you have the whole story given to you and you see a bunch of real characters in like New Dog City Or maybe even the real world which I doubt I think it'll be animated still but animated more realistically Then sucked into the mushroom Kingdom You'll be along for that ride and now suddenly Chris Pratt just kind of sounding like a slightly Brooklyn Chris Pratt But won't be nearly as jarring because you kind of understand a little more what's happening now as opposed to this first look Where we've seen the opposite. We've seen the mushroom Kingdom. We've seen Bowser. We've heard their voices They sound cool. They kind of sound better than we expected and then oh Yeah, that's Chris Pratt so I'm holding a lot of judgment out on that but overall Wow, I think that actually was very cool. I can see this being a super successful movie if not just for kids I mean that's obviously where movies like this are targeted towards anyway Doesn't mean adults can't enjoy them like Kim and I watching the minions the other day clearly a kids movie But you know we get a chocolate and we get a laugh and with this the Nintendo movie the Mario movie We get to see our childhoods be brought to life on the screen for essentially the first time. Oh wow Whoa, he looks kind of cool kind of weird. We didn't get to hear Charlie day We saw Luigi at the end for a little bit. I'm gonna assume that he came along for the ride with Mario So he probably sounds like Charlie day and they're not doing character work either I'm sure putting on a little bit of an accent, but he already has that Philly PA accent, which is Very adjacent, but not only that Charlie day kind of just Sounds like Louis. I don't know when Charlie day already has a very interesting voice And Charlie day is an incredible actor so I Definitely excited for that and then to see all the other characters do their versions of the mushroom Kingdom Characters and yeah animation looks great story looks great. I am surprised by this one I truly truly am I think this is gonna be a great movie any way you slice it man I spent hours of my life stomping Koopas. Oh my god cringe. All right, everyone. I Appreciate you guys. I wanted to give my thoughts on it because I actually had a lot more to say than I thought I did I'm gonna be live tonight on twitch So if you want to watch that come and hang out. I love you guys I appreciate you guys and let me know what you thought of the movie. Let me know down below I have a new video like tomorrow morning. So Watch that too. I actually like to direct for once Wow


The Labour Party in Edo's state have called for the SAC, the Chairman of Independence National Electoral Commission, Ainek Mamoudiakubu, and also accused the state government for sponsoring election violence in the state, following irregularities they observed in the Saturday's 18th-match state assembly elections. In the process of briefing journalists and the party's secretariat in Benin City, the state capitol, the state chairman of the party, Kelly of Balloy, revealed that the election was mad by lots of electoral malpractice. The election was completely mad with severe irregularities, where indeed we considered very imperative to make mention of them so that the agencies could sign, we take note and do the needful. There was heavy supply of funds and vote by excel unrestricted, and of course these are agencies that do not portray democracy in good light, and why we are still having all of this is quite surprising to the Nigerian people, especially those of us in Edo's state. The expectation is that by now Ainek would have grown beyond the level of stepping questions in terms of electoral matters, but today is so abysmal and we think that the governments of the day stay in charge of this country, should know that they made mistake in appointing Mahmoud as the empire of Ainek, and even as we speak, it's possible within the past of the federal government to terminate his appointment immediately.