we want to make sure the researchers are properly credited for that and if we are going to go forward with disclosure which we're currently doing in a limited standpoint for anything that does lead to a CBE we want to make sure again that there is full coverage for that, fixes are available for customers both for github.com and github enterprise server so from there figuring out payouts and touching on this a little bit more and figuring out severity rankings whether or not you want to use CVSS or some other framework for it or if you want to do things yourself so we have opted to use our own threat model for this we think we have a pretty good understanding of how things affect us and our customers rather than a genericized approach like CVSS and the key part of that is that as we figure out these things in our ecosystem we want to understand we want to understand the actual risk for it so we've certainly seen some cases of vulnerability that you plug into CVSS and it's a 9.5 or something but when you actually apply it to exploitability and impact for something like a SaaS offering specifically for github.com it may be significantly reduced so we'll use this as a sanity check certainly if there's tiebreaker stuff as we go through and deliberate things as a team we can use this as a sort of a sanity check or a reference point for it once we've got through all that we'll figure out how to not screw up disclosure this is much trickier than it may sound if you haven't had to do this before I've been on the receiving end of it from a bug I can't overstate how tricky this actually is to line up one of the first things I'll note because there have been some really good examples of this in the Twitterverse lately is that the more you work in public for a bug bounty program or really anything I suppose the more open your staff and company are to harassment and scrutiny there's a great example with bug crowd a couple days ago you can poke through Twitter and I'm sure you'll find it but overall cracks will begin to show quite quickly for it so you want to make sure that you are putting on your best face for it you understand what the implications of all this stuff are and how it's going to affect the rest of the ecosystem as well certainly if there are other products out there that have similar technologies underlying them make sure you have opportunities to collaborate before things get fully disclosed so right now we are doing limited disclosure which is sort of a summary for reports and then a researcher provided summary for it as well along with severity payout and timelines but not necessarily all of the back and forth and not the original report that has the exploitation details some programs opt for what would be called full disclosure with Hacker 1 which is absolutely everything that goes into it so that's a we do want to find a way to share as much as is feasible for this I talked about some of that talked about limited disclosure with Hacker 1 every platform has some sort of tool for this is not specific to them but the key thing is everyone of course always wants more right the more details you have out there for this stuff the easier it is to hunt on equivalent programs or basically contribute back to the overall bug bounty world so we are trying to move more towards more disclosure whether it be through full disclosure or just more reports in general rather than just CBEs so we are going to see how that plays out over the coming time but certainly if you've got experience working with this I'd love to hear from you and chat about the pros and cons so feel free to come up and chase me down after we're done here but shifting gears a little bit into some of the other areas that are a little fishy for bug bounty programs is of course fishing this is something that's out of scope for virtually every program out there we're no different for that but it doesn't mean it should be just flat out ignored whenever you're looking at fishing stuff the key thing is to understand the difference between a mechanism that might enable fishing and one that requires fishing so if you look like a CLI tool or really anything if you run a command and you expect it to do something it should do that thing if you run a command and it does something else because some very very plausible legitimate scenario has taken place like another file in the right path location and it now does something malicious that's something you can defend against and that's where we look at this as a defense in depth opportunity we want to find a way to improve that and it's a safe guard flip side is if somebody says hey just run our MRF slash no preserve route like that's a you problem that's not something you can necessarily protect against technically we've approached this and we've seen a few other programs do it as well as this idea of thank you payouts so it's something that doesn't necessarily register on what we consider low severity but it's still something we want to acknowledge it this is a good finding but not necessarily a security threat we are going to take some sort of action on this a small award whether it be swag or you know a smaller cash award than our minimums would normally be. And really the takeaway from this is Murphy's law right if there is a way for somebody to do something wrong they're gonna do it wrong so if you can have secure defaults it's always always preferable and that's certainly not to suggest that we're perfect nobody in the world is for this stuff but something to strive towards and really why we've adopted this type of setup. Another question that comes up quite a bit usually from from sponsors for this is why would you implement a bounty program instead of spending that money on red teaming or external pen testing or more lawyers right and the biggest thing is it's it's not an instead of this is an in addition to when we talk about defense in depth this is one part of a much bigger picture for all of it and the way I like to describe it despite this having been thoroughly disproven I think by science at this point is if you can have a thousand monkeys riding Shakespeare you can have a thousand security researchers finding some gnarly bugs you're opening things up to a world of eyes that otherwise might not be there and if you can incentivize that through ideally having a very good responsive transparent program or having a lot of money or both it makes that a lot easier. So one of the other parts of this in terms of having eyes on it and fitting the best of both worlds here is looking at opportunities like invite only programs BIP programs live hacking events you know a lot of this does come with budget but there are ways to get around that in many cases but what this lets you do is attract very specific groups of folks to look at very specific things so where it may be a lot of back and forth to engage with another company to do a deep dive on you know code spaces for example from the last presentation if we can say hey we want to get 30 people in a room as part of a live hacking event and here's some extra cash bonuses if you're able to find you know I doors or crits or something on code spaces we now have an opportunity to do that and people are flocking to come into those events and even if they don't normally work on our program or maybe even on the platform there's still possibilities to pull them in so that is one place where we're working with somebody like hacker one or bug crowd or any other platforms can be super helpful for it but for us specifically between invite only programs where we've found folks who contribute frequently high quality stuff to our program or live hacking events we've had great success for this shifting gears to internal and I say internal internal to me bounty as a way to learn I think this is something that's a little bit underrated as an entry point into the security world similar to my you know I mentioned I have a background in support this is a great way to get new perspectives on things if you have a background in engineering you're going to be using all of those skills but you're now putting a security focus on it if you have a human facing background you're now taking that because you're still doing that and building that security expertise on top of it and if you're already in security you're now building external facing expertise where you have to be able to communicate these things back and forth and really negotiate do a lot of negotiations with internal groups that are part of it if you're coming in reasonably new to the the overall security or engineering world is you're getting access to a lot of stuff that you otherwise wouldn't have access to I've worked at and with companies where it's unheard of for support folks or really any customer facing folks to have access to source code for a product certainly not the case for us but you know when when you're working with these problems having to debug them having to understand severity do investigations you're getting your hands pretty deep in into these things and working working with the experts in in these different areas similarly for understanding systems architecture you know I think there were some some great talks earlier when you're going through and taking a look at a vulnerability it's it's almost never hey I this API is vulnerable it's this API is vulnerable because the message that's going to that is coming through three or four other places and we don't have full lineage on it you know whether it be privacy stuff or deserialization vulnerabilities whatever there are many many ways to dig into this and lastly looking at engagement with other teams and companies you know I've certainly had no shortage of working with different engineering teams to dig into this stuff external vendors and whatnot and I think that's true for for most stuff in in this world and I think I look at that as a big plus that certainly comes with some some fun sometimes so moving into the what I call the picture slides for this the takeaways for folks this one is is for anyone who's looking to submit bounty reports again this is to us or or anyone else there are a few key things I'd recommend the first is treat your bounty reports as as UDP traffic fire and forget send them off if it gets looked at that's fantastic if you're going through and doing constant bumping on reports if you've been on the receiving end of that where somebody's falling up by email every six hours you know it's not a great way to really get attention if you're looking to bump stuff once a week or so that's that's usually pretty good but in general what I've seen especially from the folks who are pulling in a lot of money they will put in very high quality reports send them off and let them be if they need to follow up they will and if they don't they won't next is to have a pretty good understanding of what you're reporting there's a whole lot of cases where you know if there's smoke there's fire so if you see something say something absolutely nothing wrong with that if you are looking at submitting stuff and you think there's going to be a bit of back and forth around it it's really helpful to be prepared for that to have an understanding of what you're looking at key example I'll give here with GitHub is we have an import function that can pull stuff in from other source code repository providers or even on-prem stuff and we get reports probably about once a week talking about SSRF vulnerabilities with it because you can provide a URL and then GitHub reaches out to that that's exactly what it's designed to do so understanding that context can be can be quite helpful both for you making sure you're not wasting your time but once a report goes in you know if you really need to push something through you you can do that next up is when you're looking at submitting with any program you know understand the scope that they have understand the rules they have around disclosure where information needs to go nothing is worse than having a report come in with some pretty gross stuff and somebody then realizes that it's in you know paste bin somewhere else that they've tried to include stuff so not not a great look for anybody at that point because now you have a security incident in addition to a bug other part of this is you know if you're looking to work with programs long-term we have a lot of folks who come back I think for a lot of bounty programs out there there's a lot of people who have a lot of information about how to repeat I say repeat customers repeat submitters it's really helpful to understand that you know of course there are humans on both sides of this relationship so if there are ways to sort of understand how people tend to approach reports on both sides if there's stuff that is generally asked for that maybe not part of the program whether it be video POCs or scripts whatever if you can come armed with that it's going to save everyone a lot of time and generally builds things up from there and the last one which I think is the most important part of the program is to be able to create avoid bullshit you know we talked earlier about understanding or at least having a decent understanding of what you're submitting if you're sending stuff in just to say you've submitted bounty reports it's not particularly helpful a lot of programs will actively punish this not and whether or not that's up to the program owners is a different story I would generally encourage folks to be lenient with closure states for reports but looking at what you have to have to be able to submit reports so if you wind up getting dinged for sending stuff in through a program that's maybe a bit less generous around those closure states you can wind up just nuking your career before it starts on that. Shifting over to folks working on a bounty program because I know there were a few here which is nice the key thing here is to remember that when researchers doing well in your program you know when they win you win if you can continue to incentivize folks to come back and make it worth their time and worth your own time to deal with that it's good for everybody at that point. And next up talking about closure states and what not is the more you can help folks to grow especially if you're working with a program that gets a lot of let's say less experienced folks submitting reports if there are opportunities to contribute back through those reports that's a great way to do it. I mentioned punitive closure states with some of these platforms we use something called the informative status on Hacker 1 which basically is no reputation hit if you submit a report and we say hey it's invalid whatever a default might be to put that as not applicable which will be a reputation hit we will tend to opt for informative for it which is no reputation hit and we always try to give a sort of a quick explanation as to why that's the case so if you send something in with that SSRF scenario I talked about earlier we're actually going to provide an explanation of why we don't consider it to be a vulnerability or a problem in general so again if you can keep folks coming back through that way keep educating them everyone sort of comes out better there. As a person working on the program as well do your own research around this understand the vulnerable surface that you have understand the trends that are out there understand the attack vectors it's going to speed things up for everyone if you can get reports coming in and we know what to look for as soon as those land that can be incredibly helpful and the last point on here and I can't stress this enough is be professional similar to being on the submitting side and not wanting to try to baffle people with bullshit that goes two ways you are I say this being on stage talking about it you are the face of your company just like working in support or working in sales or working at the desk at a store if you say something or do something that represents the company almost more than it represents you so if you are you know if I come up here and say something that's just wildly off color it's not necessarily Logan said this it's GitHub said this so keep that in mind. And last up this is for folks who are actually running programs because I know there are a couple here thank you for what you do you make this possible for all of us but biggest thing here is you know you utilize your program as a way to refine your program and to work with your broader security teams for this stuff take a look at where your reports are coming in what types of reports you're getting and use those to refine your operations your secure SDLC all of that and certainly and this goes for everyone you know try to be as honest and fair as you can for things if there are scenarios where your program has had a screw up or you know maybe you've closed a report only to find out six months later that it was actually valid do the right thing look for opportunities to reopen those communicate with the original researcher make things right as much as you can it doesn't take long to go on to bug bounty forums or something and find some horror stories about programs that have absolutely botched this I don't don't know and I don't think our track record is absolutely perfect I don't think anybody's is but the more you can strive to go in this direction the better. Similarly looking for opportunities to collaborate internally the more you can reduce the friction for engineering teams wanting to be in scope for your program the easier it's going to be to run because you'll have a very clear definition of your scope as well it's not going to be a case where you have to constantly go back and forth to understand if something's in scope if your default is that it is in scope and that you have ways to then reach out to those teams. Another part of this as well is to look at opportunities to bring things in looking back at invite only programs VIP events if there are ways you can build that into a beta for it's something rolls out if it's right before release if you can feature flag folks into that so they can start hacking on it before it's necessarily going to be out there in the wild affecting customers one that's a great perk for VIPs because they know they have limited competition for it but two it also lets you ship a more secure product when you get to that point. We already talked about this understand trends technical and non-technical if there's stuff that's going on out there whether it be log for J or the next one if you can help prepare your company and your teams for responses to that making sure you've got things in place to be able to follow up quickly it's super helpful and yeah on the non-technical side as well understand if there are big spam issues or something that are coming in for your platform or your program again if there's ways to streamline that just reduce stress for everyone. And lastly look for opportunities to grow your program and attract researchers if you are brand new into this space building a new program start out small look to build up from there but again be very clear on your scope so there's not a lot of confusion for folks and certainly once you have folks coming in try to treat them as well as you can so they keep coming back and keep finding cool stuff for you. If there are opportunities to do live hacking events or promotions whatever through bonuses for new features things like that certainly encouraged the feedback we've gotten from folks working on our program and other people we've spoken to with other programs is really the more you can sort of target things, hype things up and deliver on them the better off everyone's going to be for it. So with that hopefully everyone got pictures of the picture slides that is wrapping things up if you do have any questions around any bounty stuff come find me otherwise I'll probably be at the bar at the end of it you can find me on any of the wonderful antisocial things here but otherwise thank you and good luck with the raffle. So we're going to take a five minute break just to set it up and we're going to go ahead with the raffle and this is it for Norsak 2023. Well the conference the CTF starts. Okay hello okay so we're going to raffle some stuff yeah very exciting so the way this is going to work is we're going to read out names so if you are here you're probably on the list and we're going to ask you if your name is called out just come up here and it is first come first serve you get to pick what you want to take in addition to the nice gifts there's also these stacks of books in the back if anyone wants to learn visual C sharp 2008 please take it so any of the stuff that's in the pile in the back just take it if you feel like taking it otherwise eventually it's going to go in the recycling so it's just here okay do you want to announce the first few winners sure yeah just so we have a bunch of stuff we have a flipper zero we have some letterman we have no storage books those are new those are we have some Yubi Keys and we have a bunch of stuff so to start out we have Marc Olivier la voix one time two time Craig Duncan all right it's going to be fast Guillaume F lots of opportunities there pick your poison no pressure we also have Norbert Raskovi Hervé Bariel Flo did we already do Will Summerhill Will Summerhill okay Simran Aurora Benjamin Chambon Mathieu Boswell Leanne Dutille okay I saw her going once going twice Tufik Waganuni I am very sorry if I butchered that Jawad Nasser Brian Wright François de Varene is there a question if you're not there we all know Leanne but sorry Leanne Pierre Francois Rémi Langevin V.K. Tran Todd Stavely Louis Lavoix-Coron James Lee so is this the list from the CTF Simon Charrette Gary Pascal or Gary Robert Whitney Benoit Renault Galina Shellest Gabrielle Ruyard Felix Charrette Connor Laidlaw so Simon we're going to need new names Asha Kourgourou Asha Kourgourou Shivashankar William Adam Grenier Michael Nadeau Max Délage Marie-Eve Bergeron Touranjo Yannick Vielle Mathieu Chouinard Maxime Leblanc Rawan Morshed Felix Contant Can you do the next one? Next one I'm not going to be so lucky on Ashia Hanim Ayasur Guillaume Lacasse Emmanuel Roy Dubreuil Clinton Leg Etienne Ducharm Not scripted Where are we? Yifan John Guylain Carrier Nicolas Lemieux Did you say Nicolas Lemieux? Bradley Callender Marc-Antré Boulet Xavier Pépin Tristan Dostaller Gael Sylvain Francis Venne Tharesh Sharma Martin Proa Eti Shirley-Anne Pagé I saw it too early but... Again Guillaume F Francis Gravel St-Pierre Brandon Borodash Khaled Bra Jessica Williams Michael Laet All of you can take the prize Alexandre Provost Alexandre Laforêt Godot Jonathan Roy It's good that we don't have names that are memes Vincent Theriot Iba Moumenet Tristan Binstman Alexandre Cotessir Kevin Lagasse Deborah Roulot Genmey Fan Alexandre Ogorodnikov Eric Christensen Felix Boulien Felix, Felix, Felix! Oh no, I lost Philippe Guirégoire Richard Vannet Alain Zakour Gary Pascoe Maté Engel Or Maté Angel Samuel Aubert Woo! Michael The Wolf Damien Artoin Dario Martin Silva Guy Comtois Denis Douzgun probably butchered it Stéphane L'Esperance Orion Mock Patrick Bertiom Réda Baidoun Ok Nicolas Loic Fortin Simon Charret Jim Kearney Anais Yapobi Kevyn Mock This is it Olivier Toupin Guy Comtois Kim Schwanier Sarah Morshed Nathan Grant Clayton Smith Mitch Taylor Iba Moumenet Iba Moumenet Iba Moumenet Iba Moumenet Iba Moumenet Nathan Grant Clayton Smith Mitch Taylor Mart Sara Nankambu Chungku Lieberman Berg Alain Yamin Philippe Paré Parvin Ramizani Sébastien Bordage Are you still awake? Now I don't know where... Michael Hopper Balouan Ngouyen Norbert Labé Yinguo Alexander Amstoy Mathieu Chouinard Shane Schuster Someone Julie Petnaud Vincent Drolet Lost Too much traffic Eunice Boulphred I don't know if I pronounced that accurately Nicolas Lemieux Michael Nadeau Ahmed Abdel Wahab Jasmin Paré Philippe Crégoire Liam Rafaille Jonathan Brunette Etienne Gervais Nicolas Tremblay Stéphane Pelletier-Lamotte Neil Yousouk Charles Terrien Jack McCracken Oh okay! Orion Mock again Tristan Beansman again Sarah Hughes Henri Lebeau Dani Lafrenière Marc Alexandre Montpa Thomas Heller Anlisa de Forêt Artemis Livingstone Patrick David Patrick Davidson Tremblay Eric Tahan Alexandra Stilaire And next Do you want a prize Flo? I'm okay, I'm okay You want to learn SQLite? Oracle We can loop around Did we just get another one? We're out of names, do we want a... Okay Alright, so we're going to try something else We're going to try to throw some things Not the books So the book is going to be a later So you can come and not make a mess, please and take a book No Fight, Allowed Please So are you guys ready for receiving things? So please That's fun So I don't know how good I am at throwing Oh, sorry Yeah Okay, so that's not good That's not going to happen This is not amazing for public safety Yeah Okay We're going to trivia at this point What does CISSP stand for? We have an answer We have a polite person who raised their hand Good I didn't hear, so Honor system There's another Systems and security I don't even know the answer That's good, alright Come claim another prize Yeah Do we have another acronym? There are many acronyms in security Yeah I think Okay We're calling it a day This has been fun or not There's some books to come and get So Please So the laptop


Hello, my name is Dr. Lesha Rushkin and we are in the Ozark mountains of southern Missouri. I am a natural beekeeper. I keep bees that I obtain here from the wilderness in the Ozark mountains and put them in beautifully decorated hives like this one. And a few years ago I had a SAIR grant to create a collection of local bee strains that we have here in the Ozarks. Amazingly, most beekeepers in the United States use just a very small selection of honeybees. They are called Italian bees that are native to the subtropical climate in Europe. And these bees are being propagated all over the country even with climates that have very cold winters like what we may have here in the Ozarks in southern Missouri. What I do instead, I set up small boxes called bait hives in the trees in the spring. And just as birds move into broth houses, honeybees when they swarm, they are looking for a new place to live and they move into these bait hives. After that, I collect them from trees and I put them into bigger hives so they can keep expanding and produce honey for me as the beekeeper. It's very important to be working with local bees rather than buying bees that were raised in a different state far the south because, again, local bees would have better winter hardiness. So starting is very easy. You set up a box and the bees just come to the box on their own. And I keep repeating that keeping bees can be simpler than growing tomatoes. With vegetable growing, you need to plant the seed and take care of it and water and fertilize. And they're protected from pests and from wildlife. With the bees, all you need to do is to start with, we need the poo called the right sort of bees. In this case, the wilderness bees adapted to the local conditions and give them a good home. I have a website called horizontal hive dot com that has a free swarm catching guide. So you can read how easy it is to catch your own local swarms. And then free plans for building boxes like this one where you just transfer the frames and the bees will keep expanding. And with the horizontal hive design, there is no heavy lifting involved. It's not like the conventional hive that you see more conventionally where you have a stack of boxes. Each of each can be 50 pounds or more. So with this natural beekeeping approach that I practice, there is much less stress on the bees because I don't have to open this box often. I work only with the local strains of bees so they stay healthier and stronger without chemicals or antibiotics. I never feed them sugar. I allow them to have the same kind of natural cycle as they would have living in a beet tree in the woods. And I have a book called keeping bees with a smile. And I can tell that for me it is as much about the smile as about the livelihood or the honey and wax and other wonderful products that bees can produce. So I can tell you that I can make more from one acre of wilderness even in terms of economic return by working with local bees and low maintenance beehives that you can build yourself from some scrap lumber. I can get more economic value from an acre of wilderness land than I could if I were running cattle or growing crops here on the very dry and rocky soils of the southern Ozarks. If you would like to learn more about the natural beekeeping approach and the importance of working with the local honey bees I invite you to explore the information on the SAIR grant project that I made and also look up my website horizontal hive.com that has much more free information on natural beekeeping. If you get encouraged to get started I very much would like to hear from you experiences and I wish you all the best keeping bees with a smile.


Because I mean, when you kind of even think about it and look at artists like Juice World, it's like, I think he's at this point, they've released like three or four projects after like he's been dead. And I know like, there's been the stories of how he's like, he used to record so much music. So I know like, he's probably had so much music like go from. But at one point do you be like, let's say down the seventh, eighth, ninth project of like releases, when do you kind of think about it? Like, is this still like his dress? Like, where do you think the industry is going? Like more so with AI? AI is going to have some massive impact on the music industry for real for real over the next year, or do you think it's a little further along? Personally, what I think with AI, and this is going to be kind of a problem more so for the fans and labels. I think that like, you know how like we have like a lot of post humance releases, like when artists die, I think instead of only relying on like the songs that they made before they died, and even like just like the rust and all of that type of stuff, I think they're going to take it a step further of making records with the AI voice and the fans wouldn't know. And they will just be allowed to make, now I don't know, I wouldn't say loud, but they would just put out more projects and make more money off that artist and probably try to renegotiate deals with that artist estate to put out more projects with AI voice, but making it to where it's like, you really think it's this artist, like it really sounds like the music that they make, because the voice is already there just got to like sound like how they sound. I mean, like as far as like the lyrics and stuff and the melodies and stuff. And I think that's what labels are going to do because it's going to make them more money, but it'll be bad for fans. Bro, I'm glad you said that because I hadn't heard that perspective yet. Like, obviously, we know that there's a lot of situations with these records that I'm going to be created for sure that fans don't know, right? If it's somebody, because it could just be a random kid in the room. I make this record that sounds like Kendrick Lamar. And then people don't know that actually not Kendrick Lamar, right? But if you have a situation where everybody is in on it, all the official people, the record label in the state, then truly, the lie will never be revealed. That's crazy. That's crazy. And you know, knowing how these labels move, I do not doubt that one bit. And knowing how some of the states might be like, well, we might as well, because we own the likeness, right? We own the like whatever else is required to be able to do that. And it would technically be legal. Exactly. It's just the fans who would be mad about it. And they wouldn't even be mad about it because they wouldn't really know. But right, it just comes down to do does anybody care enough? Like, or what do you like kind of value more? And I think just generally speaking with businesses is a business. So if it makes money and you can get away with it, cool. So some artists and managers are just waiting for lucky moments when the ones who are killing it have systems to consistently take artists to another level over and over again. And if you want to see what that looks like, we just did a collab where we not only show the system that we use, that's resulted in Billboard hit some of the biggest viral moments on TikTok, Instagram and YouTube. But also we got J.R. McKee to break down how he took artists from zero to one of the biggest hit songs of 2022 and getting a Grammy in January of 2023. This is recent stuff, not old tactics. If you want to check it out, go to www.brandmannetwork.com slash Grammy. Don't forget the www or it won't work because J.R. gets into the details of looking at the data, decisions that got made, how much content got created and how they adjusted the content over time for different parts of the campaign. This is real behind the curtains type of stuff. So again, go to www.brandmannetwork.com slash Grammy. If you want to check this out and apply it to yourself, back to the video. It technically is just bringing life back to the IP because we do that with movies and other type of images, cartoons and things like that. Technically, it would just be that, right? Because all of them are art forms. I think we associate music a little bit more personally, but technically it's just that. And it's just an uneasy thing that we're probably going to have to get over. Because I mean, when you kind of even think about it and look at artists like Juice World, I think he's at this point, they've released three or four projects after he's been dead. And I know there's been the stories of how he used to record so much music. So I know he's probably had so much music go from. But at one point, do you be like, let's say they're on the seventh, eighth, ninth project of releases. When do you kind of think about it? Is this still his draft? See, that's the whole thing. That's when you get into conspiracies. They're starting to build that he works all the time. That's step number one. So it can be believable. They're trying to create it, make it seem. Wow. Wow. Yeah, man. That's a great take. That's a great take. And that would be interesting. Very interesting to see.