Everybody forced here up in 2023 prison football hobby three bucks over 29. It's a random style here. We're gonna random And rip. Good luck. Look everybody Got a nine Spencer's gonna have a rough time F3 to screen share one two three four five six seven eight and nine Ricky down to Harper and The teams nine times one two three four five six seven eight and nine Niners down to Browns. So this one. I just always have open I'm just gonna f5 to refresh and that's what I just did. I'm gonna click both of them to open them up Be right there. I'll highlight it all Ricky Niners Harper commanders Alexander has the Titans Garrett the Jets Tyler Z Rams Jason. Oh Cowboys Barry G Jaguars Robert B bears Gordon P Giants Jeffrey M Seahawks Nicholas Z Vikings Eric L Packers Gordon P Lions Jason S. Bucks James C. Pats Eric E. Cardinals That is you do what with the bills Nicholas S. Colts Raymond M Broncos Nicholas Z Ravens Ricky S Eagles branded as Chargers Barry G. Dolphins Falcons Luke S. Steelers Sean M. Bengals Ronald M. Chiefs Bruce B. Saints Ricky S. Raiders Nicholas Z Texan Simon M. Panthers Harper with the Browns Troll a again control C to copy F2 for main screen Then now that I already typed in and set the visibility and then the results I just paste and hit save Yes, you just set everything up before and everything's pasting. Yeah, and so When you hit the save it's out public or it's not like on the site. I can click the view real quick It'll bring it up. I'll grab the link right there Right there. So everybody has it. There's results guys. Yep. Anytime leansportsgrads.com. They are available to y'all Or click the link there and links in chat if you do see it again Niners Chiefs again, dude couldn't have gotten that at least one of the one of the one of those teams to lose Blue Wave Berks the 199 Titans Tank Del rookie Chris Rodriguez All right, when can I bet on the coins off? Are you picking tails or heads heads? Silver Minka for the Steelers green scope nice Jameer Gibbs Lions rookie that a 75 50 of 75 That'll do right there. Aiden O'Connell rookie Washington Orange number to 249 Patriots rookie Christian Gonzalez We've got Hull and tune Silver rookie Saints Isaiah Foskey time for baseball Harrison blue rave rookie to 199 Zach Evans Rams I'm kind of feeling that way too. Oh And then hooker Joey Porter Jr. Spring training I heard a 175 James Winston for the Saints Silver fireworks price young Panthers red wave to 149 Hamlin for the bills. We're not cool a rookie Truly sorry Jace they blew it They blew it Sorry, Jace orange to 249 Josh Reynolds. That's the that's the man right there to 249 The man that doesn't have any hands Look the hands at home Everyone's gonna feel bad for Jace no one's gonna feel bad for Spencer Spencer suburb Patrick Queen Ravens Gates out of 99 blue ice autograph That's cool one for the chargers for an Addison and Maisie Smith The Jets are going to the Super Bowl purple CJ Stroud 2125 Out of a three box.  I last break too. Oh Jolarian shorter big one for takes Sean might bring up the Lions losing to Spencer so much dude Chiefs MVS on the silver green scoper. Mondrade is 75 for the Patriots Jones and a Richardson rookie. Yeah, the way I'm like, definitely and it but like the way I'm flipping through is is like How it's got to be pretty much. There's a Bijon on the flashback orange the 249 curse for the Titans Or something like yeah, cuz like I do I'll show you I do a weird thing like I kind of go Like downwards almost which is fine silver prismatics the fondigs for the bills And a 75 is Leroy Kelly on the auto What would Sam do Leroy? Kelly Sam will like how does Sam put their part? This it's definitely different than like He'll like It's a lot of it's a lot of motion You'll have to like you have to now that I said it. I do that way about left-handed.  He'll do this Hyper rookie Derek Hall to 175 Seahawks I'm not telling him he's wrong. It works. It works for him vision Robinson rookie But there's lots of different ways it hit 300 folks but the the preferred way is to just like All in one like go there silver for the bucks is Chris Godwin For she writes rookie auto chiefs nice hits nice Sam LaPorta Devon weather spoon Opening packs is another thing. So like Sam will open it like this and you'll like see the back card I'd like try to hold it like this You don't want to reveal the cookie Right, not that it's super important in like prison because it's just the base rookie. Yeah but Certain products that last card, you know, rookie silver Brian branch of the Lions purple rookie to 125 is whether sweet for the Seahawks What Kim Andrew you're trying to do Cole? But they're shooting 125 Okay, that just means what? I was going cool You just teaching me how to open up the cards here That's all it's that's what you're referring to Blue ice the 99 is as Campbell for the Jags I try to teach Sam how to go through it like that But he just likes to do the action movement is nothing else. It's safe. He's a good breaker But like he does like this. You guys know what I'm talking about. Yeah, yeah, there's a gold vinyl now It's a cold vinyl now as you as you're doing the same technique Aaron Rogers fireworks gold vinyl That is fire Two of five Prism is hidden right now. That's a jet to prison be hidden right now Yeah, the jets purple ash Ricky Harrison a 225 falcons jets jets jets That's right. Hey, go pick Lee tell them Take the points, dude. Yeah, that's what I said as soon as it happened I was like what what's going on here? Like you're like 14 and you want to go for a fort down in fuel orange The Dutch are going to Superbowl now. That's that's how you flew momentum right there Blue eyes chase young got a 99 commanders. I'm all for going for a fort down when it makes sense, but yeah, dude go up by 17 and Then you had another chance. It's high the game with a field. There's a lot of clutch Don't hand it off to March on that. Just do they Dan Campbell themselves out of it You know, I'm so excited for the halftime show I'm probably more excited for like the halftime show of the commercial the game this year for us sure Is it us sure? Yeah, never mind then. He's okay. I like this. He's a holder now Yeah, orange the two 49 Ricky ties a spear to the Titans But I get it because it's like you got to get the guys that were popular 20 years ago Because all those people are the big consumers now and yeah, it's like our age the ones you're pushing ads to 30s 40 And the 30s and 40s Who had the Jets? Jets was Garrett Purple I say 225 Skymore chiefs Garrett L. I'm Smith and ETR. It's a different conversation if they make it I guess hindsight's 2020, but When you're up by 14, it's like, all right. Well erid on to the 199 for the Rams a Momentum the momentum that you would gain from getting the first down is not as big as momentum You could cause the other team to get by stopping you and that's exactly what happened. I'm your Gibbs Woke up the sleeping dog, dude That's right bond hockey and basketball till baseball. Do you might as well a Steve young the 75 franchise legends auto as the Niners are going to the Super Bowl for the first time in 12 years Evans and Jones Man, maybe they'll win it this time in Miami two straight Superbowls Silver Thompson for the Cardinals that's supposed to that's real barely even counts Hyper to 175 for the Bengals We all had pre-COVID brain every single years in the AFC championship Super Bowl odds are live go go go go go Silverators Jimmy Garoppolo purple eyes put a Baker out of We think it'll be It's like an automated response Spencer has a PR team bet against the Sensor hired a PR team just for this moment get it together Here, you know what? Oh, man, crazy of a Good old Sean Michael thunder stunk 2049 Joey Porter Jr. Steelers. I know who did ball out today. They're Orlando magic Blue eyes what emergent to 99 for these Steelers purple power.  That's cool. It is Nick job for Cleveland Snake skin about one a case on those school or 99 Aaron Jones Packers Richardson base rookie definitely off-centered on that one. Oh Who's a larry holy print lines and off-centering way over Devin way over actually she wanted to be there He's heating up. She might not even be there Silver fireworks burrow for the Bengals These on on the rookie auto Falcons now Another on the flooded quite do Ride in the pine They got to have that over under on how many times they actually cut to Taylor Swift. That's gotta be a bit Silver Brian Robinson commanders hyper rookie Evans for the Rams to 175. Thanks, Jay. Appreciate you for hanging out man. Got some rest Sleep why what time is it? That's only 10? I'm sorry John Lynch bucks legends Purple eyes the 225 van der Esch Cowboys For both you rule of thumb for cards being upside down if you're gonna call it out flip it over Got a Kenneth Walker the third on the flashback Seattle purple rookie Dorian Williams with the bills Hookah Scots Now throw like base upside down not like that first chunk of the prison pack like that Yes, as long as like you can show the card like I'm going slow. You can see the image Silver rookie Jaden Reed Packers Blue ice 99 Berks Titans And then Prism is cool because you can flip through all that and then you can bring your hands in closer and have all those last few cards already like right there Like I'll just flip through back here Silver to Sean Watson a Brian Burns, that's cool Panthers auto branch and Jones rookies. Oh, yeah, the day in advance Vaughn. She can make it There will she though you can He's on their purple ice over shown out of 225 for the Cowboys. It's like 16 hour difference. I think like I'm teaching chat as well how to be a breaker I Mean Silver Austin Hooper for the Raiders blue wave to 199 Campbell for the Jags That's right Devon Nick Chubb snakeskin to 99 Watts Berks Jones young Campbell 75 Stevenson Jamir Gibbs rookie purple power is a flowers flower power right there Autos of Burns Dijon Rishi Rice Gates Leroy Kelly and Steve young you had a gold vinyl out of five fireworks Aaron Rogers for the Jets and Purple Rookie CJ Stroud number to 125 Two of 125 Monster card sections. Thanks again everybody moving on now to more prism


Okay, we're back for a live on J5L. This is ThinkTech. More specifically, this is Talking Tax with Tom, Tom Yamachika, president of the Hawaii Tax Foundation. Today we're going to talk about the state auditor that is less condo and is he on the chopping block? It was an article a few days ago that suggests that there's people that like him in the ledge and there was this long report written about him and we're going to find out today from Tom what's going on and how this affects our prospects at learning about government. Hi, Tom. Hi, Jay. Thank you for having me on the show. So what is the state auditor? And what is the state auditor supposed to do? The state auditor is basically a one arm of the legislature. His job is to go into state agencies, make sure they're running okay, that they are honest and stating things to the public correctly. That's what an audit is to make sure your financial statements are not materially misstated. But the legislators have been tasking the state auditor with all kinds of interesting assignments like evaluating general excise tax, net income tax and other tax exemptions on a rolling basis. That kind of was legislated into place during the time that Jill took Huda. I don't know if you remember her, but she was ways and means chair at the time. That was a few years ago. And those reports have started coming up.  Well, wait a minute. An auditor usually audits the affairs of government to see whether there's any funny business going on, whether our tax money is being spent appropriately, whether people are engaged in actions which are illegal or improper. But this is different. The auditor was asked to make an evaluation of gross excise tax exemptions. That's new, isn't it? That's a completely new task for the state auditor, is it? Oh, yes, it is. But the legislature has given the state auditor plenty of new tasks along the lines of what an investigative reporter would do. So it's kind of a brave new world to be a state auditor. And not only do they have to kind of learn about general excise tax, but also net income, franchise tax, all kinds of other things that we have in our tax arsenal. But when the state auditor examines their state exemption under the general excise tax or income tax, whatever it may be, is the state auditor going out there for anecdotal evidence and picking up the phone or interviewing people and finding situations and cases which the public should know about? Or is the state auditor simply looking at the calculation and the revenue and the way the bill works or the prospective bill works? You say investigative reporter that leads to the possibility that the state auditor is out there in the landscape finding abuses, for example. Is that what the state auditor has been doing on tax bills and exemptions? Well, yes, the state auditor has been tasked with trying to figure out if the legislative intent has been met and if it hasn't, then maybe we ought to be recommending this exemption for repeal. The state auditor has also been looking at non-general funds that the agencies control. That's been a staple of their existence for quite a few years now. They look at special funds, revolving funds, and so forth. Are they appropriately classified? Do they meet the criteria set in statute for a special fund or revolving fund or whatever the heck the fund is classified as? And if not, is it better to reclassify or abolish the fund entirely? So the auditor has been tasked with doing that. I mean, that's not a typical function of an auditor. The typical function of an auditor is to go and look at an entity's financial statements and express an opinion on whether they have been materially misstated. Just like an accountant type of auditor. Yeah, that's exactly what the auditor is. But there are, of course, differences between auditing a public company and auditing the government. So the auditor has been kind of tasked with going into different agencies. And to do that, they normally hire regular auditors. Like when I was at PricewaterhouseCoopers and Anacuity, we did a lot of state auditing work. And Anacuity still does that now. And let me ask, this is really an interesting discussion. So back in the day, before this state auditor was tasked with these examinations of whether a statute was working, whether a tax was working before that day, who did that? Who went out into the governmental landscape? Who decided to go out into the governmental landscape and do that? And did it? I mean, it sounds like if this is a new function, who is performing it before? Nobody? Probably nobody. Because the state auditor was created, I think, at the 78-con-con constitutional convention. And so the office hasn't been around that long, although it's been around a good couple of decades or so. Probably more. Let me do the math. That was 1978. For you and me and people like us, it only seems yesterday.  Right, it is. So the idea and what brings us to this conversation today is that last week, Thursday, there was a report that was issued by a working group that was convened by the Speaker of the House. And what the work group was tasked with is to see whether the auditor was complying with the constitutional provision that spawned his office in the first place. And there was something in the Speaker's Memo that says, basically, well, look, we know that the auditor's office has limited resources. And can this working group help the auditor prioritize the work that he's got and give suggestions as to scope of work? This was a criticism of him. It was a 79-page report. It was not kind to him. It raised the question of whether he should be removed, removal would take two-thirds of the legislature. I mean, he's under fire. In fact, title of our show is on the chopping block. So what did they claim was wrong with how the state auditor was functioning? Yeah, and see, that's kind of where the second half of our title comes from. Is this a real reporter or is this a whack job? And we're trying to figure out which this is. Now, if the idea was to help the auditor prioritize and rescope his or her workload, the findings and conclusions of this report didn't seem to help in that department. What this report did was it started off by looking at, oh, let's interview some former employees of the auditor's office and, oh, he has been combative. He's been a dilly of a person to work with. He's been argumentative. He has been creating a toxic work environment. Okay. And that is under the rubric of, okay, why is the office of the auditor not producing as much in final work product as maybe some others have been? Well, yeah, that seems good. I'm just looking at the newspaper article now. It was in the Star Outsizer on April 6th. Is that today? My goodness. You're well informed. Yeah, well, what can I say? But it seems to me that he hasn't come through with reports that they expected him to do and finish. And he hasn't responded to their requests for reports and audits and the like. And I say, you know, it seems to me like just lancing at the city. They don't consider him well suited for the job. But you know, there's got to be a sacred cow in there somewhere. There's got to be a backstory that is not in this article and maybe the public doesn't know about. Who knows what it is. I mean, one possibility is that he's working on things that would embarrass people and they don't want to do that. So they want him out. And he says his reaction is they just they want him out for the wrong reasons. Let me quote the article here. It's very interesting. The budget issue and all this. He opposes being removed. And he thinks this is a kind of to use Donald Trump's term of which. And it's a fight. It's an argument. And, you know, we're going to see who who prevails. But I still don't know exactly what he's done wrong or why there should be this contention. Yeah, a new story going forward. We'll find out more. Yeah, now a lot of the report concentrated on Oh, one of the things that happened, if you remember, is that there was a budget proviso inserted in two years ago in the 2019 legislative session saying that $3 million of his budget is contingent upon the state order being able to produce a financial and management audit of that agency. Okay. And so so his office goes in there. And before long, they take a look at the minutes of the of the trustee meetings and they say, okay, can we see the minutes of the meetings unredacted? And because there were a number of consultations with a legal counsel. And they wanted to see what they were. Now, for for most people, conversations between an attorney and a client are privileged. Okay. But the question there becomes, okay, they are privileged to outsiders. And so if I, for example, had a conversation with an attorney, and, you know, you weren't my boss, we didn't work for the same company, you can't see those conversations. But if you were my boss, okay, and the the attorney was hired by the company, then of then, of course, you have the right to see those conversations because it's the companies, you know, the company is the client, I'm not. And you're not an outsider. So the question then becomes, okay, if the attorneys here were retained by OHA, as opposed to any, you know, particular individual like Mr. Krab, who used to be the executive director of OHA at the time, then- Oh, he was the one that wrote to John Kerry, wasn't he? He was to run the road on behalf of OHA to John Kerry, saying that OHA represented a separate nation, and John Kerry should deal with him as, you know, a separate nation. In fact, back in the day. Yeah, I don't know if that was the chair of the board of trustees or whether it was the executive director. I think it was Krab. Okay. But in any event, the question then becomes, okay, in Les Condeau's position as state auditor, is he an insider or is he an outsider? And I think there are good arguments on both sides, but OHA did file suit. The question of privilege was raised and the court held that, you know, these minutes were privileged and, you know, they're not to be disclosed to the state auditor. Okay. But this is the state. OHA is a state agency. There's no question about it. Right. Doesn't what they do, doesn't it belong to us as the taxpayers? Doesn't it belong to the state auditor who works to find improprieties? Yeah, maybe there's a good legal reason there, but I tell you the truth, as a matter of just, you know, fairness and responsible government, I don't see why they would fight with that. They're funded by the state of Hawaii. They are the state of Hawaii. Why can't we know about that? Well, in any event, what the state auditor did was he really didn't wait for the court ruling. He said, look, if you're not going to give these things to me, I'm going to stop my audit. I can't continue with this.  What's wrong with that? Anything? I don't know. I don't know if I would have done the same thing if I were in his position because I think there's a lot of stuff that you can, you know, take a look at and conclude even if you didn't know the results or that you didn't know the attorney-client conversations. One of the things that the report says, for example, is that they faulted him for looking at the LLCs that OHA owned. But even in financial accounting, you have to look at the enterprise including all more than 50% owned entities in order to have a good understanding of what the financial enterprise is. You've got to be able to do that. Remember, again, it's a state agency, and if they got a schematic of subsidiaries and affiliates, they have somehow constructed with our tax money, we really need to know what's going on. I compliment the vote of the trustees to call for an audit and I compliment his... No, no, the trustees didn't call for the audit.  Okay, well, I compliment the legislature for doing that. And that's what we expect, isn't it? We want to know that our state agencies are performing properly. And I don't know, what other recourse would he have if they stopped him on looking at minutes and the like, if they refuse to give him information about affiliates and subsidiaries of a state agency? Now, I think at some point, you would have to suspend the audit and say, you know, I can't access enough information to come up with a conclusion. But now he's being criticized for not finishing the audit. That's right. Among other things. A lot of the report, you know, the speaker's working group report goes into that incident and claims he's at fault for, you know, pursuing a scope of audit beyond what the legislature asked for, which I mean, I don't agree with that either. I think that if they want to have an audit of OHA, you got to look at the subs. And then there's, I think, financial auditing guidance that says that. Yeah. And if you were working for Price Waterhouse Coopers and you found something, you would want to follow it wherever it takes you. I mean, that's the mark of a good investigator. You don't stop. And I really don't think it resonates to say you went beyond the bounds of what we told you to do. An auditor has to have a certain amount of flexibility, of discretion, going after what he feels is the story, the truth. Don't you agree? Yeah. So that then, you know, has us take a look at the report in its entirety and, you know, we start wondering, okay, is this really a tool to help the auditor prioritize and, you know, define the scope? Or is it a whack job? And the more of these kind of questionable conclusions that the report comes up with, the more it starts looking like a whack job.  In this case, Mr. Condo. There's got to be a lot of politics behind the scenes, don't you think? I mean, the people that OHA didn't want him to get that information. The lawyers for OHA didn't want him to, you know, get that information. And what the net effect of all of this is that he didn't get the information. And now he's at risk of losing his job. And perhaps no one will ever get that information. Isn't that what happened? What's happening? That's what it looks like.  We have, for example, new trustees in there now that are, you know, working to, you know, bring a lot of this information to light. You know, Kili Iakina comes to mind. And I think we need to know the truth. We need, as taxpayers who are funding this agency, we need to know the truth. And we do need to have insight as to what is actually going on within OHA. As we need to have with all of the state agencies, you know, especially the big ones. Yeah, OHA has tons of money and they get tons of money from the state right off the top, hundreds of millions. So we really need to follow that money. Now, you know, and I agree with you absolutely about Kili Iakina. He is a breath of fresh air over there. But, you know, I have the recollection that there are rules in OHA that make it hard for the auditor to talk to trustee about these things. They have, you know, internal rules that limit the ability of any trustee make public statements about what's been going on. Is that true? Yes, it is. But again, it's really to kind of preserve the, you know, the secrecy and lessen the accountability that the public looks like, you know, looks like to me. So I would have just some concerns about whether that kind of rule is valid. I would too.  He's served on a number of state organizations, including the Public Utilities Commission. And, you know, he's seen the way things work.  And if Les suspects is something you should be looking for, you've got to give him credit for that. He knows the territory. On the other hand, you know, you also have to look at the fact that the state has a certain culture of not revealing, protecting certain information. So this is really an important matter. This is a this is a an important case, an important controversy, because it stands for more than just this one, you know, this one audit, this one auditor, this one agency, as you say, we really have to clarify whether the public has a way to find out what's going on. A newspaper reporter would have difficulty in finding these. If the auditor can't find it, you know, what about the newspaper? That'd be hard, too, wouldn't it? It'd be harder. A newspaper reporter is treated as a member of the public, and they can't get to stuff that the state auditor can get to, or at least in theory. And I think that's why it's very valuable to have, you know, a state auditor who is committed to, you know, investigating, finding out the truth and making it known to the public, you know, the public that pays all the bills. Yeah, and the public whose money may be squandered as we speak. You know, that is a real possibility here. So what happens, what happens if less condo is, quote, removed by a two-thirds vote of the legislature? You know, that's what the article talks about. You know, what happens? Another auditor would be appointed, I suppose. Yes. And the other auditor would be managed by whatever committees or officials are involved. And maybe the next order wouldn't be as aggressive as less condo. That's a real possibility, yes. Very, very troublesome. So what's the process here? Let's just look at that for a moment. If he was removed or if he quit, you know, like, who needs this? Who appoints the next one? And does he need to be confirmed or she confirmed by the state senate? It's not just the senate. The house and senate have to meet in joint session to approve any nominee and also to fire one. So a two-thirds vote is needed to house someone from the state auditor position that they now have. And I think a majority of the house and senate is needed to approve a nominee to a state auditor vacancy. But the idea is they need to have a house, senate, joint session, which doesn't happen very often. But that's what's required by the Constitution. So in the meantime, what we have is the kind of stalemate. This report sort of creates or codifies the stalemate. The $3 million isn't coming out because the audit's not being done. And I guess part of the criticism is that he's spending more than the legislature wants him to spend on these audits. And they're mad at him because he's not producing the audits and he's calling for more money, but they're not willing to give him more money. And they're limiting his ability to do what he feels needs to be done. There were other measures in the legislature to A, lop his budget in half, B, combine his office with LRB and I think the Ombudsman, neither of which have passed. All of them are, all of those bills have died. So and really the wild card in this is the senate, assuming the house is going along with what the speaker wants to do, the senate needs to go along in order for anything to happen. And the question is whether or how much in lockstep are they, is the senate going to really do their own investigation? All of these are open questions. Well, as I said earlier, it just sounds to me like an ordinary citizen. It sounds to me that there's more here than meets the eye. Because, you know, to write a 79 page report, take a whack, use your term, take a whack at an auditor who is charged with representing the public. That's pretty serious business. And it's seriously troublesome, yes. Seriously troublesome. What it is. And I can see that anybody interested, for example, in the way the tax laws are being implemented, the way the money is flowing through the state government, you know, who becomes the watchman after that? If you attack the watchman and you remove the watchman, you criticize the watchman, undermine his funding and his credibility and his power. You're really undermining the right of the public to know. I can see we should all be concerned about that. We should all want to know more about how this all got started. We should all want to know more about what happened with OHA and other investigations. Now, I would grant you that some audit reports that we've seen in years past didn't seem to be justified. Others did. Mary and Higa was very good. She was a great state auditor and everybody relied on her to find out what was spoken. And, you know, one point I would say is that in the case of Mary and Higa, you didn't have to audit everything. Just once in a while, you come up with an audit that reveals things that the public should know about. And everybody stands back and says, wow, we didn't know that was happening. And including state officials who then say, we ought to guide our conduct by the possibility that Mary and will investigate our agency. And maybe that makes them more law abiding. I hope it does. Yeah. So you can't investigate everything, but you have to investigate those cases that are going to send a message rippling through state government. But you can't get away with stuff. And to hit the auditor now, that could send another message altogether. Yeah, it's like defunding the police, right? I mean, you rely on the police to maintain law and order to make sure that people are honest.  You know, same here. So I'm frustrated by this because I think the ultimate decision process here is not within the hands of the public. It's a back room decision, isn't it? It may well be. And that's another reason why we're concerned. And that's why we thought of taking the time today to bring this matter up in this show. We should follow it, Tom. You should follow it. And I would like to follow it with you to see how it spins out here. I would be I would be troubled with some results. Like if he was removed, I would like to know more. So hopefully the newspaper will help us and will otherwise find out what what is what the dynamics are here. Closing thoughts, what would you like people to think of this discussion? Well, whether or not, you know, I agree with let's go on those reports and, you know, some of them I agree with some of them I don't. But in in any event, it's, you know, it's, you know, those reports have been very valuable in getting, you know, information that the public hasn't seen, you know, into into the public light and discussion. So I think these reports have been providing a valuable service. Certainly, when I write my articles, I've used lots of auditors reports as as fuel and ammunition. So I do want to keep the, you know, the information coming. And I do want somebody, you know, with with metal with, you know, you know, a good bulldog mentality in that seat. I don't want somebody just, you know, whitewashing whatever the government does, that's what would serve no purpose. Yeah, it could be a personality thing here, you know, he's a lawyer, he's done aggressive things in his career for sure. But you want somebody who will go after it. You'll want somebody with a curiosity and inability at this time to find out what's going on to represent us. You don't want a wallflower. Mary and Higa was not a wallflower. And we don't want a wallflower in that job. Thank you for bringing this to our attention, Tom. Really appreciate the discussion. Thanks for having me on the show, Jay, as always.


So, guys here is the JEE paper which happened today, you can read the questions are there this is a memory based paper which is most likely the same as was received so you can see 20, 21, 23, 24, 25 questions of physics and similarly 25 questions of chemistry and mathematics clear and the same copy is available as a readable document in the descriptions please download and try to solve the paper we the Centre of Academy will be here with the solutions as soon as possible. Thank you very much.


Okay, yeah. So hello everyone, my name is Deepak. I'm a quality engineering manager in Red Hat and with me is Jallak. She leads the Red Hat customer portal search quality engineering efforts and everything that goes with it. And our second guest who is still trying to find a way through the Hopin app is Swapnil. He leads the QE efforts for our internal integration platform called Hydra. So he's more of a mid-tier person and Jallak is more of a solar. Oh, here is Swapnil, hello Swapnil. Hey, hi, am I audible? Yes, yes, I'm listening to you. Hello, hello guys, hello all. Sorry for being like, that was some issues for connecting to Hopin so I hope I don't need to say anything. That's okay, okay. So again, welcome to Ask the Experts panel for the software quality assurance track and we hope you enjoy. So it is going to be a very interactive session. So I'll probably ask Swapnil and Jallak to introduce themselves first and let's see. Let's start with Jallak first. Thanks, Deepak. Hello everyone, I'm Jallak and I've been associated with Red Hat from around, from past two years and I'm working as a senior software quality engineer in Red Hat, looking forward to talk to you, everyone here. Thanks, Swapnil, over to you. Hey, hello Jallak, hello Deepak, hello everyone. So I'm Swapnil Chado, I'm Q-lead at Red Hat. I've been associated with Red Hat for close to three years now. Mostly I'm interested, like my area of interest are specifically in the automation, specifically the microservice automation sorry, any of the AP automation performance testing. So those are my area of interest and this topic is really interesting and I'm looking to share my views and hear your old views as well on this topic. So yeah, really excited for it. Thank you, Swapnil. So everyone who is hearing us, please type in your questions during the event as well, it's not a presentation so that you have to wait for the end. Just if at any point of time you feel like asking a question, just type it in, I'll read it out to our guests and we'll try to see what their views are on that topic. All right, so starting in the beginning, let's start with building a fence around what psychological safety is, right? Let's start with Swapnil this time. Swapnil, what do you think? What is your idea of psychological safety? We see it has to us like psychology and the safety. When we talk about the safety, it gives you a safety net wherein you are safe in that zone. You can make mistakes, you can do mistakes, you can learn from those mistakes. So basically psychological safety for me is something wherein I have the freedom to be heard or to be making mistakes and still not being worried about being punished or being penalized for those, my opinions or questions. So yeah, that is what the psychological safety means for me. Excellent, Yalak? So for me, we can say that it is a shared belief where which is held by the members of the team and the others on the teams where you do not feel to be embarrassed, rejected or punished for speaking up. Now, consider a situation yourself being at home. You are just yourself and you be very comfortable. So similarly should be the situation when you are at office. People should feel comfortable of being themselves. They should be bringing their full selves to work and it should also allow for an honest discussion about results so the results could be good or bad. So whatever takeaways could be. So this is what psychological safety means to me. Just be yourself. Okay, so talking about this particular problem, right? Psychological safety for testers. So historically speaking, if you go back, let's say, 20 years into software development, when we had this old school waterfall model, testers were mostly a support group who would be included at the end to validate whatever was built, was working fine and then give a sign off and then so that they could release those golden CDs to the public, right? So it's very recently that line between a developer and a software is blurring, which is good, right? But still see something which is very deep rooted, stays in our unconscious point, right? So do you think that, do you think that given the fact that testers have always been considered a support group? And some critics will even go to the extent of calling testers the second class citizens of software development, right? So in that sense, in that sense, do you think that it is highly important for whoever runs, whoever is running the team, it can be a product manager or a project manager or a PO or anyone or an engineering manager, right? Who is the directly control of taking decisions in the team? Is it important for them to properly take care of these things, right? That testers don't feel left out, they feel included. So my question is for Sopnil, Sopnil, do you think that psychological safety as a concept applies more to testers in a development team? Yes, Deepak, I definitely agree with this, like we're in testers, this concept specifically applies to testers more. Basically whenever we hire a tester or any other QA engineer on our team, what are the qualities that we look for? We look for the critical thinking, we look for inclusion as we look for the collaboration with other teams. So these are the basic things or the basic attributes that we look in the testers whenever we hire them. And all these attributes of a QA testers, they are quite closely related to the psychological safety. If a QA testers or any of the QA is not safe enough, like it doesn't feel or willing to ask really hard questions, stakeholders or business analyst or your developers, definitely the quality would impact. If all the soft questions are being asked, definitely the quality of your software isn't going to be that great. So definitely this concept is really applicable to testers. They should be free to ask the questions. However silly it may sound, however silly the question may be, but they should have this platform, they should have this freedom of asking this question. They shouldn't be judged or rather mocked for the simple questions because they might not have the technical background which the developers have for developing those applications. But they bring in the perspective of the customers. They bring in the ideas or the vision of the customers for that particular application. So they see the application from the customer's point of view. So if they are given this freedom, only then they will be able to ask questions to the developers, business owner, project manager, and that's how it will indirectly help the entire team. So yeah. So you're saying that they have to be given some kind of freedom, right? Yeah. Right. So Jalak, what do you think? What are the steps that we need to take to get psychological safety protesters in the team? So by now we understand how important it is to have a psychological safe environment in our workplace. So there are a few hacks, a few steps that we can share with you to see how we can have a psychological safe workplace. First is we should be meeting each other's needs. So now when you're interacting with your team members, you need to be conscious of their preferences. Too often managers make decisions without even consulting their direct reportees. So we need to figure out what your employees want in terms of communication style or one-on-one meetings or feedbacks. So that you show that we actually care for them and this is how we can bring some amount of psychological safety. Also, when you have taken their feedback, make sure that you follow up and was that feedback fruitful for them because of the requirements or the mindset of the people keep changing. Then other thing could be, you know, you have to, the trust. Trust is the key of psychological safety. You have to establish and build trust. So you need to strengthen an employee's trust when you have gained trust. People are comfortable being themselves. And believe me, if you have gained an employee's trust, you, there could be a healthy employer or manager relationship. Employees who trust their managers are more committed, more productive and then they communicate better. So building a strong workplace culture which is rooted in trust is more important than ever. The other point I would bring in here is, you know, go for the appreciation, go for frequent appreciations. We all like to be, we all like to get appreciated, right? So in a survey, it showed that around 93% of the employees wanted to be recognized quarterly at least if not more frequently. So people value recognition from both their managers and peers, be it genuine, personal or meaningful. So though recognition costs nothing, but then it can have major consequences if not done. So make sure that you are appreciating your, appreciating your team members frequently. Next one is show empathy. Now consider the situation when you're putting yourself in somebody else's shoes. Though it takes time to understand the person, but then it pays off in speeds. Listen to people and then acknowledge their thoughts. When employees show empathy towards each other, they're more likely to continue collaborating in the future. Nowadays, what the issues are that people do not collaborate or people do not speak up, but then they should be feeling very comfortable in speaking up. They should be knowing that their decisions would be respected, right? Their decisions would be acknowledged. When people do not speak, they do not speak out of fear. So next is include them in decision-making. Make sure that you make them feel valued, that their decisions are being valued and how important their decisions are. Collaborate with your team when we are making decisions. So more and more input would give you a good feedback. And then this is a great way to involve everyone. It's a gather continuous feedback and then review it as a team to build collaborative action plans. So this is how I think we can, these steps can help build a strong psychological safe environment. Okay. So what I gathered from your points is that the essence is that every person is unique, right? The management needs to let them assert their individuality, right? So some people are on the left side of the introvert, extrovert spectrum, right? And some people are on the right side. Plus this is a spectrum, right? This is not a binary thing, right? Yes or no? So, right, okay. So, but the things, the points that you mentioned, Jallakar very generic for every employee, right? So what is that special thing about testers that you think should be there? How can we fix it for testers, especially? I think we need to be very vocal, you know? Our job is being, it tells us to be very vocal, speak out. So I'll give you an example. So in the past, there has been a tragic incident where, you know, a Boeing jet was crashed because as for the design that the BA gave, that the BA gave was overburdened and because of which a lot of lives were destroyed. So the pressure to keep the plane on schedule, overroad designer is concerned. And this, because of which the jet safety was not met. So this led to two crashes and then around 346 deaths and thousands of planes were grounded after that incident. Now, so engineers knew that the shuttles were doomed, but they were afraid to say anything to the management because they were afraid of the consequences. How would the people react? But they could not say. And since it is, at that point of time, they were being not vocal, this led to such a big tragic incident. Now consider, put yourself in that situation if this would have happened to you. So whatever the result may be, good or bad, it is required to be vocal. You know, the QO people are seen as the gatekeepers of any application, they criticize, they point out the weak points. So it's been, for us, it's been an easier and harder time both. But then, yeah, it's our job of doing that perhaps, and it requires a larger sense of psychological safety to dare to speak. You have to dare to speak, no matter what the consequences may be. Don't consider it what the people may think because they can take it as a criticism. But then, yeah, this is our job, and we have to do it. Okay, excellent. Okay, a quick time check. We have 11 minutes, and a quick audience check. Anyone has any questions so far? I just feel free to write them down in the chat section or the QA section. Okay, so something in my next question for you. Let's say I put you in charge of finding out, there is a team out there, right? Let's say inside Red Hat, a team that is working iteratively to deliver software to their stakeholders or customers, whatever. I put you in charge of, as a spy, to detect whether this, let's find out the maturity of the psychological safety in this team, right? What would be your markers, your cues to detect that psychological safety level? So Deepak, this is really an interesting question. So like, there is one old saying that says, like, don't shoot the messenger, but that is not exactly happening, right? Now today, what is happening? The person who is raising the issue has been shot right there itself. Like that is what is happening as of now. So in psychological safety, let's say there are two teams that we have. One is actually following the psychology safety and it's well bounded with each other and another team which is not well, they are not well gelled with each other. So there has been a couple of features done and let's say if we have to parameterize a couple of things, if we have to see like whether, particularly following the psychology safety or not, it can be quite easily figured out. We can just check a couple of things or detecting whether it is present in a team or not. Like first thing is how often does the manager talk to their employees or all the associates? Not only talking about having the one two meetings, but also taking the frequent feedbacks from the employees. Like whether they are feeling safe, whether they have their, like, is their voice being raised? Like, is there a way to take it into consideration? So people might not raise these questions in the meetings, but they might raise it to their individual manager. That is the first thing that how frequent these one-to-one meetings are happening and how effective they are. Second thing, let's say if you're giving any presentation, in case you're giving a grooming session or any presentation, so always see how many questions, follow up questions that you're getting. So in case you are getting a couple of follow up questions, either you might not for two reasons, either like all the audience, all entire members of the teams, like they understood entire project, entire requirement, or they're afraid of asking the questions. They are embarrassed because I might ask a really silly questions. So whenever you're presenting an idea, presenting a requirement of the, check how many follow up questions that you're getting. You might not get the questions right after the presentation or after the describing the requirements, but after a certain time, how many follow up questions that you're getting. So this couple of parameters will help you to understand whether my team is comfortable or not. Another point is like how well the team is gel, like how many, like ownership of the mistakes, let's say there is some issue that has been happening. How effective are your retrospectives? Like how, you know, how the teams are using this retrospective meetings. If they are able to own their mistakes or like they are pushing this mistakes to each another, if we see these kind of parameters, it means that people are not able to own those mistakes. They are feeling like in case I own this mistake, definitely there will be some issues with my career or there will be some issues with my arrays. So all those things, these are the couple of parameters which we can consider. So yeah, for judging the same setting, right. So I was reading a blog somewhere and especially for testers. So let's say I go to, so we, the problem is manifested in a different way. When you are a tester that reports to a QE manager, but works in a separate team, right? So in those scenarios, so what, as a manager, what I should do is go to that engineering manager where my QET member works and ask them, have this product or the service that you are developing for, let's say one year, being challenged or the process with which you developed this thing. What was the last time someone really criticized or challenged this thing? Either your process or your product, right? And was that person a tester? If the answer is yes, was that person a tester? So calculating, like we do in when we hire, when we try to notice the gender ratios in tech, right? We see the talent pool. How many CDs are we getting in the gender ratio? And what is the gender ratio in the team, right? So you have to find those points. So in this case, the point is, if a process or a product was criticized or challenged, let's say 10 times in last six months, how many times was it distributed equally or it is just two or three smart people in the team who always criticized freely without any fear, right? So yeah, good points. Okay, seven, 24, six minutes. So Jallak, my last question for you. So when you say that we have to speak no matter what, right? So I think this has that mental illness conundrum, right? Where let's say somebody is not feeling okay, right? We tell him to cheer up, calm down if somebody is not, right? That does not, that never works, right? So eventually we have to align accountability with the authority. So the person in authority is accountable for making sure there is psychological safety in the team, and that can be their direct manager or whoever is running the team, correct? So who do you think is responsible for and how can you properly hold someone responsible for maintaining the psychological safety, especially to testers? To me, it looks like it could be the other way around also, but to me it looks like that a manager has a, or manager or the leaders have a key role to play in this. Consider, now this is my practical experience when I have been going through this illness of having a lot of thoughts were going into my mind where I was being, I have been depressed by other members of the team. So I somewhere had a trust on my manager that he's going to, if I share my feedback with him, he's going to acknowledge it and work upon it. So my manager always ensured that the psychological safety is there in place and always confirm for me that are you feeling psychological safe? Now, but if I say manager, we have discussed a lot of points where whatever role manager has to play, but on the same front, I would say everyone in the team should also be responsible for bringing in psychological safety. And why I say is this, if you're having any problem, you have to step up and go to the manager and discuss it instead of having, instead of going through that, bringing yourself down and not feeling a psychological safe. So it is very important from our point of view also, are we reporting this to the leaders or our managers? Managers can help get rid of this, but then are we trying to do that? So of course, managers need to understand their reportees, need to gain their trust, need to have to address all their concerns, and then we need to come up with our problems also. We need to report our problems. So you are saying that both parties...  Yes, yes. Okay, let me see if we have any questions, no questions yet. I think we have one, sorry. Okay, yeah, yeah, go ahead. I think we have one from David Duncan. Tell us a statement that you must speak out, doesn't mean that you have to be insubordinate, does it? The manager is very much responsible party and by definition must trust the team as a whole. So Chalak, could you take that? Of course, yes. Thanks for the question, David. By this I mean, sometimes there's an insecurity where a manager doesn't trust the efforts or the capabilities of their reportees. So this could be a situation where the deadlines have not been met or the manager has the fear or the insecurity of the deadlines being not met. So there, a manager needs to have a lot of trust on the employer and when they show that trust, the productivity comes out from the team. Like a small example where you are just micromanaging your team, how would the team react? And then you ask your employees to just finish your work, how much hours of a day you work, be it three or four, but I want to finish the work. So this is how the trust should be. Okay, any closing remarks, Chalak and Swapnil? So yeah, as Chalak's already stated, like psychology, safety is everyone's responsibility, making that environment safe for everyone. It's like everyone's responsibility, but yes, leaders can lead it. They can set the priorities, like it is even for us, it is very important for us. But yeah, to make it safe, it's everyone's responsibility. So yeah. I should, I would be saying that it is, please practice psychological safety because it is very important for somebody's mental well-being to feel psychological safe. We think of our physical safety. We think of, so how much physical safety is important and our mental safety is also important. Most of our times we are spending in office, we are giving most of our time in office. So it's really important that we, to ensure that we have a psychological safe workplace for everyone at first. Excellent. Thank you, Chalak. And thank you, Swapnil. All right. Thank you so much, Deepak, Swapnil and Chalak. Thank you for asking all the right questions that are the need of the hour actually, given this pandemic situation and given all the psychological stuff that we are going through as testers and as programmers, as managers as well, as the employees of these and working in the software industry as well. Thank you so much for all the inputs.


to introduce Carl to the stage. He's a researcher up at UW. He's been a friend of ours for a long time, spoken at a couple of tour cons. So please welcome him to the tour con stage. All right, thank you. So today I'm going to talk about a third party service I built called TLS My Net, which allows you to enable HTTPS for home network devices through the standard Let's Encrypt service. And this might sound to you like a pretty uninteresting talk. It's like, OK, it's how you use Let's Encrypt, blah, blah, blah. But there's actually a bunch of issues, in particular with local network devices, that make it hard to use and also reasons why you might want to use HTTPS or TLS on your home network. So a question that I get, let's see, let me start this here. So a question that I get commonly asked is, all right, so why do you need TLS on your home network? You already have WPA2 on your wireless network. Isn't that enough encryption for you? So it turns out that browsers are starting to require TLS for what they consider powerful APIs. And so this can mean using things like requesting permission to access the camera or the microphone or using certain permissions or capabilities that you would not want a compromised website to be able to have. And so you might want to build a web app that uses these powerful APIs, but you might also want them to talk to local network devices. And the problem is that you can't make cross-origin requests from insecure sites to HTTPS sites to HTTP sites. And so you really can't make these web apps that or these secure web apps that talk to local devices. And in particular, the issue that came up for me, which caused me to think about this whole thing, I was writing an app for a Chromecast that would talk to a local network tuner on your network and then show a current over-the-air channel on your Chromecast. So Chromecast requires its applications to be delivered over HTTPS. The HD Home Run tuner in particular does not support HTTPS. And so in fact, this is impossible to build currently. And so I was trying to figure out, why doesn't it support HTTPS? How can we get them to support HTTPS? And it turns out that there is a lot of issues for enabling TLS on local devices. So the first one is that these local devices are often discovered by IP. So in the HD Home Run case, the HD Home Run device actually connects out to their cloud service and says, hey, this is my local device. When you want to find a HD Home Run device, you connect out to the same cloud service. And since you're knotted through the same IP, it can say what the local IP addresses are of the devices on the same sort of knotted external IPs. And so you can discover internal devices that way. There's a bunch of other different ways of discovering local devices by IP address. But in general, you only have an IP address and not a host name. And certificates are generally issued for host names right now. And they're certainly not going to be issued for internal IP addresses. So you might propose solving the solution by just issuing a certificate that is common across all devices. So let's say all these tuners have one common certificate and you connect to that. Unfortunately, this is easily abused. So you might remember the Superfish Fiasco from several years ago on Lenovo laptops, where basically there was one static public-private key pair that was shipped. And once you have the private key, then you can impersonate the service or the cert to any other device that trusts that public key. And similarly, even if you were to create a unique cert for each device, some manufacturers like to use a constant host name for each device. So you might have like routerlogin.com, for example. And each device might have its own certificate for routerlogin.com. And the problem there is that if you have one device for routerlogin.com, then you can impersonate routerlogin on a different network with a different device. And one of the issues of using let's encrypt to solve this by automatically creating these certificates locally is that end users typically don't have their own domain name. And even if they do, these local devices usually aren't externally facing or they're not passed forwarded through the NAT. So standard tools like let's encrypt and the standard cert bot doesn't really work for creating the certificates for these devices. But it turns out that there is one company that has actually solved this issue. And that company is Plex. And so here's how Plex has solved it. And by the way, if you're not familiar with Plex, Plex is basically your own private Netflix. So you set up your own Plex server. You load your own media onto it. And then you can give access to it to your friends. They can access it remotely over the internet and locally on your network. And it's all secured by HTTPS and TLS. And they've basically figured this out and made it work. So here's how they did that. Each server has a 16-byte GUID. And they issue a wild card certificate to your server for that GUID.Plex.Direct. And then when you want to connect to a Plex server by IP address, you go to that IP address dot the server GUID.Plex.Direct. And then in the background, they have a DNS server that resolves that IP address GUID.Plex.Direct to just that IP address. And this allows for dynamic IP addresses, both exposed through nets onto the internet and also for local IPs. So it'd be nice to use Plex's solution just off the shelf as it is. Unfortunately, the way that they actually implemented this is they partnered with a certificate authority to issue these certificates. I believe they ended up actually paying some money to this certificate authority to make this work. And most IoT vendors aren't going to spend any amount of money to increase security whatsoever. And so I thought, well, hmm, can we sort of emulate this with Let's Encrypt? And well, this is what that talk is about. So before I get into the details about how we make this work, I'll quickly mention how Let's Encrypt issues certificates. It uses this protocol called the Automated Certificate Management Environment called ACME protocol. And this is implemented by SIRTBOT and their CA site software called Boulder, along with some third party clients as well. And it basically does automated domain validation. So these are only domain validated certificates. And the way that this works is that the CA issues challenges to prove that you have control over the domain that you claim you have control over. And so there's two main challenges that are used right now. There are some that used to exist and some that are coming later. But the main two challenges right now are HTTP01, which is please create a file at this specific URL with specific contents. And the second one is please add a text record with specific contents onto this domain. And the DNS01 challenge is the only way that you can actually get wildcard certificates. So Let's Encrypt has this idea of accounts. And accounts are basically tied to a public-private key pair. And the public key is essentially your account ID. Now for performance reasons, they actually have an integer account ID. But basically you can go from a public key to your account ID. And then if you want to renew your certificate or do anything else with your account, basically you just re-sign these requests with your public key saying, hey, that account that I registered with the key that I created before, I'm the same person. So let me please do this again. So the solution that I'm proposing here is a service called TLSMyNet, which lets you issue wildcard search for subdomains where the subdomain name is tie tier Let's Encount public key. And so tying the account or the subdomain name to your account key lets you verify the legitimacy of the certificate at an application level. We can't guarantee that, say, if you go to any TLSMyNet site that it will be your server that you're talking to. But if you go to your certificate or public key fingerprint.tlsmy.net, then you are talking to one of your machines. And so the way that we're going to use this is we're going to use a Let's Encrypt and SIRP bot as normal. But we're going to prove ownership of the private key of your Let's Encrypt account to a third party domain for subdomain validation through a text record. And this is what TLSMyNet does. So the way that this works is a device initiates a subdomain wildcard certificate request to Let's Encrypt through SIRP bot. The device sends this challenge request. And then so when it contacts Let's Encrypt, Let's Encrypt responds back with a challenge to say, please prove ownership of this or control of this subdomain. So then the device sends this challenge request back to TLSMyNet. And this request is signed with the same Let's Encrypt private key using JWS. And the thumbprint of the public or the corresponding public key is used as the subdomain of TLSMyNet, My.NET. So you can't actually request SIRPs for a different account. And the way that this works is it's just a base 36 encoding of a SHA-256 hash of a particular way of hashing public keys. And so there are a couple of ways. So the way that this ends up being implemented is with a couple of Python scripts. So there's dnserver.py, which resolves a.b.c.d. thumbprint.tlsmy.net to a.b.c.d. And this allows you to basically use a host name instead of an IP address. And because it's a wildcard certificate, the TLS stack will accept that as a match and say that the certificate works. The second thing that it does is it provides these text records for subdomain verification. So when you send a challenge to us, we will add a text record for thumbprint.tlsmy.net so that we can get a wildcard for that. And the way that you submit these requests or these challenge requests to us is through this web server, which is just another Python script, which handles these requests for creating these text records. It's implemented with async.io, aio.hdtp, and JW crypto modules. And we also have a Redis server that sort of connects the two scripts together. So when we receive a valid request through the web server, we create a temporary text record in this Redis store that the DNS server can then access. And the nice thing about this is that this can be completely stateless. Because you are proving control over a particular public key by proving knowledge of the corresponding private key, we don't actually have to create any accounts for you. We just know that you have control over the subdomain that corresponds to the hash of your let's encrypt account ID. And so basically we don't have to do any long-term state storage. So it makes a very lightweight to run. On the client side, there are two more Python scripts. So one is called GetDomain, which basically just looks at your let's encrypt config files and comes up with a particular domain name that you will use or that you will request. And then there's also a RetrieveChallenge Python script, which is designed specifically to work with certbot as a manual authentication hook. And it communicates through environment variables that receives the domain that you want to authenticate for. It receives the challenge token that let's encrypt gives you that you need to add it as the text record. And then it takes those and uses your let's encrypt account private key to sign those and send that off to TLS Minet. And I don't see anyone out with their laptops. I'll say you can follow along with if you want, but it's probably too late. But if you want to try this later, you can just go to tlsmi.net. And that will redirect you to my GitHub repo. Just read the instructions and then read me. And it's basically as simple as this. So you set up this environment by basically cloning my repo and setting up a local directory for your let's encrypt account information. So you don't have to be root or anything. You'll create a let's encrypt and count yourself. So it will automatically generate this public private key locally and store it in your home directory. There is you need to tell these scripts what account private key you want to use to sign all of these challenges. And assuming you only have one account, you can just use this simple shell script one liner to say, hey, just give me the first private key file that you find in this let's encrypt home directory. And then you run certbot with this mess here, which basically says use the let's encrypt configuration in my home directory. I want to only request a certificate, not reconfigure the server or do anything. I want to do it manually, but the way that I want to do it manually is to use this manual authentication hook script and then the domain I'm going to get from another Python script. And so I did this on the plane last night, and it still works, so hooray for that. So if all works well, you should get your new certificates in some files in your home directory and dot let's encrypt slash live slash your thumbprint.tlsmy.net. So then you can take those certificate and your private key files, and you can copy those to your home network devices. And then basically you're done. Now they're only valid for 90 days, so don't forget to update those every 90 days or so. So briefly, I'm going to talk about the risk model here because you might be thinking, well, this guy up here can now impersonate anything, and that is true. So basically the third party domain service, tlsmy.net in this particular example is assumed to be trusted because they can always issue certs for your subdomain. But sort of the way that I envision this going forward in several instances is that sort of each device manufacturer might have their own domain that they use for this, and you sort of trust that manufacturer anyway, so maybe you should trust them. I don't know. But even if you don't, there's this cool feature called a certificate transparency where you can search these certificate transparency logs to ensure that no certs have been issued for your subdomain that you weren't aware of. So for example, this is my home network subdomain here. I searched for it on crt.sh, and it shows that it's been issued twice once in September and once on the plane last night. And then you can go in there and see if it's been revoked. And further down, you can check that the public key matches what you expect it to be and that the hash matches and everything is good and kosher. So right now, tlsmy.net is sort of a public service. It's not getting a whole lot of use at the moment. It's currently limited to 50 certificates per week because Let's Encrypt assumes that I have control over the whole tlsmy.net domain. So if I'm getting all of these certificates, why don't I just get a wildcard certificate for the whole thing? However, I've engaged them on the forums and they said, yes, this is actually a legitimate use of Let's Encrypt. And so if usage gets up to the point where rate limits become an issue, we can probably whitelist that or add you to the public suffix list or things like that. Ultimately, I would like to see Let's Encrypt do some sort of version of this natively. And maybe this will prod them into that sort of direction. But for now, I sort of see this as a proof concept service to encourage tlsadoption. And it makes it really easy. So please bug your IoT vendors to support tls because it's becoming increasingly important to support. So in summary, going forward, tlsupport is essential for all of these innovative web applications. But there are a bunch of problems that make getting tls certificates for local network devices difficult. But I have presented a proposal for a service where we can easily enable tls on these devices using Wellcard certs and Let's Encrypt and this third party service. So with that, I thank you for your attention. And I will take questions out on the beer garden. Oh, and it's lunch. So yeah, it's lunch, everybody. Be back here at 2 o'clock for Pookie Bear's talk, Real Life DevSecOps. You can also go outside and grab some food truck, or you should have some time to go to the mainland and get some food.


Everyone's got like just a little bit of anxiety about public speaking, no matter how confident you may be when you get up there, it's always like that. The most important thing in oral presentations is to act confident, even if you don't feel confident. We act confident by doing a couple of things. First of all, speak loudly and clearly at a good pace. Secondly, make eye contact with your audience. That's pretty much it. If you speak loud and look at them, they will assume that you're confident and that means that you'll get higher marks. People will take you more seriously and they'll engage more with your talk. It doesn't matter if you don't feel confident. Your audience is very, very bad at reading emotions. Lots of studies have now shown that people can't tell if you're nervous and that your degree of nervousness doesn't influence your grade. So for public speaking and if you have assignments where it requires any public speaking representation, it's really good that you practice in front of your friends or a safe place where you can just practice without any feeling of judgment. Because I feel like when you actually practice in a safe environment that you're comfortable of, you will be more confident as well. So definitely practice with your friends or your family or any relatives. Understanding the way you feel in certain situations, there may be a way that you deal with it better than others. Maybe you might need a coffee before you do a talk to come in. You might just need a bit of a nap. So you work out those strategies that obviously help. And just trying not to maybe make direct eye contact with people. I found that works for me quite well. You're still sort of like maybe looking at a crowd, but just don't single out individuals. Maybe refer back to what you're presenting on the board as well to give you a bit of that distraction. So yeah, it really comes down to as you do more presentations, finding out what works for you because you'll see that over time and then just trying to apply those things. So that can become better at public speaking because it's useful for everything. Prior preparation makes so much more of a difference. When you go up, they're already knowing like they've gone through it. You have an idea of what you're saying compared to like when you've rushed everything last minute and you're not exactly sure you're stumbling over your words. You may miss a poem call or you may go over a point that you don't remember where you start.  And then, you know, so like try and do your notes, not just do your notes earlier, go over your notes, practice your notes. Rural presentations are best done after lots and lots of practice. Very difficult to do. But if you can find a friendly audience, your housemate, a child, children are usually quite brutal and quite honest.


All aboard for the transcribed premier production the crews of the Paul Parrot and the thrilling adventures of whaling days The trim whaling ship the Paul Parrot has set sail from New Bedford in the spring of 1858 With a fine crew and the most unusual company of people aboard Although she sailed with the announced purpose of hunting whales and collecting a cargo of whale oil The true reason for the crews of the Paul Parrot is to seek a valuable mineral treasure on an unknown island Captain Dalton his best friend and first made George Wainwright The one-legged sailor Dickon the cabin boy Johnny Robbins and little Sue Grain sister of the ship's owner have succeeded in Uncovering the secret which was known only to the owner of the ship as regrains He is also on the void supposedly as a passenger, but really to find the treasure He seeks after a bold attempt by a Spaniard named Al-Testi and his partner in crime Red Mulholly to get control of the ship and secure the treasure for themselves has been foiled by the bravery and quick thinking of our Friends the troublemakers have been thrown in irons down in the hole Since Johnny Robbins father was one of the original discoverers of the rich mineral deposit on the secret island Ezra Grange has promised him half the treasure when it's found Just at this point with the villain safely disposed of and the ship well on its way to the island a cry comes from the mast head Blow me down mr. Grange a whale sighted and so soon out What were the new purpose in mind to seek in for treasure?  Hi. Hi, sir Yeah, I wish I could go along Best it's a mammoth one for fair a giant blue whale He'll be hard to take but worth the effort. I'll lay you to that Mr. John's board will make the catch when mr. Miscaris boat standing by of assistance is needed He'll likely need it from that whale size Drop anchor even to He's up to captain here comes old Dickon with our mascot Polly on his shoulder Captain Captain Dalton shiver me timbers captain. It's him. He's too. Dickon. What are you balling about?  You may later That's a but dick and how could you be sure that's the same whale when he's so far from the ship? Oh last I Could never mistake that whale never dummy dying day Captain I want to go after that whale. I always saw me met again.   I know how close this is to your heart I'm willing to give you a chance, but if harm be fairly. I'd never forgive myself Captain I'll take the risk. Please let me go sir.  We haven't bless you. I'll not fail a best mate May have to weather heavy swells near that monster there they go I hope they can catch is this whale.   That's right The second mate mr. Jawad is steering but after dick and makes his strike and makes fast to the whale Then he and jaw it will change places and he'll truly be the boat steerer It seems to be a strange custom. I know but it's always been so in whaling as far back as any man can remember They're creeping up on the whale Gee, he's really a big one. All right. He's surely is Never dreamed anything could be so big They can make no more noise than they must young and because you see a whale's eyes are poor But his ears are keen and if he hears the slightest noise that's irregular he'll sound sound Yes sound dive under and once he's under there's no tellin where he'll go. He may breach miles away Reach what's that captain doll? Hmm by breach.  Yes He's about to cast the iron may the gods of the sea smile on him and bring him luck look the whales turning about no me down He sees him. Oh there goes Dickens arm.  I but there's the danger a blue whale though He's the biggest of all has no teeth.  It grows in plates in the whale's mouth from two to twelve feet in length Well, if they're not teeth, why are they in the whale's mouth to collect food and keep it in his mouth? But it's not his mouth I'm worrying about it's the flukes of his tail the most dangerous things in all the seven seas Flukes are the points of the tail aren't they captain Dalton? That's right Johnny those enormous points. Those are the flukes The whale is raising his tail out of the water. He's bringing it down on the boat Suffering whitefish both the boats are match wood and the men are all out in the sea We ain't right make my boat ready and lower away. Hi captain, but by the host of it. I'm going along well very well George in my boat That's it make swing go along captain. I'm small and quick. I can help Blow me down Roy. We're lowered now. There's no time to put the ladder board Oh Johnny, you shouldn't have done this but it's too late to do anything now. He's blowing out of the way ready men You know, I'll take the iron you take a place at the stroke or I've got to make this spike myself On me home the man out there in the sea are almost ready that way of turning up the water so There's dick and he's well and put your life When I'm going to catch the iron get ready to change places with me. Hi. Hi, sir I've asked every picture right ahead for me at blubbery. He looks like a man of war and still see the consign in him It was a good strike. This must be a better or we're all lost. We're on him Roy.  He's running. He's got a rabbit. Pull me down. He's turning again Give a side to whale. He's hanging on to a spool. What has he got in his hand? Bratton down by a hatch he's got a lance.   Watch out man, the whale's sound. He's done it All dickens done it. That floor of the lance finished him. Good old dicken. He got his way Jean Yeah, I was never so excited in all my life. Come on, then we've got to pick up the men They'll up south of the water on the boat me hearty We've almost been prompt captain of air.  Then the hand makes look like we're there Help with hands first of it. Help him a forward man. Easy there. Easy. Easy. Are you sound dicken? Are you all right? My soul is a boy cramped captain, but I've done it. I've done it. Nobody can say I ain't even up to score Hey diggin sit over here. We've got to get all those other men aboard Look captain, but the nickels and on board is selling us signals with the colors and the gallons He's done not another boat wait us and pick it up a man. Good. Look lively. Mr. Wait, right there's Buscara and his boat steerer support and there's Joe it pick them up Here comes nickels and extra board I think all the hands are accounted for sir a vast. Let's see Joe it and Buscara three hands here two making for Nickelson's boat five still overboard there Hi, I'm Mr. Wayne right all present all accounted for our boat will still hold a few more hands help those men a stern over the gunner Well dicken who's a hard battle, but you've a stout heart Man and boy, I've sailed the sea many years and I've never met with a braver seaman and you may later that thank you Captain you don't know all this day is meant to me I've evened up the blowman score that great blue whales floats broke me legs on 15 years bike And that's how I come to lose it you know and now they're the beast rolls dead is a Scatter, but and it was your thrust with the lance when you were on the whales back that did it dicken. I land It's more than a fan exchange as I see it I'm content now Look captain. There's nothing more signals up at the main miss so they are it blew me down They've sighted land land sir in these seas. I know I know no land here about a fast The signals they land three points over well about I can't understand raisin land in this Look, can you sight something there? Why it looks like smoke smoke? I led your right But it's a lot of smoke for a fire was shiver me timber sir. I may speak me mind It looks like smoke from a volcano to me a volcano Why the secret island we're sailing to has a volcano on it a holland That's the ticket that city me later that they've sighted our treasure Island our cruise has reached its mark Land the secret island that bears the wealth of minerals that Grange has been heading for Dickon has realized his life's ambition by killing the giant whale that once cost him his leg But what lies ahead on this mysterious island? Will our friends have trouble ashore or the two troublemakers imprisoned in the hold of the Paul parrot likely to start any more Villainy only the further transcribed adventures of the crews of the Paul parrot will tell be sure to follow Captain Dalton sue Johnny and their friends on the cruise of the Paul parrot your Paul Parrot announcer is Dave Ward


These are real comments and tweets from the Dorito chip of a dumpster fire that is sitting in office. We're not going to die. We're not going to die. We might, though. At least, not tonight. Not you guys. We might. Yeah, not tonight. So tonight, while we're here, I thought we would listen to Trump's tweets. I loved my previous life. I had so many things going. This is more work than in my previous life. I thought it would be easier. I like to drive. I can't drive anymore. Linda Belcher, Bob Spurger. I don't even know what this means. Sorry about my breath, by the way. Right at Fox Nation, grateful Syrians react to real Donald Trump strike. I'll name my son Donald. I don't even know what that means. He thinks that the Syrians who are getting killed by him are going to name their children Donald. They're so happy. They're so grateful to him.  That makes the two of us. Immigration ban is one of Trump's most popular orders so far. The same fake news media that said there is no path to victory for Trump is now pushing the phony Russia story, a total scam exclamation point. The real story turns out to be leaking exclamation point. Find the leakers. People are urinating everywhere. This is like anal leakage or news leakage. Had a great meeting at CIA headquarters yesterday, it's a packed house, and I pay great respect to a wall, long-standing ovations, amazing people, win. I think even CIA knocked me in. I don't know what I said. I don't know. Should we do three more? Okay, good. Allegiance agencies should never have allowed this fake news to leak into the public. One last shot at me. Are we living in Nazi Germany? Yes, we will with you, Donald Trump. Third anti-Christ. Yes. Do you like Nostradamus? We'll talk after the show. Yeah, I do. I feel like you know me, you get me. My daughter Ivanka has been treated so unfairly by Nostrum. She's a great person. She's always pushing me to do the right thing. It's terrible. It's terrible. It's terrible. Who says terrible anymore? What a fuckface. Tremendous respect for women and the many roles they serve that are vital to the fabric of our society and our economy, especially the Pussies. I added that part. Yeah, you did. That's outside of the quotes. Bye. Bye.