Getting impatient for baseball season to start have a touch of spring fever Want to get away from it all? We offer you escape You are in mid-ocean aboard a drinkship Already nine men have died and you know that some malignant forces aimed at you From which you cannot escape Escape designed to free you from the four walls of today for a half hour of high adventure tonight We escaped on the North Atlantic in the year 1900 and to a sailing ship whose very name struck dread in sailors hearts as Joseph Conrad told it in his famous story The brute just by looking at her proud and strong and beautiful on the outside You couldn't see the black heart inside of her and you'd never know she'd killed at least a dozen men and maybe more But I knew her knew her for the murder in she devil. She was I Saw the day she killed her first one and I was there too when she finally made a big mistake and killed the wrong person But that was a long time later Oh, she had a name all right, but after that first day her first killing Nobody with the family ever used it again Everyone else from that day on would look at her half afraid half snarling And they called her the brute Remember I was 14 the day my father took me down to the South Thames bow yard to watch the launching of the ship My brother Charlie was there of course eight years older than me and very proud of his one gold stripe Now that he'd be made an officer in the apps line Charlie and father were talking. I just stood and listened to them and didn't say much of anything myself look at her dad Ever see a ship in your life with lines like that. I bet you'll out sail any clip on the China trade Well, that remains to be seen Charlie How soon are they going to launch her any minute now? I'd give it a lot to be sitting on her instead of on the Malcolm apps Well, the Malcolm's a good ship son as good a ship as any of the apps family owns. I'm not kicking I'm glad enough to be through apprenticeship and get my commission But even at that I'd almost rather be a boson on this ship than paired made on the Malcolm I understand the cool chest is to be her captain. Yes, that's right oldest commander with the absent son's line Look at the size of her dad. She's a full 2,000 tons less half a ton Charlie. Oh, good morning. Mr. German Hey, Mr. Wilmeth. Hello, Ned. How do you do sir? No Charlie. She came to one thousand nine hundred ninety nine and a half when we measured her up Well, 2,000 tons or not, mr. German. You'll never build a better ship than this one. I don't know Charlie I built with the way mr. Ops once there. She's big and she's stout, but I don't know and what's your reason for saying that sir? No reason that makes any sense about the devil's own time with her Kevin Dawes jamming when they shouldn't edge covers that wouldn't fit after they'd been measured up Blocks fouling for no reason at all Yeah, I don't know mr. Wilmeth But if she were a human being I'd say that maybe she's insane. Oh come on. You've been working too hard, mr. German Better take a vacation now that she's finished. Well, I could certainly you I say That's Maggie Colchast up there the captain's knees. Is she going to do the christening? That's right, Charlie And I'd better get down below now My own men are going to knock the stays loose and let her slide down into the water. Well, good luck, mr. German Thanks, mr. Wilmeth Come on board for the celebration after she's lodged bring the boy fine. Thank you. We should be there They'll let it go any minute now Dad I'm going to sail on that ship someday. Oh, you'll probably sail on a lot of apps line ships before you're through Charlie Look Look, they're giving Maggie the champagne now and she's going to christening. Yes, listen I christened the apps family The apps family so that's what they're naming her, ain't it? All right, me knock out the stays that are built Yes, well look at that speed. I never saw it. German look out I haven't got the ways in shape. She went over him He didn't fall a timber rolled off the deck and knocked him under she said right over him Mr. German the man who built her she's lost in blood if that means anything She's a brute to the murders now, Charlie Still think you'd like to sail on that was an accident. It doesn't mean anything. Perhaps not. I'll sail on her someday sooner or later I will sail on her Things worked out. I was the one to sail on her first instead of Charlie He'd gone on out to the orient aboard the Malcolm and six months later when I started my apprenticeship I found the camp company had assigned me to report to captain colchester on the apps family Or the brute as everybody was calling it privately With some kind of mix up in the sailing orders and by the time I came on board A tug already had a line on the big sailing ship and was starting to ease her stern first out into the channel All right now Captain colchester was at the taperell shouting orders to the tug captain and the mates were forward somewhere handling the check line You've got the slack now all the way I stood at the waist waiting for a chance to report in and watching a young fellow about my own age He was doing something a rather upper loft on the mismast above me The tug had drawn the line out taut but the ship hadn't started to move yet. You've got no way on here Hurry engine up to first speed The tug was churning the water to froth and the hoser was tight as a bowstring, but we still didn't move Then suddenly the ship gave a lurch and started back like a bucking horse The men forage had no chance to ease the check check cable and a second ledward snapped The ship plunged on back and then sheared off Against the pier head that knocked me sprawling on the deck and at that moment The lad who'd been working a loft on the mouse crashed down onto the deck not 10 feet away from me And he lay there without moving give a hand up here on my waist plate young hawk has just fell out of the tops Hey That's too bad.   Don't stand there trembling.  All the day they launched this ship.  Yes, sir No doubt you may have heard this ship called by an unpleasant name once in a while Yes, the brute Well, you'll be kind enough to remember why you're all bored that her name is the apse family and she's had her share of Accidents the same as any other ship. Is that quite clear? Yes, sir You get along forward with you and stow your gear away on the folksal You'll take over young hawkins duties for the time being Yes, sir I sailed aboard the brute for the next four years and watched her kill nine men during the time We got so we tried to out guess her tried to figure how she'd do it the next time But no matter what we think we never were right And it wasn't only the killing it was everything Most ships of little ways all their own and you'll learn about them and allow for them Ah, but not her She was like a crazy woman. You never knew what she'd do next I remember once off the gold coast. She ran before a gale for two days as pretty as you please And then brooched two twice the same afternoon Flung the helmsman clean over the wheel the first time and the second time swamp herself Fore and often split out every stitch of canvas And after we got the decks cleaned up We found one seamen had gone overboard He was her fifth, I guess it was Or maybe the sixth Oh, she was beautiful. The app's family was big and proud and beautiful And along with it a killer Black-hearted seagoing brute My brother charlie was on the china run all that time first on the malcom and later on the lucy apps We never happened to hit port on the same time Finally the time of my apprenticeship was up We boomed into london at the end of the trip I went before the board of my papers I guess they figured anybody who could stay alive for four years on the brute must be a seaman Anyway, I passed and mr. Apps handed me my sailing orders along with the commission I was assigned as third mate to captain colchester on the apps family Congratulations Ned glad you're going to stay with us. Thanks captain cochester You've been a hard-working apprentice and I've no doubt what you'll be a good officer In fact, we have a man on board who'll make sure of that. Why what do you mean captain? Got a new first mate on this trip Come in charlie charlie. Well, hello there youngster I say you've been doing a bit of growing in the last five years charlie I didn't even know you were in port been in for a week down country though I hear you fooled the board careful man. You're talking about your own third mate So they tell me and you'll be jumping lively on this trip me boy easy easy Don't forget. I know this ship and you don't and I'll learn it quick enough Been wanting the chance for a long time And between us. I think we can even break this jinx. That shall be no talk of a jinx on this trip At least not in the cabin as long as Maggie's going along Maggie who's Maggie ask your brother I think he's the one who talked her into the trip Although she claims it's for her health I'll leave you two to get acquainted. We'll be about 10 days loading if you've got any plans What's he talking about charlie? Who's Maggie? His niece Maggie Colchester You remember her the girl of christen the ship. Oh, of course Olly well, he's not dad told you where I've been spending shore leaves for the last year and a half No charlie. I didn't know anything about it. Well, let me show you something. Yeah Now if I have my way Maggie'd be wearing this before the trip's over. Yeah, take a look Blimey, that's all right. Yes. I bought it in Cape Town The blue white diamond set in platinum. Is it big enough to go in a finger? Oh, it's big enough. All right That's where it's going if I can talk her into it And who's going to talk who into hot charlie? Maggie I was um saying that um Um, I hoped I could talk you into going ashore for dinner with me.  Oh, Maggie. This is my brother Ned Ned. This is Maggie I do and are you one of the officers too? I'm the new third mate Well, I certainly hope you're more truthful than your brother. Maggie whose invitation to dinner I am accepting with pleasure. Oh, really? See you both later. All right, charlie But now charlie She's lovely. She's more than that Ned she's Everything as far as I'm concerned. Well in that case. Good luck. I hope you get her. We'll see about that Anyway with Maggie aboard we've got to make sure this jinx ship stays on good behavior for once It'll be the first time if she does and it's the first time we've had both the Wilmets on board together We'll tame her down Ned We'll make her calm and peaceful as an old workhorse Just you wait and see if we don't And The strange part of it was he was right We stood out past graves end and made the passage to the china coast In 121 days of a finest weather you could ever hope to meet And for the first time in a bloody life the old ship settled down and sailed herself as meat is your pleas Charlie and I had talked about it sometimes when Maggie wasn't around He'd always laugh and say the brute knew when she'd met her match that she didn't dare try to buck the two of us But I I was more ready to give the credit to Maggie To think maybe she'd charm the old murderous the way she charmed all the rest of us From the second day out Maggie was the secret darling of every man on board She was all over the ship here there and everywhere with red tam and a bright blue eyes Never still a minute and having the time of her life If she'd come along for her health she'd found it before we passed graves end We raised the storm on the passage back and ran four days in a heavy gale I stood by and held my breath ready for anything and nothing happened The old lady apps family held up her head and sailed along like a seagull Any time before she'd have buried a gunner in the quartering seas But now all the water she shipped you could put in a teacup A hundred and nine days from Hong Kong we raised the dungness light And early the next morning picked up a tug of sheerness for the long tow up river to London The ship followed along on the tow line like a puppy on a leash and we moved slowly up the river past graves end All of us were glad to be home But Maggie most of all I think because she'd never been at sea so long before I had to smile at the way she danced around in the bows picking out one landmark after another as we came to them Sometimes standing up on the spare anchor we'd taken in on the foredeck in order to get a better look at the river banks ahead She wasn't wearing the ring yet, but I knew she was going to and was only teasing charlie as long as possible What's wrong Ned? That tug stopped her engines collision up ahead in the channel charlie looks like a yaw and a schooner foiled together Oh, yes Well, it looks like they're clearing it up now Guess we can move again a couple of minutes Maggie Why don't you go on the afterdeck? You're on the way up for there Better save your orders for the crew charlie. She outranks you. Oh, I'll take orders from her any day Yes We are almost home ned We've had a lucky voyage. There's the first halfway peaceful trip. I've ever made in the old brute. Oh, I told you we'd dim her down She's turned over a new leaf Ned. Well, it won't last long if she keeps on shearing off there and drifting back down the channel Hmm Yes We're heading straight for those fishing smacks better have the tug start up and hold a taut line on her I've seen her do this before. Yes. Ahoy the tug Take up the slack and get her straight in the channel Hold it against the current Any other ship would have held steady for the two or three minutes. We stopped but not the old rap's family And now when the tug tightened up in the halzer pulling at an angle across her bows She wouldn't respond wouldn't budge The old girl wanted her own way. She was just as stubborn as ever. Ahoy the tug We're still drifting open up to full speed Can't find her Never saw a ship back like this the heavy halzer was pulled so tight It was humming and tug's paddles with her engines full whipped up the water like a middle race And then it happened the heavy towing chalk tore loose from the deck The halzer began sliding across the bow ripping out rail's tunches like matchsticks Then my fault was going to sweep under the crux of the spare anchor the anchor that maggie was standing on She tried to jump clear but she was too late The great anchor had tipped up on its side clasped her about the waist like a monstrous arm of steel It had carried her with it and swung down and over and smashed against the side of the ship She went into the water take charge of the deck net i'm going in after The net was that maggie. Yes, sir.  She's killing Let go the port anchor I hadn't told charlie and I didn't say anything about it to captain culture But I stood there and I knew it wasn't any use Because I'd seen the way the heavy anchor had carried her over And then swung in to smash her against the bow before it dropped her into the water And I'd seen the way that water beneath the bow was all colored red Under at late afternoon when the tide turned and she floated clear of one of the mooring boys And the next morning we tied up in the london docks The man had been happy at coming into their home port But now they remembered how she'd been happy to Their own darling I'd never before seen a crew leave a ship so quietly And some of them when they reached the wharf Turn back and cursed her under that breath Finally it was only charlie and I alone on the quarter deck and captain cultures. It was below somewhere in the cabin She never wore it made The ring She never wore it, but she she would have charlie. I know she meant to She was just having a little fun with you. That's all with all of us on board. Why did the brute have to go for maggie? Why? I guess there's Not much answer for that She's everything I've wanted Everything. Yes charlie. I know I talked her into making the voyage It was my idea. It's no good charlie this kind of thinking. I guess you know that I don't know She's everything I've wanted charlie Over here captain I'm going ashore The ship keepers come aboard now. The two of you are free to go whenever you like. Thanks, sir charlie, I Nothing I'm designing command of the morning. I'll never sit foot on board her again as long as I live I feel the same way, sir Well, come into the company office in a day or two and sign out for the log Good day, gentlemen charlie we Better go ashore too. We're done here Yes, I I suppose we are I'll arrange to have our gear picked up later There's no use of uh, uh captain look out Missed him But but yard arm off the main mast fell right behind him. Ah, you missed me your murdering brute And that was your last chance Ned that yard was made faster dunganus An art falls out of the tops with the ship lying still at the wharf. Yes charlie come on. Let's go ashore wasn't the devil satisfied for one trip So now we have stopping her. How many more does she want to kill charlie? That'd make me Charlie was 10 years older by the time we reached home And it was two weeks before he'd do anything more than sit in his room and stare at the wall Saying nothing Captain court has to carried out his threat and resigned from the company the morning after we docked And I filed my application for a transfer The abs family was reloaded and ready to sail But she stayed on lying at the wharf with nobody to take her out And that's the way things stood for two weeks until one morning a bombshell dropped Hello Ned charlie I wondered where you went this morning and I Left the house early day. How do you feel fine? Ned Mr. Apps tells me you've applied for a transfer Mother ship. Well Yeah, yes, I did as a matter of fact. You saw all man apps.  Yes, they did Me you You're going to skip of the brute. That's right land. But I I thought it's a short voyage north atlantic run You're awfully glad to have you along somebody I could depend on if You'll feel like signing on again charlie. Of course. It's up to you All right charlie I'll sign on again. We glad to We boomed out past the sheerness light and headed north hugging a lee shore in a stiff breeze The ship drove ahead as steady as a barge. It's scarcely a roller or quiver But in spite of the smooth and easy way she handled I couldn't help feeling uneasy I could sense the black spirit of her Brooding somewhere down inside Mocking and taunting us with her bloody memories And waiting for a new chance By nightfall, we were running hard in along the ketting coast where those rocky headlands break at intervals out of the shelving sandy beaches The onshore wind held steady in our quarter and the sun sank down behind the land some three miles away It wasn't quite full dark yet when charlie sent for me. I came up to where he was standing alone near the wheel That you need right charlie. Those and said you wanted to see me. Yes I did send for you Ned Well to steady as she goes close to the wind I've been standing here thinking about maggie ned I should scramble around over the decks making friends with everybody Having the time of her life charlie. You've got to stop it. No, I'm all right I like to think about her. It's this ship and all the memories around it. It's what I was afraid of. No, no, it's all right Ned I want you to take charge of the crew and give an order Of course, you'll question the order, but you'll carry it out anyway.  What's What's the order charlie? Have all hands prepared to abandon ship. What? But why there's nothing wrong mr. Wilmot It is not an officer's place to question an order by the captain He'll do as you're told Yes, sir. You can give the order now mr. Wilmot charlie. I can't let you Very well captain All hands on deck stand by the boats Prepare to abandon ship All right, young swim find your place in the boats. I'll take over the wheel. Hi, sir You don't know what you're doing charlie. We're in no danger. There's no reason to abandon ship You're always in danger about this black-hearted brute I've put on the quarter now you can get the boats in the water when she yields. Very on steady Easy on all right now I don't have any trouble running ashore to that beach there at the south Hey, what about you? I'll hold her steady until everybody's clear You better go over the side your boat standing there. Oh, no, not until you do. I'm staying with you charlie.  No charlie. Not while I'm here mr. Wilmot You will abandon ship and take charge of the boats in the water and that's an order charlie. I can't Mr. Wilmot very well captain That's a spirit lad And who be orders and step lively And you'll be a seaman yet Good luck. Night. Thanks charlie Stand by for you in the boat. Of course lad Fine Bye I slipped over the gunnel and dropped down into the boat the trail the long side on a line from the rail I'd hardly hit the bottom of the line slacken. I knew charlie had cut us loose from the ship He was alone on a now alone in the night sea with a black brute He's laid it over away from the wind charlie put the helm over hard With a terrible shudder of her dark sails and a smother of white foam from her bows The great ship healed about in a sharp turn and then began to drive ahead like some mad thing before the wind Straight before the wind and straight toward the shore look sir the rocks on the headland She's going to smash herself faster and faster. She plunged her head through the weltering seas faster and faster on the back of the Gale while the black hearted spirit of her screamed in the rat line Look sir the rocks no and now for one long instant She hung poised at the top of a plunge and then drove smashing downward on to the We stood by As close as we dared by the killer ship pounded herself to bits in the surging sea But we didn't find my brother charlie And from the first minute I knew we wouldn't because just before I'd left the ship there by the helm In the light of the binnacle lamp I'd seen the thing he was holding Clenched tight in his hard brown fist. It was a tiny platinum ring Set with a blue white diamond Escape is produced and directed by norman mcdonnell and tonight brought to you the brute by joseph conrad adapted for radio by less crutchfield Featuring dano hurley he as net wilmett and eric rolf as charlie wilmett With nina cardin as maggie jeff corrie as captain colchester Wilms herbert as german and parley bares the father Music is conceived and conducted by wilbur hatch Next week you are far into the remote hill country of afghan Caught in an ambush by the fierce paethan tribes Trapped in a hopeless fight From which there seems No escape Next week we escape with rudyard kippling's gripping story the drums of the fore and aft Good night then until the same time next week when once again we offer you escape This is cbs the columbia broadcasting system


Well, what is going on with squad and welcome back to our channel So you guys really enjoyed when we tried trying Filipino food for the first time We did do one thing wrong though, which was a halo. How we hollow hollow and I saw the comments Yeah, we were supposed to mix it up. It means mix mix. That's what hollow hollow So for all the filipinians filipinos filipinos, I think that's how you say that we're commenting on that video Thank you so much for helping us out It's hollow hollow mix mix so disclaimer for this video if we have any people from India that know or think that we mess Something up comment down below what we did wrong because once again, we're from America We had no idea what we're talking about and this is actually like one of the first times I think I'm trying India We got more than last time we have to ramp it up a little bit This is as traditional as it gets for being in the middle of Florida So if you guys have any other places you guys want us to try let us know We really enjoyed doing these types of videos and trying different types of stuff. They're like guacamole No, it's not. It's something way different than guacamole. And also yes PSA disclaimer, you know, we might say some of the words wrong We might do some of the things wrong. I think this is lamb. I think this is the lamb Or that no, that's the lamb.  We'll look it up I love yellow rice. I'm sure the yellow rice snacks So last video trying Filipino food we got six different menu items including, you know, the desserts and everything this time We got ten Nine okay, so we got nine but I think we have Unless this is something different and we definitely have time. Yeah, that's the bread. This is the breads. We have two different breads Yeah, so we have ten different items for this. This is gonna be very very crazy Just looking at these for the first time I can't wait to dig in and also the place that we ordered from had a full five star perfect rating on TripAdvisor from over a hundred and seventy people gave us a five star So if this is not good, I'm gonna be surprised. Okay, so before we get into the actual entrees I think we should start with the appetizer They had a lot of bread on their menu. So and we bought two different types. I think this is the garlic one Yes, and then was that the garlic? I think then I think this is the cheese one. Oh my god Oh, this is way different than I thought. Oh my god. You're kidding. It's the cheese one So that's kind of like a Mmm. Oh my gosh, is this literally what you guys eat? Nothing you guys but like we don't eat stuff like this. This is like it's like different I thought like a flat bread, but it's not toasted. It's just like I was expecting for garlic bread. Mm-hmm. This is That's the cheese. Okay, switch. Oh my god. Oh good. It's so much better Oh, and by the way, if you're new to our channel make sure to subscribe But we are gonna be rating everything that we eat after we're done eating it. Oh, this is good The bread is just like amazing. I bet you they cook this in-house.  All right. What do you rate the garlic and the cheese? I like the garlic game ten ten the cheese. I would say a six on ten. Why not enough cheese. Just because it's too dry for me Okay, but I like it. It's actually really good. I would eat it again There's not a lot of cheese down here, but I'm gonna rate both of these a Eight out of ten because I love bread. I love bread Whenever I go to restaurants, I get bread and this bread is very good quality.  I think they have it on there Probably okay. So for the first appetizer is the Manchurian Manchurian Manchurian Manchurian. Sorry again if you're saying it wrong. Chicken, chicken bites. Yeah, they're made with chicken bites Yeah, this looks so good. Oh my god. I can't wait to dig in just like that like presentation Yeah, even though it's not like a crazy presentation. It just looks amazing too. All right ready Dude, this smells amazing. We might have to start ordering Indian food. Ready? Mm-hmm. Oh, yeah. Oh, yeah This is some good-ass chicken. The more I eat the more it tastes better.  We have so much food here. I don't want to fill up but what do you rate this one? Manchurian, how ever you call it? I would say not a 10. This is time-out-time 100% for me.  It's chicken guys, it's chicken with a little spicy kick to it Oh it's so good. I'm eating this later. We're saving this for later. This is razz malai razz malai r as malai r as malai ma ma ma malai I have no idea. What is- Was it a sauce? Razz malai.  Is it? Yeah. This is a sauce. Oh what is it? No it's not. This is the razz malai or however you call it. I'm going to get you guys real honest opinions on this. Wow, this like takes my breath. No, it takes my breath away. It's a weird It's like the same thing. This is gulab. It looks like a donut. This is gulab jamun Not gonna lie. Whatever the circle thing is is good. Now you call this one gulab jamun The gulab. Alright, we're gonna try this one too. Phil's gonna try it It's so weird. These are that's definitely tradition right there. Hold on. You might like this. This is like a sugar glaze Okay We smell it.  You wanna try a little bit? I wouldn't lie to you. I swear I wouldn't lie to you Think of a cotton candy grape. To me it does taste like a cotton candy. Okay, this is way better. Oh, these were the desserts These were the desserts. So this is the dessert. Yeah So no hate. I like this one better than the other one. I'm gonna give this a five out of time Yeah, remember we ordered two desserts. They also had ice cream on the menu. Why didn't we order the ice cream? Oh my god, they did Yeah, they did. What is wrong with them? We're a dog. We didn't even order them. What's wrong with them?  Okay. We didn't or we only ordered two. Okay So this is the one we did with the lamb. This one. And it's a tiki mazala, mazala This is literally lamb. We picked between lamb and donkey Was it dog? No goat. Goat. I don't know why it's a dog. It was between lamb and goat We picked lamb because I've never had lamb before. We wanted to be different. I wanted to get chicken But feels like no, you can't be chicken here. Yeah, why would you get chicken twice?  All right, let's see. This is busting It smells good Smell test pass, right? All right This is the first time me and Mariah trying lamb. I'm nervous. Oh my god. I got a good nugget right here Ready for this, babe. We're doing this together. Is this the chicken bite? It's lamb. It's lamb. Trust me. It's not chicken Ready? All right, I'm gonna rate the lamb 7.9. You give it that high? 7.8. 7.8. Yeah, I really like it. It tastes like steak Yeah, the sauce is good. It's really not my favorite cup of tea, but it's good. I'm eating that later too Oh, you know what this is? This is the fried vegetables Oh, this smells so good. We're saving this for the end. Oh my god, smell it This one smells like it's gonna be amazing wait for the end so we can review that because I feel like that might be my Favorite low-key. I might have to change the chicken one. All right, so for this next one We want to try one of the rice's I believe this came as a side order to one of these meals Yeah, it is. Actually, it's it's lemon rice. Oh, it is. It's lemon rice. Yeah, lemon rice. Yeah, I told her that's lemon rice It literally looks like a lemon It's not bad. Hold on. Do I eat it? Some of these things you have to take more than one bite. Are you liking it now? It's definitely a different it's a different texture than normal rice, you know Okay, what pretty decent you like it. I'll give it a five out of 10 You know, it's not my favorite, but I feel like the aftertaste is really good. Like you can really taste the lemon Oh, yeah, it's like it feels like I just have like a lemon mint or something like that I'm gonna write this six out of time because I don't hate it The rice is just a different texture than I'm used to being in America. You know We have our minute-made rice, but uh, it's just really good. I can tell this is good quality This is what good quality food tastes like we're not used to it. Like I said in the last video we live in America Everything's processed here. Yeah, this is probably some good quality rice. We don't even know it. So what? What's your rating on that? Six out of 10? Okay, so feels a little bit higher than me. Oh, we get some fried food up in here I think they're fried vegetables. I think that's what this next one is. Okay. I think this is pakora Which is like fried vegetables fried vegetables These don't even look like the typical fried food. These look like like they use such a good batter Like this is an onion ring or an onion Oh, yeah Try this. Are you doing onion? India onion rings, right or onion sticks, whatever you call. All right now. We're gonna try a zucchini. I think it's a fried zucchini Look at the inside of that It looks so good. I will say it's pretty decent. I'll give it a five out of 10 Oh, this is a fried potato. Oh, let me try that There's like a french fry about fried. You want to try it? I feel like we should be dipping these in something. You know what I mean? I don't know if those sauces are what it's for guys educate us in the comments because we might be getting this all wrong I don't know if we're dipping them in the right thing or what but That's some weird sauce ready for this. I don't know. Yeah, I don't know if I'm supposed to be dipping it in this spot That's weird That is a weird wild different flavor that I've never tasted before This is crazy. What did you dip your finger in that and actually try the sauce? Tell me what it tastes like Cilantro cilantro. That's what it is. That's what it is. It's literally straight up ground cilantro Yeah, that's cilantro 100% if it literally feels like I'm eating a cilantro and I'm not a cilantro person Like I'll eat it in my stuff, but I'm not like a big fan of actual cilantro. Damn. That's good though That sauce is fired. All right guys. We're getting to the finale. I can't wait for this part This is gonna be our favorite this one. I want to try this. It's like fried rice with veggies Yeah, we got to try india fried rice. I feel like everywhere we go You have to try the fried rice if they have it smells good because we are fried we are rice lovers Every time we get sushi, we always get like a side of fried rice. So she will be the judge on this You are the fanatic No, you get rice more than anyone in this house Mmm, so it's the same rice as the one that they use for the lemon rice Yeah, it's like so different It's crazy like the different type of like flavoring and just everything getting there getting out like the middle I did. I got all the no right there Yep It gets better the more you eat it. Hmm, doesn't it? I feel like it's more like has more water or moisture 7 out of 10 Pretty good. Every bite that I've taken out of this fried rice so far has just been getting better and better So I definitely recommend this if you want to try india food 7 out of 10. This is a 8.4 Yeah, you're in the fried rice on the mashed potato. That's good. Honestly that tastes just as good as the Garlic bread dead. You know what I'm saying? That one's smacked. All right guys. This is the final Final finale product that we're trying out and this is called this is the samosa chat So there's two samosas served with a chickpea curry topped with various chutneys chutneys Chitneys chutney something like that And it literally just looks like like a pie from the looks of it, but this is a samosa. This is what the samosa is I'm guessing it's like filled with Meat and stuff so I guess I take one and you take the other one, right? But I'm excited for this one ready. You just want to go in This is good different. You gotta try this. This is fire. It tastes like I'm literally eating Thanksgiving all in one little fried clump So my rating for this would have to be a two out of 10 It's all right, babe. So for me, I'm gonna change my opinion on the fried rice. I'm gonna give that a nine I'm gonna give this an eight and a half. Wow. You like it that much, huh? I really did enjoy it. It hasn't kicked to it not gonna lie And I feel like indian Indian food a lot of it has spices and a lot of kick to it I think but this was this was good. I liked it. I'm surprised you did it literally tastes like Thanksgiving All right, so me and mariah grabbed our favorite out of every single thing you see here What he grabbed though, too is is my second favorite Yeah, this is what I'm holding is my favorite 100% and we're gonna show it Comment down below what your favorite is if you've tried these before or just what you want to try. Are you ready? three two one This one the garlic brad. I think this is the what is this one called the garlic brad's fire. Oh my god. This is the Men men churrin. Sorry guys. I'm pronouncing this wrong. This is actually really fire I wish we honestly had this one last because actually if I had it last so I would have doubted it I wish you ordered two of those because I'm gonna be eating that for dinner tonight And this this garlic Like that is fine. I really can't stop eating it like this garlic brad is honestly my favorite all around Indian food I'm gonna give it because I can go there I'm gonna get everything all around like a seven and a half out of 10 Just like I said with the other filipino like Indian food you guys make it with such good quality products We're not used to like we're not like this dough this batter is freaking yellow And like we're not used to like some of the stuff that you guys make with and it's just like I wish we were because you already know like even though fried food is not good for you I bet you this fried food is better Then the fried food that we make with all the nasty oils and processed You know chemicals that go into all of our food. So like honestly, I'm impressed I like it more than I thought I would We definitely are going to be ordering this because me and Ryan we do order a dinner and honestly We should start ordering in this because this is only like 10 minutes on the road Yeah, it's really really would you eat this again like you would order this for a dinner. Yeah, I definitely would It's really good. But you guys I hope you enjoyed us trying Indian food. Make sure to comment down below the next ethnicity or Countries food we should try because I'm super excited to try more and we will see you guys in the next video But until then peace. Love you guys


So let's take a look at another form of the equation of a line. So if a line is vertical or horizontal, we've seen that we can use either point to write an equation for the line and get the same equation. But what if the line isn't horizontal or vertical? So if we consider the line through 2, 5, and 1, 3, we found the slope and then wrote down the equation of the line using the point 2, 5. But what if we'd use the other point 1, 3? Well, we could still write down the equation of the line, but it looks different, even though they are the same line. And so the question we have to ask is, which one of these is correct? To answer that question, let's do a little bit of algebra and solve both of these equations for y. The first equation, when we solve for y, gives us, what if we solve the other equation for y? And we see that after we've solved both equations for y, the two equations are in fact the same. And so it doesn't matter which point we use. And what this suggests is that there's another useful form of the equation of the line, which is known as the slope-intercept form. So we say that the linear equation is in slope-intercept form when it is in the form y equals mx plus b. And it's worth comparing this to our equation in the point-slope form. The advantage to the point-slope form is that as soon as you have a point on the line and a slope, then you can write down the equation of the line. So, for example, as soon as we found that the slope of the line between 2, 5, and 1, 3 was 2, we could use the point 2, 5 to write down the equation of the line immediately. What this means is that you never want to write the equation of a line in slope-intercept form. Slope-intercept form is only something you do after you get the equation of a line. So, for example, let's put the equation in slope-intercept form. And the thing to recognize here is that the equation is in slope-intercept form when it's in the form y equals something. So we've essentially solved our equation for y. So let's solve this equation for y. And now our equation is in slope-intercept form. How about writing the equation of a line in slope-intercept form? So let's try to write the equation of the line through 3, 1 with slope negative 2 in slope-intercept form. So the important thing to remember is that the easiest way to write the equation of a line is point-slope form. And once we have a point and a slope, we can write down the equation of the line immediately. Now, because the problem asks us to do this, we should rewrite this in the slope-intercept form. And we can do that by expanding and solving for y. Now, in the grand scheme of things, there's actually no good reason to write the equation in slope-intercept form. Point-slope form is the easiest and fastest way to write the equation of a line, and we really don't need any other form. On the other hand, if an equation in slope-intercept form should fall out of the sky and hit you on the head, then you can immediately identify certain properties of the corresponding line. I'd also watch where I was walking. For example, suppose you're given the equation y equals 3x minus 7, and you want to find the y-intercept. The y-intercept occurs when x is equal to 0, so we'll substitute that in and find our y-value. And remember, the intercept is a point, so the intercept is going to be 0, negative 7. And this suggests the following theorem. The line with equation y equals mx plus b has y-intercept, well, you know, memorizing theorems in formulas is actually the worst way to learn mathematics. It's more important to understand concepts, so you don't actually need this theorem, as long as you keep in mind what the y-intercept is. What if I want to find the slope of a line? Well, if I have the equation of the line in point-slope form, I can read off the slope immediately. But what if the line is in slope-intercept form? To answer this question, we need to remember the definition of slope, and we see that we can calculate the slope of a line between any two points. Which means that if we want to calculate the slope of this line, we need to find two points on the line. Since the equation of our line is in the form y equals a formula involving x, we can choose the value of x and compute y directly. So let's let x equals 0 and find y, which gives us one of the points on the line, 0, 4. Again, the useful thing to remember is that if we multiply a fraction by its denominator, the fraction disappears. So in this case, if we let x equals 5, our fraction will disappear. Oh, but that's too easy. Since we want to work with fractions, we'll let x equal 3 7s. And maybe not. Let's try to do things the easy way. So we'll let x equals 5, substituting that in, and we get y equals 2, and so a second point of the line is 5 2. So now I have two points, and that's all I need to calculate the slope. So the slope between the two points is, and that slope works out to be negative two-fifths. How about the slope of the line with equation y equals 2x plus 5? So again, all we need are two points on the line. So we'll let x equals 0 and find our y-coordinate, which gives us the point 0, 5. We need another point, so we'll let x equal, I don't know, 1. We like 1. If we let x equals 1, our y-coordinate is 7, and so the point 1, 7 is on the line. We have two points on the line, so we can find the slope between these two points, which works out to be 2. Or maybe we have the line y equals minus two-thirds x plus 7. So if we want to find the slope, we'll find two points. If x equals 0, then y equals 7. Since we have a fraction with a denominator of 3, we might want to let x equals 3, and so y equals 5, and so we have two points. We can calculate the slope between those two points, and it's negative two-thirds. So remember, we calculated the slope of the line with equation y equals negative two-fifths x plus 4 to be negative two-fifths. And we calculated the slope of the line with equation y equals 2x plus 5, and that slope was 2. And we calculated the slope of the line with equation y equals negative two-thirds x plus 7, and that slope was negative two-thirds. And so as the saying goes, once is an accident, twice eh, could be coincidence. But three times is a conspiracy. So many of the things that have happened on the internet can only be explained because it's controlled by a c- There is no secret cabal that controls the internet. Totally irrefutable evidence. Mathematically, we might look at this as follows. If you see a pattern, there may be a pattern. So we see the coefficient of x and the slope are the same. And so we get the following useful result. The graph of y equals mx plus b will be a straight line with slope m. For example, suppose we want to find the slope of the line y equals minus three-sevenths x plus five-thirteenths. Now, we do have our theorem, but if we forget the theorem, it's not a big deal because we can find the slope by finding two points on the line. All the theorem really does is save us a little bit of time. So let's assume we remember the theorem. We should read the fine print. This only works if we have the equation in form y equals mx plus b. So we'll check it out. Our equation is y equals minus three-sevenths x plus five-thirteenths, which is what we need. And so our theorem says that the slope will be the coefficient of x negative three-sevenths.


Timekeeper is in the room in the back we have 40 minutes for zero awesome, so we're gonna do like Don't tempt us it's not nice to send people so Welcome To our talk repurpose purpose using gets died for supply chain security. This is Ed. I'm Ava. Hello so Couple things but housekeeping both Ava and I really do well with questions as we go in the talk So something comes up where you have a question that occurs to you It's very likely it's occurred to someone else and it's very productive you actually answer it and we find that super fun Because it's much more interesting to interact with the audience for you to ask it and us to answer it And we probably have one that we can say pretty quickly Absolutely, so second thing We are probably going to ask you a questions in the course of the talk now We're not going to usually ask for verbal answers although that it could happen there may be a quiz But usually we will ask you to raise your hand just to get a sense for where all of you are as an audience because that Impacts what we choose to present. Yeah, so Both of us have a scientific background. And so what do good scientists do in this situation? Occasionally make physics jokes. Yes, that's you We test our theory why We calibrate so quick calibration How many of you can raise your hand?  We usually only get about 80 or 90% for that one. Nice It's really tragic than the incapability of hand raising that happens So a little bit of her street from a Little bit history first. So how many of you remember the colonial pipeline hack? Awesome Good with hand raising Now when that happened You wound up with the cyber security executive order for the Biden administration that also familiar to folks fabulous so For a lot of people that's where supply chain s bombs first bubbled up to their consciousness But there's been a lot that's been going on for a long time, right? So for example spdx Which provides an s bomb format goes all the way back to February of 2010 and they've been diligently working in this problem space since 2008 is where this problem landed on my lap at Cisco and where I had built out an industrialized S bomb process meaning tens of thousands of software releases shipping every year for which we had to have the complete notion of what was in them both for open-source license compliance and Also for third-party security So Mistakes were made there's no question about that any time you move into a new field That early in it, you're going to make mistakes and that was absolutely something that happened there But in the process I learned a hell of a lot about the available airspace Which is always important because if you remember the mistakes that have been made you can try and avoid them in the future Which sort of flashes us forward to this colonial pipeline hack situation So again, that was May of 2021 Very quickly you got the cybersecurity executive order time a whole bunch of friends of mine in the spdx community Which I hadn't really been participating in for about a decade at that point reached out and said you remember some of your crazier ideas Now may be the time and so in late May There was the first hip-bomb talk occurred and presented the crazy idea that you're going to hear today people liked it And so after a whole lot of background conversations With many many people in sort of what I would call the pseudo public meaning that every all the slides were available Everyone knew it was going on, but we hadn't really formed a community. I didn't really announce it We figured okay, we've got a website up finally We finally went and got a Twitter account We should probably announce the public community start holding regular community meetings and start actually working on a spec and a bunch of proofs of concepts and things and That went well You can't do it. You can't call it public or even really work until it's on Twitter. That's true. It's not real So in the first couple of weeks we got about 82,000 impressions. We had about 19,000 people who went by and visited the profile We had, you know, five to five hundred five point six thousand people visit the website from all over the world Like it was a pretty successful launch for a Twitter account that had never tweeted before of a tiny open source product that didn't really have much yet besides a Draft of a spec and some words we copied out of the spec and a white paper and a white paper Yep, so again that went well, let's see if this clicker works. Can I go back? Yes, I can go forward Wow Okay, so this is where I step on the picture Gosh, we can't see that it's baby Yoda It's baby Yoda sipping some tea Because I stepped into the supply chain space completely new to supply chains I've been working at open source for a long time 20 some years everything from hardware security and firmware to cloud infrastructure to databases to other things but had not really Focused on supply chains didn't know spdx from cycle and DX when I started like great. I have a New thing to learn. I'm gonna try taking a beginner's approach to it and just learn from everybody else And I spent about six months Going from community to community reading docs talking to people finding out what's going on here And it looked like that Is this what it looked like to everyone else as well? I Mean not the disappearing screen is this what it looked like to everyone else So how many of you saw it this way when you first started looking at supply chain security in open source? Yeah Even as someone who's been everywhere from Linux kernel to hypervisors on up I Could trace a supply chain in one community or for one project, but thinking of the whole domain I didn't have an answer no one that I spoke to had an answer either This picture probably won't come through either. It's baby Yoda looking very overwhelmed like oh face This deck is gonna be a little bit more challenging with bad contrast hmm So anyway, well if you feel like the baby Yoda here going, oh, you're not alone even today A lot of folks are still really overwhelmed by the the the number of different tools trying to fill the space and not Seeing how they all fit together. So let's try and simplify that and whatever one wants to know Is that my safe? Underneath all of the tools and the technology we all want to know can I use this piece of software? Does it contain a vulnerability? Does it contain malicious code? What happens with its next update? so I've been around long enough to become slightly opinionated about the world and One of the things that I learned the hard way because I have this sort of mind that thrives on abstraction of the world It becomes very complicated and so having made again many mistakes One of the things I've learned is you want to focus on simplicity Because simple things are reliable. They work simple things are performant and simple things are secure But the problem is that humans tend to want to make things very complex And in particular some problems are complex, but often We make problems more complex by how we choose to think about them So just take a really simple example of what I mean here If I have this linear picture that probably looks familiar to all of us from middle school And I've got a bunch of points that I look at and say ah the model is complex enough I need two parameters to describe every one of the points here because they've got some place an X and some place And why that's actually not the complexity of the system here. We're looking at we've made it that complex If you just tilt your head to the side a little bit You realize how simple it is You could often simplify a problem space by making a perspective change And so, you know very often that's a productive way to approach these things so when I look at the supply chain problem space from the perspective of Building open source software communities and providing the stewardship for them over time Three things stood out What is this software artifact is it a piece of source code is it a binary someone else gave me is it a docker image That is the identity of the software Is the thing that we have to be able to see and understand and represent. What are its dependencies? What's in it and What metadata is associated with it? What else do we know about the software? This is really everything else that isn't its identity or its dependency graph So I'll dive into these for a few minutes. These are my slides. I think of course. Yeah An artifact in our terminology here is really any software object of interest Could be if you can see the tiny little writing there and dim gray source code file object file Dot SO shared audit file dot DLL on Windows. It could be a jar file a class file at Deborah dot rpm package They all have one thing in common software artifacts can be represented as an array of bytes because that's how they're stored on disk and So any two artifacts are equivalent if and only if the byte array Representations of them are equivalent based on this it should be possible to represent each one with a unique ID and That ID should have this the following three characteristics. This I think is sort of the the one of the hearts of get bomb The ID needs to be canonical that any two independent parties can derive the same Identity when presented with equivalent artifacts needs to be unique right non equivalent artifacts have a different ID and Immutable if you change the artifact you inherently change the ID as well a Bunch of things that are talked about today are not identity The file name I Can move a file between directories. It's still the same file I can change the content in the file but keep the name the same and it's a different file So file name and location doesn't work same as true for URLs if I fetch it from from the website I fetch something from that URL tomorrow or if you fetch it from a different IP address in a different country You get different content URL of pearl. Yep. That's what I just meant and then the Sorry, Alan. This one's at you Minimum elements of an S-bomb The the Linux kernel gets built by a lot of companies if I build one and Ed builds one And we tell you these are both the 5.17.3 But we might call it something different. I call it the Linux kernel and it calls it the kernel They're from different suppliers. Do you know if the same files were used the same source code files? You don't There's about 50,000 Files in the kernel tree any given build probably uses about 3,000 of those files But you don't know which ones when someone gives you a binary you have no way of knowing that today and That's sort of the fundamental problem here So Along with simplicity. I've also learned not to reinvent the wheel Especially don't reinvent the wheel only this time triangular because you have strong stability requirements This identity problem is already actually solved Very nicely for source code by get So how many of you use get? How many of you understand get? Yeah, how many of you have a really strong in this room? How many of you understand the merkle tree underneath the get? Okay, okay good good. So you eat a lot of this so basically For those of who are you who are less familiar get is actually Assigns a get object ID to every file that you check in So if source code files are artifacts For source code files, we have an identity for them that while it's not used for every source code file in the universe It's used for the vast majority of them So most of these things are already identified and indexed as well And it's very very simple the get object TV across the contents which are just the byte array of the file gives you a 20-byte hash That you can go and find and see exactly What the identity is that I use in my local repo that's used up on github that's used today That's used a thousand years from now. It doesn't change Speed up a tiny bit. Oh, I think it's you, but I can do it Yeah, so effectively get is not actually really a source code management system Get is actually an object store that uses merkle trees masquerading as a source code management system And so what that really means is a merkle tree is just something where you've captured all the leaf nodes with an identity that's unique immutable and canonical and Every non-leaf node gathers together its children in such a way that you can't Misrepresent that and this is one of the powerful things about get because it allows you to actually if I give you an ID for a commit or a tree and get I Can't give you something that doesn't match it and get away with it Verify all of the descendants all of the dependencies in that graph. Yeah Which is which is why by the way get is both history and get is both ephemeral and immutable at the same time And so We maintain and this is sort of one of the fundamental things that get bomb maintains And this is why get bomb is get bomb is that your best bet is to use get oids as your identifier for software artifacts They're a suitable identifier and they happen to be extremely powerful identifier because the vast majority of things that matter are Already indexed this way which brings us around to dependencies so When you look at what went into this artifact the dependency graph of the artifact So here's a really simple example. You've got a bunch of source code Something transforms that source code in a case of C a compiler into the object files Then some linker links them together into an executable You can then think about a running executable something running on your software on your system And in the case of C it's very often true that you need to know not just the executable that you're running But you also need to know what so's with their attendant trees were linked into it because otherwise You can have a vulnerability that sneaks in but it's not a vulnerability of your executable But is a vulnerability in combination with that shared option now this works all across all languages Java you compile Java files to classes you load them with class loaders into running executables And so you might look at this and say what if we just generalize and this is what get bomb suggests is Whatever language you're using whatever the artifacts you're dealing with Generalize this and start talking about the artifact dependency graph Now this is a directed acyclic graph. We will sometimes improperly call it a tree But just a graph and then use get oids as the artifact IDs in this graph Very simple every language has libraries and get they can compute the get oid and if you don't have one it takes about 15 minutes to write one in most languages that I've tried super easy now Then you might say okay. Well, how do we capture the graphing this of it, right? We've identified the nodes in the graph. How do we capture the relationships and so what? get bomb suggests is for each artifact that has Some inputs to it We simply capture what we call the get bomb document that expresses the relationship now in the case of artifact 2 and 3 They only have leaf nodes as children So that looks like blob space and the get void of artifact 4 New line terminated record blob space to get rid of artifact 5 new line terminated record You put them in lexical order. So again, they're canonical everyone gets the same one every time and you the same for artifact 3 and Then for artifact 1 and this is the merkle tree in this of it all You simply start the same way, but because artifact 2 and 3 both have children You include a stands up for the get object ID of their get bomb document Which means that you've captured the merkle tree in the course of this and this is by the way No, the projector did that last there we go. Yeah, this is by the way the same Almost the same very heavily inspired by the file system structure of git It's not precisely the same because git does care about things like file modes that are uninteresting to us. Yeah, but it's heavily inspired by get so Metadata the third factor here is what else is known about it I'll quote one of our colleagues that an S bomb is just a format for organizing metadata that describes the makeup of a thing It's really everything else. You know about it So looking back at that graph one might say that any artifact can have metadata associated with it source code file could have a license associated with it a binary could have a supplier or a contract terms or a price or a CVE Those are all things that can be and are represented in S bombs today And so we've been working with the S bomb communities like spdx to create a way to inter relate these Git bomb is not an S bomb it complements them So if you have an S bomb document, you can as of as pdx 2.3 the current draft It's been approved and merged waiting for them to issue the the new spec update You'll be able to reference a git bomb document directly from your spdx document and say this artifact has all this extra information and It's that one by using the git void So you can think of these as two different domains in however you're tracking this in your your excuse me Yeah, what was I gonna say on this one? I think I just said it Running ahead of myself on the slide sorry about that. So if this is what is known about a piece of software You might ask yourself How is it known and how can you trust that knowledge? Have you ever thought about this show of hands? Have you ever thought about how do you know the things you know with software not that many hands?   Are you just gonna run it because it's signed Good answer And yet a lot of people are focused on that as the answer right now, right? A signature is only as good as the chain of trust in the signature chain It could still be compromised beforehand all that the site the signing of the software has done is proved to you when you verify it That it hasn't been changed since it was signed if you then verify the signature through some other channel You might also know who signed it But not what they signed or that what's in it is the thing you think it is Which kind of gets down to this question of what is trust itself? What is trust in computing? It turns out this is a really complex question I'm gonna touch on it a little bit actually edited a book last year that was just published called trust in computer systems in the Cloud if you want to go down the rabbit hole of contemplating How do we trust our devices and how do we trust each other through our devices? What does it even mean to say I trust my computer when I type in the password or I go pay a bill? Who am I trusting when I trust my computer and my banks systems? It's a fun book. It's like this thick. It's super dry Don't read it. I mean, please do it's it's good. I don't make any money from it There's no answer. There's no easy answer answer to this Going back to the 90s Dorothy Denning Said this in refutation of what was then the prevailing wisdom from a government issued book called the little orange book that Said that a that the orange book said that a computer system could be built in such a way as to make it arbitrarily trustworthy and Dorothy Denning said no, that's that's not true trust is not a property in a thing It's an assessment of the thing based on experience made by some observer at some point in time in some context It might be trustworthy here, but the same device is not trustworthy running in space It might be trustworthy for my bank, but not for some other function and so whether it's an S-bomb or a Binary scanning tool that you use as your ingesting software downloading a package from the internet. These are our mechanisms To either look at someone else's declaration that they trusted it or decide for yourself that you want to trust it By combining them, maybe we get a little bit more of a sense of trust But trust is always Time-dependent asymmetrical and contextual and that's sort of the hypothesis or the main thesis rather of the book Last year just because you trusted a piece of software. I gave you today. Does that mean you should trust it a year from now?  No, it's asymmetrical and same thing again. It's contextual so Built tools. Oh built tools. That's you. Yes indeed So Context is a really interesting part of trust Um, and so when you look at those tools part of the problem you have with build tools is that build tools transform their inputs and They transform their inputs in fundamentally destructive ways meaning you're losing information In the course of compiling your software And So, you know when you look at this you're like, okay, so the bill tools transformed their input So how do we actually figure out what happened there? so you could try And that will tell you that it contains apples and cinnamon and flour and eggs and app and other apples so This would be sort of scanning the inputs on the desk. So if you how many of you build code How many of you ever built a piece of code where not every filing your repo gets built into it? That should be all of your hands by the way So knowing what's actually there as a potential input or even what's it? You know No, we haven't We'll get there. You're a great straight man, but give us a second Surely this will save us take your output point to scanner at it. So we're gonna turn the entire audience Into a scanning tool What kind of pie is that? Shout it out shout it out So we have a play-doh pie. We have a This is not a pie. Are you a Taoist sir? I It's the image of a pie good good good other other ideas about what kind of pie it is as these scanning tools Pumpkin blueberry. So now you understand that the play to the poor person trying to run scanning tools on the output Even even if you you know take a little cut of the pie and look inside and go oh, I see apple slices but if someone has let's say a Peach allergy or strawberry allergy.  Yeah, could be a peach pie Um, so post-hoc scanning while if there's nothing else available to you can be somewhat helpful It literally can't tell you what's in the pie. We just demonstrated that with an example in the audience And I think everybody's realized this I've been post-hoc scanning has been going on for at least 15 years in my experience So if we can't trust pre-hoc scanning and we can't trust post-hoc scanning to be perfect They'll get us some things but not all the way there. I think we got our things backwards. So yep Next one might be Yeah, so basically what can you trust the answer is you can trust the build tools They're the thing The build tools are the things that built it So if I'm the build tool I opened the bloody files that went into the thing now Maybe I'm gonna lie to you that could happen But generally speaking the build tools are at least in a position to know the answer Maybe something else attaches to them and injects things into them. Oh, no You can go down there up a hole very far if you need to But effectively all the available choices the build tools are really your best choice for the question What to trust about providing me sort of the canonical information about the inputs along the way And please know when I say build tools, I don't mean build orchestrators things like make I mean We also don't mean things like Jenkins The CI system that's running the build process. That is not what we mean What I mean here is things like GCC LLVM your linker or the rust compiler the go compiler The Python runtime itself since it it compiles as it loads on dynamically Or if you're putting a container together like that doctor bill actually be doctor bill Yep, but these are actually the pieces that at least in principle could be trusted Because they have the right context they're in the right context at the right time Yep, and so we finally reach get bomb. It is a minimalistic scheme for build tools for following what we mean by build tools here to provide a or to build a Compact artifact dependency graph by the way, I'm pretty proud that I used I reused DAG from git To create an adg that tracks every source code file incorporated into each artifact built along the entire supply chain To embed an ID for that artifact dependency graph itself in the artifact that is built by it and to do this in a way That is language Independent it can work in a language heterogeneous environment like open source is at scale Across packaging formats most importantly with zero developer effort One of the biggest challenges here is getting this adopted by open source projects 99% of which have roughly one developer and no budget So doing this in a way that can enable artifact resolution across packaging and languages Better all volunteer run and don't have budgets That's our goal people can answer the question. Am I safe? So let's fast forward. Imagine we have this It's been integrated into the open source build tools that everyone's using five years from now and you get a docker image and It has a fingerprint and you can look up somewhere in a public location That fingerprint and see the whole artifact dependency graph You you can pull its s-bomb you have the git bomb tree for it when the next log for j happens It's buried down there in some source file and read that you probably can't see on the slide. Sorry But you can identify it because the fingerprint is there in the tree and so the the value proposition that I believe we are really enabling is For the blue teams for the incident response teams of the world who are consuming open source packages today built by other people They download them. They do a basic scan on them load them into their internal mirror This gives them additional signal to be able to identify ones that have Discovered vulnerabilities in between the time of course that it was built staged launch in production The additional signal resolution here enables those teams who are often under high stress Short deadlines low budgets to find the issues faster and remediate them better With again no imposed cost on the broad community just a cost on a few you know a couple tens of Large projects like the build tools out there. I see a hand popping up I did skip that step very astute Well, so here's the trick. So let's take for example So take for example log for j if I remember correctly There's a small number of versions of Janie and I realm dot Java or something in log for j They're actually the source of vulnerability Now in the magical five year in the future world, it becomes extremely valuable report those get oids with the CBE, right? That's sort of the longer term answer is Report them because they're a higher precision report of the vulnerability Not in place out but in addition to addition to any other information. We have it's sort of like we were talking about That's bombs being a description of things if I give you the GPS coordinates of my house It's also useful for me to tell you that it's a yellow house with blue trim, right? So in the CBE report, I want to tell you the GPS coordinates of the vulnerability in source code And also tell you that it's this package this versions, etc Now as we're getting from a to b there's a bunch of places in there A bunch of tooling that's being done as proof of concept work in the get-bomb community Where folks have tools that can be pointed at the get repo for log for j and spit out those getaways for you so The mechanisms of discovering those getaways even from where we are exactly now Is fairly straightforward? Not perfectly but enough to be extraordinarily useful and I think part of your question was the correlation Who publishes that correlation? Well when we know there's a CBE and it came from these JD9 files Or it came from this version of an open SSL dot H that Can like that file has a getoid Whether it is MITRE or some company that then publishes the correlation doesn't matter to us It can be done by anybody It you could stick it in the in that project in some way I probably want to centralize it somewhere at least in a couple places. Does does that answer your question? Okay, well we have the same thing today, so I'll repeat the question if you Trace down a vulnerability to a particular function and you realize that that function was in the known the now known bad state For multiple file versions and multiple releases of the package How then do you do the correlation the same way we do the CBE where it says? Oh, this CBE exists in version x dot one x dot two x dot three It's in this range. We just use we just add getoids and say it also Exists in these getoids Okay, it's actually a good question right because it's not going to be obvious to everyone But for example, how many you've ever written get log on get log and a file name. Oh goodness Get log and a file name Because you could actually ask it. It's the blink of an eye To know the log information for a particular file in get Yeah, so Other questions questions. Yeah, we're the last slide here is just pay here some links to come learn more about the PoC is so we'll stay here and bring on the questions. I see a hand I see I think David's hand and then you and then you Yep, right So I'll repeat I'll repeat the question How does get bomb intersect with the reproducible builds effort What David didn't ask is do we need reproducible builds for a get bomb to work? And what David did ask is if we use get bomb by embedding the getoid of the Build tree itself. Do we prevent reproducible builds from being reproducible in environments where there's a nut? There is no other functional change or difference in the resulting artifact, but some non-functional header files Got read in resulting in a different I get oid embedded in it thus making it not reproducible We're thinking about both of these. I don't have a good answer yet Yeah, well, so I mean part of the thing the thinking process and please note This is not an answer because as David mentioned this is ongoing dialogue Yeah, is part of it and I've sort of been whining in my head how you attack the problem is How do you define the reproducibility of a built? Right and one way to say that a build is reproducible is to say if I give you a set of inputs I will always get exactly the same output and It happens and then you get into the question of equivalence of the output So you may have noticed we made a very specific choice about artifact equivalence And that choice was the biter rays are the same Now This is not the only available choice for equivalence But as far as we can tell it's the only one you can reliably do in the generic because Different languages will have entirely different behaviors around all these semantics work out and it's also one that's extremely simple I will throw a wrench in our own works Okay, um bite obfuscation techniques can result in Functionally identical binaries with different bite structures, and this is a lovely way for malware to you sneak past scanners We're gonna have to figure out how to deal with it in this space as well Yes, well, we had we had a couple other hands come up and wait if your other hands come up David It's only like two minutes left debating debatable discussable I believe your hand was up and then I saw hand back there if we have time Doesn't matter. We don't we don't depend on get we're just using the get hash function The getoid function as the identifier it could be stored anywhere So we use the getoid hash function and we draw tremendous inspiration from get yeah, right? And we advocate actually for using the getoid hash function in a lot of places a lot of folks We've talked to about interoperability of get get oil with other things in the ecosystem The answer really comes down to hey if you'll store the getaway of the thing Then we're done. We've had interoperability doesn't matter doesn't matter what version control system you use I think yep So as bombs do that well, let me let me actually let me sort of repeat the question first because this is a brilliant question And one we just didn't have time in this presentation for so I'd love to talk to anybody and everybody But especially you after months debating and discussing this point effectively with a good question the The question was what if there's other metadata that I care about that? I'd like to know and in particular what if there's other metadata the build tool knows that I would like to know about And the fundamental thing From our perspective is we've actually talked about it's perfectly fine for your build tool to write out of their metadata Into we usually talk about putting it in a metadata directory, right build info or debug info Whatever you call it credible numbers of things that people are interested in and the way you connect them is The metadata points into the artifact tree So if I wanted as a very simple case that almost every build tool once immediately is I'd actually really like to know as a Matter of metadata the file name and how it associates to the getaway to the artifact So when I'm debugging what the hell just happened I can see what's going on now You don't want to put that in the artifact tree for all the reasons we talked about about how it's essentially a femoral data to the artifact dependency graph But it's super useful for users and it may also be too detailed to get into your S-bomb But you can have that metadata generated out as part of your build you can pick it up and use it You can be generated by your build tools And in the same rich discussion of the space in the community I think that in the same way that the spdx community now is using getoid as an artifact External reference ID build tools could do the same and then you'd also have Compatibility between different build tools for their debug in but in for debug symbol files if they all referenced into the Artific dependency graph in the same way. I think we're at time So, thank you all so much. We're definitely a time I know I am and I think I suspect that as well we can wander out of the hallway and find some place to folks want to talk Yep, also find us at any point. You know subsequently We're very friendly And we'd be delighted to talk about this stuff because the more eyeballs we get on this the better Thank you


They gave your boy Mike. Yeah! Ha ha ha ha ha! I had to put some diesel in my tank. Oh yeah, we're coming diesel. That's all right. Turn up champ. That's a fire. But that time when I was about to hit him, he stabbed on me just too far. We good, we good.


So once you've picked your style model, the next thing we need to do is caption your data set. Now there are two ways to do this, the automatic way, which is easy and works pretty well, and the manual way, which does give you some better results, but I always think it's good to know both. So today I'll just show you how to use the auto caption tool in Koya. Now something you'll need to figure out is the keyword that you would like to use to identify your character in stable diffusion. The keyword is what you use to summon your character whenever you want stable diffusion to generate it. Now this word can be anything and it's actually best if it's not really a word more like an acronym or a combination of numbers and letters, whatever you come up with, make sure your keyword is not already taken by something else. So it's good practice to type in your keyword ahead of time and see what gets generated. If the results are random, or they give you a variety of different things, then that is usually a pretty good sign. If you type in something and you always get the exact same character, it probably means that if you train with that keyword, you run the risk of your character mixing too much influence from what's already attached to it. For example, if you use a keyword like cow boy, but you're training a female character, you probably run the risk of generating both male and female versions of your character because your keyword is very closely related to the word cowboy and boy. So you're probably better off changing the keyword to be something more like cow girl or C girl or C G R L something something that isn't the opposite of what you are hoping to train. But the basic rule is even if you see other characters come up, as long as they don't always generate the same clothing, face, hair, eye color and background all the time, then you're probably fine. For my character, I'm just using the keyword AHRA, which is just an acronym. And by default, this keyword generates these kind of results. None of these characters look like they are over trained. They have different faces, different hair and eye colors, and they're all attractive females with a somewhat similar build to the kind of character I'm trying to train. Regardless, once you have your keyword picked, go to your Koya training file and add a new folder for your character, open it, then create three new folders named image, output and log inside the image folder, create a new folder named 20 underscore and the keyword for your character, and then drag all of your training images into this folder. Now if you're wondering what this number is, what I'm about to say is a gross oversimplification. But basically, this number determines how many times the training data runs through all these images. Essentially, the training will go through 20 sets or epochs of this folder. Usually 20 is a pretty safe number if your training data set is fairly small. So assuming that you have 20 to 30 images like I do, then the number 20 is a pretty safe number of sets. Once you've done that, launch the Koya GUI that we installed a few videos ago, go to the utilities tab, find the folder with all your training images and create your auto caption prefix here. And this should just be a general description of what your images contain in my data set. Basically, we just have the keyword. And what we see is basically a woman and a green background. And we're just going to stop there because the simpler you keep it, the more flexible the training can be. Now, sometimes if there are important details about your character that you might want to change, for example, my character is wearing a hat. And if we wanted to make sure stable diffusion noticed that then we could add a hat to this caption. And this would help us later on ask it to do things like remove the hat or hold the hat. But I personally know my character will always be wearing a hat. So I don't think that's a detail I really want stable diffusion to hyper focus on. So we're just going to keep the description like this, make sure you check overwrite existing captions, click here, you're done. Congratulations. Now you know how to use the auto caption for your training data. Hope that helps. And as always, I'll be of a fantastic day and I'll see you around.