we'll come back to another XOzeros video so today's video we're going to discuss FC Garf and her suggested team comms but before that if you want an updated XOzeros content please hit the subscribe button it's actually down there below okay so we have here FC Garf for me I have been just a background of how long I have used Wasted Red probably three months four months or five months I don't remember I have been jumping from one nation to another starting with Greenland and I went to Astorys then I actually ended up with Wasted Red because again Wasted Red faction is a mix of offense defense support they're all around so to discuss FC Garf right now let's actually go to actually a video up there in terms of her new buff it's actually going to be up there I'm just gonna post a video there you can check it out later in terms of the new buffs that she has but in today's video I'm going to discuss a couple of suggested team comms that you can use especially for PvP or even for PvE okay so I'm now at Master 3 let's let's go through some of the team comms that I have here um let's reset this actually this is my my my what they call this my offensive team or what they call this for Wasted Red so Garf is here but I'll reset this I'll start from um a team that if you really want to pursue you would actually have a team comp mostly or all of them Wasted Red so we're going to have Garf in the front going to have Annie Redley Maggie and the other one would be Jean so I've tested this out this team I use it in one of my tag matches and they are actually good they're complete in terms of what you need in terms of buffs they're going to maximize your buffs because of the nation buffs or signature force so if you're going to go with this team be my guest this is actually a great team to bring you have you're you're complete there with Jean who can actually give bigger damage to barrier to to to heroes with barriers and almost most of the core cast is actually there so next would be in my suggested team would fall on a synergy between um Greenland so um in any synergy with Greenland the core should be there so your core would be again FC Garf FC Redley of course so the two of them are your core if you want to mix and match with other nations um another member if you want to add would be would be Annie I would suggest but if you paired the the two as your core for Wasted Red for Greenland you're going to use um let's change the formation a bit going to use Talia Bathory and Rera oops so if you want to have a synergy between Greenland I think this is your most optimized team this is actually pretty much very hard to kill already um if you want to swap out and put in Schmidt you can actually take out Talia change your formation and put in Schmidt here so two from Greenland two from Wasted Red and Schmidt would be there so this is actually another option synergy with Greenland in the splash of FC Schmidt okay our next would be for Astorys Republic again your core would be Redley um Garf then you have their um if you want to more or less have a sorry my mistake one two three four four and change formation let's add Shell okay so this one this team I actually am good as well this is actually one of my pet projects um I'm actually finished with signature force for for Wasted Red also finished with um with Vagabond the next signature force that I'm going to to to finish up would be Astorys Republic and this is actually the the formation that you have to go after because again um you can't you can't go wrong with with with Adams, Jenae, and Shell for your main Astorys then compliment them with Wasted Red again if you want to if you want to bring in Schmidt you can actually swap out Adams for Schmidt so this is actually another option as well so let's move on to the next one would be Linombe again core of Redley and Garf then you go with I'm sorry but my Linombe team actually sucks it hasn't been built yet um so you have their April you have Rachel and the other one would be Xeon okay so this one is actually a good lineup as well you can actually replace um if you really want Schmidt again as part of your team you can actually replace Xeon with with what do you call this with Schmidt so this is actually my recommendation for Linombe if you want to bring a Linombe but again um I would actually prefer that you bring Xeon for this one Xeon actually brings more to more to Linombe if you have a splash of Wasted Red with your Linombe team so where's Xeon Xeon where are you there you go so again recommend recommended um team um if you splash Wasted Red with your Linombe team okay let's go back to what I'm bringing actually let's go back to my main team so my main team for defense um we're actually here already in team B so this is my main team for defense um I have here Garf uh Ramji, Redley, Schmidt, and Talia, I'm sorry and and Maggie so more or less this team I put on defense if I'm not playing to more more of a defensive you know defensive unit more on more on playing it safe um my liability here is just Ramji but again I think he can hold his own even if you know I have I don't have a high enough signature force but this team is actually good for defense in terms of leaving them to defend your record to for have defensive wins from my experience they're better than my offensive team my offensive team again I'll go back to what I showed you guys earlier so yeah so this is it my offensive team so Garf um Garf, Maggie, Annie, Schmidt, and Redley so the way I play this guys is in terms of manual I would usually take out first um first garges because of their barrier so that is actually the main concern or take out key um what they call the soft or key units like FC Iris or FC Talia again um this team has surgical precision in terms of taking out heroes you have silence for Annie you have silence for Redley then you have um masters footsteps for Schmidt for a way for for Garf here Garf actually plays a big role in protecting the party additional health um health and defense and shared health and with the buff that he's going to bring um defense team would you know would would be better and the offense team would have more survivability um because based on my experience if I'm a on a head-to-head match with a Greenland team it's more difficult to take that down than a Linombe team because for Linombe what I usually do if if I have a matchup is I take out um FC Zeon first uh because FC Schmidt is actually very fast so S2 killed FC Zeon and the rest is actually soft enough but for Greenland I have to really pick my poison either I take out FC Iris or FC Talia so let's actually have a sample match for PvP okay sample match for PvP win or lose um I'll have to accept it but I'll show you guys on how I play my my PvP team um with Garfinit my main PvP team right now I used to have um I used to carry FC Iris with me but now I you know I I don't have her with the team because I found out that I need more firepower or either firepower or defense so again I have here um Linombe so I I'd like to take out Zeon so that I could eliminate um dragon scale scale and have a you know a a better time finishing off the other so again very good critical hits from Schmidt so again if you could if you can see Zeon's out then I could have an easier time taking care of the rest so have have single hits so again um the key in defeating Linombe would be taking out Zeon because if you if Zeon is there and for example you you hit him with an AOE um you're going to have a problem in terms of um you know uh penetrating that shield so I silenced I silenced the enemy Schmidt because um so that he will be limited to um his regular attacks not his s1 so it's actually valuable because I don't want my team to be affected all by matches footsteps so he silenced twice and he's gonna die in a while so let's have this one so that I could have AOE damage for Annie um without Zeon you don't you won't have really a problem shield's triggering so next um let's have let's silence uh let's silence April so that she can cast her s1 or s2 then try s2 for Maggie Maggie is actually crucial here because she provides shield also for your party or for your team so more or less she will be your finisher let's not get rid of her so that she won't give HP to the remaining team let's take them out first and let's endure a beating from Baraka okay both of them are already angry Baraka and Rachel but again um the key is going to be Zeon eliminating Zeon would be well April died so I don't have a choice so let's go with s2 for FC Rachel to try to eliminate eliminate him as soon as possible the regular hits not critical but I think this is this would be enough to take him out and what is left is Baraka so he might be invisible in the wild so let's try to use Red Lee's s2 to try to finish him off or at least half of his life so down to see if he's gone so he's gone and that is it guys um that is how you play a team with Garf um and with um Wasted Red as your primary most of them are your primary units so in this team I only have um smith in the mix four of them are with Wasted Red so again guys um if you have any questions on team compositions with Garf you can actually put your questions down below ask me anything team compositions what are you know what are you or what um current teams if you want to join our discord server please do a link is in the description for an in-depth discussion and at least we could you know have screenshots there share screenshots of your team also guys for those who haven't subscribed yet please do around 80% of my viewers haven't subscribed yet and if you subscribe this helps my channel I'm actually near a thousand subscribers so again it's a race to 1000 hopefully in a month's time or in in two I could reach 1000 subscribers so you guys will be helping me very very much if you subscribe to my channel okay guys again stay safe good luck in your pulls tomorrow for FC Garf I'm sure most of you will be pulling for FC Garf and take care this is the warden and I'm out of here


What's up everybody? Jason here for jazbyskatesbreak.com. We just sold out 2223 Panini Spectre basketball. This is a two box picket team's number 10 and again guys, chance to win $500 in break credit guys. How to do that? Just buy two teams. You buy two teams in this break, get an entry, buy four teams, two entries, six teams, three entries. Now if you only buy one team, you won't get an entry into the giveaway. But good luck to you on that team guys. Top two names win $250 in break credit back each. So we'll do that round of miser at the end. So off of a ties out like that and see who gets two or more teams. Now number nine is on the website. Would have been the first two boxes of the fresh case. But number ten sold out straight up because number nine wasn't around in number block. So number ten is gonna start it off. So doing ten before number nine. Let's go over here. Let's flip them around this way. And again, we'll do it like we have before. These will be a break. This will be a break. These two will be a break and then these two will be a break. So we'll have four stacks. This will be stack one right here. And then two and three in the back. Or one, two, three, four. Just go there and run out of the room. If I roll a five or six, we'll just re-roll it. So I hit something. Move this over here on the side. Five. No, let's do it again. Two. So this was one. Two.  So these ones here will be for breaks numbers nine and then of course 11 and 12. All right, Kevin Love for the Miami Heat. Out of ninety nine. Chris with the Heat. Then we have a Jabari Walker and Malcolm Brogdon and then a redemption. See where the redemption is right away. rookie jersey autographs astral 244 Chad Holmgren. Nice. I didn't realize he was a redemption in this. Let's see what Astral's out of. But there you go. Oklahoma City Donner. Ed, look at that. You watching Ed? I hit two of the three. That might be a different Ed. Yeah, this is Ed H. Astral is out of 35. Didn't you actually? Yeah, I think you said you actually hit one of these back now. Like they already have it ready. Nice one there for OKC. Oh, you hit the RPA meta. Gotcha. Well, that's not bad. Get rid of one and keep one now. I bought a chat contenders ticket a few months back now from a customer when we did the hip pads. I'm just holding on to that now until he tears it up and then I'll just get rid of it. Yeah, out of 35 is also a patch. Nice. Markel's full for the Magic. And Steve Kurt in ninety nine for the Bulls. Deep space. Bulls. That's going to David B. Desmond Bain. The Grizz going to Valomar. And the Valinchunist in ninety nine. Catalyst for the Pels. Pelican is going to David B. as well. Lasso in here. Jimmy Butler. Number to 149. And it's a four out of five Kelly Albury Jr. Nice for the Hornets. Want a cup? Four out of five. You gonna watch this one on Sunday? I don't even know if I want to wake up that early. The Toy Story NFL game. They're going to be in Toy Story game. Guess I'm in the game. Yeah. Yeah. Test it out. Oh, that's Mike when he comes back. I don't know. He says something about Mike when he comes back. Robert Harris to 49. For the Celtics going to David B. We have a Dejonte Murray. You know, I haven't ripped much of this guys, but I still haven't even pulled a freaking color blast yet. Michael Huber to 49. Only this is the case. Lakers going to Omar. Doing spectra. The two boxers. We have a nice Jalen Brown. Out of 25. And Goren Drogic. Deep space. Good luck guys. Yeah, it's not that bad though. They're both fine. All right, here we go. Last pack here guys. And the chat was nice, but I still feel like we can still get one of those bigger short prints. Scotty Barnes to 99. No, Nikolas really fast too. Rashid Wallace. Lester's Legends. 33 out of 75. Yeah, you get there with time, but just some people don't want to eventually. Joe is actually really fast. It's just he talks a lot. But other than that, yeah. All right, so there you go. To be honest, they probably do have the odds of a color blast. I think they do put it out there right here on the box. But I mean, I don't know. Let's see. We can find color blasts. Color graphs. Nebulas. Yeah, color blasts on average, non base cards are included in approximately one every pack, but deep space memorabilia numbered 1 to 99 to 1. So yeah, I mean, it's on there. Just got to like read it right. All right, guys, well, there you go again. We got a nice chat here. Number number nine is also in the store. That's part of an R&B. So again, you know, thunder are not available in that R&B. It was more like the Orlando magic with Palo Bancaro, you know, Lakers, a lot of other different teams there that didn't really hit much in this half or this first break. So if you guys want to get that one going, it's magic wars, maps, Lakers, blazers, nuggets. Some of those teams do have color graph color blast and Eclipse, which are super sharp prints in this. And again, our PAs and vets auto. So again, that's 89 99 if you guys want to get the first half done that we wanted to do down and I love guys. Thank you. Now let's switch teams and do the break credit giveaway now. So two or more teams covering that six. That's three. Murdov with two, Chris to David be with 10. So that's five entries at two, Omar to Steve Birch with six. Yeah, there's a total 15 there. All right, so two winners of 250 coming back to two winners. Here we go. Snake eyes just two times too. Nice. One and two. Boom. Adam cover man. David be there.  So I'll send you guys the $250 break credit codes right now. You guys can reuse them for other breaks on the website. Thank you guys.


This will make you not want to edit. Stop. Babe, you're chill.   Hold on. Guys, I want you all to experience this with me right now. Mariah, what are you doing? Making us lunch.  Marvel Squad. Today is a day to remember. You actually did not ask me to make you food this time. You are so cute. You know that? You deserve a star. Are you okay with mac and cheese? Are you okay with mac and cheese? It's kind of expired though. It says March 22nd, 2020. That's two months ago. Why are we eating it then? Because my dad said it's good. Since her dad said it's good, it's all good. What is good, Marvel Squad? Welcome back to our channel. If you guys are new, make sure to hit that subscribe button. Turn on your bell notifications. So you get notified every single time we post. We've been getting pretty bored in the house recently. We still have another month. What happens if in a month they delay it for another two months? I don't even know if we're going to do this anymore. We're going cuckoo. We've already ran out of canvases. Oh, by the way. You go get it. I'll watch the mac and cheese. She's going to be showing you. We did a little TikTok video. This is a huge important video for TikTok. You did not follow us. And you did not know already. Ready? We are verified on TikTok. We're not starting yesterday or two days ago. You guys have no idea how long we've been waiting for this verification badge. Probably like three, four months. Forever. We were waiting for it since we hit a million. We're like, oh, we haven't gotten it yet. And then two million and three million. If you did not know, we are at 6.9 million followers on TikTok. And we just got verified. So we are so thankful for everything. We are so thankful for the verification, but it took forever to get verified. And we are so happy we're finally here. Do you want to explain what this painting represents? This is Bill. He's Jimmy Neutron. Wait. What? Right. Guys, comment down below. Is that Jimmy Neutron? Comment down below who that is. Jimmy Neutron. Timmy Turner. Timmy Turner. Come on, Timmy. Timmy. Timmy. Sorry. Sorry. Sorry. And then Bill thought I should be Bella. Bella. So then I painted him. He painted her. AKA Tinker Bill. And then we did this. And then that because we got TikTok verified. But this is so lit. We are so excited that we got verified. And now... Finally because all our comments are like, you're not verified yet. Why aren't you verified? I know. It was getting bad. Oh, really? Now we're just waiting for that YouTube verification. YouTube, where you at? Well, I'm excited because I haven't made like... Mac and cheese. Yeah, I haven't made mac and cheese in a while. She hasn't made mac... No, you haven't made food in a while. Because you don't know why? Because last time I made mac and cheese, Bill made fun of me because I put too much butter in it. You put like... She put half a stick of butter. She put half a stick of butter. She put half a stick of butter. You literally put a little sliver. And that's all you need. Four tablespoons. That's half. That sounds like half butter. That's what you're supposed to do. We're trying to stay fit. Okay. You know what? We're trying to get lean. Quarantine has been hitting us hard. We're going to be hungry, so I want to make sure this is some yummy, yummy food. All right, well then, we just got to make up for it later. We could just add some healthy stuff like apples and... Okay, okay. So it's okay. You could just eat like an apple and then a stick of butter and you'll be fine. That's what you're saying? Okay. Can you finish it? Because I'm going to go upstairs and do my hair. What? I have to fix it. No. Yeah, it's just, can you please? See, you always make it. I'll be back telling you like five minutes. You're always making me do your food for you. No. Can you please? All right. Five minutes. That's all. That's all you get. All right. Wait. Is this cheese going there, too? No. You have to wait to drain it. Five minutes. Five minutes. Okay, guys, as you guys see right now, Bill is downstairs and I have a title and the reason you clicked in this video, today I'm going to be flashing Bill. My try to keep his PG-13, I know it's a little bit out of my comfort zone, but you know what? I have to get him back. And you know, I know many of you guys are DMing me, asking me to do this prank and I just had to do it. So, basically what I'm going to be doing is Bill is after we eat, I know he has to edit for our YouTube video. So while he's editing, I'm going to set up the camera and I'm basically just going to flash him and see how he reacts. I think it's going to be hilarious to see his reaction just so random for me and just be like, oh, hey, you know, like, it's going to be so funny. Make sure to comment on below hashtag Team Mariah because you already know I'm a lit team. I got to keep it on a roll. Before I go downstairs, make sure to give this video a big thumbs up. Let's get this video to 20,000 likes. You guys have been crushing it recently. Also, I want to give you huge shout out to all of our TikTok supporters that are on the screen right here. Thank you guys so much for supporting us and being on our live streams every single day. He has no idea. No idea what's about to come. I'll see you guys later. Oooh, how's it? Oh, we got to get it out, Bill. The timer just went off. It doesn't mean it's ready. Okay. You ever do a taste test? That's what you've got to do, right?  If it tastes good enough- Is it good enough? Is it been no longer? Yeah? It's good enough. Okay, great. We're going to finish it. We'll see you guys when the food is all done. Right Bill? Yeah, let's get ready. Because Chef Mariah is going to do it. Chef Mariah? I took over the situation. I'm taking over now. I'm going to make sure Alright guys see you guys in a minute. Alright, so I just want to say something before we start We literally had a little argument before we started filming when I was putting the butter and I put it like a little sliver Good, and that's why you don't need that much babe.  That's the least of my problems nice gene source buddy I like them different bill has been switching up his style if you guys were here since day one You guys go back to older videos bill style has changed Completely and it's just something he's always wanted to the kind of like branch out and do but he's nervous And hype him up in the chat doesn't tell him he looks freaking awesome. You're an artist bill. Hey, hey, you're an artist Hey, don't disrespect the drip No, thanks. No, thanks If anyone tells you Marvel Squad you cannot do something you're not good enough you need our help, you know what you say No, thanks. That's all you got to do Like Before he goes to bed it is one of the cutest things ever All right mom's got so I have to get some editing done for our next video that is going up So make sure to peep that after it's up because it's gonna be pretty late And we will see you guys after I'm done editing we could go vlog and do some stuff outside because it's literally like beautiful out today So we will see you then Can you do quick for Miami? Actually, no, we probably shouldn't put those. Yeah, just like get back the money that we would have got spent This video is so funny Well, no, you'll like it more when it's done done Want to edit Stop Necessary stop Right Stop stop Oh my gosh, please right here. Wait, come here. Here we go. Stop doing that. Look at me. Look at me. I Love you. I love you. I love you, but you love these two. I love you, but I got it.  Give me the editing mood right Go away. I love you. I love you. Can you go away? Can you actually go away? Can you grab me a water from downstairs? We're not doing that I'm always paying attention to you, okay No, I'm not getting up to pay attention to me.  I have to edit literally. I'm like falling behind. Let me finish so we can finish our vlog We have a lot of filming today to do stop Don't squad want to be too too not say any you're not doing that for a video. Yeah, I was You're gonna show that in a video.  I scared you. Yeah, so you know what actually this was this was more of a cuter way of showing that I love you That's not hurt. That's just a blanket. No, it does hurt.  Wait, how do you feel mariah? How do you feel that you just expose yourself across the world? I didn't expose myself. I expose you You literally like I was wondering why it's so random Why I was so abrupt like I'm supposed to be editing and this girl's coming in the room Acting like she's being needy or whatever. Was that your whole plan kind of there's more just flashing my boyfriend Oh, so you actually just didn't want to like hang out with me. So you just didn't care. No I'm just kidding. I do want to hang out. So make sure to give this video a big thumbs up. It gives me 20,000 Again, oh my god, you guys are literally crushing every video. We could easily get the video 20k Oh, yeah, thank you so much for showing love and wait We gotta give our end of the video post notification shout out and that shout out goes to ted nugget Shout out to you Ted. Thank you so much for being a part of our channel. We love you so much And for those who are supportive enough to watch our videos to the end You know who I'm talking about We are going to ask you a question at the end of every video that you have to comment down below Today's question is do you guys like to cook and if so, what do you guys like? It could be the simplest meal or it could be the most Intrigate meal.  But if you don't then that's totally okay because I'm not a big Into cooking you'll be a team rise category. I've been trying to start cooking She's getting good. I think her most advanced meal is meatloaf mashed potatoes and corn. She made a pretty bomb That was my first time doing it. It was it turned out really good. So I could definitely read a recipe and make it It's just I never got confident in myself to actually do it. So I never really started cooking until now But we're gonna be moving out soon. So I gotta make sure my cooking skills are on top. We're going to Florida pretty soon guys And we have a big surprise combo. We're not gonna say anything yet.  So just get ready. You have no idea what's in store for Florida We're gonna get into that a little bit Just make sure you're paying attention during our videos that you're watching that because There's there's something behind the scenes that you need to figure out that you're gonna figure out We're really excited. We don't want to say anything yet But just know just don't worry.  Oh, it's gonna be lit. Do release it. It's gonna be epic. I'm excited. I'm excited I'm so excited. So thank you so much for watching all of our videos all the way till the end We appreciate everything one of you guys and we will see you in the next one. But until then Peace


If you're planning to visit Dubai but your budget is limited, keep watching this video! Hi guys! Welcome to AXI Vlogs! If this is your first time here and you would like to know more information about life in Dubai, don't forget to hit subscribe button and the notification icon so you will not miss anything. We all know that Dubai has a lot of things to offer, so it's very easy to spend money here. When you're coming to Dubai as a tourist but you are on a budget, you might have a question. What places should I visit not to spend a fortune? So in this video I will share with you some places and cheap things that you can do in Dubai. First of all, I would like to recommend you to rent an accommodation or book a hotel next to the metro station. Dubai is not a pedestrian friendly city, so if you don't have access to the metro station, you will spend quite a lot of money on taxi. Before you come to Dubai, I advise you to check out these two websites because they have a lot of coupons and they can help you to save money. But make sure that you make a reservation or booking in advance. Now let's talk about the places that I recommend you to visit. If this is your first time in Dubai, you definitely should visit Dubai Mall, Bush Khalifa and Dubai Fountain. All these three places are located in the same area, so you can visit all of them in the same day. Dubai Mall is the largest mall in Dubai. It's a paradise for people who love shopping, so you might spend the whole day there. There is also a Dubai aquarium and underwater zoo inside the mall. You need a ticket to go inside, but you can also see a lot of things just standing outside. Once you finish your shopping and you exit the mall, you will see Dubai Fountain. It's really beautiful. The dancing show starts at 6 p.m. and the last one is at 11 p.m. Every 30 minutes. Right next to the fountain and Dubai Mall, there is Bush Khalifa, the iconic building, the tallest building in the world, so you will definitely see it. If you want to go to the top, you need to buy a ticket. The entrance is from the Dubai Mall, so you don't need to go to Bush Khalifa itself. If you want to go to the top, the entrance there is from Dubai Mall from inside. Just ask the security and they will guide you where you need to go. But if you want to save some money, you don't want to buy tickets. You can just take some pictures outside the mall, standing next to the fountain. Many people do that. The next place is called Dubai Marina. It's one of the most popular areas among tourists and residents and you can get there by metro. Dubai Marina has a lot of beautiful tall buildings, artificial water canals with yachts, plenty of restaurants, shops. You can have a walk along the water promenade. You can rent a bike there and just have a ride around Dubai Marina. There are plenty of bike stations, so it's a really beautiful place and I highly recommend you to visit. Why this area is so popular among tourists? Because it has access to the public beach. It's just five minutes walk from the promenade and when people come to Dubai, especially with kids, I recommend them to stay in this area because there are plenty of hotels, residences, accommodation that you can rent and you have easy access to the metro, so it's very easy to move around the city. You have access to the beach and you can walk there just and you have also a lot of restaurants, shops and supermarkets around you. So you can even stay in one area and you have access basically to everything. Once you reach the beach, you will see the tallest ferries wheel in the world. It's called Ain Dubai. At the moment I'm filming this video, it's not operated yet, but you can go, it's located on Blue Waters Island and you can go there just crossing the bridge from the beach and it's free to enter, everyone can go there to that island. The next place is my favorite public beach in Dubai. It's called Kite Beach, but you can get there by car or by taxi only. They have plenty of water and outdoor activities. A long time ago I filmed a vlog there so you can check it out on my YouTube channel. You can bring all your own food, drinks, beach towels and also you can rent a sunbed and umbrella, so it's up to you. They have a 7 kilometer running track, so if you love running, you can go there for a run. Also you can rent a bike and ride along the beach. So there are plenty of activities to do. Of course, they have a lot of restaurants and shop there, so if you want to buy food or drinks, you can do it.  So this beach is quite equipped. They have shower, they have restrooms, everything there. Now let's move to Palm Jumeirah. So the place that I recommend you to visit there is called The Point. It's a waterfront destination with a beautiful view of the iconic Atlantis Hotel, but why I recommend you to visit this place? Because they have the largest fountain show in the world there. It starts at 6.30 pm and the last one on weekdays is at 10.30 pm. On weekends, I think at midnight. And now I'll share with you some historical places that you can find in the old part of Dubai. One of those areas is called Alsif. You can get there by metro and then you need to walk a little bit. It's located in the historical part of the city and you can see how old Dubai looked like. It's quite Instagrammable. And also there is an interesting place. It's called the Museum of Illusions. You can check it out. You need to buy a ticket to enter, but it's an interesting experience. Overall, you can just walk around the area. It's a really beautiful place. The next area is Al Fahidi, the historical neighborhood located along the Dubai Creek. You can get there by metro and it's one of the oldest parts in the Emirates. And they have a lot of museums and the textile market. Once you finish in Al Fahidi, I advise you to take the Petrol Abra boat and go to Gold Sook. The boat station is located in the same area in Al Fahidi. And the boat tour one way costs only 2 dirhams. It's so cheap, but the experience is amazing. I highly recommend you. Gold Sook is a traditional market where you can buy jewelry. It's so popular among tourists, but if you're not planning even to buy anything, just go there. Imagine that you go to the museum. So you can visit Al Fahidi and Gold Sook within one day.  If you want to know more about this city, I have a lot of videos on my YouTube channel, so don't forget to subscribe and check it out. See you in the next video. Bye-bye.


Hi, everyone. Very happy to be here. Yes, like you said, my name is Stefan. I'm a tech leader at Yelp. And in this talk, I'm going to take you a little bit on a journey of testing services at Yelp. And actually, this journey started, or rather me talking about it, started already two years ago because I gave a talk two years ago at EuroPython. And it was also about testing, and it was also about testing services. So just a quick recap, like what did I talk about back then? If we look at the testing pyramid, my talk back then was really focused on the top end of that pyramid, or what is supposed to be the top end. So on end-to-end tests, or what sometimes are called system tests, inside Yelp, we often call them acceptance tests. And these are the slowest and most expensive tests to run, since typically what you do is you spin up each of your dependencies, and then their dependencies, and so on, and so forth. And that is obviously not always a fast or cheap thing to do. So why do we do this? Why was I talking about just these tests? The reason is this, because when you have many services and we do have many services at Yelp, they're all interconnected. You have this huge graph. Your code is split across repositories. When you execute your code, it's separated by a network layer. And so actually verifying the correctness of this whole system is no trivial task. And end-to-end tests help significantly in that effort, because you do try to replicate something that is as close to production as possible. And so you actually gain confidence that everything works well together. Obviously, it would be better to use something like unit tests more, but the problem with unit tests is that as long as soon as you test something that interacts with an outside system, you have to use mocking for that, and especially with something that can get complicated, like service API calls. It's not always easy to make sure that you get the mock right. So sometimes a test can fail, and you don't know is your code wrong or is the mock wrong. Otherwise, a test might pass, but actually your code is still buggy. You just adapted the mock to fit your buggy code. So that's why our testing permit doesn't really look that much like a permit. It's more like it's a lot of unit tests, and then maybe a few integration tests, and then again, actually quite a lot of end-to-end or acceptance tests. And that's why we invested in making end-to-end tests easier to write, easier to run, and that's why I gave a talk about it, about, well, running end-to-end tests more quickly and how to manage state in all of these other services that you're including in your tests. But it turns out, they are not just slow these end-to-end tests. They can also be flaky. This is an extreme example here, but yeah, we were actually running into issues due to us spinning up all of these other services in Docker containers, needing to create state in some of these other services. So we had Docker failures, we had request timeouts, and we had high hardware requirements. So in this extreme example, the box we used to run the test was just simply too small. But still, this is not something that scales infinitely since we also have a large monolith. And it turns out, yes, it's almost always used in some form. Again, a lot of other services. So we actually continued our investment. How can we make this run better? And here, this is a different view from Jenkins. We are actually able to run these acceptance tests end-to-end tests in a reasonable amount of time and with no errors. And we use MountBank, which is an open source project, to do this. So what we do is we record, like when we do these full test runs with all of the dependencies, we record the communication between our service and the other service, or actually within all of the services that we spin up. And then we can play them back. And we actually even, I think like many companies do this, we even augmented it a bit so that when we record these request end responses, we know about the context, so which test is this. So we actually don't rely on executing the tests in order. We can actually paralyze them or shuffle them around. And it will still, when you call a service 10 different times from a 10 different test, it will always return the answer within that test context. And I would say this is actually what, for example, Martin Fowler describes as contract testing. It was self-initializing fakes, how he calls it. And it does eliminate most of the flakiness that we saw due to timeout issues. There are still some Docker flakiness there. Plus, it only helps when you can do this in replay mode. Record mode still has all of the problems I mentioned. And we do need to run tests in record mode, actually, at least once during an engineer, like doing a feature branch. Because if you change the behavior of your service or the pattern of services it calls, you typically have to re-record these interactions. So maybe making end-to-end tests better and better is not the solution. What can we do? Contract testing. There's, like, many articles and papers about it. I just picked this one definition. Contract testing is writing tests to ensure that the explicit and implicit contracts of your microservices work as advertised. And in this talk specifically I'm going to focus on consumer contract testing. So testing the contract from the consumer, so the caller of another service. And oftentimes, like I described, people mean or talk about contrast testing. They say, like, testing against a real instance or like a real instance that has a special isolated mode that doesn't require any of its dependencies or maybe a stub or a fake. But what if we could, like, use in-process testing like unit testing, so with marks, but with validated marks? So we are actually able to validate that the marks we provide adhere to the contract. And this is what I'm going to talk about. It turns out that at Yelp we can already do that. And we could actually do that for each and every request that is done between two services. To explain that, I'm going to talk a little bit about how we do service to service requests just very quickly. And Yelp, each service has an API specification. And this will be our contract. Or this is actually the contract. We use OpenAPI or Swagger, how it has been called for a long time for that. But there's, like, other systems as well that you can use just as well. And when we talk to another service, we have a client library. This client library is, for each destination service or producing service, we have a client library. It is versioned. And it ships with a Swagger specification or OpenAPI specification for that service we're calling. So each point and time, whenever this specification changes, we create a new version of the client library. And then people can use it. And when you do make these API calls, what you really make is Python function calls. And then this client library does all of the magic in the background. We actually, like, the main part of that client library is an open source library called bravado that you can check out that we maintain. So how does that help us in having, like, fast testing that provides a similar confidence like end-to-end tests, at least in some respects? Well, if we look at how internally this client library works, there's, like, several steps that are executed. First of all, it takes this function call and from the information encoded in that function call. So not only, like, the arguments that we pass in, but also the name of the function, it constructs the request by looking at the API specification. It then marshals the data, which is the process of converting, like, Python objects and data into the on-the-wire format, which forces JSON typically. And then it has the option of actually validating that marshal data, like, that on-the-wire data against the specification and making sure it is valid. And then it sends out the HTTP request. It comes in and it goes, like, the other way around. So this response, because there's, like, you can actually use different HTTP clients. So at first, it's adapted for bravado, then optionally, again, validate it, and then on-martial, so transferred into Python objects. So what could we do here? What if, instead of, like, when you typically use unit tests, you would, like, mock out the whole function call? Like, you have this function call that translates to making a service request. You mock it out and you provide a return value. What if we didn't do that, but we let most of our client library machinery actually run? We just made sure it doesn't call the remote service and we provide, the mock we provide is, like, the on-the-wire format for the response. And then we let it run through the validation. And the validation is actually done by a library called SwaggerSpecValidator, which in turn uses JSON schema. So it's actually, like, pretty good at making sure the data is valid according to our contract. And since we know the contract, what we can actually do, we couldn't even provide a default mock for free. So developers can specify it, but we look, like, we look at the structure of the response. We know all of the fields, all of the values, all of the sub-objects, and we can provide the default data for it. So if you look at a code example, as you can see here, all we need to do is we need to patch the client lib. So that's, like, one function call we do, which is actually a context manager. And anywhere in our code where we use this specific client library, it will just be replaced with our mock machinery.  And yes, it's, like, initialized to some default, in this case, for integer zero, for strings, it's the empty string, and so on and so forth. It knows these names for the days because that's, like, an enumeration, actually. Yeah, and that is it. And it turns out, in the open API specification, you can even provide, for each response, you can provide an example response. And if that is present, we actually use that, so we don't use, like, zeros in empty strings, but the developer of the other service can provide an example response, which will be used. But of course, there's many test scenarios where you don't want some default data, so obviously it's also possible to provide your own data, like in this case, you can see, I set the return value and also the HTTP status code that is to be returned. You can also, like, you know, from mock because internally, we obviously, we use mock. You can also provide a side effect, so you can actually do almost anything, raise an exception or whatever. Yeah, and this works, but this is actually not different from just patching on your own and doing mocking. So what happens if the return value I provide here is not valid according to our contract, according to our service specification? Well, what happens is actually not that impressive, but I hope you can read it, but basically you get a JSON schema error in this specific case, the error I produced, I provided a response to specification said in the response, there should be a field named ID and my response didn't have it, so there was an error. Same thing if I said like, the ID field is supposed to be an integer and I provide a string, it would also complain. This is actually something that we deal with internally because obviously internally, IDs are integers, but whenever we do external APIs, then we provide them as strings, so there's always the potential for confusion there. Yeah, and this means like your marks will actually be validated against your contract and you don't have to spin up anything, you don't even need more than one process for testing and it is extremely fast. So let me summarize this a little bit and still talk a bit more about it. End-to-end tests don't scale infinitely, that I mentioned that, so we need a solution to that. Contract tests are supposed to help here, I didn't get into too much detail what contract testing actually is, but what I mean by that at Yelpus is that we can leverage existing infrastructure to do consumer-driven contract testing and essentially what this means for you as a developer, you get way more confidence in when you do the testing you're used to from unit testing as opposed to doing just unit testing. So the goal here was and is to gain way more confidence in these cheap tests and so having to do fewer of those expensive tests that are expensive to run and also sometimes a pain to develop. One thing I'll mention is that we are relying on the fact that our service, the service we're calling and we're testing against adheres to its specification. So if that service does a backwards incompatible change, we won't detect it. There's other tools like PACT or Postman actually has no framework for doing contract testing that deal better with this and that not only like do consumer-driven testing but then also do this testing against a producer like the destination service. This solution here doesn't help with that but we have developed a tool that is supposed to help you detect backwards incompatible specification changes because that is another thing. I actually talked about this in the past as well. Here at EuroPython, that's another pain point. Developers inadvertently making changes to API specifications that are backwards incompatible. So if you're interested in that, you have something that is called swag aspect compatibility that's open sourced and that you incorporate to hopefully make sure your service remains true to its contract. And that is it already. I'll mention that we are hiring and we are sponsoring so please find us at the booth. We'd love to talk to all of you. We do have European offices at Yelp in Hamburg, Germany and in London. And thank you for your time. Love to hear your questions. For questions, please come to the microphones or raise your hand and I can bring your microphone. So maybe I can start it off. How do you deal with the consistency of values? So in the Open API spec, if you give you types and structure, but how do you deal with values? Especially consistency between different fields in a reply. Yes, that's a very good question and that's exactly one of the limitations of this approach. So when you read about contract testing, it's not about the specific values, so this won't test it. It's not, you're not able to, well in Swagger Open API, you are able to set some restrictions for values and so we will actually test for those. But yeah, like fields that depend on each other, strings that have like an elaborate meaning like locales or something like that. It won't be covered here. You'll need to do more elaborate testing for that and maybe you need something that is more like an end-to-end test to do these sorts of verifications. Hi, so I was going to ask about the Open API spec and I noticed you probably use Swagger, which is opening API spec to zero, right? So you have a chance to actually ruin something for my company because we just finished writing our client library system for Open API spec three zero and last time we look into Bravado, it didn't have any chance of it appearing there so do you know anything about plans in Bravado to actually support the newest Open API spec? Yeah, that's a good question. Unfortunately, currently there are no plans. So if you want to use the newest spec, there's other tools out there. There was actually a talk by, I forgot the name, like there's actually people like doing great Python development for Open API three. So there's like, I think there's tooling like Bravado. I don't know if it's as well developed. There's official generator, but like no one likes code generation, so yeah. Yeah, and I think somebody also did like a pyramid integration for Open API three. So yes, if you require that, currently at Yelp, we don't have tooling around that. So ours is still about the version two of the spec. Thanks. You mentioned that you record your requests and responses in end-to-end tests. We actually do a fairly similar thing when I was just, I'm just curious about your opinion. So essentially as part of our tests, we run tests against the API of each service using a tool called Hoverfly. I don't know if you're familiar, which essentially records requests and responses as well. And as part of our build artifact, we publish the recordings of that service of requests and responses, which is then consumed by other builds. So in our continuous integration platform, when one service is built and changes interface, its recordings will change, and any service dependent on that will pick up the recordings and run its sort of integration test against these recordings. Have you tried something like that? Or what's your opinion? I think that's a great idea, no. So up to the point of sharing that between services, that's pretty much what we do as well. But we haven't looked into sharing that between services yet. Because what we did is, like I mentioned, we actually have stuff, we added stuff to PyTest, so with each request it sends the context of the test so that because oftentimes you do multiple calls, right? But yeah, I mean that sounds like a great idea to like further enhance the system. It does take several processes though, so that essentially you spin it up as a separate docker container and use it as a proxy that then records or mocks out any replies. Yeah, I mean that's the same for us. Like the test recording and replaying that's still multiprocess for sure, yeah, absolutely. Okay, great, thank you. Any other questions? Thanks for great talk. Have you considered Protobuf instead of your code by yourself library? It's made client. I mean Protobuf can do client and without any efforts. Yeah, so that's I think mostly historical decision. Please, I hope I'm answering the question correctly. Your question was about like why don't we have like a different system for generating clients, right? So that's absolutely something we looked into and that we might actually do in the future. So the way Provado works internally is actually like very dynamic, whereas inside Yelp we have switched to these static client libraries that still use Provado internally but actually don't use the dynamic nature of Provado anymore. So that's definitely, I think that's mainly due to the effort involved in changing that, why we haven't done that yet, but that would definitely be like you suggested a great improvement. Hi, thanks for your talk. Do you use any strategy for sharing schema and enforcing schema between different microservices or to implement API guidelines inside your company so that all those processes could be simplified or streamlined? I don't know about simplified or streamlined. What we do have is a central repository where each version of each service specification gets posted to. So you can imagine that as really just a version git repository. And whenever developers make a change to an API specification, a new version for that service will be posted there. So we definitely have the tooling for you to interact with these API specifications and figure out what changed and things like that. That's actually how we implemented the tool that detects whether you're doing a backwards and compatible change. It actually looks at the code as it is now, just like the YAML or JSON for the spec and then Fetch's previous versions and things like that. But in the end, it doesn't really, for example, it doesn't help for making sure that all of our API specs are consistent, things like that. Any more questions? Not the case. So let's thank Stefan again for his nice talk. Thank you.


So a while ago I was at a speaker workshop and they told me what you should never do on stage is Add disclaimers to your talk or say that you're not an expert because then no one's going to believe you I'm going to do both today.  So I hope you'll still believe me in the end So first a disclaimer if you've ever been to one of my talks Most of them have been highly technical and what that means for me is that I try to stick as close as I can To the facts or to something that some people believe in called an objective truth Well, not today today. I'm also going to give you my opinion And this means that you may disagree with me that you have a different perspective that you have different ideas about security and the role of a developer in security and that's fine Please come see me after my talk and we can have a lovely conversation and maybe I can learn something from you so Today I am going to give you my opinion the second thing is I Am not a security expert So this may surprise you I'm going to talk about security, but I am a software developer So this is not only a guide for developers. It's also a guide by a developer. I am a developer That is very interested in security. I love to advocate security. I love to champion security. I love to raise Security awareness but everything that I'm going to say today is from the perspective of a developer So I am not an expert. So you don't have to believe a word that I'm going to tell you today Well, let's start with the talk itself so today the most important question that I would like to answer and it is really a very simple question is Just why are developers so important for security? That this may seem like an obvious question developers write a lot of the code that's being used So if developers write insecure code, then probably the security is going to be bad But if you ask security experts who look at this question from a different perspective They typically argue that developers are not so Important for security. They don't say that developers shouldn't be important for security But they say that developers currently are not as important for security as they should be in fact Some go even further. I was reading an article a while ago and it had this very interesting quote You know how it goes Mentioned security to your typical developer and you're likely to be met with an eye roll at best or puzzlement at worst Generally, the whole security thing is seen as someone else's problem This is quite a quote to have in your article and I didn't cherry-pick it either. This is Below a header that basically says the same and this security expert goes on for two more paragraphs Basically making this same point over and over again and this isn't an isolated article either I typically I watch a lot of security conferences and especially in like the Panel sessions there are typically security experts who make similar statements that developers They don't really seem to care about security. Well If I look at myself as a developer, I do care about security. So what is going on here? So I think we have to ask herself a different question Why do developers behave as if they don't care about security? I think this is a really important question to ask ourselves and for me When I take a step back and look at my work and look at what I'm being paid to do I think we can find a reason there because I as a developer I am paid to deliver value some kind of business value to deliver Features to deliver a new release. So my entire environment is Basically telling me we should release soon. We need these features. We need to have this competitive advantage You need to deliver this business value now over the past 20 years or so if uncle Bob is to be believed Developers have actually changed their behavior. They they are now most of them are now writing automated unit tests or an automated Testing suite they care about maintainability They use good design patterns and they will even argue for that with a product owner with a product manager With the people telling them to deliver soon or if you want to rephrase it They use their technical or their professional responsibility to argue for the quality of the features they deliver But this is difficult. So why don't developers do the same? For security, I think to understand that we have to take a trip to a different industry And it's the safety industry the industrial safety industry and there they have a very neat term and it's called safety culture and what this means is that well Everyone knows that safety is important because otherwise things blow up But knowing that a safety is important isn't enough and you shouldn't do safety just to meet the regulations to be compliant What you should do is you should make sure that everyone Believes that safety is important that everyone acts like safety is important and that everyone prioritizes safety This is what a good set having a good safety culture means in an in a company And for companies, this is really important because if you screw this up Something bad might happen like your company blowing up This was a big industrial accident in the Netherlands 10 years ago. This company no longer exists So they had a bad safety culture. That's what all the reports say they had a big accident And it was just the end of the company So now in the security world we have a similar term and it's a security culture And what this means is that if you have a good security culture, then it's not only the CTO who says well All my developers are writing secure code. So come by with us. It's not only the promotion It's not only compliance to check all the checkboxes But what this means is if you have a good security culture then people really truly internalize the Importance of security and they will argue for it. They will change your behavior for it They will prioritize it. It doesn't mean that you have to have perfect security Because that is impossible But you do have to be very aware of the kind of risks that you're taking and the kind of impact that Certain vulnerabilities may have you or certain threats may have in your in your company But there is a bit of a difference with industrial safety and That is that if you have a big security incident in your company, it may not have the same financial impact So if we just go back one year There was a series of data breaches as last pass which is right in the core in their core domain They say give us your secrets. We will keep them safe And then they had a string of data breaches now. I cannot look into their culture and organization I don't know if they have a good safety culture So I don't want to comment on that But what I do want to show is that this company is still in business And I think they had a dip in a number of customers. They have but I think they're actually Going back up again. So if you look in a security perspective having An incident that goes right to the core of your core domain Might not even be the end of your company. So there are less financial incentives to invest a lot in in security Regulators have caught on so in Europe There are now regulations that if you have a data breach you have to pay a hefty fine and those fines can be millions of euros In total so they're trying to create that financial incentive, but there is still a bit of a difference In safety in between safety culture and security culture. So why are developers so important? Well, I think that developers are important because we have to take our professional responsibility so if we are We have our responsibility for our work and we have to argue for it And this is often a bit of a negotiation. You have a project manager. You have a product owner They come to you. We want to release next week. Can you do that? Then you say well If we do that we have to cut these corners so better or not And then you start up the conversation But someone has to argue for security and because developers are typically the people who are involved for the longest in that development Process, I think there's a responsibility for developers to stand up for security culture for security to argue for that It's part of your professional responsibility But that's difficult because if you want to argue for security you have to be an expert in it, right? So to improve the security you have to be a security expert And this is a big problem Because if I look at myself if I want to become an expert in anything It's probably probably in developing software. I also do a bit of ops. I do a bit of security Sometimes I do a bit of front-end development if it's really necessary But I cannot be an expert in everything So this is a problem and I think a recent tweet by Kelsey Hightower illustrates this principle very well We cannot expect developers to become an expert in everything that idea just isn't sustainable So, how are we going to do this? How are we going to do this as developers? How are we going to make the change in development? Well today?  You don't have to become a security expert you can actually Contribute to security without becoming an expert, but how do you do that without feeling lost? I think there is a very very good Initiative within the security world that that's there to help us in the security world. There is a principle of shift left And what that means is well They kind of use a caricature of the past to sell this just like how agile uses a caricature of waterfall to sell the Benefits of agile in the security world. They say we used to do security very late in the process So we used to do it at the end developers weren't involved design We didn't really care about security design. We did it in the end. We hired a team of pen testers We found a million vulnerabilities then we had to go back releases had to be delayed We had to rewrite stuff redesign stuff a lot of costs associated with it So we shouldn't do that. We should take security and shift it left Now obviously if you just take security and shift it left and then don't care about security after That's also not good. So actually some people are arguing for start left So you should consider security throughout your entire software development life cycle So and why is that important for us? This means that now a lot more people are writing resources That tell you how to do security as a developer. We don't have to reinvent the wheel and That is really important for us developers We can just look at resources online and all of the things that we can do they are not rocket science Nothing that I'm going to tell you today is rocket science You don't have to be an expert to implement them and that is basically what I'm going to tell you in the rest of my talk I'm going to tell you how you can navigate that landscape. How you can learn about security How you can apply that in your work without feeling overwhelmed. So why is that important? Well, let's zoom in on the first security principle that I want to show you today And it's a term called defense in depth. It's typically illustrated with a castle And what this means is that if you want to do security? Well, you cannot rely on a single security measure So here you have a castle and if you look at this castle, you have a mode So if you want to get into castle, you first have to cross the mode that you have to get past the wall And then you're in the inner courtyard But all the treasures are in the actual castle, which is a fortification onto itself So you still have to make it into the castle there guards everywhere rooms are locked So you have multiple layers of security. This is what defense in depth means And this also illustrates why developers are important a lot of companies these days that buy a vendor An on-premise cloud environment. They invest a lot in edge security So if not if nothing gets into your systems, then we're safe, right? But the problem is every layer has holes So if we ignore the part in the middle where the developers write the applications we can still get in So that is why in a true start left or shift left environment developers are very important In the safety industry they typically Illustrated with this model. This is the Swiss cheese model by James reason I'm not really going to go into it But there is one important point to make here in this model you have various barriers between Normal and a disaster or in our case a security breach And the realization is that there are always holes in barriers So in software, you might have a zero-day Vulnerability just lying to wait there for someone to pick it up You might have a misconfigured firewall And we call those things latent conditions there are holes that are always there in your system But you might also have active failures for instance You might have a user of your system handing out their past password in a phishing attack Handing them the keys to an application So in this model and I think that's really cool You have latent conditions and active failures that were holes in your system everywhere But once those holes align That's when we need to get in and that is why developers are important We are responsible for some of those layers and we should implement them This is enough about industrial safety if you want to know more. This is a good book Which has a lot of overlap with security. It's a nice book to read so what can you do to prevent those holes in your project and This isn't rocket science. I'm not going to tell you anything that's really difficult But I'm just going to show you how I do it So in my opinion for me, there are three main pillars and the first thing is that you have to learn about secure design principles And I don't mean about big architecture principles that you have to design into your system But coding patterns just like you learn about repositories and observer patterns and stuff like that There are also secure coding patterns that help you keep your code and application secure look into them practice with them The second thing is There are a lot of mature security practices these days look into them adopt them They're often very easy a lot of them are automated which I love as a developer There are a lot of tools that we can use use those tools get familiar with them and finally know how to mitigate Common vulnerabilities and this one is really important. There are a lot of top 10 lists out there But I'm just I'm going to tell you later that that is not enough So these are main my main three pillars for the first I'm not really going to take you through a long list of design principles. I'm sure you can all Google It would be a bit of a waste of our time to go past everyone. I've selected a few here The the extra cards under under validate input indicate that there are a lot more to find But I do want to zoom in on the first one and this is one that I've encountered in Production a lot of times I sometimes do code reviews for other projects And this is the no and less principle And if there's one thing that if you go home that you should check is if you're doing no and less or deny by default Which is a different name for the same thing. So what am I talking about? Well, let's say that you're using a nice API framework in Python If you create an API endpoint in Python It's really easy in most frameworks like fast API Django flask You just write a function or a class you map her out to it and hooray everything works But what this means is if you just create an endpoint it is open by default. There's no authentication There's no authorization and This also means if that's someone if someone refactors your codes and down the line You have no mitigations in place During that refactor that decorator may accidentally disappear or someone Has a really complicated feature to build with a lot of business logic and everyone is focused on the functionality And then they forgot to add that base class to the inheritance list of the class. So if you have Yes, unless and you forget something then suddenly something is open So what I typically try to do is I try to invert that it's denied by default unless There is something that gives someone access and this is a principle that you can do today And this is one that I think I've reviewed five or six projects over the last two years This was present in at least four of them most were minor one was very major. So The second thing that I want to talk about is mature security practices And this again is going to be an introduction in how you can learn about mature security practices because I can talk about this For two hours and I only have about 11 minutes left So mature security practices mean that you just have practices that help you enhance security So, how do you know what they are? Well, luckily in the security industry people love standards And we as a developer we don't have to look at standards to see if we're compliant But we can use them as a guide and not every standard is as accessible to us developers As the other one. So if you look at this slide, I've made it Kind of like a hierarchy of standards in terms of high-level abstractness to low-level close to the doing and I'm going to show you one That's really close to the doing that basically just tells you you can do this and your project is more secure So right at the top. There's one that maybe some of you already know which is an ISO standard 27001 and this is really abstract if you look at this standard in detail It doesn't really tell me what to do as a developer I can't take the rules from this standard to my workflow and know what to do Luckily below that there's a model called the software assurance maturity model or SAM for short This is by an organization called OSP. They recently re-branded from the open web application security program to the open worldwide application security program just to highlight that it's not just about web development And I really like this organization because of their logo. They're called OSP So their logo is a wasp inside of an Oh, which I think is really cool So if you look at this model, you'll find something like create a formal definition of the build process so that it becomes Consistent and repeatable. This is already more concrete as a developer I can already kind of imagine what I can do to make my builds more secure But it's still a little bit removed from the actual practices that I have to do And that's why there is a fairly recent project, which is the oh wasp DevSecOps maturity model Now DevSecOps is just DevOps plus sec Or D some for short and this is much closer to the doing still so in the in the D some model you might find a practice that maps to the build process like pinning of artifacts You do have to learn the security lingo a little bit But if you pin your artifacts your dependencies to images that you're using that is one way to ensure that your build is more repeatable So if you zoom in on that project, you're going to find a lot of practices that you can just do today I do have to mention I adapted this sheet from a talk by Timo Pajol. I asked for permission and he was okay He's one of the leads on that model I do want to show you a little bit what's in that model So if we zoom in on the oh wasp DevSecOps maturity model, how can you use it as a guide? That's actually a really simple model You can just look it up online. It has five dimensions And again the disclaimer the terminology here is slightly different than how we use it as developers So testing and verification is mostly about verifying and testing security although unit tests are also in there But if you then zoom into one of those dimensions like build and deployment you'll find sub-dimensions build deployment patch management They are really familiar to us And if you then look at something like patch management, you're going to get a hierarchy of practices that you can do today That you can just implement in your workflow. So here are a number of practices Practices rated against several maturity levels I've heard that some security experts don't really like the gaps in this because that messes with their scores But for me as a developer, I don't really care about that I can just look at this and say hey What's what do we mean by nightly builds and should I do them and I can look up what nightly builds are and Bit of a spoiler. They're not the nightly builds that I was used to when I was younger I grabbed the latest nightly build of a Linux distro and wrecked my computer every day What they mean by this is if you have a built pipeline Just run it every night. You don't have to actually go to deployment But most of your automated tooling security scanners dependency scanners They are in your pipeline and if you have a long-running surface that you rarely update Chances are that you've not run your build pipeline for weeks sometimes months So just schedule a pipeline run every night and make sure that if your scanners now fill because the security Definitions have been updated that you get an alert in the morning So you know that you have some work to do and this is a very simple practice that you can start doing today and Now for those long-running applications. You just get alerts about outdated dependencies and stuff like that. There are also Related techniques in here like automated patch PRs, but these are really simple things that you can do There are also some dimensions in here that you might not check out as a developer And I urge you urge you to do so. Anyway, so this is the culture and organization and then specifically the design Subdimension this mostly has to do with stuff Like how are you going to make sure that you design security securely in your organization? And you might not feel as Familiar with this as a developer, but there's a technique in here It's called simple threat modeling which I think is really important and everyone should check out what this means Is that if you're in a very early stage of your project? You should just think about what are the threats that that are potentially in this project? How severe are those threats? What is the impact? What is the risk? And then you can get an idea of the things that you should think about while designing your application while implementing your application I say ideally you do such a workshop with a security expert who knows how to run these But if you don't have one just do it yourself Grab a whiteboard start drawing your routes and your relationships between your services And just analyze what are the vulnerable bits and make sure that your design counteracts that and not only at the start If you're going to make a major change, please do another threat modeling session so for instance if you run a webshop and you're expecting a Christmas sale and You expect a big run on your website and you want to make your website more performant You're going to change all your caching rules. Do another threat modeling session. What are the threats there? Should we mitigate some stuff? Should we build and test to? Not cash too too much things because if you don't you might end up like steam They were heading to their one of their famous Christmas sales Someone ramped up all the caching and they started caching individual account pages Which meant that if customer a was the first in a caching period they added stuff to their shopping cart Then the next customer would see that the shopping cart of the previous customer What's worse if this happens with credit card information if you visit your own payment information And you see that of the previous visitor. That's obviously not a good idea So you can make a threat model you can analyze what is the sensitive information? What is The not so sensitive information. What is it that we can cash and you can take steps to prevent failures? Don't rely on memory. You can build a security integration tests that just Verifies that you're not caching something sensitive so that if someone a year later changes to config You don't make the same mistake, but in a threat modeling session. You can think about such changes Well, and finally No common vulnerabilities. I think this one is pretty obvious There are a lot of top ten lists out there that list the most common vulnerabilities now I hope none of you are just formatting in raw Arguments into your SQL statements. So I do urge you to dive a little bit deeper into all those vulnerabilities I also urge you not to stay passive. I don't really like reading passive lists But there are a lot of challenge websites out there that have a vulnerable website and they ask you find the vulnerability And that's a great way to not only get to know the vulnerability But to also see the impact and a lot of those websites also have common techniques to mitigate those vulnerabilities So don't reinvent the wheel and finally and I think this personally this is the most important one If there are vulnerabilities that are identified within your own projects share them with your colleagues Don't be afraid. Don't shame each other. Don't put the blame on each other But if there are certain vulnerabilities that in your domain are in specially important It's important to talk about them and that is probably one of the most important things if you're handling a lot of PII personally Identifiable information and you've noticed that you're logging that in production and it goes to vendors That's a data breach personal information is now with another company You've lost control of re information if you discover that talk about it to other developers because they may be doing the same thing So that is really important Well and to wrap it up if you do want to implement stuff take it slow Don't add six security scanners to your pipeline overnight Because the only thing that you're going to teach yourself is how to ignore those millions of alerts that you're getting So take it slow take it one step at a time. You don't want to teach people how to ignore good security advice You also have to be pragmatic and it's kind of related to the first point You don't have to be here You don't have to compare yourself with the biggest companies out there, but if you're currently here work on Getting to this maturity level first be pragmatic about it and also always make a cost-benefit Benefit analysis. That's what your threat modeling is for and also be vocal We can only truly build a security culture if we do it together if you talk to your fellow developers if you organize a Capture the flag exploit this vulnerability workshop together do stuff so that you make security a topic that is talked about in your company and if you're Confident do also talk about it with people higher up in the company So that you also get the support from your product managers from your product Owners from your CTOs out there. So be vocal and that's all we have time for today This was me the slides are available on discord in the talk slides and artifacts channel or whatever it's called And thank you very much


Hey Karu you were up against Benjamin Glidura with the black pieces, but you didn't seem to have any trouble at all actually today a very smooth victory Yeah, I think I caught my opponent in a variation that he wasn't really expecting and he's a little bit unfamiliar and just in general the position He's a little bit cramped. White doesn't have a lot of space and he didn't really come up with An active idea to create an encounter plan.  Where do you think he went wrong? I think actually as I said before I think he wasn't he wasn't comfortable I think in general the position is probably relatively fine till about move 20 ish But he just wasn't comfortable position didn't really see any good ideas And I mean it's it's very hard to play like that even even if you're completely fine If you don't see any ideas any ways to play I mean where we're humans we're not computers So you know you can't just sit around like a computer would as though, you know, you don't care So yeah, I mean it was it was just He just wasn't comfortable, but he was always fine. I think for the most part, but it happens Right. Absolutely. Now. He's a very talented youngster and in fact last Last year brought he had a great game against machine I'll give us a little bit of an insight when you're preparing against somebody who's Who's young and talented. How do you prepare against him? Well, generally, I think one big difference is a lot of the younger players. They tend to have a very set style They don't seem to be as universal as most of the top players So certainly you try to find systems or openings where it doesn't suit their style And I think today especially I was successful But I mean, of course, I saw that game last year where where he beat Vichy Um, so so I was aware, you know that of his his potential. I mean, he's a strong kid obviously Long way to go, but still he's accomplished quite a bit so far So I think time will tell right well great game a game with black Congratulations, and we hope to have you back in our studio soon. Thank you


I am delighted to welcome Kass Mouda to the IIA and to Ireland and to start together a conversation on the surge of populist fever across Europe and the challenge that this raises for the future of democracy as we know it. This reflection is one which the IIA is going to actively advance over the next few months through a series of speaking events that will commence next week with a presentation by Timothy Gartenash and then there will be a series of speaking events going into the new year. So understanding populism, the roots of it, the dynamics of that phenomenon is important. It is equally important to grasp the complexity and the diverse reality that the term encapsulates and for a start it is important to get our definitions and concepts right. So I have no doubt that Kass Mouda's presentation is going to set us on the right conceptual tracks. Indeed Dr. Kass Mouda is a leading scholar in the field of political extremism. I think that his interest started with Western Europe and then expanded to Eastern Europe and then further afield to America, North and South and even to Israel. Dr. Mouda has published, has authored a number of not worthy books, so general books on populism, on the rise of right-wing populist movements in Europe and then also a couple of monographies including one I believe on the left populist party Syriza in Greece which could give us ground for an interesting discussion on the Irish situation and the possible similarities between Syriza and Sinn Fein. So Kass Mouda is currently associate professor in the School of Public and International Affairs at the University of Georgia. He's also a researcher in the Center for Research on Extremism at the University of Oslo. He writes very regularly for newspapers and he is very active on the social media. The core question at the heart of Kass Mouda's work is one which I believe calls on all of us who cherish democratic values and civil liberties. So that question is how can liberal democracies as they defend themselves against the challenges of extremism, how can they avoid undermining their core values and institutions or in other words, how can the liberal ward off the barbarian without self-barbarising. So these are I believe questions that Kass is going to address in his presentation. So before inviting him to speak I would ask you to switch your mobile phones to silent mode please. And nevertheless you are encouraged to tweet and with the handle at IIA which is a hallmark of reasonable and informed debate. Thank you very much and thank you for this invitation. It's nice to be in Ireland, one of the countries I don't know so much about and that's always good to be here because then I learn 20 minutes very short for an academic so it's going to be a very basic presentation which is mainly thought of as an introduction to have a conversation afterwards. As said I think terminology is important and even though it's often seen as something academic and that only academics all the time fight about what things really mean without actually knowing what we talk about we can't really normally talk about it. And so I think the problem that we have at the moment is that while populism is the buzzword of the early 21st century without any doubt increasingly more and more of the debate is actually about nativism rather than about populism. And so let me define these two terms and explain how they are related and how they are different. Now populism was for a very long time a truly contested concept in the sense that not only did people disagree about the exact details of it but they actually completely disagreed about what it was. And so for some it was a movement, for others it was a regime, for others it was a style or an ideology. So it's not just like conservatism where we binary all think about a set of ideas or an ideology and then we disagree about what exactly that ideology is. Now we actually totally disagreed about what populism was in essence whether it existed. Over the last couple of years I think that disagreement is becoming less and less and most recent authors not only in Europe but also in the Americas are seeing populism first and foremost as a set of ideas. And that set of ideas focuses on a fundamental opposition between the people and the elite. There's virtually not a definition that doesn't have that in it. But then there is a debate about what separates the people and the elite and what that set of ideas is whether it's a rhetoric, a discourse or whether it's actually a full blown ideology. My personal definition is that populism is an ideology that sees society as being fundamentally divided into two homogeneic and antagonistic groups the pure people and the corrupt elite and at once politics to follow the general will of the people. And so what's important here is that I do believe it's an ideology I think that is a set of ideas that informs not just campaigns to grab power but also once populist parties are in power it will inform what type of policies they will implement and how they justify them. Second it's a moralistic distinction. The people and the elite, the distinction is not class like a Marxism and it's not about money, it's not even about which position necessarily hold, it's about morality. The people are pure and the elite are corrupt. Second it's monist. So the people is, it's not the people are, they are one. All the people share exactly the same interests and values. Similarly all the elite are corrupt. And in line with that they believe that the people have a general will that they all want the same thing. And therefore that politics can be made that are good for everyone in the same way. Because of that distinction, the moralistic distinction compromise is frowned upon because if the pure compromise with the corrupt the pure get corrupted. On top of that while populism to a certain extent accepts democracy in the most minimal terms as in popular sovereignty and majority rule the idea that the people elect their own leaders they do not support liberal democracy because they don't see any legitimate minority. After all there's only one group that is homogeneous, the people the only group that is accepted to exist outside of that is the elite and they're corrupt. And the corrupt don't deserve the protections of minority rights or rule of law. Now nativism is a term that is best captured as xenophobic nationalism. Unfortunately it's a term that almost exclusively exists in the US American literature as well a little bit in the Australian literature and actually doesn't have equivalence in other languages like Dutch, German or French. But nativism is xenophobic nationalism which is best captured in an infamous slogan of the streets of the early 1990s in Germany which is Deutschland in Deutschland aus Lenderhaus or Germany for the Germans, foreigners out. Nativist want their state for their people and consider anything that is alien, non-native be that people or ideas as threatening. Now many contemporary populist parties are indeed also nativist. This is a group of parties I call the populist radical right, parties like von National, FBE, AfD, Lega, etc. But importantly not every populist party is nativist. Syriza in Greece, Podemos in Spain for example are not nativist. In fact both are among the most pro-immigrant parties in their country. And not every nativist is necessarily populist. At the moment one of the most nativist parties in that place is to say a zoo in Bavaria which are not populist. The difference between the two is that populism speaks about a vertical opposition. It's within the own people, between the people and the elite. Whereas nativism speaks about a horizontal opposition. Between our ethnic people, the ethnic us and the ethnic them. So those are different oppositions. There's virtually no nativist that argues that the elite is of an ethnic other. No one argues that it's the Muslims that control the Netherlands. They might argue that the ethnic Dutch politicians are pandering to Muslims at the expense of the own people. So populism and nativism are different things. Now how important is populism today? You can answer that question at two levels. First, populism doesn't only exist at the elite level. It's not just something that is spewed by parties. You can actually measure it at the individual level through surveys. It's very hard because populism overlaps partly with just a general pro-democratic discourse after all like the will of the people and partly with anti-establishment sentiment. Both of these are very broadly shared. In pro-democracy obviously, 80-90% of the population. And in various countries, the vast majority of people are anti-establishment too. In any case, for the studies that we have, there are large pluralities if not majority's whole populist sentiments, at least to some degree. If you look at what we normally do, political parties and how much support they get then if you would look at the debates over the last couple of years you would think that they're phenomenally important. On average though, populist parties within the EU gather roughly 15% of the vote. I just want to stress that 85% of people vote for non-populist parties. That seems to be completely missed. Because those 15% of the people who vote for populist parties have been implicitly made into the people in much of the media and political discourse. It is they who define what the people are concerned about. It is they who define who are the real authentic people whereas we liberals in the big cities live in a bubble. It's not to say that populist, authoritarian and nativist sentiments don't stretch further than 15% of the population. But it is important to keep in mind that on average the biggest populist party in the country is the third biggest party. And yet probably a three-quarters of everything that we write about politics is about populism. It's not about the centre-right or the centre-left. Now, averages are fine, but of course Europe has many differences. There are five governments at the moment that are led by a populist party and therefore have a populist prime minister Hungary, Italy, Poland, Slovakia and Greece. Three of them are coalitions. And four have a populist in government as part of a coalition, generally the junior partner, Austria, Finland, although it's switching Denmark and Bulgaria. And so at a certain level you could argue that the centre holds. 85% doesn't vote for the populist. 19 of the EU governments do not have the populist. The biggest political groups in European Parliament are non-populist groups. And yet that's not the case. To a certain extent we live in a populist era or what I've called in 2004 already a populist zeitgeist. And to be more exact, increasingly we live in a populist radical right era. Populism or aspects of populism, aspects of authoritarianism and aspects of nativism have become absolutely mainstream. Just think about the discourse about the so-called refugee crisis, which is full not just by populist radical right parties but even by mainstream politicians and media of ideas of threat to the cultural homogeneity or even balance of European countries. They're rife with speculation about the link between immigration particularly refugees and terrorism. And they're rife with betrayal or at the very least incompetence of the established elite. And that is where the real power of populism is. And again I would argue at this point in time the power, the agenda setting power. So they decide not just what we talk about but how we talk about it. And here populism is again secondary to nativism because we're actually not so much talking about how the elite have failed and how we should solve that. We're talking about how threatening the ethnic other is and how we should solve that. How should we protect our societies? And I think that is really where the core is today. I'll give you an example from my own country which is the Netherlands which is the country that together with Denmark has shifted most radical from kind of a beacon of liberalism in the American sense, progressiveness in the European sense to really right wing politics where the radical right itself is radical right populism is rarely really in power but the mainstream parties either govern with their support or largely on the basis of their agenda. In the summer of 2015 the so-called refugee crisis started. Large numbers of asylum seekers came through most notably the Bolton Rat. Our Prime Minister, Mark Rutte, was at that moment in the U.S. about one and a half hours south of where I live in Atlanta doing what he does best, mainly advertising his big businesses like Heineken and others. He didn't have any position on what was happening for more than a week but someone else did. He had builders, our most important export product and probably the most important Islamophobe in the world. He had builders defined the whole situation of asylum seekers for the Netherlands. He called it a crisis. He called it a threat. He put the link to Islam and to terrorism. And that was by a large mainstream, partly problematized by journalists saying, well, he had builders said that this is threatening, what do you think? And then Mark Rutte came back and because Mark Rutte is a problem solver, he said okay, so there seems to be a problem. It's a refugee crisis. They're threatening our security. So I'm going to solve this. That is where the power relationship is. So if we're talking about a populist era, we're talking about a populist era because the non-populist give the populist this power. And this is why I'm less somber than what at the moment is this whole crisis of democracy literature, which is a coterie industry which is making way more money than I do with my reasonably optimistic story. But I think it's a very American story. I think the situation in the U.S. is potentially more problematic than Western Europe in particular. But it misses the point. It misses the point that it's still the mainstream parties, the non-populist parties that hold almost all of the power. It's them that decide that they give in to the myth that the populist radical right voter is the people. And the reason why, and I'm not arguing that this is A, not problematic, or B, not long-lasting, I don't think anything will change until the European elections of 2019, which are going to be about the embattled status quo versus the emboldened populist as the 2014 elections were, as the 2009 elections were. But let me just take you back to the two months after the victory of Emmanuel Macron. At that point in time, there was broad speculation about populism being that, about the real people actually supporting the mainstream agenda. And I still believe that if the German elections would have had a free 4% different outcome, with, say, the 3% higher and half-day 3% lower, we would have a completely different debate. Because at that point in time, people would have said, well, you see, Merkel is still popular, despite what she did. I have days problematic, but under 10%, so it's not really a big force. So a lot of this is hype. It is hype. And the reason that it is hype, and that is where the real problem of democracy, I think liberal democracy is today, is not because of the strength of the populist. It's the weakness of the liberal Democrats. Liberal Democrats don't have a discourse, and importantly, they don't have an ideology anymore. Many leaders, I honestly believe, don't fully understand what the system of liberal democracy is and why minority rights, rule of law, separation of powers are crucial to the system. On top of that, we all know by now that the center-left has lost its ideology. That has been debated for decades now, since Blair and going back to Clinton. The center-right actually has a similar ideological crisis. To a certain extent, the center-right at the moment is going through its Blair-right moment. It has given up on its old ideology. It has bought into pragmatism, and it's winning elections with it. But it's winning elections on the basis of someone else's agenda. And just as new labor has become irrelevant, because in the end it just did what the center-right did, I believe that the center-right, if it continues like this, will become irrelevant too, because it is, in large extent, doing what the radical-right does. And it will never do it as well. And so where we are today is still for most cases, I'm not talking with Hungary-Poland, in most countries it is still the game of the liberal Democrats. They still have the power and the opportunity to redefine themselves, and thereby redefine politics. And the struggle is not about weakening populism. If we weaken populists, we still have a weak liberal democracy. Yet if we strengthen liberal democracy, then by definition populism will be weakened. Thank you.