What's up everyone? It's your girl Kenzie here from Layton Sports Cards and I'm ribbon 10 box Tuesdays 10 box definitive flawless icons baseball mixer number 126 random teams again. Here's a look at the random results You can always find these at Layton Sports Cards comm underneath results tab in the link is also in chat for you. All right, best of luck Everyone. Let's see. Let's start with the prison draft Here we go looking for five We've got a Tanner McDougal that is 38 out of 50 Silver Evan Justice blue Jackson Meryl Not numbered on that one. We've got out of 50 a Parker Shavers CHA VRS shavers Parker Shavers 32 out of 50 Chicago Cubs going to the Cubbies the first auto Rocker Fox a royal Hazelwood Robert Silver Isaac Pacheco Red Jordan buyers Not numbered on that one. We have a Michael McGreevy on the silver crusade Michael McGreevy. I'm picturing a red team. You agree. Is it Cardinals? Oh, yeah, Cardinals on this one Michael McGreevy and Thunderstruck Landon Marceau I have such like a picture memory. It's ridiculous. Oh, yeah Back rocker Ferguson. We've got some checkerboard of Michael McGreevy. That is five of 35 Silver Clay Dugan got red wave of Dayton Duny not numbered Next auto up. We've got three of 12 on the cracked ice Michael Kyrian KIR IAN Out of Kyrian KIR IAN three out of 12 Nationals Nats taking on this auto draft standouts of Brendan Beck Look Murphy's silver crusade Dalen Lyle Lyle. We've got a tiger of Ian Muller Nice tiger stripe there Ian Muller Silver Chase Petty. We've got red mojo of Andrew Abbott's not numbered 57 of 99 blue auto of Dominic Hamill Dominic Hamill out of DB you 57 of 99 Metz on this one fireworks of Coulson Couser and last pack Trimble Petty Rudrick Fireworks silver Nathan Hickey. We've got silver Brandon Boyce a red wave of Sam Prider Next auto not numbered out of Houston a Robert Gasser Silver Auto Robert Gasser Padres on that and power surge of Ethan Wilson Some of them did get magged Chad. Yes for the diamond icons not all of them Some of them did get get magged. Yeah, some of the bigger heads alright Pops Chrome anniversary Up next Elendor you had obsidian. What? Oh last night. I'm sorry. I thought you meant the last break my apologies um We don't know you had two gold cards in one box, right? We've got refractor of Sheffields can't remember off the top of my head our roll of thumb is if it's over $200 it gets magged It's over $200 value X Fractor Salvador Perez Wendell on snag Nice box not sure force mag any of those I cannot remember Ripped almost a hundred person last night. We ripped a lot of boxes. So that was a nice box for you refractor of Ian Kennedy Sounds good, thanks Is there a Maggie up theme? Evan White got refractor Roy Oswald Phillies Tristan Mackenzie rookie we've got out of 100 red atomic Jonathan steve here White socks $2.01 Refractor John Drysdale Yeah, everyone plenty of room left with Sam for personals after group breaks Just to two in queue for personals y'all plenty of room order now. It'll be one of the first couple rip Those will start around midnight Eastern And again tomorrow big baseball reliefs museum collection. We got dual streams in the morning tomorrow refractor of Johnny Damon Nice so only only football breaks remain tonight aqua wave Marco Gonzalez But yeah dual streams magic Matt will be live out on the Layton baseball breaks channel with half case pick your team breaks and forced over here starting at 11 with random team We've got gold Jose Conceco Cool one there for the A's on the gold. That's sick 12 out of 50 Rico Oakland Nice one there Where's Oakland? Stephen M nice one there Segar Darvish last factor Eddie Matthews refractor, let's do selects next I got out of 25 for the Braves signature select signatures cracked ice John Smoltz That's a cool one. There you go Braves Great way to start the box and Fuego Shane Bieber Weston Griffey Myers. We've got red rookie of Kevin Smith for the Blue Jays 38 out of 199 It's not when you see very often at all out of select Tri-color Ichiro on the concourse We've got blue Xander Bogart's for the Red Sox 13 of 149 over Tyrone Taylor out of 99 we've got Mets RPA of Thomas is a pookie Christian Yelich Phenomenons They're in lightning short print Aussie albies for the Braves nice one there tie France Silver Out of 99. We've got a tri-color patch of a mere Garrett the Reds Moonshot Stanton Kibrian Hayes on the premier level tri-color Pirates, it's Guardians rookie jumbo patch Eli Morgan Guardians Jram on the Phenomenon Silver Justin Verlander concourse last packet selects got neon green to 99 Liam Hendricks for the White Sox Let's see. Let's see. Let's go top scrum black next We've got rookie Breila Marquez for the Cubs Elvis Andrus doesn't look almost like a lifesaver at first. Yeah red bat. It was like wait a second This isn't Star Horse and we've got refractor Joey Gallo to 199 Rangers 34 of 199 What's up sin? It's up sin Victor and are in case car We've got a yes, Monty grand dollar factor 26 of 150 white socks Nice sit there white socks Christopher G with the socks Nice one there.  We do appreciate it Just all remaining Now we've got flawless tiered random ten bucks. No, I think ten bucks to say sold out luminance Luminance select and flawless. Yeah, luminance select and flawless for the night Half casers on the luminance and select and then we've got a full case tiered random for the flawless Sighted for that. I've a flawless in a little bit We got a slice of a star Joe Carter for the Blue Jays go birds Purple Andrew McCutcheon friend Mel Reyes, we've got purple huge Julio. You're yes, there is new bar molar stargle I don't know how to I do it We've got pristine boarders Freddy Freeman Bala you try that PSL yet New bar rookie pristine boarders Adrian Beltry Yes, I've got the pumpkin spice Boba Shep for the Blue Jays Cold brew I got the cold brew instead of the latte today Good Gehrig Hey war eagle having a good day Got a PS5 retail nice Pure power Aaron judge Chateau pristine boarders of each row All right in case we've got gold for the Yankees in Carlos Stanton 28 out of 50 Got Sammy Sosa for the cubbies Another hit here for the ace same guy too. How about orange Jose Conceco? three out of 25 Got a gold and now an orange blue Frank Robinson for the Orioles 10 of 75 Got blue Jays, Vladi Guerrero, Jr. Not numbered and rookie Otto for the Tigers Matt Manning not numbers Haven't gotten to bed yet. Let's have Sean why Yeah, I was watching to make the stream a little last night like three. Oh, yeah Clark Schmidt, we've got pink to 75 Christian posh a rookie this one there brave speckle out of the 99 Edward Perez for the brew crew Nice one there Casey Mines rookie and Kevin Alcantara. I love that. This is a thing A little Can't even see it that well on Jason Dominguez on the thing refractor rookie to 199 Luis Garcia Got Otto for the Guardians Gabriel Arias Cleveland Christian posh a rookie again and osteo handy Like bone rookie Jake Cronoworth rookie Padres. We've got gold to 50 Matt Manning Tigers Second Manning hit there Detroit and we've got a Bobby Miller on the prospect autograph card wave refractor Parallel that's a mouthful. There you go Dodgers on that one Cory B with the Dodgers Bobby Miller Max Meyer and Riley green Evan white rookie Max Malacosta J.J. Bladet. We've got Robert Hassel Otto Padres. Nice one there Padres starting to get up a little bit. There you go Shane Oste handy again and Bruhan Last pack here Nick Magical rookie Anderson to Hannah got Shane McClanahan Otto for the Nats Cole Henry Cole Henry Torque face and Ian Anderson rookie All right, they'll do it for Sterling. Let's do Bowman sapphire 2021 Bowman sapphire edition empty again every one of these cards We'll get sleeved and top-loaded for y'all. We've got Francisco Alvarez Jordan Walker Bo Nailer and a Zach v. No first out of that first pack Alec Manoa Tyler Callahan a Josiah Gray and O'Neal Cruz nice one there for the Pirates Don't know first come on Hey Antonio Gomez first there you go Yankees Grayson Rodriguez Marco Luciano and a Gabriel Arias first Cleveland Okay, Cavalli Christopher Morrell first for the Cubs. We've got Aqua first Otto tonight. That's again Noah We'll mag that one for you and Jordan Westberg that one caught me off guard. Wow You chin care him and blaze are really like the ones that people are chasing heavy when this stuff came out Nick Gonzalez Carson Tucker Emerson Hancock and Josh John Is that what button I pressed I probably meant to press the horn sorry hunter green Austin Wells Elliot Ramos and Drew waters Bobby with junior we got green coming up Matt Manning Green Jackson Co Arto 125 Royals and Nova for the Astros Last pack here that we're gonna get into the big boys. We've got Woods Richardson Ronnie Mauricio Geraldo Perdomo and Blake Walston Very nice box of um, it's not far there. All right. I'm gonna go definitive first Definitive time see we got something thick thick. We got something thick thick Empty Fill her on top First we've got 26 out of 30 Brandon Crawford For the Giants on the four-colored patch 26 of 30 Nice 29 of 35 bat helmet relic of Jordan Alvarez you go Stroze helmet relic card air your dog Nice one there Green patch auto five of ten Randy Johnson for the Mariners Five of ten Mariners there We've got patch auto 25 of 50 Walker Bueller for the Dodgers You were a dual auto here Jesse winker and sunny gray Three of 35 for the Reds nice dual auto their reds three of 35 Got Goldboarder 14 and 25 Reggie Jackson for the Yankees There's a cool one Yankees Namco L nice We've got rookie out of 50 for the White Sox Gavin sheets 23 of 50 and green three out of ten love these defining images Robin yelp for the Brewer's He's brookery sign that pretty darn big to nice All right, that'll do it for definitive Up next diamond icons that we're gonna finish it out with some flawless baseball Icons has been super hot for us today my goodness empty Fill her on top up first. We've got eight of ten Orioles Calrican junior patch to color Yes, and bomb I Just saw here. I just saw your order note on We have here cut auto two of four of Lee Mac fail Paula fame 98 Lee McPhail Major league baseball executives You see if he's got a team affiliation Icon on your order note was not funny by the way gonna make me it not funny didn't laugh All right, no team affiliation on the checklist. Who did he manage? American front office executive a major league baseball as a baseball executive for 45 years serving as a director of player personnel for the New York Yankees President and general manager of the Orioles Executive vice president in general manager Yankees and president of the American League So what that's between the Yankees and the Orioles then right? Yeah, those are the only two associations. He's had Again, he was director of players for the Yankees and president in general manager of the Orioles So we'll go ahead and random this between the Yankees and the Orioles. Look at that magged up first Please read those two teams on sticking up for me. So remember Wow. How about this red ink two of 25 Ken Griffey, Jr? No reds uni on this one Reds That was a combo spot Edd D nice one there two of 25 We'll mag that We've got red patch auto two of five of a roll this Chapman for the Yankees two of five there Another name coup hit there for you. Very nice That's a time out waiting to have some Sean patch auto here tigers four of ten Miggie Cabrera Four of ten Miggie Cabrera Tigers Seven of 25 auto for the Guardian Shane Bieber Shane Bieber for Cleveland. We've got 12 out of 25 Joe Maurer for the twins Joe Maurer to 25 One out of ten Red Sox Xander Bogarts Red Sox action there one of ten We've got another red ink here for the reds two of 25 Barry Larkin red starting to heat up two of 25 We've got gold acetate four of ten Ryan Sandberg What a case of diamond He's got him Going to the end to the Andrews to the angels Andrews red for five color match my Trout told you we're going fishing Nice trout. There you go angels. Congrats again Andrew big love the red color match They're cheese We'll mag that of course Wow. All right, and we still have flawless We still have flawless That's not supposed to be like that It's been a minute since I've ridden This is thick in here All right up first we got triple patch partial laundry tag Four out of ten Joey Bart on the master crafts sick card their Giants Michael T beautiful Giants hit Very nice. We'll mag that one for you Wow, how about stand the man four out of ten on the dual relic For the cardinals. Wow Coach Warren used material Stan the man That's sick Nice one there We've got three of three brewers on the signature prime materials Keston Hurrah What a box so far my gosh Brewers three of three Josh H Two-color patch there Then we've got rookie auto three of fifteen for the Phillies Alec bomb There you go Phillies trying to find them here Phillies Jimmy are three of fifteen Mag that one for you One out of twenty five patch auto for the Rangers Dane Dunning on the three-color patch one of twenty five Four out of ten autographs for the Red Sox Jeter Downs Jeter Downs Nice one there Red Sox We've got six of twenty five patch auto of keyboard Ruiz Dodgers On the RPA there six to twenty five And last but not least on the inner We've got going to Richard F with the Marlins RPA six to twenty five Jazz Chisholm, Jr Nice three color and two-color patches there six out of twenty five We'll mag that one for you beautiful very nice box of flawless All right in that side Start over here with the diamond. We've got rookie diamond for the Angels three of Tony 20 Joe Adele Angels with the nice last two boxes here Joe Adele and that comes with the diamond guarantee Angels and last hit of the break. We've got 22 and 25 partial logo auto Christian Pasha Braves with another nice hit there Chris S Focus there Christian Pasha 22 of 25 partial logo patch my apologies There we go 22 of 25 Very nice All right Empty box here Give me one second again got to set up the random here for this Lee at McFail to a four-cut auto again He was a manager in front office for the Yankees and the Orioles. So that's who the random will be between And Orioles Got our random here gonna roll the dice again Whatever team is on top after the random will take home this cut card three times. Good luck Yankees and Orioles one two and three Orioles taking home the Lee McFail McFail two of four strived Hall of Fame 98 going to the Orioles All right Got our relics here first We got stand-the-man four out of ten for the Cardinals Cal Ripken jr. Six of ten Orioles Fran and Crawford 26 of 30 Giants Eli Morgan patch auto Cleveland a mere Garrett for the Reds on the patch 68 and 99 and a Joey Bart On the Mastercraft that was four out of ten Giants and our autos We had the Kiebert Ruiz RPA 16 of 25 Dodgers cheater Downs auto four of ten Red Sox Dean Dunning for the Rangers one out of 25 Keston here a three of three Brewers the gold Ryan Sandberg acetate four of ten Cups very Larkin to a 25 Reds Joe Maurer 12 out of 25 twins We had Xander Bogart's auto one of ten Red Sox two out of five roll this Chapman Yankees Shane Bieber seven of 25 guardians Mickey Cabrera four of ten Tigers Green three of ten Robin yelp for the Brewers Randy Johnson five of ten patch auto Mariners Gavin sheets rookie auto 23 of 50 white socks with the Reggie Jackson 14 of 25 Yankees Walker Bueller 25 of 50 Dodgers a dual auto of Jesse Winker and Sonny Gray three of 35 Reds Cole Henry for the Nationals Robert Hassel Padres Bobby Miller on the prospect auto card redemption wave refractor parallel Dodgers Gabriel Arias Cleveland Hedbert Perez Brewers 39 of 99. We had Joe Carter for the Blue Jays Thomas the Pookie RPA 32 and 99 Mets the John Smoltz for the Graves Crack dice nine out of 25 Jose Conceco on the gold 12 out of 50 Then we had Robert Gasser for the Padres Dominic Hamel blue Mets a Michael Kyrian for the Nationals Crusade Silver Michael McGree the Cardinals Parker Shavers for the Cubs Are in case We had Matt Manning rookie auto Tigers a Yes, Mandy Grandal out of 150 white socks another Jose Conceco 325 for the A's in our Magd cards We had the Yordan Alvarez helmet relic 29 and 35 astros the Christian posh a partial Logo Partial laundry tag auto 22 a 25 nice one there Braves the Joe Adele for the Angels 3 out of 20 diamond Alec Baum on the 3 out of 15 rookie auto Phillies a RPA 6 of 25 Jazz Chisholm, Jr. Marlins We had Ken Griffey, Jr. Reading to a 25 Reds a beautiful Austin Martin on the Aqua 64 and 99 first auto Blue Jays and four of five Mikey trout Angels that will do it for the 10 box mixer. Thanks again everyone congrats on all of those hits and we'll get them right out to you


So, the one that we discussed first is based on Intel made first micro architecture is the first one that it is announced in early 2000. It is a completely new architecture on bit of Intel 3. So, in the class we mentioned that Intel 3 uses the E6 micro architecture we discussed in some detail. So, in 24 trace caches were introduced they replace the convolutional instruction cache. It uses very high speed and particular units often these are called double pumped areas we will discuss that. So, essentially what this means is that if the processor runs at 3 gigahertz they will use in up to 6 minutes they will complete in half a cycle. Made first had 42 million transistors on a 217 millimetre square die on 180 nanometers in mass. So, this is a fairly advanced completely new mix R 10 K and R 41 6 4 which are in mid 90s. And the one that we will be discussing now was called the Millimetre. So, Intel Pentium 4 you will be not know because this is not come out really in the market. So, I mean why we will buy a Pentium 4. Now, Pentium 4 has several traditions we will discuss 3 of these the first one is Millimetre next we will discuss more and the next one So, these three pretty much show the new designs that we introduced as you go along. Prescott was the last one actually. So, Millimetre consumes a 55 watt at 1.5 volts. And it introduces a large number of new sylvanes functions and those are sylvanes functions. So, this is just a partial pipe. I am just trying to show you how long it takes to verify a branch prediction. So, calculation of next instruction pointer takes two cycles. So, so we need to go this is the program signals trace cache fetch takes two more cycles. So, we will occasionally find pipe stages in the drive. So, these pipe stages actually do not do anything they will be communicate from one part of the chip. So, this happens more as you try to achieve higher frequency because what happens is that where is do not get faster as you reduce transistor size. Transistors get faster so you faster computation, but since where is do not scale as fast as that your communication becomes more or less constant time. So, as you try to scale at a higher frequency what happens is that you find that suddenly you just cannot communicate from function A to function B. And actually accomplish the task on B. So, A has produced result which you want to communicate to B and B has to compute something new. So, you suddenly find that you cannot accommodate this communication at compute of B in a single cycle. So, then you have to divide into two parts. One of the cycles will just be communication nothing else. So, that is this particular stage. Then you allocate allocating queues allocate ROVs etcetera. Rename for two cycles then this one actually schedule the instruction queues this one schedule final grain micro of queues will discuss that that takes three cycles. And then finally, you dispatch micro of to the function units that takes two cycles register file read takes two more cycles you execute. So, this is the fastest possible execution that I am showing here. There are instructions that take longer. And after execution inter x86 ISA there is something called a flag register that you have to update based on outcome of the instruction. For example, data overflow by addition operation. So, there are many other flags that are mostly used by branch instructions to decide whether the branch is stationary or not. So, you flag a bit and then you decide whether which way of branch should go. And finally, the branch outcome is driven for one more cycle to the front end of the pipeline. So, if you count you will find that starting from the beginning of the pipeline to the time you get to know that the branch prediction was correct or not it takes 20 cycles. So, you can just add this up it comes to 12. So, it tells you that there is a 20 cycle branch prediction penalty. I predict a branch 20 cycles later minimum 20 cycles later I will get to know whether I was correct or not. And we soon get to know that every cycle this particular processor features three x86 instructions. So, 20 cycle last with 60 last instructions. You essentially wasted 60 instructions in the pipeline which is a huge resource. So, the implication is that you need smart branch predictors to find this long branch inspiration penalty. So, there is a block diagram of a micro architecture. So, there is a front end branch target buffer which has 4096 entries which talks to the instruction TLE and the instruction perfection. So, this one will be used only when it actually needs the trace cache. We do not find the instructions in the trace cache. So, we discussed how a trace cache actually works long back. Similarly, the trace cache is a branch target buffer as well. So, since trace cache in the trace cache a cache line contains mark sequential instructions we can take the line because there will be branches in between and depending on the target that you have seen in the past the trace will be built. So, when you read from a trace cache a particular trace you have to verify that the branch is behaving the same way or not if they don't then you have to discuss the trace. That is the purpose of having this branch coming back. You ask this PTB to tell you what the branches branch outcomes are that fall in a line and if they match exactly then only you can do the trace otherwise you discard the trace and go to the L2 cache. There is no L1 instruction cache in this architecture. The trace cache provides microbs which is why you see that the decoder is not in the path of the trace cache it is actually before it. So, only if you don't take from trace cache then only you decode otherwise you don't have trace cache gives you decoded microbs which directly go to the microp cube or if the instructions are fairly complicated you can actually execute it from the micro coded reloading mode. The microp cube sends instructions to allocator in the renamer. So, what they do is that of course they rename instructions which we have discussed already and the allocator allocates the instructions into two different cubes. One is a general purpose cube contain integer and forward point operations. Other one is a memory microp cube from these two cubes you send them to the respective scheduler cubes. So, these two cubes are pretty large, but in these smaller cubes so that you can actually prepare your different instructions and figure out the different ones. So, these two cubes send instructions to what they call schedulers. These are very small and here you can see that there are five schedulers one is a memory operative scheduler which will schedule a bit of this cube. There are four schedulers here one is a fast A new scheduler one is a slow A new scheduler one is a general floating point scheduler one is simple floating point scheduler. So, what they do is that all of them send the instructions to the register point. So, for example, floating point schedulers would send instructions to the floating point register point by the others who send the instructions to the integer register point. And then you have several functions in this here as you can see on the floating point side you have a floating point move unit and floating point ever makes SSC and SSC too. On the integer side you have two address generation units which will compute the loads to addresses. And there are two double comp A use that operate at the double frequency of the processor. And there is a slow A which execute complex instructions and operate at the same frequency as a processor. Memory operations continue after this particular address computation to L over data cache. And in the miss here they would go to the L2 cache and in the miss here they would go to the bus only to the system. So, that is the rough micro architecture also you can see that there is a direct path from L2 cache to the instruction DMP and instruction preparation. The reason for this is that if you do not hit it trace cache you have to go to the L2 cache to access instructions there is no L1 instruction. What is the difference between general FB, general and simple. Yeah we will discuss that you see what instruction goes to each other. So, the question about this general problem. So, let us start with the front end. So, here I will of course not try to go stage by stage because that will take a long time. 20 after branch there are many more after that. So, I will just club them together in terms of functional what they actually do. So, front end includes a trace cache, a trace predator, a decoder and instruction DMP, a branch predator, a branch target buffer, a return of the stack, a micro code raw and a micro cube. So, decoded micro ops are fetched from a trace cache of capacity 12 k micro ops and all of them may not be discussed already about that. The trace caches may have implications. Each trace cache line contains 6 micro ops, but can fetch only 3 every side. Trace cache uses a trace predator which is essentially a branch target buffer working in the trace cache to carry out branch predators. So, the sole purpose of this is that when you are consuming a trace it might contain several branches. You have to know whether the branches are going to be in the same way or not. Also it consults a 16 entry RAS on return instructions. Our trace cache means the ITLB is accessed to generate a physical address for accessing the entry branch. While fetching from L2 a bigger BTB with a branch predictor is used that is it has a similar organization as the P6 micro architecture which we have discussed. So, why L2 should have a BTB you should imagine your L2 cache as the L1 instruction cache. Then you can see that why you need a BTB. Because it is just as if this is your first level of instruction cache or where you are fetching. So, you will have to know what my next instruction point is going to be that is the purpose of this BTB. So, this is the reason why you had a BTB in the fetcher. But these two BTBs are managed differently this one and the trace predictor. So, how do you have a trace cache risk as the IA32 instructions are fetched from L2 cache. They are decoded into simple risk micro ops. So, we are talking about this point in the path here. So, you have missed the trace cache. So, you are going through this. So, you bring something from trace cache goes to a decoder and then put in the trace cache. So, decoder can handle IA32 instructions that can be processed with at most 4 micro ops. More complicated instructions are executed from micro core draw. So, this one also we discussed earlier we are talking about the Pekkin pro architect. So, what is the aspect of the decoder. On a front end BTB miss static prediction is used to guide the L2 fetch. And what is the static prediction it says for not taking back opaque. So, this one also we discussed in the last. As the instructions are decoded they are in micro op queue. The trace gets built dynamically as and when branches are verified. As soon as a trace length reaches 6 it is sent to trace cache because a trace cache line contains 6 micro ops. The trace cache instructions point to an L2 cache instruction point will manage different. So, there are 2 different instruction points. Once this is done we move on to the allocator and the rename one. The allocator consumes 3 micro ops every cycle from a 3, 4 micro op queue allocates an ROV entry out of 126 entries. So, why is it 126 because does anybody have an answer. Because you want something that is divisive by 3 because you are allocating 3 every cycle. So, that you can bank it you can organize it to have 3 banks 42 entries each. Allocates necessary physical registers out of 128 entry into the 40.5. Why is it 128? Because it has to be a power of 2. Allocates 1 entry either general purpose queue or memory operation queue both queue are free for. Allocates a load queue entry for a load. Load queue has 48 entries allocates a store queue entry for a store store queue has 24 entries. The rename or rename 3 micro ops every cycle maintains an 8 entry register alias table for these 8 registers for x86. Writes the renamed instructions in general purpose queue or memory operation queue. So, the next stage is micro ops scheduling which consumes instructions from general purpose and memory of queue and sends them to respective schedulers. There are 5 schedulers for different types of instructions each with 8 to 12 entry collapse in the schedule queue. Each scheduler handles different types of instructions they already mentioned about this past day in this way in this way. The schedulers work on the 3 constraints availability of operands availability of issue codes and availability of functional links. So, there are 4 issue codes in little medium 4. 4 0 is shared between fast A and U and floating point move store and floating point exchange.  So, there are 2 fast A p's right slow A p does S S C and M M X. 4 2 is for load and 4 3 is for store. So, these are the 4 codes that we are talking about. So, here they are shown actually. So, this is these are ports 2 and 3 we have these 2 and here you can see the other 3 other 3 ports sorry other 2 ports. So, there are ports that are shared between. So, you can see that this is one port and this is another port. So, what is the implication of sharing issue ports? So, the question is of course, we would have designed the past self. So, that you have dedicated dedicated issue ports. So, again I mean we discussed in a little bit earlier also why you might want to share for example, register file that. The reason is that some instructions. So, these are very common, but these are often not so common. So, you can assume that most of the time the fast ALU will actually get a port whenever you use it. Similarly, here these are not very common instructions, but these are common instructions the fast ALU instructions also the slow ALU instructions are not that common, but shift and rotate are actually common. But most of the time you can assume that the fast ALU will get a port and load and store are given dedicated ports. The reason for this is very interesting that you find that memory operations are always given most of the time are given fast lanes for in x86 architecture because x86 has very small number of registers. Those who have got the compiler of course might understand that if you have small register number of registers you will have a lot of load store operations in your program because the processor will have a lot of registers in the speed data on the memory and then against loading back. So, loading point exchange exchange is a loading point register with top of the loading points. But it is not an attribute operation it is just a loading point exchange structure. So, fast ALU can receive an instruction on every edge from either port 0 or port 1 because both the ports are connected last year. The slow ALU can receive one instruction from port 1 every cycle. The slow FP and simple loading point units can receive one instruction each from port 0 to port 1. At first one load and one store can be fed to the cache every cycle because they get only one port each. Issued instructions proceed to read operands from register 5 which may get over written by a bypass. So, how many read write ports in register 5? So, you can compute that based on this particular issue requirements. Similarly, you can compute that for porting point 5. And Pentium 4 had a multi cycle pipeline bypass network. So, although you have designed bypass networks you have a pipeline those. You are sure that you can bypass values from one stage to another in a single cycle. As you go toward high frequency this may happen. So, what you may have to do is that on the destination stage of course, it is just bunch of wires going to the input of the multi cycle. That is your bypass path. You have to put matches. Because the wires it just takes time to communicate from here to there which will not happen this way. So, it pipeline the bypass path. So, let us suppose this is my destination pipeline register. So, I have to bypass from here and this length of the wire is so long that you cannot do it in a single cycle. So, what are the options now we have. Well, you can say that this value will be held for several cycles. And during those cycles this register cannot generate any more bypass values. Otherwise the value will get current. The other option is that you can put latches in between. So, you segment the wire. So, that this can be done in a single cycle. So, then while the first packet of value is here in this particular segment you can generate new values. So, that was a key requirement to meet the high performance. Otherwise it was almost impossible to have high performance in this process. Fast ALU bypass is carefully designed to operate in half cycle. So, the next slide you look at the values. So, there are two double clamped ALUs produces results in half cycle. So, how they do that? First adder acts on low 16 bits in quarter of a cycle which is basically in half cycle of value clock. And it is made to the upper half forward of value as well as bypassed the lower half forward of value for dependence. Process is upper 16 bits in the next quarter cycle and updates flag in the next quarter. So, essentially what happens is that in half a cycle you are done with the operation, but the flags are not in updated. The flag of retrievers another one quarter of cycle. So, the data is sufficient for beginning of a cache tag you come, because this is also used by the address generation unit. And the for the index part, the index part of the cache falls within the last the least significant 16 bits. That is how they actually size the ALU on cache. So, that the the first ALU is enough for generating the caching mix. The upper part of the address will be needed for ALU transmission. So, the ALU loop should just take over the 16 bits and it is input masses. That is basically enough. So, pictorial is what it looks like. So, this is the the first ALU which operates on the on the lower 16 bits and see that bypassed immediately here. So, that it can start operating on the next operations lower 16 bits. Also, it is sent to the next ALU to operate on the higher 16 bits. So, the caching mix has to be sent for the for the for adding up the next 16 bits. And then the output updates the flags. So, this is basically the carry out. It signifies over flow over flow or extra borrow whatever you want to do that. The barrel shifter is a four cycle one. There is a 14 cycle multiply and a 60 cycle divide and of course, there are MMS and SSC. So, these are basically the functional limits that you have. The cache island has a small and fast L1 data cache. Load access latency is critical for IHR2 as I have just mentioned Intel architectures pay special attention to memory operations. So, the L1 data cache is 8 kilobyte four way associated 64 bytes and write through. Virtual index is intact integer load latency is two cycles and floating point load state six cycles. Load hits speculation for dependence as we have discussed for RTK and R4P164 with the help of predictor based on partial address match. In case of this we execute all the dependence. So, here unlike the other architectures they actually do not start a refresh. They only re-execute the dependence and here how they do it is that they have an estimate of the upper bound of the number of dependence. Because you can exactly calculate the number of cycles that you take to know the exact outcome of the of the hit of the cache and with those cycles how many dependence can issue that you can also calculate from your constants. And they actually maintain a buffer of that size where they dynamically remember who are the dependence for each of the nodes that are complete and the final. There is a for entry LO on MSHR we have discussed the purpose of this particular structure in the class. Store to load forwarding is allowed if the store address matches the load address and node size less than the store size. So this one is a little conservative because this rules out the common place. So suppose I have a load instruction which loads these bytes and I have a store instruction which stores these bytes. So this is the store and this is the load and this is my program model. So the store comes before the load. So in this case the load can actually take the value from the store completely because the load is stored but that is disallowed. What I want is that the starting address must be aligned and the load size must be less than the store size. So this is only a subset of forwarding to P. Here on L1 cache we have 256 kilobyte each way I want to read by line size right back into cache. Seven-sided round trip into the latency. It has a multi-stream hardware procedure identifies up to eight independent streams using simple pattern based predictors. So mostly strike predictors which try to pick up arithmetic progressions in addresses. Prefixure stays two cache lines ahead of the current request. Interfaces to 100 million spot pump 64 which is the bus that connects to the computer. Any question? So we move on to the next one. After development. So what is the code? Oh I'm sorry. So it actually maintains four different clocks at four different phases and on each for every age of each of the paced clocks you can transfer 64 bits. So essentially it has an effective frequency of 400 meters. Why is it the same as the process of the clock? Sorry? There is no same with the process of the clock. Yeah there would be a synchronizer at the interface. So synchronizers are essentially buffers. The problem is that from this side we have fast requests coming in. We have a buffer which would actually allow you to have a slow interface on this side. Any more questions? So this one Willamette was 180 nanometer. So in between there was Northwood which was 130 nanometer transistors. 55 million transistors on 146 millimeters per die. The only thing that they changed from Willamette to Northwood was the double the size of the AC cache. That's it. The next one was more interesting and that's what we're going to discuss. That is the 90 nanometer pithium core. That's the Prescott code. And this one was actually the last in the pithium family. So this came after Northwood and it redefined the concept of deep pithium. This is the first processor designed in industry with 90 nanometers in most process. A few micro-architectural enhancements over original networks. So this is what we will discuss. It had 125 million transistors so you can see that more than double compared to Northwood. So must have done something. On a smaller die, 112 millimeters square store buffer size is increased to 32 which was 24 again. A low on data cache size was doubled to 16 kilobytes and was also made 8-way set also. It has a 31 cycle branch from 20 equals to 31. So it really had a very deep pipeline. The first version of Prescott that came out had 2.8 kilohertz plus frequency and it was predicted to have 4 kilohertz by the end of 2004 but Intel could not achieve it because of power problems. So Intel stocked at 3.8 kilohertz and this is what you can buy in the market in the name of Intel 2024 instrumentation. That's Intel 2024 Prescott clocked at 3.8 kilohertz. You can go and read up this one. I don't know if it's still available though. It's an old link. You can read the story why you didn't have to kill the 4 kilohertz. So this was the termination of the Pentium line and we'll discuss what happened after that of course. But first let's try to understand what these enhancements are in Prescott. So to optimize the store to load forwarding so they found that it's impossible to have a complete address match between a load with all stores which is needed for two purposes. So if you imagine a single queue of load and store instructions.  So you need to care about the stores before you because you may have a match with the address. So you may have to get the data from here on the store instead of the cache. You may have to care about yeah, fine. So loads you have to care about the stores before it for this reason. And the stores may have to care about loads after it for a symmetric reason. So when a store issues it has to make sure that there is no load which has got a wrong match. So now the fundamental question here is that when you're issuing a load whether you should get the data from a store or you should wait or it can get the value from the load data. It can get the value from a store if the store has already executed and there is an address match. It must wait if there is probably an address match you don't know. And it can go if you know for sure that there is no address match and the data can be taken from the load cache. So for all these things the fundamental element that you require here is a match of address. So you have to compare these addresses with all the store addresses here. And Prescott found that since the target is very high frequency that they just cannot accommodate a full address match with their cycle. So you cannot compare a 32-bit address of the load with a 32-bit address here. So what they said was that well we will be happy with a 32-bit address match. So you pick up load qubits and just do address match. So the main point here was that the time constraint because store forwarding logic must not have higher latency than L1 data cache. So it should not be that of course you look up the L1 data cache parallel with weakness but this should not become the one. So L1 data cache latency and this ideally should match and this one should be smaller should not be bigger. However if we the latency of this particular match was exceeding the L1 data cache of qubits. So they speculated based on partial address comparison. So if the partial address comparison matches they say well the load should take a value from the store which may be wrong. And the other side could also be wrong. If the partial addresses don't match the load is safe to go and access the L1 data cache which could also be wrong. So you initiate full address comparison I'm sorry if the partial addresses don't match then of course you are sure that there cannot be a match. So initiate a full address comparison also and overwrite the previous comparison outcome if needed. So if there is an overwrite that means the load and effectiveness must be instituted to outcome here. They had a new logic to forward fights contained fully in a store data even if the address is misaligned. So essentially they finally addressed this particular case what they did was that they would actually do a rotate of the load so that they first align the addresses. So in this case essentially what would happen is the load should get these bytes only. So they would actually shift the store data to this side and take because the circuitry is such that it can only take the first few bytes. So the circuitry remain unchanged from your previous generation which will allow you to take only the leading bytes of the store. So here they kept that unchanged but what they did was that they actually shifted the store data by whatever amount they want. So that you can still continue to take this data but now this will become this will come here. So that requires a shift data. The other case that is here we are talking about the situation that the load so that there could be two possible effects of this speculation. One is that the load could have consumed the wrong data from a store because of a wrong partial address management. So that could be that the load consumed the wrong value from the LOR data cache because there was a store which could not compute the address yet but the load bypassed. Because what the load is doing here is that it could only pick up the stores from this side which have already computed address. There could be stores which have it executed. So in both cases there would be a re-execution of the load and the data. Then the static branch predictor store is not executed. Yes for the store issue it checks all the loads behind it. So recall that when you missed the BTB element was using a static branch predictor which was forward not taken backward yeah so north and then both. So the observation that they made was that not all backward branches are load branches and hence may not always be taken. So I should mention here that these are actually not very frequent cases. These are mostly totes and other cases where a compiler might be optimizing certain pieces of code and generating a backward branch which is not a load branch. So Prescott Team did a study and all that there is a threshold distance between backward branch and its target below which it is a load branch. So what it says is that if you take the distance between the target and the branch instruction if it is larger than a threshold it is unlikely to be a load branch which means a loop was a normal system. So what they concluded was that you predict only those backward branches are taken that have target distance below this predetermined threshold. So this threshold was actually hardware inside the processor. This was not really dynamic threshold. All the team observed that there is a correlation between condition time of a backward branch and its behavior. Backward branches with certain conditions are almost always not taken. So on a BTV miss you could just fall through in these cases. So this entire thing is a static predation there is no dynamics in here. All you do is you do analysis of your benchmarks fix up a threshold which separates these two points you know maximally and then you look at these conditions you decide statically which conditions should be tagged with loop branches and which should not be. And then you hardware that and do a static predation that's it. There is no dynamic learning going on. So then it enhanced the direct predictor also and particularly for indirect branches in this case because BTV is not good enough you must have seen it in your homework. So the observation was that data dependent branches have targets correlated with global path history. So you have already implemented one such predictor in your homework and hopefully you have seen that your normal BTV is worse compared to this particular predictor. So this idea was borrowed from a BTVM team which was part of the Sentinel Chief Set team. In addition to a conventional BTV essentially they had a table of targets tagged with global history. The global history direct branch predictor gets priority over the prediction. Some more micro-architectural advancements XOR is often used to load a zero value in a register especially if you do not have a hardware to register like in X86. So you typically come across this kind of code in X86 where you are essentially loading a zero in EX. And EBX is just sounding as some register here but it could be anything else. The problem is that consider an instruction that produced EBX before it. So there too many instruction which produced EBX. There will be a bunch of instructions that can be consumed in EX. This instruction is also appearing to consume EBX but that is not actually true. It has nothing to do with the value in EX. So it introduces an unnecessary dependence between previous producer of EBX and this instruction. The point here is that this instruction will probably be held up until the instruction produced in EBX has executed. Which does not make any sense. It is actually a dependent instruction. Same problem with EX. And whatever register you use you are setting up a dependence change. So, the Northwood scheduler could actually detect all these situations and ignore the dependence. So, the logic was very simple, they had a table of such op codes which could be problematic and just look at the op code of the instructions compared to the table and make sure that the both sources are same then what we do is let it go it is not holding it up. The press what expects the set of such instructions. So, x and y 6 has many more such instructions where we could do such interesting things where there is no dependence as such. The Northwood also used the floating point multiplier for doing integer multiplication and this had an overhead of moving integer sources to floating point in a path and back which was same in 206 for divide. So, last time we discussed about this we say that 206 for use of the floating point divided by moving integer. So, press got implemented and we get integer not required. Some more enhancements the general purpose and memory of queues are made longer, scheduler queues are made bigger to get larger selection window, 30 new SSC 3 instructions and 2 caches increase to 1 megabyte, enhance software prefetch Northwood used to cancel software prefetch is that cost pg and ptr releases, press got just continue. Enhanced hardware prefetch agentry low on MSHR, concurrent multiple pasted walks needed for hyper threading which we will discuss next week. Let it be done what happened after that. So, once the Pentium line got dominated until essentially took their Pentium M core which was designed for mobile devices and improve it to be used in their desktop, server and notebook market. And this was called the improved architecture was called the core micro architecture based on which you have all your processors starting from new or down to today the core ISM and everything that use this basic micro architecture. As such nothing but changed cannot change this fundamentally it is still an out of order issue processor some numbers changed fetch requirement with increase from 3 to 4. So, now that matches the pipeline was made shallower to save energy. So, press got had a 31 plus stage pipeline. So, it has a much smaller pipeline actually. They also introduced something called micro fusion this was very interesting. So, what the deal was that. So, they had actually two types of fusion macro and micro fusion. So, macro fusion actually takes multiple extrinsic instructions and fuses them into a single operation at runtime. So, this is done totally in hardware and micro fusion what it does is that it takes the micro ops of an instruction and fuses them to reduce the number of micro ops inside So, that actually saved a lot of energy and also same execution time. Enhanced rounding mode control in floating point pipe. So, actually well I should say that this was actually done because they did not want to change their decoder. Because they could actually could have it has a decoder to actually not generates only extra extraneous micro ops. So, after the decoder they put this optimizer which would actually examine the micro ops of fuses and fuses. So, they are made as rounding mode control in floating point pipe faster integer division on average. So, these two are very interesting that actually where we give a very high performance boost in their processors early detection of problem loads. So, this one is talking about loads that bypass store and later get caught because that was a mistake. So, I have seen it 2 out of 6 4 that they use a load weight table to remember such loads which has caused problem in the past. So, the core micro optimization actually incorporates one such predictor a similar such predictor which tries to identify the loads that continuously cause such problems. They do not actually issue them specularly they wait until all the stores before it has completed. They also incorporated a load data cache predictor which is instruction pointer directed. So, this one is very interesting what the observed was that when actually this has already been observed in several research papers that if you take a program and look at a particular load instruction. You find that the data addresses that the load instruction generates are highly coordinated. They will probably be sequential if you are accessing the array. So, I am what I am talking about is that. So, this one will be broken down into a load and a store and it are passed with an additional portion. So, if you look at the addresses that these load instruction generates there will be all sequential. So, and this is just one instruction that you are monitoring. So, that is fairly easy to prevent that is exactly what they did. They essentially maintain a table where for each load store instruction's address there will be a prefeature which would actually find out this particular parameter in this case the parameter is structure. So, the advantage of an instruction pointer directed prefeature over an address based prefeature exactly it gives you a lot of compressed information. Just for a single program bounded you completely compress the whole pattern instead of actually looking at dividing it into a bunch of streams and learning each of the streams separately. That is not needed yet which was. So, those prefeatures are still there because those are needed for catching other complicated patterns. But these one can catch simple patterns and can work fairly well with a very small storage budget.


My name's John. And I'm John. There we go. And this is Hacking the Kubernetes software supply chain with .zip domains. So in this talk, kind of what we want to present is a little bit of background about .zip domains, the trouble they may cause, the role of social engineering in that, a little bit of a demo, and then the defense against something like that as well. So before we get too much further, let's go into a little bit of background on what .zip domains are, how I somehow found myself with the kubernetes.zip website, and I get into a demo. So .zip domains, or top-level domains, became available in May of this year. And generally, to kind of the outcry of the internet, people generally just said, this is probably just bad for the safety of the wider internet. Having a top-level domain like johnscoolwebsite.zip, or johnscoolwebsite.zip, or something more nefarious, like myfiles.zip, or kubernetes.zip, just gives you kind of the air of, oh, is it a website? Is it a zip file with a bunch of stuff in it? Who knows at this point? .zip top-level domains are out there. So I got it in my head that, oh, who has kubernetes.zip? Somebody picked it up already, and this was months later at this point, and I was able to get it for like $12. The first thing I did was immediately redirected to kubernetes.io. I talked with Dimms a little bit, and we just made sure that, okay, we don't want this out in the wild. I can only imagine the kind of things people would do with some nefarious actor saying, hey, can you help me figure out what's wrong with my cluster? Here are my logs, kubernetes.zip. Can you help me? Yeah, so .zip top-level domains, websites, probably not a good idea for just the general safety of the internet. But let's break down how a malicious actor would use social engineering, a .zip top-level domain, and some tricks with a malicious URL to make this a much, much worse kind of attack. So a quick show of hands. Who thinks that this URL goes to google.com? Nobody, wow. Who thinks it goes to bing.com? A few people, yes, you would be correct. So let's break this down real quick. The first part, HTTPS, that's the protocol. The next part, before the at sign, is essentially a login, like a username login to this website. And then bing.com is where that would be directed. Let's do this again, but with a more malicious looking URL, again, we have HTTPS, github.com, Kubernetes, Kubernetes, archives, refs, head at kubernetes.zip. Same thing here, this actually goes to my website kubernetes.zip. We have the HTTPS protocol, and then the orange part is the username login at kubernetes.zip. The really tricky part here, you think that those paths would be escaped in the URL, but those are actually Unicode 2215 slashes, not the ASCII slashes, which gets interpreted as one username login. So that's really like the social engineering trick here, is that that whole orange bit gets interpreted as one username login and sends you to kubernetes.zip. There it is, very bad, very scary. Let's jump into a quick demo here. So what I have here is just my terminal up with some pre-baked stuff. I don't wanna have to download a bunch of this over the conference Wi-Fi, but this is that Google Bing URL. Let's click that real quick, and that's just gonna take us to bing.com. It takes us right there. Now, some browsers, and I've had a very hit or miss with this, we just saw it went straight to Bing, but sometimes a browser, maybe depending on caching, will actually say, hey, this URL may be trying to trick you. In Firefox, it'll literally say, this may be trying to trick you to take you to a different website. Sometimes with caching, sometimes not, it might take you just directly there. So that took us right to bing.com. If we look at the real URL, this is what the real URL for the master zip on top of GitHub looks like. And if I click that, if I click that, there we go. That's gonna start downloading a zip file. I'm just gonna cancel that real quick because we don't wanna have to do that over wifi. But what that zip file that I just started to download is, was if I go over here to code on the Kubernetes, Kubernetes repo, and then I come here to download zip, that's that same URL. So I could be some cloud provider. I could be somebody who needs to distribute Kubernetes and get the code, build it, send it off, run it, whatever, and maybe this is the way I do it. I'm gonna download the zip file from the tip of the master branch on Kubernetes. So what I thought that the most likely attack using a Kubernetes zip file top level domain would be, is to actually have just a very simple redirect to an S3 bucket of some malicious code that looks almost identical to what you would get from the top level zip file here on Kubernetes Kubernetes. So let's look at that. If I now cat the other one, we notice here, again, that at sign, and in my terminal I can almost not tell with this font that these are Unicode slashes and not the ASCII slashes. So if I click that, ah, there it is. That is the warning that says this may be an attempt to trick you. But you know, we're being socially engineered so like there's big problems. We gotta do stuff now, so I'm just gonna continue. And it does something almost similar. It's downloading that zip again. Let's cancel that out. And that's a very similar experience to just getting the zip off of Kubernetes Kubernetes. So now let's say that we're gonna continue down this path, this kind of thought of experiments of having the code bundled. And we're gonna go to some pre-baked stuff that I have right in here. And if we pop in here, you know, this, we've seen this, this is Kubernetes Kubernetes.  This is the stuff, like my boss is telling me I need to download this right now and build it and ship it. Looks good enough, let's go. I might build it, you know, do like make command. Let's cancel that just so that we don't actually build a bunch of stuff. And what that's gonna drop is into our outputs, which anybody familiar with actually building Kubernetes will have seen this local bin for this architecture. We see a bunch of this stuff. This is great, we got the Kubernetes things. Let's ship it, we built it. Now let's actually run kubectl just to demonstrate. I'm just gonna do like a get. Oh, that's bad, what is that? And that's really kind of the end of this proof of concept is showing that there are some modified bits, some modified code that I was able to essentially just serve you over S3 via that malicious looking URL and a very similar flow to what you would do to get that zip file off of GitHub. Let's go in here and let's search for that. Clusters, is that how I spelled that? Why is this not working? Oh, I'm in the wrong directory. Let's go up a few directories, one more. Let's search for that again, there it is. And this is the chunk of code that I injected in here into just the top level Cobra command, but this could be anything. This could be some bits that were modified on the kubelet, on kubetm, on kubectl. And at that point, anything is possible with modified code that you're distributing or building or running, anything is possible at that point. So again, really what we're talking about here is the role of social engineering in these kind of attacks. What this sort of scenario looks like is like, oh, like something bad is happening and we need to patch this critical CVE. Here's a link to some of the code that we need to ship and it looks legit enough. If you were to click that link in this Slack message, that would take you to my Kubernetes.zip website, redirect you to the S3 bucket to get the malicious zip bundle. Somebody might click into the CVE, be like, oh, that's pretty bad, this is a real CVE and we should probably patch it, we should probably fix it. So, where I'll hand off to Sean is with this bit. Software artifacts without software validation can be dangerous, so Sean, what do we do about this? Yeah, so what do we do? For one thing, like John said, this is a social engineering hack. This is kind of the bad idea. You're busy, you're in a rush, you don't know, you're doing other things and I can't look it up, can someone give me a link? And they do, but that's not the link that you want. So really making sure that you get your sources from somewhere that you can actually trust, so that you're going somewhere that you recognize in getting those. And then not only getting that source, but then you can make sure that you're actually downloading what you're expecting by looking at the contents and that the provenance of that source is really coming from who you think it's coming from. So talking to a few people, there is the GitHub link, you can download the sources from there. I actually found out a lot of people don't realize that the Kubernetes project has a website where you can go and download actual release artifacts from it. So that's, you know, don't grab a random link, actually go to somewhere, recognize, that's maintained by the community and has everything you need there. There's also downloadkubernetes.com that has each of these things, each different artifact that you might want. And one of the very good things here is besides the download link, there are these links for checksum and signature. So not only can you download from a source that you can trust, but once you download that, you can get that checksum and then looking at it locally, you can take that checksum, look at the checksum file that has this long string and then locally you can run SHA-256 sum, Windows has a similar PowerShell command, you point that at the file that you've downloaded and you can make sure that the number that you're getting locally actually does match the number that's published that is validating that yes, this is the same file, it hasn't been modified, it hasn't been corrupted during the download. So you make sure that what was published on the website you actually get. Now the one downside about that is these are both from the same website. What if this website was compromised? So a next level besides just actually validating that checksum is, oh and have some links there to help, there's actually some very good documentation. Besides that checksum link, there are the signature and certificate links and that's where you check some, make sure that nothing was corrupted and what you downloaded. The signature is where you can really validate that this really is coming from the Kubernetes community or from vendor acts or whatever software that you're pulling down. So very similar to how we check the checksum, we can download those signature files from that site and once we get the signature, we get the certificate.  And then they do give a nice command on the website that shows you, run this command and that'll take this signature file and verify that the signed zip file actually does match and then that's where you get this verified, okay that yes, this certificate file which you can open and look at and see who it's coming from is what signed this software artifact. And then one more thing that they do publish out there, every release of Kubernetes also generates, every build generates a software build materials and if you haven't seen software build materials, as bombs, what that basically is, is a text file that has standardized format that lists everything that's included in a software and a deliverable of what you're getting. So it's a text file, you can open it and read it. It is a standardized format so you can figure out where things are. It's not something that you really just wanna browse through. Again, they do a great job on the website and there's a link at the bottom here. They give this sample script that you can run. There are a lot of tools now that are starting to work with Sbombs where they can check the signatures in that Sbom file. They can also scan because of this list, everything that's in the software deliverable, it can go beyond that and see are any of the included dependencies here versions that have known vulnerabilities, soft security issues. So you can really, if you tie this in to those types of tooling, you can really get a lot more confidence in what you have and what you're going to put into production. So ideally, you can run all these commands, you can look at this Sbom, but using these tools, doing these checks and validations, that's a great thing that you can just put as part of a CI CD pipeline and then as part of your own build process, you can really make sure and have that validation that yes, especially through automation, what I'm pulling in and using, I know is something that's going to be good. Now I did also want to bring up another option. I'm one of the co-chairs for this special purpose operating system working group undertake runtime, so I'm legally obligated to mention it. But another option, there are, you can go and use distros that are geared towards running Kubernetes and running the containers.  They've all done the work for you and do that validation as part of their build process and making sure that what is included in this distro is what's actually coming from the upstream community. So main thing, watch where you're getting things from. Even when you're in a rush, it's so easy to just grab a link from someone, but kind of like way back in the day when people could email around viruses and nothing could stop them. Same way, don't just click on things. Validate what you have, make sure it is really what you think you have, and make sure it's coming from where you think it's coming from. And the supplies to Kubernetes applies to a lot of other projects out there. A lot of folks are publishing the checksums, publishing signed artifacts, so take advantage of that where you can. And then my own personal thing, don't just pipe a random URL into a super user shell. It is really convenient. Again, if you're getting this, if you know where you're getting this from, it is a great convenient way to install a lot of software. It's also a great convenient way for someone to get you to install a whole bunch of other things that you don't know you're installing. So just be careful. And hand it out. Yeah, this is just a quick attribution to Bobby about, I think, really discovered the Unicode and the ASCII really applied this well-known, I think, hack to URL spoofing to using top-level domains. So a huge attribution to Bobby, and thank you very much. Yeah, short and sweet, we would love to spend a little bit of extra time doing Q&A here if anybody has questions, but yeah, I hope this was enlightening to the dangers of social engineering and the unfortunate unsafety of the internet these days with certain domains and things. Yeah, go ahead. Can we get the mic for questions on? Go for it. Okay. Okay, so a short question and then a more substantive question. I noticed while you were going through this talk that the URL that GitHub generates ends in the branch name dot zip. So a lot of these repos are gonna have master dot zip and that domain has actually been registered. Is it known who that domain belongs to and are they a good actor or a bad actor? I mean, that's a great question. We good, you know. And then the more substantive question is when you're talking about verifying signatures and certificates and keys, of course, it's great to publish them on your own website, but the first thing that a malicious actor would do if they breached your website is generate their own certificates, keys, et cetera. Sign everything so that it looks legit. Is there another site because that's always the answer, right? Is you should get these certificates and keys from a third party channel. So where else can we get these keys and search and things to verify these through an independent channel that is under separate control? That's a great question and yeah, I'll reiterate that. That is an issue. If you're pulling, you know, as I showed, there's this download site. It's got these convenient links there, but as he said, if someone were to compromise that site, it's easy enough for them to replace those checksum and signature files. So you can look at that signature file and depending on how thorough they are, you know, maybe you can tell if that's actually the signature of who you think it is or not. But yeah, ideally you're getting the zip file or the software artifact from a known good location and able to verify those signatures and check some from another separate, well-known trusted location. I'm not aware of like a common registry for those types of things. That's actually an interesting idea. I think it gets to the interesting point about like the software supply chain and like even something like that could end up being a single point of failure and where do we end up distributing all this trust to? I really hope that people aren't just downloading zips off of GitHub or releases, but in theory that in itself would be a single point of failure. Yeah, I don't know if there's an answer to that. To answer this question about like who has master.zip and you know, it's registered. You could dig into the DNS records, try to find from the registrar who has it. Most of the time those registration details are masked by the registrar, so who knows? You could reverse DNS, look these up and figure out who the registrar is and stuff, but typically DNS registrars make that very hard to figure out who actually has a website. So I mean, even if I put in and dig has additional stuff, Kubernetes, and this is not a talk about dig, but even that just comes up with, I mean it looks like also Google's DNS servers. So this wouldn't surface information about me, it would just surface information about Google's DNS, unfortunately. If there's no other questions, anyone else? One more. Just good news that master.zip is registered by GitHub. Oh, okay. Very good. It's safe, everybody, it's safe, that's great. And that probably makes sense. I mean, I'm sure there's plenty of good websites that point to actual use cases for things. I could see that being a legitimate use case for GitHub with that domain, but again, it's not hard to find really good socially-engineerable URLs that, some of those Slack messages, I would not be able to tell. I would click those links right away. And that's the scary question we hope that you can ask yourself and your organizations, like people just kind of suck at those kind of validations. That brings me back to my last slide. Software artifacts without software validation are just dangerous, so. Yeah, I don't think we have too much else. Was one other thing that may be worth checking out. There are some projects here that are working on this whole thing. Tuft, if you've heard of TUF, that's a great framework for everything that builds in a lot of these security checks. So if you're looking at how do I distribute my software and make sure that I'm able to provide a really good way, that sort of addresses some of those issues of, some compromise something and changed signatures. Tuft has a lot of protections for that. There's also Sigstore and some other projects around here that can tell you a lot more about it than I can. Yeah, hopefully in a few cube cons, this is a relatively solved problem where getting some random code zip file off the internet would be pretty easy to not shift into your pipelines. But with that, we'll be around for a little bit for a few minutes. Yeah, thank you everybody very much.