Hi everybody it's Sam at Mixed Up Craft, thank you for watching my tutorial today.  You could add a handle onto the sides here and turn them into a little gift bag, so there's lots of ways to use it. It's very easy, I've just used some circle dies and just some simple scoring for this kind of case piece here. All of this I will talk you through. The paper I've used is the gorgeous, it's a really nice orange, it's mandarin orange and this is by Paper Mill. Just see it there, there we go, Paper Mill Direct. So if you use that one today, all the links and everything as always will be shared below. But mine are going to be table favours and you can see there I've filled them with lots of sweets and I'm going to probably pop a scratch card in there as well because we tend to do that within our family. We have a little scratch card, we do it on our Christmas table favours and things like that, so yeah I think it's really cute. I may well put a little name tag on it as well, I'm not entirely sure, but yeah very very straightforward so let me show you how to make them. Okay so I used my tonic nesting oval dies, you would have seen these feature a lot and I used the one, two, three, four, the fifth largest one. I'll give you the measurements for this one in case you you know you want to get it as close to my size. So it's three in diameter and three and three quarters in height, yeah okay. So you'll want to die cut six for every box, so I've got three there for the front and then I've got two here and I've got one more that I'm going to show you just how I quickly distress the edges. I just think it's nice to do that, you don't have to but it does really kind of, I just, I think it just highlights the pieces and it just makes it look a bit more 3D because it gives that depth on the sides here and it makes it look a bit more like a pumpkin. So really easy to do so we'll do that in a moment then I've just got these little bits which I'm going to be cutting bits and pieces from. There is one of these, now this is actually the ivy leaf from John Next Door dies, this is the plate, you would again you see me use this a lot and I did say it was going to get used a lot and it certainly does because although it's ivy if you look at a pumpkin leaf it's it's got that kind of very similar shape, it's much bigger but do you know what I think it works really really well. So yeah so I die cut, you get two on each and I use two per pumpkin so I just run that few times, that's how it looks and everything but again I'll share as much as I can and then I've got the flower and I'll show you how to do all that. So again I'm going to distress one of those in a moment with some ink, I'm just going to talk you through the I guess the inner case part so you want a piece that's three by seven and a half okay. Along the three inch side you want to score it half an inch and two and a half and then along the seven and a half inch side you want to score at two and a half and five so you should have two and a half, two and a half and two and a half, three equal pieces there okay. With this piece here you just want to fold and burnish all of those score lines and then we're just going to do a little bit of cutting so where you've got your two score lines here and here you will also have this bit here you just want to cut a triangle so that the top of the triangle hits the corner of this piece here so take that one off there so you can hopefully now make out what I've done just make sure the top of the triangle is in line with those score lines there okay so you need one of those for each little holder, carrier, box whatever you want to call it, favour, it depends on how many you're going to make will depend obviously you'll need to cut those accordingly okay let's just do a quick little bit of inking okay so I've just got my mat here which I've been basically inking everything with and I've used the Stampin' Up Cajun craze and I just pop it on my mat and then just pick up the ink that way it's just much easier than popping your brush into this all the time and don't want to go in too heavy so I kind of just you know make sure you get it evenly distributed on your brush and then just go in and you're just kissing the sides of the card stock and I don't really go over it too much because every time I'm kind of brushing it's picking up a bit more ink each time from the mat if you want it to be a bit more intense and you can go over it again but I did just go around mine once and that's it just it just again when it's like against itself you can't really see it when it's on its own you can't really see it but once I put it against something you know you can really notice it more so that was that one and then for the green I've done exactly the same and this one I used always artichoke so there's some older Stampin' Up ones there and then again just got some of the ivy there and just the same way pick a bit up on the brush and just just catch all of the edges of the leaves and there's the other one that I done it just makes them look more real I think they look quite authentic there okay so that's how you do that so now we want to pop it together the first one you have to kind of do yourself because you've got nothing to put it against but once you've done one I then use the first one I done as a template and I sat sat all the other ones over that so all of these are exactly the same if I put them against each other back to back they are all exactly the same because I used the first one as a template but because I've kept this one for video I'm going to have to do this one again but I'll show you kind of how you do it so because I do want to make sure they say similar so I'm going to just kind of do like that so you have them like two of them like this and then the top one goes on top and then I pop glue on the back of this stuck it down and then just popped a little bit of glue on the back but I do just want to make sure mine are the same as this so I'm going to just sit them over like so and then I'm going to just add some glue on the back of this one and then I'm just going to sit that over the top lining it up with that one underneath okay and then when you get your other three you would now use this as your template so ignore that I've done that okay this is your first one you've laid it all down then when you go to do all your others sit them on top of this first and that way you know that you're getting it exact each time so again just going to pop a bit of glue on the back of this one and then what you do is just go in behind the back because a bit of it won't be attached and just stick that down and then that's all secure oh that one's all been pushed together so let's just move that around I don't think I've put enough glue on that one and again I'm just going to go underneath that one there and that's how you do it I'm just going to let them dry a second okay then grab your base and I'm just going to pop some glue on the center tab first of all so work from the middle out it's much easier so just like so and you just want to sit it over the back here turn it upside down and you just want to make sure that these score lines you can get them as close to the bottom as possible without it showing so I just fold that over you can see how far down so this is all hidden within this section and if I go over this way here you can see you'd basically when you look at it that way because we're going to fold these up you don't want to be able to see any of this case you'll see it all gets hidden okay so then grab one of the sides again add some glue if you haven't got your glue you can use double sided tape and then just bring it up and this one you just want to bring it out just right up to the edge there again you don't want to be able to see it from this side if you want you could come in and have it more square so you could come right up like this and have a square little kind of box but I wanted to kind of fit as much as I can inside it so by you know having them fan out gives you a lot more space and I've done this in a lot of my gift bags deconstructed gift bags I do a lot like this and then this one here just pop it out so you can get all the glue on that tab there and again bring that one in and just bring it as far out as you can and you can see there how it all looks inside but now from the front you can't see anything then the back one it's up to you if you want to do one at a time I just popped glue on all of them okay so I did actually do the tunics teacake treats they were going to be my table favours however my sister wanted them so now I'm doing another one so I'm doing these you wait she's going to see these now I'll be like oh no I want those ones so tough she came and pinched my other ones with the tunics teacakes how dare she so this time it's sweets so just stick that all down and there you go you have your little pumpkin little holder I think it's so so cute now you could put a handle on this if you wanted to turn them into little gift bags I know lots of you that watch make a lot of these things for your grandchildren so I think they would be quite cute as a little bag as well if you wanted maybe someone's got a birthday party on Halloween how cute would these be as little party bags for people to take although I don't think that's done a lot is it I mean I'm old school what happened to a good old party bag and a piece of cake but that doesn't seem to be the case but I think they'd look really cute so maybe if you're still doing that then that can be an idea now I just want to decorate the top so we need to create the little piece here and I just done it freehand I'm just literally going to show you how I cut it so it measures its height just so you can get a rough idea it's one and a half high and it is one and a quarter wide okay so again though I'm not really taking too much notice of that so just a I've got a piece of scrap card here I'm going to come up like this it's kind of like a coat hanger or like the top of a witch's hat and then kind of come around you know this kind of thing I can't really like teach because everyone's is going to be different but the good thing is you don't want them to all look the same because it's a pumpkin it's a piece of you know food they all grow differently but there that's what you kind of want it to look like so like a bit of a witch's hat yeah and now when that goes behind there once I distress it a bit I think it looks quite cool so that's that's it that's all I done then for the these curly bits I have already done two but I'll just show you with this piece of scrap here I just want to cut very very thin amounts or you can run this through your trimmer and just cut very very thin amounts because I know my Tim Holtz guillotine will cut very very thin slithers but I'm cutting probably about one eighth of an inch strips I'll just do the wunks I've already done those and then I just grabbed a pencil or a pen anything and just wrap it around the pencil like so really kind of squeeze it onto the pencil then slide it off and you will have a little springy piece to pop on your pumpkin that's it really easy no special tools needed I'm going to quickly just distress this one just so that it matches all of the others okay and then again I'm just going to apply a thin strip of glue and you may be able to just slide it in between the two here like so okay and then I'm just quickly going over and shaping my leaves this is just a foam that I made a little foam block that I made myself using the packaging from the Tim Holtz stamping platform so you can see now just by kind of curling them it just again makes them look a little bit more authentic so just do this one here okay that is all optional you do not have to do any of this they will still look great without so you know if you are going to make loads then this might be quite a lot of work to do for you know a lot of them this was five this didn't take me long to do and whenever I make I guess more than one thing I do like I've said before I do all of the scoring for the bits there all in one go I cut and distress all of these and do it all in kind of chunks and then when you come to put it together it's actually really quick so now I just need to add these now I think I did actually end up cutting them down a bit so I'm just going to remove because it was a bit too long so I'm just going to take off that bit there a bit of glue on the back and I'm going to pop this one just behind here and just kind of pull them down I do add a little bit of hot glue just behind I think it was like that one there for example just for this day in place I'm just going to hold that one there for a second okay and then this one here I'm going to just pop this behind the other one yeah and this die is really good because you can pull them around and it just I don't know I just think they look really really good and then this one here I actually popped in between the top here and the front of the pumpkin so I just popped it just inside like so and I'm just going to get some hot glue for the flower I'm going to pop that one just there and then I'm going to pop a bit of hot glue behind that one just have him there and then these pieces here just you know pop them anywhere you want really just a little bit of glue behind I'm just going to pop one just in there and I think it's these bits that really finish it off I just think they're such a nice little touch and it's so easy to do and you can stretch them out a little bit okay so those are my table favours for this Halloween and I think they are so sweet I really do like them I'm wondering whether to add the name tag or not now because I could easily put these away you know and bring them out again next year they're saying that I'll probably make something else so who knows but either way I hope you've enjoyed them I hope they've inspired you I can also see these working as their Father Christmas face so if you've done them in white cardstock that would be sorry a snowman's face that would be all white then you could use snowman's eyes and everything and then this bit would be the black hat and you could do some holly and the berries on the hat I think that'd look really cute so I might actually do something like that because I think that's very fun so yeah I hope you've enjoyed it I hope it's inspired you please give me a thumbs up if you've enjoyed today's tutorial and subscribe to my channel so you get to see more thanks for watching


You want to have a very honest conversation with your unmotivated self. So if you're motivated right now and you're watching this, place yourself in the mindset of when you're not motivated, because our motivated selves, we overshoot always.  And it's going to be some crazy number versus when they're not feeling so, so hyped, right? So put yourself in an unmotivated state of mind and then ask yourself the following, what changes can I make now that I feel relatively confident I can do forever that I, and also it still needs to be a little bit challenging. Okay. Here's why. If it's not challenging, it has no meaning. It's not going to mean anything to you, but it also needs to be realistic forever because you don't want to have a lot of failures on your plate. You want to be able to have these little successes. So this means it's different from person to person. By the way, this accelerates, it's a snowball effect. Discipline builds upon discipline. It might start off slow, but it starts to accelerate and each step becomes bigger and bigger. So that's the, that's kind of the light at the end of the tunnel.


Okay, we're gonna let this run first without marking it and I just want you to watch and tell me if you can tell me Really quick. Which one is Julio Jones? About that one they're lined up over here in what we call a two-man stack This is against man-to-man defense with our offense this year and the amount of weapons We're going to have you're going to see a lot of this type of thing man-to-man Post-corner did you see him at the top of the route shove the DB off? This is a big strong man. We're blessed with two big strong dudes now for a defensive coordinator now This is going to be a nightmare. Here's what we want to see watch this little celebration. That's it That's what we want to see here. All right next play. It's a three-by-one split They're in man-to-man. They can't play this guy man-to-man They can't play single man-to-man on he and AJ at the same time This is a broken play and what he's going to do is going to react to the quarterback react off of the quarterback But at the end of this play watch him use his size and his length to stiff arm the defender away from him as he goes to the end Zone and I think he and Derek Henry stiff arm will go pretty nice together out here at Nissan Stadium. That's Julio Next play gys rounds again without highlighting them firsts you can pick them out pretty quick See the guy running down the field in the end zone with the ball That's him. It's a straight takeoff against quarters coverage The corner has no chance even though he's on him big tall long receiver. That's defensive pass interference That's touched down gys rounds The next play that we're going to see he's going to be lined up in the slot in a three by two talking about his versatility He runs a double move where he's going to stick not outside and they go up in the seam What I want you to watch here is for a big long receiver Watch how flexible he is and able to come down and take a low throw and still be able to make the completion This is what you look for when you're looking for versatility in receivers These two receivers are going to make a great addition to an already explosive offense


All right, my name is Jason Ford, CTO of Blackmesh. Been doing this for, well, security for most of my life, for the most part. But some of the challenges that we see and the kind of things we've gone through with our customer base, I kind of want to give it here. I'm not going to be talking about our customer base. I'm going to be talking about really what we do, per se. I'm going to talk more about frameworks, which if I say the word security and you get excited, you're going to love this. If you go, oh my god, it's security. I don't want to deal with that. I'm probably going to bore you for 30 minutes, but you can bear with it. So some background for myself, like I said, I've been kind of doing security since 97. I started in FedCiv space in the FBI headquarters building and then kind of went around the civilian sector for a while. Us as an entity, we're PCI DSS certified for level one. We have FISMA moderate. We have FedRAMP moderate as a platform and as infrastructure. We were founded. I'm one of the founders in 2003. And we have basically slide customers, everything, commercial side as well, from that side.  Besides the logo on the corner. That's going to be it. All right, so security versus compliance. I mean, a lot of you probably out there are kind of familiar with this concept. Maybe you aren't, but security is how you actually do those things. How you actually implement those controls. Compliance is a snapshot of how you implement those controls. So from that snapshot, it really doesn't give you a holistic picture of what's going on. It's just how it looked at that point in time when you looked at it. So security is that framework that you actually see everything that is associated with either that system or that plan. Some pretty notable things in government for at least this base, anyway. White House runs a version of Drupal. We actually host the Department of Energy, their main website. Department of Ed, obviously recovery.org, drought.gov, recovery.gov, Homeland Security runs it. There's a lot of them. So the point is, it is a secure platform. And that's one of those things that a lot of people seem to have to fight a lot of, especially in the government summit yesterday. We talked a lot about that. How to present Drupal as being secure. And that's really the hardest part. And if you can get over the Linux part and you can say, well, Linux is secure. You're doing that with Stig's and in the Disaspase. You're doing that with other things as well. Why shouldn't it be other open source technologies like Drupal, like other CMSs, to be accepted in that same framework? So frameworks really at the end of the day, there's a ton of them. But here's the main ones. PCI for credit card, FISMOS in 2002. The basically federal government decided that they wanted to actually have some kind of compliance around that. So they created that off of NIST 853 framework. NIST is the, if you're not familiar with them, they're the entity that advises the government and others on how to secure their, not only their IT infrastructure, but all their infrastructure, financial, everything else. ISO standards are more global. HIPAA is obviously healthcare, FedRAMS, virtual version of FISM at the end of the day. And then DISA has its own thing as well in the DOD space. Really comes down to just this, compliance in general comes down to just these six steps. I know it's hard to boil down compliance into anything. But at the end of the day, it's really just these things. So going through, figuring out what you have to actually monitor on, what you have to report on, how do you assess those controls, how do you actually implement them, and then you monitor those things after you implement them. At the end of the day, it's as simple as that. How you actually have to do that process is not so simple. And that's what we usually run into and that's our problems. So kind of going into a couple of these compliance frameworks in a little more detail, I'm gonna focus more on FISM and FedRAMP, more on anything else, just because those seem to be kind of the harder ones to do. PCI is also difficult to do as well. HIPAA is kind of a joke compared to the other ones, honestly. But from a framework perspective, like I said, FISMA came out in 2002. It was based on this 853 framework from NIST. At that point in time, all systems actually had to get an authority to operate an ATO based upon how the system looked at that point in time of implementation. So kind of some of those requirements, you have to have a system inventory, you have to basically say what your network diagram looks like, what's the system look like, basically get all these things in place and then figure out what your risk factors are from that and then try to figure out, all right, if these are my risks, is it as acceptable risks or not? And it doesn't matter if this is on the software side or if this is on the hardware side or any of those sides, it's all of it, including yourself as a human in the system, right? You're part of this, whether you can be spearfished attack, for instance, and compromise the system. And then you go through a certification process and you go into continuous monitoring. I'm kind of flying through this pretty quickly, but I could, I mean, we spent literally eight hours yesterday talking about security and compliance and we didn't even scratch the surface. 30 minutes here is hardly justice for it, but just want to kind of give a high level overview. Within those, that framework, there's different categorizations, so you can have low, moderate, or high and it depends upon what that system needs to have. So if you have a high system, for instance, as I always use the example, if you're in the space of energy, for instance, and you have nuclear work codes, then that's obviously gonna be high, right? And there's gonna be a lot more controls wrapped around that, whereas a low is gonna be similar like a public-facing website that you may not even collect data on, right? It might be just like a brochure site or something like that. It is based upon FIPS compliance. If you've done any federal compliance work at all or anything in a security world, you know FIPS already today. It is the way that encryption happens and how those things are encrypted, whether that data is at rest or whether that is in transit and how you are interacting with that system to actually see that data, whether it's in the clear or not. Just a couple more, like security controls, things of that nature, so how we categorize these things. All those things can categorize into an SSP or a system security plan. Those things, there are things that you have to write as a system owner. So you as a developer, you have to write an SSP whether you know it or not. You may be answering questions for your security person, which then they were taking those answers and then writing that plan out. Really it's just saying how your system works. So if you're saying you use two-factor authentication for single sign-on, you have to say that you do that and how do you do that, right? Do you have LDAP behind that? Do you have something else? Are you using CAPTCHA for your forms? All that stuff matters, right? And you have to document those things. Once you have all that documented, then it goes into those control families, which I think I'll talk about in the next slide, but basically we have the, there's a really well-known format template for FSMA, but it's pretty lenient from the perspective of how you write those things. It's really just a word doc with these control families inside of it. Then you kind of go through the risk assessment, like I said, trying to figure out a vulnerability threat. It's no different than what you do for Drupal updates or any other CMS, and trying to figure out what actually is gonna impact the site and how someone's gonna actually attack it. And then from that, you either do compensating controls to basically deal with those attacks and mitigate that risk, or you figure out a way to write the control or put a better system in place to deal with it. Lastly is the independent assessment. This is the most painful part. You have an auditor sit with you for long periods of time, and then they ask you to take screenshots of things and give them screenshots so you can see all the stuff happening. So you can actually verify that you say that if you change, you have password complexity turned on in your application, show me, right? Screenshot that. And that's gonna be part of the compliance piece of it. So once you have the certification, the certification comes out of all of that stuff, that assessment, and all that stuff goes to, usually it's the head of security for that agency, typically in FISMA space, because the agency typically deals with that. And then once they have that and they look over things and if the risk is acceptable to them, then they will give you an authority to operate or an ATO from that piece. And that's the authorization piece. So FISMA requirements from the perspective of, continuous monitoring is the last bit of this as we saw from the first piece before we move on to something other than FISMA. Continuous monitoring is just ongoing what you're looking at. So do you do penetration testing? Do you do credential scans? Do you actually update your antivirus? Do you actually see, if you have intrusion detection on your stuff, do you actually update those policies? Things of that nature. Do you actually rotate your passwords? Is there logs for that? All these things go in that continuous monitoring bucket. Auditors, when they come in and look at you, they will ask you for all this data. That's part of the evidence. So that's the important bit to actually get that recertification piece at the bottom. If you don't do all that stuff, then they flag you and either you have a very short amount of time to remediate that or you lose your ATO is what it comes down to. So that was all FISMA side. FEDRAMP is, FISMA is really for, it's a one-time authority to operate for that system how it was deployed. If you make any major changes to that, then you have to change the whole thing and redo it again. FEDRAMP was an ATO once and then you can operate it multiple times. So, and it's also virtual versus physical. So FISMA is like physical servers, bare metal servers. FEDRAMP is all virtualized. So that'll be Docker containers, cloud stuff, things of that nature. Same kind of concepts, but at the end of the day, what they've done is they've changed some of the, control sets to deal with virtualization and multi-tenancy. So FEDRAMP is, FISMA is done at the agency level. So whatever agency you're dealing with, FEDRAMP is done at the GSA level. So GSA owns that program. The PMO office is run by Matt Goodrich currently. He and his staff basically deal with all these incoming packages from all these different cloud service providers. And I'll get into some of that here in a minute. So anybody who's doing virtual services for the government, you have to go through this process. So that includes infrastructure as a service, platform as a service or software as a service. So if you'd come up with a Drupal platform and say you wanted to offer multi-tenancy for multiple agencies inside of something, you'd have to be a SaaS provider. And then you'd have to find either someone who is an infrastructure or a platform service provider in order to help you with that. Or you do it all yourself, either way. It was basically geared at having a standardized approach for offering virtual services, which didn't exist until this program happened four years ago. And like I said, there's software, platform and infrastructure as a service. So the whole idea and concept of this was that you can use it by multiple agencies. So for instance, for us, if we got FedRAMP certified, another agency could actually use our ATO and not have to go through that whole process again, unlike with FISMA, right? FISMA is laborious, it's tedious, it's all those things.  Two methods, there's the joint accreditation board or the JAB, and then there's agency sponsorship. Agency sponsorship is the fast path to this because the agency that in question that gives you the ATO is actually responsible for doing the continuous monitoring efforts with you, whereas the JAB is done by volunteers inside the GSA. So there's three high level security officers from different agencies that volunteer their time to the GSA. How many government agencies do you know or officials wanna actually volunteer time to read 1200 page documents? It's a long process and it's awful. I mean, it's bad. There's about 100 CSPs right now in the JAB queue. Average time to get through that is about two to four years, depending upon how fast you move. And then agency sponsorship can be much, much less. Same kind of things, so we talked about before on the FISMA side and the requirements. Again, hardware, software, network diagram, data flow. Data flow is new, right? So how does your data flow through your application? Where does it see things that are encrypted? Where is it at rest? Things of that nature is all important here. And then on top of that, if you have to have a trusted internet connection or a TIC to talk from your agency to your system, that all goes into that data flow section as well. Again, same thing, FIS 1.99 based. It's actually a dash two now. So how those things are encrypted, how those things get pushed around. Right now, there's only load moderate in FedRAMP. There are no highs. GSA doesn't know how to deal with it. Not only that, no one wants to put high data in cloud service providers these days. There's an equivalent cloud in DISA space, which I'll get to in a minute. It's DISA's actual cloud is actually high, but it is inside of the DoD. And only DoD people can use it. So again, security controls, again, 853 framework, FISMA and FedRAMP look a lot alike. The controls are written in different words, but they mean the same thing. Access control is still access control, password complexity is still password complexity. How are you doing this in response? Still, how are you doing this in response? It's the same thing. So if you do one, it's pretty easy to transition to the other. Not super easy, but easy enough, right? Low systems typically have about 120 controls. And controls are broken up into those control families like I talked about before and I'll just show those in a minute. My system is roughly about 300. And that's before an agency can actually add more stuff to you so you can actually get more stuff. Same kind of thing with FISMA, system security plan, you gotta write that. Just the template is 350 pages before you put any words to it. Once you start writing paragraphs and paragraphs for each control, it can go over 1,000 pages. Ours is currently about 1,200. So as time is forward, you keep adding to it. So you have to have these supporting documentation. It's just not answering the controls is enough. You have to do things like have a user guide on how to use your system, right? How do you do privacy control? How do you do encryption at rest? How do you do rules of behavior? How do you do security training? All those things are attachments on top of that. So you're starting to see it's a long, complex system of stuff to deal with, right? That's why it takes so long to get through it. Because usually the first time you get through it, you don't get it right. You have to go back and modify and edit those things. Risk assessment, again, very similar to, and you're seeing a lot of commonalities between FISMA and FedRAMP, figure out those threats as vulnerabilities. Again, do the risk analysis. Here's the different part. So the assessment's not done by the agency. It's done by a 3PA or a third party auditing agency or organization. Those are all certified by the GSA. So they're actually commercial companies that go and get certified. There's about 30 of them today. But here's the difference is that not all of them will do accreditation. Some of them will help you write your documentation. So they focus on the upfront, how do you get your rules and behavior done? How do you get all your documents in place? How do you actually get a successful package to go through the first time? Because it's costly and it's difficult to do. So again, certification authorization, again, very similar to FISMA. Either you get the authorization granted by the JAB or by the sponsoring agency you have. If you get it from the JAB, you get a PA or provisional authorization. If you get it from the agency, you get an ATO, which is an authority to operate. I think it's monitoring, again, it's kind of the same things here. You have to do these things more often than I wish to say, because it's really a lot. But at the end of the day, what I'm trying to show here is that you're always going through this agile environment of trying to figure out security. So all these things that you guys are doing to develop code, it's the same process for security, which it can be a difficult task to try to find everything and try to plug every hole whenever they change all the time, right? So again, kind of showing here infrastructure and paths for FedRAMP, you have this ATO for CSPs and then for what we're showing here is like different dev shops would have stuff on top of this or applications or system owners in this case. So your system has to go through, if you're using a platform or an infrastructure service and you're not doing multi-tenancy inside your application, then you can use FISMA for your application. You don't have to go through this FedRAMP process, which is much, much lighter. And on top of that, you get to inherit a lot of controls out of the CSPs package in order to leverage up for your SSP for your application. All right, so that's FedRAMP. All right, as I'm seeing time in 10 minutes. All right, so this is the next one is DISA. DISA has their own thing, which is awesome because that makes things so much easier to understand. You have basically impact levels in DISA space. So some of these translate over, some of them don't. So FedRAMP moderate will translate into DISA impact level two. A FedRAMP plus, which I haven't talked about yet, which is additional 25 controls on top of the FedRAMP moderate, will translate into a DISA four, impact level four. What usually comes out of from four to five is you have to go through background checks, you have to facility clearances, you have to have a security officer on site. I mean, it's a whole laundry list of things, plus you have to have encryption between all your stuff between the agency. The list goes longer and longer. And then there's actually a six as well. I'm not aware of a six that's out there today. So some of the basic controls, I just want to kind of pull out some of the stuff that would apply to Drupal, in particular or any CMS really. So some of these things like AC7 failed login attempts to count lockout. So if you need to lock out a system, right? So you need to do that, you need to log it, right? Not only do you have to do it, you have to actually report on that. And then you have to have some kind of automated alerting system saying that that happened, right? Session activity, AC11, same thing. You have to make sure that the inactivity timer actually meets those times. So if you have a session lockout, it's not only for Drupal, but it's also for PHP sessions, right, it's both. So whereas Drupal, you have to worry about one thing, but you also have to worry about the undercarriage, which may or may not work the same way you want, until an auditor finds it, right? And then you have to fix it. And then you go into remediation and then you do a poem, basically that's an after-action piece that you have to fix those deficiencies. So some Drupal modules, we kind of talked about these yesterday in pretty heavy context in some ways. Paranoia, the first one, was the one for D7, it was used heavily. It hasn't been updated for D8 yet. Security review is the one it has been. The guys at Civic Actions have been doing a ton of work on that. And we actually came out of yesterday talking about how we're gonna, or how they're going to, along with other people that are in the room, come forward with a plan to basically push that even faster through D8.  Some of them are updated for A and some aren't. So session limit obviously gets you past that AC control, right? Password policy, same thing. You want to have complex passwords. And the last one should go without saying, just upgrade your stuff. I mean, I know it's a pain. I mean, upgrade your modules, upgrade core, keep it upgraded. I mean, that's the shortest way not to get into a remediation step, right? And do that with having some continuous, not continuous monitoring, but actually tracking your changes, change review, that kind of thing. You have to go through that process as well and show that you can document that. All right, that's all the federal stuff, I think. So now, on to quickly through PCI and HIPAA. So PCI, I'm sure you guys have dealt with credit cards at some point in time in your life. You probably have a couple in your pocket. That kind of thing, you bought things. So in the service provider industry, it's PCI DSS is the thing. So it is this version of PCI that they just came out with today, or this last, I think it was the end of last year. They did a major revamp of the control sets and it makes it actually more difficult to go through. But that's a good thing because now credit cards are, in theory, less easy to compromise. Very different from the perspective of how FISMA and FedRAMP work. You basically get a report of compliance or a ROC and then you have a QSA or a qualified security assessor come in and then you get an AOC, which is the same thing as an ATO. So that process is pretty straightforward. And you can do this for your application, you can do this for the infrastructure, you can do this for your platform. It's all different things. And I'm sure you guys have filled out a SOC queue before if you've done PCI before. Healthcare side, very light compared to the other ones. HIPAA non-high trust is a very easy process to go through compared to PCI and the other ones. Still has sensitivity data because you're dealing with PII, right? The harder part is just making sure that that stuff is encrypted. That's the end of the day. Make sure things are encrypted, both at rest and in transit. There's basically the agreement that you have to sign between you and the person that you're dealing with this as a BAA. It's literally just a contract form, two usually two pages long, has some stuff in there, some stipulations saying what you have to deal with and what you're gonna deal with and how you're gonna deal with it. And then has some instant response stuff inside of it. That's about it. Pretty straightforward. So tools. So OpenScap is out there. God help you if you try to write policies to it. It's a pain, but it is there. It is customizable. It is open source. You can install it on any Red Hat system just by the time you install app get for anything on Ubuntu. It is maintained by NIST. So you can get some policies and some control sets out of them by default. You can write your own. You can create regression testing. If you wanna dump it out of Jenkins and then do code review, all that stuff is all here. We talked about yesterday the code review module on Drupal actually hooking OpenScap into that. So it's a module. So whenever you do a checkout from Jenkins or something happens, some event fires, you can actually run some of these policies on top of that and then they can fail the build. Things of that nature is kind of what it seems like is the process. Kind of going into another tool is Nessus. If you've never heard of them, it wouldn't surprise me. But they, Tenable is the name of the company that owns it. It is commercial. It's fairly inexpensive. But at the end of the day, what it does is it basically does credential scans or scans on your database or your code for vulnerabilities. You can use them for, you have to have an ASV or a certified scanning provider actually scan your code or scan your site. Every, I forget how frequent it's, it's pretty frequent. But they are actually one of those ASVs. So it is QALIS, if you've ever dealt with QALIS before, those type. So in DoD space, Stig's are popular, which are awful. Again, if you haven't got a reoccurring theme, security is not fun. It's consumed in my life for many, many years. And as much as I love doing it, it's still a challenge in every aspect. They are DoD Disabacked. You can download these things. You can apply these templates to the boxes. In the Linux space, only Rail, Red Hat Enterprise Linux, it has Stig templates for it. Ubuntu, Debian, nothing. I mean, there's nothing. You can write your own, but they won't be certified. In Windows space, there's obviously stuff for Windows. Again, you can go look at these things if you want. There's also a Stig viewer out there that someone wrote that you can actually try to figure out what those things are. Again, it is extensive. Logging is obviously something I kind of talked about a good bit here. Some tools that you can have, open source land is Elk, right? So, LASA Search, Logstache, Kibana. The hard part there is you have to know how to do Kibana. Logstache stuff, LASA Search is fairly simple. Splunk has an enterprise and a free version. You can set up a learning inside that. You can do all kinds of fun stuff inside there to basically automate your life into your inbox into a point where you have so many emails coming in for alerts that you won't be able to do anything else. And then OSSEC is the other tool that you can kind of use which is I think Trend Micro is the one that backs that one. It's basically host-based IDP, so you can actually see file integrity and things of that nature. It also does host-based IDP from a firewall perspective as well. All right, I think I actually did 35 slides in 30 minutes, so that was around time. So, three minutes left before the next people come up. Any questions? If you could, stand at the mic so we can get it recorded. Sweet, I bored you to death. All right, cool, thank you. How's everyone doing today? Good? So, how many of you shop online? Pretty much the whole room. I've been asking that question for 10 years and over the last 10 years, obviously more and more of the room has said yes to that question. To the point that I was just driving by my local sports chalet and it was going on the business because I realized that I probably haven't walked in there in two years, just like everyone else. And what I've also realized is it works the same way with user experience and the websites you shop on. So you probably, so you all shop online now, how many of you have your favorite websites to shop on? Right, because you've decided that's the user experience you like and it's come down to, it used to be, I don't want to get in my car or drive to a store anymore. It's too inconvenient. It's now come down to a matter of seconds, right? Well, this website is two seconds faster than this website so I like that user experience better. I'm gonna go on that website and that's where we've come to. And studies show that you convert more on sites that are faster and where the user experience is better. And user experience is more than just the look and feel of the website. There's a piece to that which is just the passage of time and the patience we've all lost over the last number of years waiting for a website. So it's become very important for your website to have high performance. Drupal, which is open source, isn't great and the greatest benefit of Drupal is that it's open source but it's also it's greatest weakness, right? Because anyone can do whatever they want to it. They can customize it in however they want which is in the right hands an amazing thing and in the wrong hands, it can cause more problems than I've seen over my career. So even though Drupal Speed can set your revenue on fire, it can also slow you down and cost you a lot of money because of it. So how does performance impact your business? Did you know one second delay reduces conversions by 7%? This was a, they looked at this a couple of years ago and I saw the research and it's pretty amazing because we were talking about what could essentially be up to almost two and a half million dollars a year annually for a site that sells $100,000 a day which is a lot of money. And what we're gonna do here today is I'm gonna start here at the beginning going through some of these numbers generically but then we're gonna show a case study in real world examples of one of our clients to show you how the better your performance is, the more people come to the site and the better conversion rates you'll have. Is Mark in the room from Perfectly Post? So the case study we're gonna do is for our client Perfectly Post. We have one of their employees here with us and Christian's gonna come up in a minute after we go through this and we'll walk through the case study of bringing them from another hosting company over the platform and the success they've had on the performance side. And what really is important to understand and to know that performance isn't just related to the hosting company and it's very important but as important is the partnership not only amongst the client, the hosting company and the developer. In Posh's example, they are also the developer, they do it internally but having a partner for the development side is just as important. So what you'll see is as page loads times increase, you have lost opportunity and again we'll be able to show this in real world examples with Posh. What was happening on the other hosting company is as they had a rush on the flash sale, what was happening is people were not coming because it would take seven, eight, nine, 10 seconds and as more people showed up, the time to check out was getting more and more because of the structure they were looking at. So people were bouncing and they would have these sales that should last an hour or two and they were lasting three, four, six, eight, 24 hours because of the fact that the site was slowing down. So conventional wisdom today, we were talking about seconds says that you should have a sub two second page load time which personally I think is unrealistic because of how complicated websites are today. I think it should be closer to about four seconds and I'll explain that to you in a second. So what we did, does anyone know what the IR 500 is? That's the top 500 largest e-commerce websites in the world. So I spent some time reviewing them and the average page load time in 2014. So when I did this, this was a couple of years ago, it was 3.67 seconds and actually what's happened since then is it's actually gotten slower. So what are the ways, some of the ways it can get slower? I'll explain. I had a client call me once and says my website's slow. I said, let me take a look at it and I bring it up and they do a trace of the site and it was 1,050 calls to generate the page, something like 17 seconds to load the page and he sold books and I said, how many books do you have? What's your SKU count? He said 1,000. I said, you see the scroll on the bottom that shows about six books? If you scroll through it, it's actually loading all 1,000 books. What you need to do is have a lazy load so it just shows the six that are there and as you scroll it'll load the others. He did that and it took it from 17 seconds down to about one and a half seconds. But these are all things that you have to be cognizant of from both the hosting side and what things you can do there, like caching and compression, but also just as important are things like the number of calls on the webpage, the size of the webpage, all of these things in concert are what makes the user experience so great. And as I mentioned, to really do this correctly, you have to have a true partnership.  I give them the site, they're hosting it from there on out, it's their problem. Or I've hired a development company, they're supposed to develop my site. It's a partnership and that partnership doesn't just include the client, it includes Drupal. If you're choosing that as your application, it includes the Drupal developer and it includes the hosting partner. And what you really need to do is work together in order to have the best experience. So when we went to Posh, one of the big things we said in Dallas who's not here, that's Mark's boss, they came to us, we architected a custom stack built for them because of the unique way they do things and I'll explain it in a second, but they needed someone that could scale very quickly. And their current hosting company couldn't do that. They were either having a lot of downtime or they were having longer and longer page load time. So what we were able to do was architect a custom stack just for them, which is important. So what did perfectly Posh do? They have something called a splurge sale once a month. They have 45,000 independent consultants who all get an opportunity to buy one item. So they have 25,000 units and that one item might go on sale from $25 down to six, seven, eight, $9. And they all want to rush to the site and buy this before it runs out because once it's gone, it's gone for good. So what this was causing was a rush to the site but that rush to the site was crashing the site or slowing the site down. So something that should have sold out in a couple of hours was taking multiple days to sell out. So they went live with us on March after we custom engineered a plan for them and after the first splurge, these were the feedback we were getting from their independent consultants. We got things like magical, easiest splurge ever. All of these things that can show you pretty easily the problems they were having on the other hosting company. And what was the problem? They were throwing hardware at the problem and they were throwing the wrong hardware at the problem. So there was really multiple issues. You can see at one point they had 20 web heads. At some points they had 30 and 40 web heads. I can tell you we're currently at 10 and we're not running out of resources. I think we finally hit the, we might add one more now. We added an 11th. They were at 30 or 40. They were throwing the wrong hardware at it. It's crazy. So what did they do when they moved to platform? So I'm gonna bring Christian up now and he's gonna walk us through what we did in the different phases to get them from having all the problems they had on the other guys to the most magical splurge ever. Hi everyone. So the typical deployment we do for an enterprise hosting solution is that we have three hosts all load balanced across each other for both web requests, for database requests, and for caching and for search, if you use a search service like Solar for example. With Posh we wanted to scale out beyond that because they had so many requests coming in. We knew that they were typically at 20 web heads with their previous solution. And so we needed to do something slightly different and what we did is go through their requirements, look at where they were bottlenecked in terms of their performance reporting from their previous host and worked out a solution that we thought would work. But we left a lot of time to plan and look at that solution and evaluate it and test it before the go live point because we wanted to have success out of the gate. And we didn't wanna have to provision two of these environments to do testing in the future because that would have been very expensive for them and so we left some space for us to use the production environment in a test phase before we deployed. So, let's see, I'll leave this up here for a sec. Exactly, so the first thing we did is we decided because we need to load balance across more web heads we'll deploy an additional set of web heads that are all the same size so it's easy for Elastic Load Bouncer on AWS to work with and then we left the core, what we call the core servers, the original three hosts were just used for the database, for caching and for solar. They weren't serving any more web requests and the main reason we did that is both for the load balancing and because we wanted them to use the full amount of CPU and IO. We put those hosts on AWS instances which are specific for storage. They were using SSDs rather than the metal based network file system called EBS on AWS because we wanted high IO performance. They had seen a lot of database trouble on their previous hosting company and so by splitting those we were able to optimize each set of hardware for the performance results we needed. We also planned to use Redis for caching which is what we typically support that had been using memcache. This will come back to this later, it becomes important. And we decided to add Fastly for a full page cache. The advantage of Fastly being that we could add, essentially Fastly is varnish as a service it allowed them to implement a few things in a custom VCL file, a custom varnish file that allowed them to do configuration where pieces of their page would be loaded via the cache and then other pieces would be lazy loaded into the page via AJAX. So this is what the system, the system normally just has the three hosts that you see in yellow, green, blue and those are all three hosts, app one two three and DB one two three would be all together. But by moving those out we were able to pick the correct hardware for the DB hosts and pick the correct hardware for the application hosts. As Doug said, we initially structured them with 10 application hosts that just run anginex and PHP FPM. We have since added an 11th, that was just last week. And then the DB one two three hosts are running on instances which are optimized for IO and also are much larger in CPU terms as well. So and those hosts are running MySQL in a Galera cluster. They also have read instances and solar instances that know how to fail over to one another in a high availability setup. And there's a little backup post off to the side which we is also replicating from the Galera cluster. We should adjust this diagram slightly. But and that's just a read only copy. So in the event of complete disastrous failure on all three of the database hosts we still have a backup that we could restore from which is isolated from those machines. So that that was the custom engineering we did on the hardware side. And we said, okay, we think we are ready to move into a testing phase. And so what we did is we looked at a number of load testing tools. We decided to go with Blazemeter. Some of the engineers at posh had used Blazemeter before and we said, we need you to write the initial Jmeter scripts that will run this performance testing because while we know what a Drupal commerce application looks like their application was quite custom. Their workflows were custom. We needed their expertise to go and say, this is what a customer workflow will be. These are the pages it will hit. This is what a sale experience looks like to us, okay. And when that was done, we would then toss it into Blazemeter and say, okay, I want to run 600 of these at a time and observe what happened. And we had enough time spaced out before their launch that we were able to do this repeatedly and evaluate in all of our load testing tools which mostly was New Relic but also in Blackfire and other monitoring to say where are the difficulties here? Whoops, what did I do? Something wrong. No, I think your laptop suspended. I'm clearly not exciting enough for this laptop. So this is an example that we have from New Relic on both hosts on the right side. You can see another thing we discovered is that they under in high load situations were crashing due to memcache becoming unavailable and you can see the majority of the page request time there is from memcache taking really almost 80% of the request time. And that's because the memcache instances they had were not load balanced and simply were not enough. What we discovered as soon as we put this on Redis on our side was that this actually was a bandwidth issue that the hosts talking to one another only have limited bandwidth within AWS and with that number of requests we're peaking at well over one gigabit per second in raw data transfer because posh's developers had done a pretty good job and were caching absolutely everything they could which is normally a good decision and you don't anticipate that bandwidth is going to be your problem. And so what I did is quickly threw together an upgrade to the Redis Drupal module that compressed that data and was able to then uncompress it on the fly. This has a CPU cost. We said adding CPU is easy. Adding bandwidth to AWS instances is hard. We will solve the problem in the quick and dirty way. And that worked extremely successfully. So once we resolved that problem and because we were working so closely together during this load testing phase we were able to identify and fix that within a matter of days. Once we got that solved we see that we have a much more normal request profile here with the majority of your time being in MySQL requests to places that you would expect for a Drupal application essentially and we were able to knock that average time down substantially even under very high load. Another thing we ran into and this shows how the partnership was very effective is we saw initially during the load testing that they were hitting database calls that were locking in a way that you would not normally have expected that a particular table was being locked and that it was slowing down all of the subsequent requests. Well as it turned out the load testing script itself was assuming a profile that was not accurate. They were assuming that all of these requests would go to a single consultants website rather than be distributed among their 45,000 consultants. So they were really testing as if the company was several orders of magnitude larger than it actually is. And with multiple pairs of eyes on it we were able to identify that relatively quickly and get that fixed. And so that sort of back and forth almost agile process and partnership enabled us to move forward very quickly on this. So here's some comparison numbers. We got these from Dallas who's their engineering director. Average time it takes, it took for our queries under similar load went down to on the order of milliseconds from two milliseconds down to 0.2, eight times faster with Redis. Substantial improvements on the database layer also right and as I talked about Memcache had been accounting for a lot of that time. We suspect that the problem with Memcache on the other host was similar to the bandwidth problem we discovered we don't have anything. We didn't have enough information to necessarily see that but that is a strong suspicion we had. So having gone through that load testing we felt like we were relatively well prepared. Goli was on March 5th. We did a prep call for the first splurge on March 21st and we decided we need to upsize database hosts and for us upsizing is relatively simple process because everything is in a high availability setup if I turn off one of the hosts the other two respond normally if the host I turned off happened to be the leader that would fail over automatically. So we did that we upsized one of the database hosts brought it back up it takes in their setup because they're using SSDs and ephemeral storage on Amazon that takes about 10 to 15 minutes to sync all of the data back over to the rebooted host and then we were able to make that larger host the primary so it could accept reads and writes. So the splurge went well. We saw that the site under severe load for roughly 17 minutes during that time about 14,000 out of the 25,000 units sold and then at that point the site was not under any stress anymore and sorry, yeah, oh it's all here. At that point the remaining units sold out over the course of the next I think two to three hours to get through their 25,000. In comparison the previous splurge in February was a total disaster the site went down and could not be restored for many, many hours and so that took several days for those items to sell out. The January splurge was not as bad with the other hosting company. They had somewhat fewer requests per minute but the server time to fulfill those was roughly, oh no. I don't know, oh maybe you're not, cause you're not plugged in. Oh that could be it. Did you run out of battery? No. I think you did. Get a power brick. Sorry everyone, we're almost done though. We're extremely good at DevOps I promise. Obviously it's time to buy a new battery. No not yet. We're almost done. Kill me as much. Yeah. While we're getting this back up anyone have any questions Christian can answer while I do this? We'll do Q and A right now for a couple of minutes. Nothing? Yeah it doesn't like that. Went down. Yeah you see what happens? Doesn't make any sense. They want me to upgrade but no. I think it was just graphs left actually, right? No there was the April splurge down so it's worthwhile. Yeah. I know that off the top of my head. You also have it there. Yeah. It was hiding. We're back, sorry guys. Are you finishing? Yeah. Perfect, okay. Exactly so with, we saw roughly 20 to 25% load times at both at the database level and at the server level just the time to get a request and to load a page had been reduced by nearly 75 to 80% for the March splurge. And like I said that was about 17 minutes of very heavy load where the database hosts were essentially maxed out on CPU and that was the bottleneck. And we took steps to try and alleviate that both identifying problematic queries and upgrades on our side to the database layer. So approaching the April surge we did the same thing. We upsized the database hosts and prepared for the moments of truth. And during the April surge we saw much different performance characteristics. The peak request per minute went up from just above 7,000 to just above 9,000 for March. Their gross sales per hour went up 31% and they saw higher peak users on the site. And this meant that the site was under load rather than for just 17 minutes was under load for a full 45 minutes. And the times had gone up slightly because of this increased concurrency of requests but they sold out all 25,000 items within that 45 minutes rather than the three plus hours we saw just the previous month. And so what we've seen is that immediately we saw a change in customer behavior. As soon as these customers realized that the hosting problem had gone away, now they knew, oh, we need to get in here and get these items really quickly because otherwise they'll be gone. And that, you know, we saw that and realized that we had not prepared quite adequately because under that sort of load we saw increased performance times and so we explored additional things that we can do which included increasing the pool of PHP workers. We added an additional web server. We asked Posh to look at a specific database query that was causing a lot of trouble and we also added a new feature. This isn't on the slide but we added a feature which allows us to load balance read requests between the three web servers which are typically there just for high availability. What this endpoint allowed us to do is say to the application layer, okay, use this as your secondary database within the Drupal configuration and Drupal has the ability to point many of its queries, views in particular at one secondary database. But on our side that secondary database endpoint will load balance between all three of the database hosts and so we anticipate that the next words will see all three database hosts under substantial load but not nearly the max load that we were seeing with just the one under previous circumstances and so we feel very well prepared and we're hoping that we'll get the sale down from 45 minutes to 20 or 30 depending on customer behavior. So, all right, we have just a couple of charts showing bandwidth per minute. I think we peaked at about 500 megabytes per second or per minute in bandwidth coming out of Fastly and around 30,000 requests per minute from Fastly which translated into just over 9,000 at the origin so they were serving more requests of cached static assets and cached page frames that were then filled in with customer data after the fact. So, the takeaway here is that performance is driven by both of these components, both what you code and how well the infrastructure is suited for it and the partnership that we have offered on the platform SH side to work with customers on the back and forth of fixing each of these issues and tandem and making progress on them together is something that has benefited Posh immensely. Their conversion rates, their revenue are directly tied to that performance. This is an extreme example, obviously. Most sites don't have the sort of load where they're going to crash during a sale but that's why this was such a great experience because we knew that the effects would be dramatic if we could solve these problems. The profiling step was really important. Being able to look and say we know exactly where these problems have occurred and which problems we need to solve and so we leveraged server side tools to do that both to see where the problems are and then to go back, analyze the code, optimize it, all those things. And so we feel like that partnership has been a benefit both to us in being able to improve our product and obviously to perfectly Posh for being able to improve the experience for their customers and it's clear to us that their customers agree. So. I actually want to go back for one second because I love this graph again and if you think about it, we said on the other guys they were peaking at about 6,000 RPMs and then crashing, we got up to 30,000 going through Fastly. So that gives you a sense of the magnitude of the performance benefit we provided to them. And it's working still. And it's working still. So we've been able to scale it five times already within two months of going live and it's gonna get better and better and better and if you wanna ask Mark, he's back there and I'm sure he'll answer a few questions for you. So I could even bring him up if you guys have any questions for him now. Nothing? So we are in booth 524 in the exhibit hall. If you have any questions or wanna see a demo of platform, Christian is giving demos all day. Please come by the booth. Right by the coffee. Yeah, and as a side note, we already host some of the largest Drupal 8 sites in the world that are live. I think we have one that's got five or six million paid views a month, which isn't massive, but for Drupal 8 it's one of the largest out there and we're just gonna keep adding more and more and getting bigger and bigger. So if you guys have any questions, please come to the booth. Great.


Welcome to Digital Assets News to get top stories in crypto, current digital assets, and a great amount of bite-sized pieces. So, welcome back to a little Trinity trading. I'm not much of a trader, but that's why I've got these two gentlemen with me. This is, first of all, we've got Alex Massioli, Head of Institutional Services for Bequant. Hello, Alex. Hey, how are you? I'm great. He is going to be doing our sentiment analysis with Traded Chain. And as always, we've got our man CJ over here for technical analysis from Market Rebellion. And usually how this works out is that we're going to go through sentiment analysis first. Alex is going to pick it and it all starts with him. If it gets through Alex, it goes to CJ where he can take a look at technicals, then it comes over to me for whatever reason. I take a look at the fundamentals and we go from there. So, let's see what we got. Let's start with Traded Chain. And which one is our winner, Alex? Sure thing. Yeah, so, you know, I was looking through the screen and checking out what I wanted to look at. These are the coins that I'm currently covering at this point in time right here. But none of them really looked like they were giving me any substantial movement or indication forward except for one, which is NEM ticker XEM. One of the things I look for, and I'm sure this has been shown on the show before, is I like the positive one hour projection. I go here first. I like the five points to the top side. And I like the relative tweet and trading volume going up their percentage points 76 and 98 respectively. As a daily sentiment of 72, I'm picking this right now. I'm looking for a 24 to 48 hour pop-up range in price action. And the 24 hour and seven day, let me see that it's slowly moving up. I feel it has legs to go up on its momentum with the sentiment. It's currently neutral for the day. So it may not pop within that first 24 hours. Why give it the second 24 hours for some real percentage gains? Great. So before we move on to CJ, if you are new to the whole Trinity trading thing, Alex, explain how the heck this all works. Because if I was new to this, I'd be like, what's going on? There's a lot of gobbledygook. So how does trade the chain work? And how do you get to these assessments? Yeah, absolutely. So what we do is we take social media, media sentiment and data scraping. And we take that and we go through all the different postings for particular coins contextually. We're able to identify weed out, bot, spam, pump and dump accounts. And then what we do is we identify positive and negative sentiment or posts that are made. And we calculate that into a score to show where sentiment is moving, whether upwards or downwards with a coin. And we also are able to overlay that with pricing charts to show that it does follow to a 90% accuracy, the price movement of the coin. That's the big thing. 90% accuracy. So everybody at home, if you're new to crypto, welcome. But just so you know, everything, not everything, but a lot of things work on being moved by news. So as news comes up, it pushes either the price up or down because it is a volatile market. So that's the beauty of trade the chain. It takes a look at what's going on the news, the sentiment, the tweets. It's one of, I think, four or five crypto companies that has a direct API into Twitter, which is where they get all the information from. So great. So let's go with NEM. So it passes through Alex, CJ, what do you got, man for the TA? Yeah. And I agree with Alex's assessments of roughly 24 to 48 hours for this to increase. So let's take a look at the charts a little bit here. Start with the four hour because we are trending putting in continuous higher lows. We have a nice support off this middle Bollinger band right here that continues to go up. What we're facing right here now is a little bit of resistance here from the top band after closing below it on that green seven right there. So we are getting a little downward momentum with a rejection from that top band here. But the good news from the bullish perspective is that when we reach those green nines, a lot of times they have served as a catalyst for bullish price action. So we might actually see a pop on that next four hour candle. And we might actually go up and break that 70 cent level. So you think, so looking at these again, because I don't know anything about TA, just so everybody is aware of that. So tell me, CJ, what does all this mean as far as the 7s and 8s and the Bollinger bands as it kind of passes along what's going on here? So yeah, I guess I'll just start with the simpler concept which is the Bollinger bands and supported resistance levels in general. So in trading and in investing and just market movements in general, very few times does price ever just go in one direction without partially retracing back to a prior level. And so when you're looking to have a particular support level, the Bollinger bands are automatically calculated on a couple different mathematical parameters with exponential moving averages and things like that. But the concept of support and resistance essentially is it can be described by this flat line here. And so when we go up and test that line, since we've already been rejected at that level, that shows that that is a particular point where a lot of sellers come into the market and take profit. But when we break that level, it kind of flips. We automatically have buyers that kind of want to step in that say, okay, we've beaten all those sellers that have been at this previous resistance level. And so the trend can continue. So because of that, I like to look at prior swing highs and prior candle closes for kind of an initiation for a bullish trade. So while if you want to be a little bit more aggressive on this one, I don't mind entering on a bullish green three candle that closes above the previous two and one. But what I really like to see even more is a break above that previous high at roughly 70 cents because that shows that the trend has strength to break out to new highs and really test into some uncharted territory. No pun intended there. Gotcha. So right now we're at 65, 65 cents? Yes. So if so for you, if it hit 70 cents, let's say in the next hour or two, you would be you would feel more comfortable getting into this position. Definitely. Yeah, because that shows me the confirmation of buyers are interested and that sentiment score that Alex mentioned previously is being demonstrated in price action actually coming to fruition. Perfect. Makes sense. So this is a good lesson for everybody, including myself. As we were doing a couple of shows before, we were talking about, I forgot, I think it was Orchid and we're talking about it and CJ's like, yeah, you know, if we just wait till this one price point and we get this and I was like, I bought it. So yeah, make sure as you're as you're sitting at home, just, you know, if you take it like this, again, not financial advice and then you should do, but I'm going to wait on this one and see if it hits that 70 cents and I will actually be purchasing them. Now, the real question is now comes to me.  So let me share my screen real quick. We can go over that. So here we are trying the chain. So I got a congeco that has a nice little breakdown. Here's NEM in the 16th spot. Actually, pretty good so far at 12% 24 hours, 15% for the week, not too shabby. So we go over here, take a look at the charts and I'll bypass that. That's not my job. So NEM and every time I would talk about this, I'm like, what is going on with NEM? Why is this such a big deal? Because it seems like the last three, four weeks, it's been going up and up and up. So NEM, highly versatile crypto solution, adhere to a host of mainstream, okay, whatever, Ranjava, Scraps, great. Has a stated goal of a wide distribution model, new features in blockchain tech, proven forms and all features. Okay. NEM also features an integrated peer-to-peer secure and encrypted messaging system, multi signature accounts, and then EIG and trust plus reputation systems. So I think I talked about this before just like for the messaging platforms that we have, like we have, like Alex talked about this before we got on WeChat line, those types of places in Southeast Asia or in China. If you have these peer-to-peer organizations or these text messaging apps that you can send money on or cryptocurrency on, I think that would be a pretty big boom, especially if you were in a suppressed area. So I would say that is why NEM is going up and making strides. I can see this actually working out pretty well. It's not like it doesn't have a non-use case. So sure. All right. So let's go with that. So the thing that we'll do, as always, we'll take a look at, there's a link in the description. You can check it out. It's bit.ly forward slash trunday trading. All the trades that we do or we talk about, again now financial advice is what I will be doing. I will be waiting to see if NEM, let me put this in now so I don't forget. I guess it's NEM. What's the day today? First day is the first. What time is it? It is 3.30 Eastern time. All right. So I'm in Houston. So I was going to go central standard time today and the price we said was 0.65 but actually I'm going to wait till 70 cents and then we're going to get in. So let's see if we can hit that mark and go from there. Now the next question I have is where the heck can I buy this? Can I even buy this? I think you can buy it on UNI. All the great coins reside. So I can spend $25 to get $30. Sounds good. Exactly. So if you're ever looking for where to buy things, CoinGeck was pretty good. You just click on the pairs and go from there. CPG, Polonex? Can Americans use Bitcoin anymore? That's a good question. I'm not sure. Kucoin, I think. Kucoin you can use. So that'll be it. So we'll go with that. And then you know what I always wonder about this one is that they don't list brokerages. I never see Voyager on here as one of the options. It's probably good at the brokerage but you'd think they would list those types of things unless I'm wrong. I think they're a little behind maybe. They don't know how great Voyager is yet. Alex, man, you're the biggest shills of Voyager. Come on. Rob, am I allowed to do a little extra credit with this episode? Of course. What do you got? All right. One of the things that CJ showed with the chart and the various volume, I just want to go ahead and show a little something as well because what we call TA with sentiment trading is the affirmation. And that's one of those things where you look, the numbers look good. On the sentiment, for instance, I see 74% uptake in relative trading volume. So I know that there's market participants in the order book, right? And that's one of the reasons why I like it. But then if I want that affirmation, I'm going to go to someone like CJ and say, hey, listen, what are the charts telling us? Where's the volumes and whatnot? And obviously, where are the bullish or bearish patterns coming? Another thing that I want to kind of delve into real quick is that I also, blue is price, green and red is sentiment. And I can also tell by this chart that sentiment is matching up with price on them, lockstep. So this is this, the chart, the numbers, they all equal affirmation. And I just want to say I implore all traders to have all the tools that they can use in order to enter a position smartly. That was it. Perfect. And of course, do your own research before you make any trades or anything like that because it is your money, right? Good enough. All right. So we'll wait a little bit, but it's looking pretty good. All right. And if you want to learn more about Trade the Chain and Market Rebellion, there is a link in the description. Trade the chain, there's a 14-day money-back guarantee and trial or something like that. And then Market Rebellion, I think you can start learning how to trade for a buck, which is pretty cheap. All right. Well, gentlemen, that's it for today. So we'll see how we do. We'll meet up again in a week and see if this is a winner of a trade. Anyhow, if you like the video, I appreciate you guys watching all the way to the end. Hit the thumbs up, hit subscribe, as all these things are time-sensitive, especially episodes like this. Anyhow, thanks for watching. I appreciate it. And we'll see you on the next one. And that's it. And Faith to Black.