Hey folks Okay, we're 10 oh two Dive into things So I see sorry Justin you say something Yeah, I was asking if we should dive in and start to talk about things Well, let me turn my speakers. I couldn't hear you. Um, I'm guessing that we have a small group because while we talked about going from 10 to 11 last week and And Amy did update the calendar that people are forgetting that we have 10 to 11 now So I'm happy to start because I think I was just reading Marina's tough document which There's just a couple epiphanies in there that I think Help with I think some of the confusion we've had in some of the conversations Yeah, one thing I do want to mention is is that Even though tough has update in the name. That's the you and tough It is also used for initial software installation lots and lots of times and places as well so it's you know like Regardless of what you're what you're doing with it whether you're doing an actual update of something where you've already established Like have an earlier version or whether you want to install Something new tough is meant to handle that case securely and well So I it was one of things that I called out because I did pull up a couple of things and there's this one section for non goals that talks Not providing a means to bootstrap, but what that means is is that So We're not going to prescribe whether you do some way of trust on first use or how you get like a Bundle of things inside your client in in practice What's always the best if you know what repo you're going to communicate with which? Registry you're going to communicate with which maybe you do Then it's always the best to just ship some version even an old version of at least the root metadata for that Which is much smaller than you know for instance your CA bundle will be for your root CA's anyway It's you know like a maybe a kilobyte or something so We want Basically what we want to say Our way of saying non goals is to say it isn't to say that that isn't at all a concern it's to say that that's not something where we're doing something new and Interesting and that different people that deploy this in different ways could very well elect to Use different models as is true for different communities that use tough today okay All right, I'm just looking at the agenda and Yeah, thanks now as we should add ourselves to the attendees. Let me just post that here as well so for the first thing agenda was the key management and Yeah, as I'm wondering if we flip it because by the Attendance, I'm guessing most folks didn't recognize the change from 10 30 10 a.m. Start Um Gened out until late, which I'm trying to get better about sorry. What are you saying? No, that makes sense to me. I think I just more had like announcements for people to look at things So it makes sense to wait till 10 30 Okay, so Justin Marina, do you want to do the metadata overhead conversation first? I mean is that less important to have people here for? It's recorded and we at least have some people here. So I I'm open to suggestions on just I know that you know, this is the only person for the The key stuff that I know others are also like participants in where I see you guys being the ones that driving this conversation So at least it's recorded up to you guys hold on. So I'm trying to figure out what else is on the agenda Here I mean, I guess like we can really quickly talk about it. Maybe the metadata Discussion, there's not a lot of Perhaps there's there's not a lot of Debate about it. I don't know that we want to go through the numbers in any massive detail, but Basically the spreadsheet we sent out shows the the overheads and other things with this And the comparison page is really the only page you need to look at if you want to get the actual kind of Birds idea of what's going on if you really want to dig into exactly how everything was computed than the other sheets Make some amount of difference and we also Look at what the sizes of different things are for a I think there's a typo here, but for a registry with a single image and a registry with 200 million images, which is I think the size of Docker Dockers registry It's the second bit And in either case the The actual overhead numbers We show there we color-coded this to try to say what we thought Like would make sense but of course just left the numbers there if you have a large Can you back up I like explain the methodology of what you're trying to do because This is the I'm just looking at this for the first time and I'm trying to follow. Oh well, we're trying to see what the what the overhead would be in Essence for going in and Actually like Producing appropriately signed metadata and things that would allow you to verify That images haven't been Excuse me that they haven't been The metadata hasn't been tampered with you don't have all data being replayed and so on So in the end what we did is we looked at we we got some numbers from Justin Cormack that were very helpful we also went and Look at sizes of things where we tried to go and look at what Like existing systems would have or use in different scenarios How much overhead that would be and then We took the proposal that that we I guess called it the last year proposal because I don't know That's perfectly accurate, but it Is I think the solution that we've seen you present and talk about the most So we named it that because I think that just made it easier it for us at least to keep track Which was which? and we compared the overheads of Of all of these in all the different scenarios to see kind of what the cost would be and We talked in more detail about how these costs were derived but basically the way we proposed to set this up and The green options are the ones we think are good The the yellow options are the ones that we think are okay And the red options are the ones that we wouldn't recommend The red option when you're saying you did that's what I'm trying to stand your Obviously a green is good red is bad and but I'm not sure what you're done differently between them So the numbers here, okay, so there's there's two things that we looked at here but the main thing that this looks at is it looks at the the actual size overhead of doing the transmissions of data we also For this I can't highlight this well for the fresh client option for tough design option to It's this is what a client that has no previous state is going to get Which is okay, but it's not great. So the reason why this is sort of yellow from You know yellow colored is from a security standpoint You're not as as well off as as you would otherwise be That's also why this column here is is read because of the security concerns that we talked about over the past like many meetings Related to not having some kind of snapshot Metadata and then we did comparisons to look at really what we're trying to do Here is to look at like what's the overhead of? going and doing You know the sort of signing and things like that and producing metadata you would need That would allow you to do the stronger security verification So in in both cases we think the overheads are small Both for a single image and large public repo And so the options that we ended up selecting here because we view these overheads as negligible We chose we would recommend the option that has the best security for For the users as a good option because something like a point zero zero two percent overhead or a point zero four percent overhead is Feels like a drop in the bucket to pay for getting You know improved security Couple of comments here one I think The clarification definitely helps it was a little bit confusing to me because when I was looking at it from a signature overhead perspective It's not clear to me why some of these options are not recommended I think I would make that a call out in the doc that says these options are not recommended for x y dv reasons And maybe in the doc. I'm just kind of looking at this really quickly But that that that kind of this definitely does help That there's something in addition to the metadata overhead that we're looking at The other question I have and this is something where I'm not familiar enough with registries But are there other? Overheads that we should also look at in terms of like the time to pull down signatures and compute them That should also be included in this overhead Yeah, we can certainly add things like that In practice, we haven't found that to be problematic. I mean even a like, you know, even the little embedded systems that people use in automobiles That you know the signature like doing a couple of signature verification isn't a big deal for an ECU and the the real expensive thing here is the Is is like, you know would be something like a private key signing Which, you know, even then you do Tens of thousands per second Doing verifications of substantially faster than that and if you're doing something like which I don't think you're doing We'll be doing anything more complicated, but but you know the the actual time overhead here is, you know, think of it like You know like like TLS or something like that it just it really gets kind of lost in that At least in practice has has always been sort of lost in the in you know in the sea of other things. Yeah, I think that makes sense. Sorry Yes I was gonna say what we usually done in the past Is just compare that to the time it would take to deploy an artifact Without a signature versus time to deploy with and that like you know, if we consider other options down the road I think the distinction here would help call out why tough might be a better solution, right? Like if the implementation from the top side just adds very little versus sort of like some other signature validation has Significantly more validation time. I think that's a good data point to have in the future as well. Yeah, we can take a look at this But in practice It's it's going to be extremely minimal and and even just the Like the you know the signatures from Like the the on the metadata from the last year proposal will already be It's like similar to what we have which is in both cases It's like similar to what we have which is in both cases is going to be like just kind of lost in the noise unless you're on a 10 gig ethernet Downloading full bore or something then maybe it it you know, it does make some very Minor percentage wise difference, but in terms of absolute time. It's it just shouldn't really matter Yeah, one of the things I'm kind of curious about like, you know When I think about signature verification like you're Recomputing the hash of the bits that you just downloaded, right? And that's trip takes some time So I'm kind of curious as to why there isn't an impact here Maybe there's something I'm missing in how the signature validation is happening. I don't have the numbers in front of me, but you're Number one like as you would download it, you'd usually compute that but even if you if you don't In terms of actual crypto operations, you can do Like Many many I think I I'll run the numbers you can do open SSL speed on this but but doing like secure hashing over data is extraordinarily fast on a modern computer. So it's just not I I Don't know. It's not something that That we've we've had Really a concern with anybody who's deployed or tried it in practice But we can we can get some numbers for you. It's just like I Mean you do all these things too when you do a download Over HTTPS so You know if You're going to see something like that slowdown, which is is imperceptible So, yeah, I don't know I mean we can we can look at it, but Like in practice what we've seen is latency in bandwidth or much bigger contributors To this now if you're in a data center and you have a huge bandwidth and you're you know You're serving things from the same rack Then you're right that that may not matter as much, but it's it's still not going to be An expensive operation in terms of absolute time I'm still trying to figure out what exactly you're comparing here I mean because the the method all it's not clear to me what methodology or even what problem you're trying to solve here Because we've done a great job saying yes, this one is red. It must be bad And this one's green it must be good and there's numbers But there's nothing really explaining what it is you're trying to accomplish if I'm taking a Image, and I'm trying to get its signature back Then I'm not sure why What you're trying to say by how much content is in a registry and how it affects that performance So the the other design document we have has like outlined some of the security problems and shortcomings with the Proposal of just retrieving a signature This notion of like something is signed therefore I trust it is is problematic And so what we've done here is this document is focused on what's the overhead that is You know that you would have if you actually provide protection That's greater than just having something that has a signature somewhere that may or may not be out of date and So you're making a leap as to that the problem you're trying to solve is a problem we need to solve Like I You're that's what I'm trying to track and that's what I was referring to earlier of The a registry has two categories of content There's content that is you know software and base images that other people depend on and they are intentionally a single version a tag that references it as a version and We do want to get updates to that And we've built stuff in Azure specifically to enable getting updates to that not not from a security perspective Just a notification that an update has happened that the digest has changed for a given tag So that's an important problem for base images, you know, like Operating systems like Linux and Windows and the various permutations of each and so forth and the run times that are sitting on top of them But when customers builds something from that They don't want an update to that thing Because then update to that thing that they're building is a specific deployment They want a secure supply chain that's not a secure spot They want a supply chain that says Something change might be the source itself that changed that I made an update and I want to push that Or the thing I depend on changed and I want an update from that so I think we have to tease out the two because the the apps that people built should not get Updated tags that there would be any update specific to that So I think we're just Isn't really the problem I Think the people that want to have what the updated tag points to should get what the updated tag points to and people that Want to have a version should get a version a specific version I think think we agree on that and I think we also agree that it would be bad if I'm if a potentially malicious actor could give somebody That said they wanted the latest version an old version that has security vulnerabilities or other things like that I think we're we're in agreement about that and so The The problem is that the design that just does the signatures with no context and no Snapshot as we as we call it in this document that that design doesn't provide that set of protections for all the reasons we talk about in the other document that we go through the The the Google doc not the spreadsheet and so what we've presented here You know we also went through and wrote up the other Google doc that walks through all the scenarios and shows how the design that has these security properties actually works in all the scenarios and Now we've gone and we've shown that it's actually efficient at least what we feel is efficient in these scenarios and so we're we're you know trying to show that the added Security you get from doing things this way Doesn't come at the cost of usability doesn't come at the cost of overhead and so on and so You know, we're we're trying to present this in as clean of a way as we can so that others can can look at this and then You know like Get the the protection that they should have for their users because the last thing that that we want is for there to be a security Incidents and to have users at substantial risk because You know, we we decided not to add a protection for whatever reason So how me with the concern is the registry is trying to be protected from being hacked To roll it back to an older version. Why wouldn't they hack this metadata store as well? So You they would hack what they would hack The one of this metadata store that you're saying has this authoritative complete view If I think one of the things you're saying you're trying to protect from is I have the Mondays build on Monday It was fine, but on Wednesday we discover it was insecure and on Friday a new version is pushed So how do we keep and we want if that tag of went to 1404 whatever Is hacked that if there's a 1405 on Friday release that somebody doesn't point it back to 1404 which is still valid, but it's it is known to be less secure than the one that was shipped on Friday if Yeah, so there's a there's a couple of ways that this happens so first of all For clients that have any prior state who have seen anything in the past Um, then what happens is is that a client has historical? Information from the last time they've seen things But what but you're assuming the client is a steady state like we're targeting a serverless environments where the their clients are Don't have any knowledge of the previous state every time every time. It's a neutral. It's a restart So so I was I preface what I was saying by saying so in the case that the clients have state Okay, then then there's this protection. Okay, so in the case that the clients do not have stayed Then there are a few means to deal with us. So presumably they have They have the root metadata or something else from that Registry that they're going to that tells them like what the correct snapshot key is Okay, so Presuming they have this then what you or what anyone as a registry operator does is once a day You securely sign a new snapshot file Okay, so basically you take the updated in design option to here You take the updated targets files over that period You generate a new Merkle tree for it and you push the resulting metadata out Okay, so this is something we have one of everything in that one repo Yeah, it's a Merkle tree of what's in the repo. Okay, and what we show here with the numbers and things is that You know, even though the absolute data is modestly large It's not actually that large in in registry terms or you know, like real terms It's it's um You know, it's um You get the data and the data clients download is small because they only need to download their path to the Merkle tree What I'm confused though is it's 200 million. Are you saying that's the entire registry or just that one repo? Like the Ubuntu repo. We can do the entire registry You can do all the public parts of the registry. You can even Intermingle private in public it scales very well, but it's not our scaling It's a matter of like each repo is itself different, right? Like Windows and Ubuntu or well, they're not but it's just Alpine and Debian are in the same registry But there's no correlation between the two Yeah, but the idea is is that you want versioning information other things like that to be updated consistently If we'll have state so it doesn't hurt you to have it all in one repo is a large part or not repo but in one Repo's not the right term for but to have all the repositories inside of the registry is I think your way of thinking about it all be all share a snapshot file Well, I'm here. Yes. That's what I'm trying to understand. Is that what you're suggesting or? Yeah, that's what design option two does It shows you can actually put so design option one shows Like what happens if you just make private registries that are all small or you segment things up some way And people do because there's different owners of each one So that's why I'm struggling because the one of the options that we keep on talking about is Putting everything together, but we haven't addressed any of the security issues where those are fundamentally different owners and teams that They're and we have depending on the registry and how they're implemented as challenges Yeah, we talk about that in the document quite a bit if there's if there's parts that are in there that aren't clear or need more Exposition we can always do more but this this is something, you know, like the way to think about it is If you imagine for a moment you have all these separate repos, which is fine Just think of it that way. Okay. They're all totally separate. Now think for a moment What if you could like link everybody's snapshot to everybody else's snapshot together? Not targets not linking other things then then that would strictly be better than having all of the views an assumption that you're making That's why I understand why you're making that leap Because the way in which you do Okay, so let's walk through the example in the document that we wrote before This in the notary B2 signature design proposal I'm trying to find it. Hold on a second Just really quickly before we move to that I think What we're essentially having is a conversation around the design itself, right? I think the metadata doc Could easily circumvent that by just calling out what makes sense from metadata perspective Because I think the the conversation we're looking more at is does this design actually work or not? And there's a lot of other considerations we're taking in there But this doc on its own from a size perspective just can call out what are the options that make sense or not, right? I think it's saying a lot more about options without really covering the content of like what those decisions are Which is called out in a different doc and I think you know just separating out what the recommendation here is Based on size versus we look at the the other doc. I think would make more sense just for keeping context Thanks. Yeah, I think here's the thing Justin like the What I what you've got me labeled as me, you know is some snapshot for no snapshot proposal All I'm saying there is there is a way to go find content using this reverse lookup So it's not excluding any metadata Conversation so That label one bad versus the other that's what I'm just trying to understand What it is you're trying to say that the concerns we've had is not that you is a Registry especially Docker hub which is meant for the world to put content on is Intentionally segmented and then you have private registries that even though they're private to a particular customer They still have multiple teams sharing content in that so how do we Account for a set of doc a set of content that needs to be secured The first is just is it signed and then you have a second level of security, which we're not pushing back on that It's not valid. It's just where what is the trade-off of it that? An update can be somehow verified So I think it's just it goes back to the scenarios. Which scenarios are we trying to account for here? Yeah The main goal of this is just to show the feasibility of adding in addition to just signatures If you add this this second level of repository Security just main idea is that it doesn't add so much extra Metadata for the client to download that it's like infeasible for them to do it. That's kind of the The main idea and then you know, you can dig into the numbers and figure out, you know exactly how much Extra is it and what does that mean? I think that's the big takeaway I'm just looking at the I got I was reading through the tough doc where I didn't get to this This other diplomat using delegations. So I hadn't finished reading that one And did does this talk about is this theoretical in how you did the measurement or did you actually perform this operation on Docker? It's it's partly theoretical partly. I generated some metadata locally to test sizes, but I didn't actually like upload things and stuff, so Yeah, I mean we'd have to get all the Signed data everywhere from Docker hub to do it for real, but we took the we took actual numbers like image sizes and things from Docker hub and looked at Like looked at actual stuff there to do the estimates which we expect to be right within a factor of You know, like maybe maybe to something like that could be slightly larger It could be slightly smaller, but it's not going to be Substantially off and the growth rate is is about right So it's I may be giving Marina not enough credit. I think her numbers are a lot more right than that, but as As like new interesting cases or things like that like emerge if there's some weird Trying to think of even what this would be but If somebody is scattering massive amounts of small OCI metadata or something like that then maybe You know, maybe that like Changes one of the terms in the spreadsheet slightly But in general we did I think of a pretty We tried to be very thorough about this so that it was a really fair comparison And it was really factually based on the information we got okay right, I mean one of the things we can look at I mean the the Prototyping that we're looking at doing will should be able to give the opportunity to be able to put this information I think that the biggest problem or the biggest concern and If you're saying that this doc talks about it, then we we can start the address it But the biggest concern is how do we as registry operators secure? Any content across different repos because by definition there should be no Team A should not have access to team B's information especially if it's not public so The shared any shared information between them is a concern from a security perspective so So let me let me just talk about that real quick because that's come up a couple of times the kind of TL DR is Already you have mechanisms that protect like the different repositories on the same system from this Like on the same registry. So you already have all kinds of access control for this. Okay You can view this snapshot as just being extra like a Metadata that happens to be the same for every repository, but nothing else none of the other files change Okay, and then there's one other property of this metadata that is important, which is that I If I give you Like your path to the root of the Merkle tree You have no idea and no way to prove that anything else is in that Merkle tree So like Basically, it's not that you can't just go like poking around and looking at things because of the way that the Do the secure basically you're given the secure hash of things And you'd have to be able to go backwards from the secure hash To be able to get any meaningful information about what anybody else is doing and the whole reason why secure has to their Secure is because you can't go backwards from the hash to find the original thing No, son. I'm not are you saying that the If I had if team b had access to team a's Secured hashes they couldn't recreate the actual content. I think that's what is that what you're saying But the question is how did team b even get access to team a's metadata in the first place? and why okay Let uh, it isn't that they get access to their metadata. They don't have their metadata What they have is when you sign something. Okay, so so think of it It's like you're doing one signature on the registry And that one signature Has a whole bunch of secure hashes listed under it And it doesn't you don't know who those hashes are for what those hashes mean or anything What you're told is is that if your hash is there Then then the thing was signed by the registry Right And so it doesn't matter What those other things are? It's they're just they're just hashes right, that's effectively what like a What like a completely flat merkle tree would look like which would be really inefficient There wouldn't be a reason to do it, but you can you can see I think you can see conceptually why the security property the privacy property you have You get it there um And in fact the inside the document There's there's a description about how even Oh, sorry. Did somebody else want to say something? Okay. Um even if you like Knew the person you were next to somehow in the tree like you were at a company and you had the previous metadata And you went and knew that this hash corresponded somehow to this party um When you generate the new thing you can just put the like the timestamp of the thing you're doing in that secure hash And it makes it so that everything moves randomly in the tree anyway Because you're you're adding an extra piece of information into every to the secure hash as you're doing And so it really doesn't It it's one of these things that sounds more complicated than it is. It's it's actually really Really simple But it's uh, it's just a way to do this and store this information so that there isn't like a Uh You know like a um a privacy leak between parties Yeah Go ahead Yeah, sorry, if it if it helps steve I was also pressing uh, justin and marina for a bit more details on how this would preserve privacy So so let me try to see if I can use different words to try to sewage your concerns What justin is saying is correct the merkle tree is it's got a whole bunch of leaves under it billions of leaves Whatever it is and and the point is unless you know what you're looking for the key in the in the in the tree You're not even going to know that it exists, right? So that's the thing you should be worried about What if I knew the key is the question Yeah, so so what if you knew the key? What if you could guess for example? Oh, I know that microsoft is working. Maybe I know the code name of this project I'm not going to try to query this key and see if it exists in the tree, right That's the larger concern here and I ran through this with them And so the way the thing that needs to be hidden so the snapshot has got all this leaves in there That's for sure. And if you knew the key you could try to guess and query the The snapshot for it and so what you need to do is to obfuscate you need to hide The the key names that's the more important thing and the way you would do this is by using existing access control mechanisms You already have for private images If you don't know if you don't have permission to to see the key you won't you won't be able to query it in the first place Now if you knew the key for example if you could somehow guess it and you could guess the you could guess the you could query the snapshot for it And the way to solve that problem is by Obfuscating your your true things. You don't you don't want to give away. You don't use the direct code name for example Maybe use something else Does that make sense? Well, what I'm maybe I'm just not hearing it right But what I'm hearing you're saying is if I've gotten this secure information That there's no way to decode what the source was Is that kind of the argument? If I give you a secure hash you can't find I mean, and you don't know what the answer is for some other reason then there's no It's infeasible computation infeasible free to find something that matches that secure hash No, I got it. Okay. So that is the proposal. So now what I'm asking is how What is it you're expecting? Two teams using the same same registry, especially if they're private don't have What you're kind of making your argument is team b even if I got team a secure metadata that They can't reverse engineer anything. So it doesn't expose anything The fact that there is even metadata that you got access to from team a is is this the security boundary problem So I get that Metadata you get you get a secure hash of something But why do you have access to anything a secure hash or anything of across two private entities? um Because if you want to link everything together In in a way that you have time timely information like um What's the way to say this if you want to have actual, um You know the ability to say that things weren't modified You have to have some notion of Like a snapshot of information on the repository You have to have some notion of Of like time moving forward. Otherwise, you're always in like, um Like this perpetual state of Um, you know, this like this baby bird imprint on whatever random thing you happen to be given Which is is bad So I think you keep on saying that but i'm not i'm still trying to follow the the use case so if If a entity is trying to pull content from both team a and team b Then I could see kind of like there's an efficiency here that I when I try to validate both a and b's content That I want to be efficient about that. Is that is that the argument? Not necessarily no So if i'm just team a Team b and team b never looks at team a What is the benefit to this disclosure of information between the two just first the security aspect? um, what you want to have is you want to have like a um You want to have like effectively like a historical record of what's occurred at different time periods And the more that you link into this historical record The the better it is because the more like the problem with having separate historical records for every party Is is that it's easier to go through and for an attacker to then replay whatever things they want out of there in in like a different way so to go to the example in the document which is I think you have this up now so Uh figure one looks at what happens when you have per image index manifest signatures here Okay, um and the example it's giving is this is an example where In this case there happens to be um the repository that contains things both from uh Foo and bar Okay I'm trying to figure out which diagram you're pointing at Figure one in the notary v2 signature design document. Oh, there's okay Right. Um so The idea here is that an attacker goes um They're going to go and they're going to break in And they get access to um You know, uh, basically they are going to be able to go and manipulate What a party that goes to this registry looks at so if you go And look here. You'll see that there's a version that's colored in red For each foo and for bar um I must be looking at the wrong one. Hold on a second. Which document are you referring to because I see I'm looking at your diplomat use delegations. Which you're talking about a different document Okay, I think I found the one that marina put in the excel spreadsheet now. Yeah, so um If you look here figure one All right, so here you go and you have um per image index manifest signatures. You basically have no um snapshot information here. So what happens is um Here you have this this repository It had At on tuesday a bad version of foo was pushed. It's not known that this was a bad version at the time, of course um Wednesday, this was maybe discovered that hey, there's some Um security issue or something with this And so now foo one point latest on wednesday Points to foo 1.2 Right Okay, um thursday similarly bar is Uh bar 1.2 is released. It has problems and then friday bar 1.3 Is released to fix that Okay, so now um skip down a little bit here And there's a table You can just look at the top. I figure two you're saying there's a There's a table. I'll come back. Oh, I see. Okay. Yeah. I don't know what page this is, but okay Yeah, so and then at the top here, um, if an attacker goes and uh compromises the um the registry Then the question is is that what damage? um, can they do To a specific client like what metadata can they give to the client to make them think a certain version is Like is the latest version this is for a client that's trying to retrieve foo one point latest or bar one point latest So because the registry gets to pick what foo or bar points to Then if they're just retrieving the per image information then the registry gets to go and just basically um Uh like pick whatever vulnerable version they want to to have be installed and the client because it doesn't have any notion of what versions like bar or foo or like, you know, what history of any of these tags are or How they happened or what's going on has no way to protect themselves in that case um So now if we go back Well, first of all, is that clear? I The client it's a new client every time. So the client just simply was told I need one uh foo one Well in in this case, um, once again the client is going to get some metadata Now this as I said could be loaded onto the client like the client somehow gets the root metadata or whatever else That's not a feasible thing in any kind of ephemeral environment that every node every compute that's given to it Is this serverless environment that it has no knowledge of what customer it's being used for What registry it might be pulling from so it is as vanilla as a possibly can be Right, but it at least has information. It has no information about any registry it might pull to Correct. It does today because it has to know at least like I might want to go like here's the ca bundle for docker You know that that is going to let me establish trust and first use with docker hub or whatever it what I think we're mixing a couple of scenarios and yes, I just I just noticed the time and I But the scenario you have to account for is that uh A serverless environment, right? There's just the azure aws google whatever we've got vms that are sitting around and and compute instances That were just ready to give out to any one customer at any one time Majority of customers don't actually pull their content that they're deploying from docker hub They pull it from their private registry and as we give that vm to You know any one of the hundreds of thousands to millions of customers that we have We have no idea what registry they're going to pull from so that compute is instance to them in No knowledge around which registry it's going to pull from Um First use they use the x509 certificate Or what do they do for how do they get their Like the keys that they can say it's valid Yeah There is a bundling process that happens prior to the environment bootstrapping at least we need to do that so, um There is only a valid set of hosts that you will be able to pull from Not any host on the internet unless you have some kind of bundling or or Exclusion or inclusion parts that have been set up from the ca as well Yeah, not to mention that sorry I was just going to say that this bundling process is where you Effectively put this information in you put the root file just like You know where you get your stuff from you pick it in there Yeah, so I can see you have to give it the you know the the current thinking is that you would obviously give it the client keys, you know the the public keys that says these are the ones that I trust and um It then was pulled so what is your proposal that it's somehow in addition to the client keys It gives it the public keys rather it gives it some metadata as well Yeah, so um, basically if you're able to give the keys what tough uh root metadata is is it's basically just keys It's keys with a little bit of information about what those keys do So you give it those keys and you give it a snapshot file and you're off of the races Yeah, and in practice Go ahead go ahead Trishank And in practice, you probably want to add a caching policy anyway You don't want to keep pulling the same thing over and over again So this is not a this is not a biggest concern I think like adding a caching layer where you can keep the previous snapshot that you saw the merciless We I mean There is also another approach to address this in terms of like if you manage revocations for Artifacts that you no longer trust Is that also a design option? We've looked at Well tough tends to handle that for you When you generate targets metadata if you no longer want to trust an item What you do is you just remove it from your targets metadata and then it's no longer signed and available When once you upload the new version so like kind of this Deletion of trust is also a big problem although not not one that we Called out really specifically with having like detached signatures like a separate Right wouldn't that be a better solution because not only do you want someone that's getting foo one dot latest not to get foo one dot one But someone that's also directly trying to get foo one dot one to know that that signature itself is also about it Yeah, if you you can do that In fact in the example here Imagine that you want foo 1.1 to no longer be addressable even as foo 1.1 right Then on Wednesday or Thursday whenever you realize that you just remove that entry from the file as well In in figure two and it's gone If it's in figure one then the malicious registry can still just re-add that File or or just keep it around and you don't have any way to actually Like invalidated in a in a good way Um, so the the thing with figure two is that as long as you've seen a snapshot From after the change was made. Sorry. Sorry. I you know, I can go through this I don't have to go through this now and I I do realize that yeah, it's like you had something you wanted to mention too And we've kind of co-opted this whole meeting Um, do we want to spend an hour going to this? Stock plan this weekend Yeah, I think that the and this might so uh, let me I'll say this and let's figure out what we want to do I think part of what we're doing here is we're saying there's this Entity that there's almost like there's two parties. It's the two sub key thing That both have to be done at the same time to agree and part of the And in fact the original notary design actually had a separate store as well. Maybe that's why this was But if you take An environment that says that has to be clean every time because we don't know who it is But you have to put something on it so that it knows what to pull The thought is is that and I don't know the details yet because that's what i'm looking for Yes, and the other key folks to help with is that client pulls the client keys from some other entity Not from the registry some secure key management store And then it has the ability to pull from the registry because it says, okay, I have these keys It sounds like there's Unless the metadata is also stored in a separate entity that is separately trusted Then if I if that client then pulls from the registry at that point, it's not clear to me Why whatever got hacked to push it back to a previous The one one tag instead of one two how that's any Basically, it's going to the hacker is going to hack that as well So there's almost like those two two phase commit thing that we're trying to achieve And where does that second piece of information come from? Yeah, if you're able to push keys you're able to like you're able to push top Root metadata or snapshot metadata It's like the snapshot like the thing you need for snapshot and design option too is is just a It's a What would it be a 32 by value? You know, I think it's the the size or anything. It's just where does it come from that it's there's a time There's a an assumption around what's around for how long and when where does that information come from? I think that's the one other conversation. We can walk you through all this. It's not a problem We can walk anybody who's interested through this. It's totally fine Um, yeah, and if we want to do this sometime later this week, that's great I know other people probably have stuff coming up in a moment too. Is there stuff that we and I actually have to drop in a moment I just realized I do actually have a hard to stop um but yeah, I Apologize I feel like I've talked an awful lot during this meeting Is there anything else we want to cover? Yes, you want to do your quick of what you had proposed? I saw your PR. I gave you some comments on it I was there some more that you wanted to talk about Uh, yeah, I can address those. So I what I put in is questions that I expect that we'll get uh youth cases to kind of clarify like what how these questions should be and so the Uh, the guidance the feedback that you have should be addressed after the next meeting We have where we go through the different use cases and see what we need to answer there I did want to say like, uh, I'm not sure what time zones everyone is I went with sort of like in early morning availability. I had because I figured that would be easier for east coast and for people dialing in from europe But if those slots that I have put in don't work for anyone. Uh, just message me on slack and I'll update it Did you post something on stock for when you uh, I put I put it in the meeting agenda There's a doodle link there to pick meeting times So once I get feedback in from everyone, I'll go ahead and schedule some time Okay, maybe it was just me, but I don't I didn't realize it was Yeah, I think it's a conversation Yeah, if you could post it to slack, I think they'll be very helpful too Uh, I'll go ahead and I'll paste it into slack right now. Thank you Oh, the doodle link was in the agenda. I got you. Yeah, just doing both would help people I think people look at the agenda for what's currently got been Conversation thread and slack would be helpful for everybody all right, uh So that's we're at the hour. Um, I know it's there's a lot of stuff there But I think we are getting a little at least I'm trying to understand a little bit better of what we're trying to accomplish I don't know if the new environment was new information that helped understand where some of the concerns are coming from in addition to the cross repo thing so We'll keep on iterating. I've started putting out a scope for I didn't put it out really yet in breadth is uh, how to A framework for doing some prototyping so we can flush out some of these things Um, I got some of it done last week. I'll be working on it this week I'll get it out before the next meeting so people can take a look at it and That hopefully will give us the framework to start Experimenting with these things um and flushing out the details So with that encourage take a look at neos schedule for whatever he's doing around key management that I know we need And I'll you know as I'll forward it to our internal key folks as well So they know that some specific content on that topic is coming up and We'll keep the conversation going for the week and we'll meet next week It is an hour now every week. I did update that Thanks, folks


What does Pagaya call the component which is in both Seastones and the clouds of Sky Island? Alfred, yeah. How did my fun pirate quiz turn into a chemistry exam? Hello and welcome to the ground line review source for everything One Piece. My name is Liam and my favorite branch of science is of course biology, but that's mostly because my high school teacher was pretty hot. But today we are here because I have been challenged. Apparently there is a quiz on the internet that claims to be one of the most difficult One Piece trivia based events possible. And I have to say when it comes to One Piece quizzes that call themselves difficult, I'm usually very disappointed because the first question is always something like, question number one, who gave Monkey D. Luffy his straw hat? Was it A, shanks, B, whoopslap, or C, Luffy doesn't have a hat, silly. You know that sort of stuff that probably even non-One Piece fans have a decent chance of answering at almost 100% accuracy. But I've been told that this one is quite different. And I've also been told that I'm probably going to fail quite spectacularly. So that should be fun. For some reference, it's called One Piece Hardcore Quiz. Very generic but very promising and there's a link to it in the description if you'd like to take it for yourself and then watch me flail around and fail around struggling to answer questions. But since we're already doing a quiz for this year video, I say we go ahead and let fate take the wheel. The very first question that pops up is going to be our subscribe game. So basically you're all going to answer it with me and if you are incorrect, then your punishment will be to subscribe to the Grand Line Review. Thus resulting in consistent injections of One Piece culture administered straight into your YouTube feed. All right, let's do it then. Show me what you got, quiz. What are the oven baked noodles in alabaster called? Meezu Meezu, Moodles, Conifer or Terracotta Special. Holy crap, so it's going to be that kind of quiz, is it? Anyway, I think I know, but before I show my working, let's take this opportunity to have you all choose a delightful answer. Which of the four is it? And if you choose incorrectly, then you're going to do the subscribe thing. No arguments, you're going to do it. But I think what this is referring to is when we meet Ace on alabaster and these noodles are what he's eating in the restaurant and then proceeds to fall asleep into maybe. And I'm probably going to pick C because Meezu Meezu is, I think obviously incorrect. Terracotta Special sounds a bit too French for alabaster and Moodle, whilst hilarious is definitely wrong. So by process of elimination, I think it is C. And bam, it certainly was. So if you guessed incorrectly, then you know things to do and please do say hi in the comments below if you are a new member of the Grand Fleet. Welcome. So we're off to a good start. Now, question number the second. Did Sir Crocodile wear three rings on his one hand? Yes or no? I actually think it might be more than three. If I remember correctly, Crocodile's hand is pretty bling down to maybe a, I'm just, I'm going to go for no. Aha, success. Question three, who said everything humans can imagine is possible in reality? Willie Gallon, Joe Wall, Louis Arnaut. So I know what this is referring to, but with that said, not entirely sure what the answer is. This is a really weird moment in one piece where we quote a fictional in-world scientist and the straw hats actually encounter a ship that falls from the sky. And what makes this a little bit harder is that I'm pretty sure this fictional character isn't actually named in the anime. It's just like a manga thing. But I think I'm going to go with Willie Gallon because I have this ridiculous vague memory that may or may not be headcanon. It's like that moment in Jidutsu Kaisen where a new memory just gets inserted into Toto. That might be what's happening here. But I have this vague memory of thinking, huh, that name sounds like Galleon, which is, you know, the huge ship that fell from the sky. And that's just how my brain seems to want to interpret things right now. All right, give me the Willie. Yeah. All right, question four, what was the name of the pod where Buggy had his base the first time he appeared? Is it Drinker's Pub? Meshie or Sake's Club? I have no idea, to be honest with you. I didn't even have a recollection of them drinking in a pub. I just remember them screwing around in like generic area of Orange Town. I think I'm gonna have to use Nudalogic here. Sake's Club sounds not right, considering I don't think they were drinking sake. Drinker's Pub sounds utterly absurd. So in theory, it has to be Meshie. Like at least that sounds like a thing that exists. It's reasonable, so we're gonna go with that. It was Drinker's Pub? Really? Sure, sure, why not? Question five, how many boxing gloves did Gorilla Puncher 13 have? Oh my God, 30, 25, 20, 13 or 10. All right, so the thing about this question to keep in mind is it's definitely gonna be something dumb because this is Foxy we're talking about. It's definitely not 13 and it's probably not 10. So I think I'm gonna go with 30 because it feels nice and round. I guess sounds a bit like 13, I suppose. Yeah, whatever, let's do it. Of course it was 25, of course it was 25. 30 is far too reasonable. It sounds too much like 13 and Foxy would never be that semi-logical. So yeah, that one's on me. 25 was the most unreasonable answer and it's the one I should have gone for. How many stones did Smoker play with the first time he appeared? Four, six, seven or nine. Well, it's since definitely guessing time. And of course I'm wrong. Seriously though, I had to go and look this up afterwards because I did not remember it and yes, he is clearly stacking seven stones in chapter 98 for whatever reason. In my defense though, Smoker actually first appears in chapter 97 and there are no stones to be seen. So you know what? I'm gonna be using that as an excuse for why I suck. Was Sanji working before he met with Zeph on the orbit? Yes or no? 100% yes. He was in fact working on the orbit I believe so that's a really easy question. What does Pagaya call the component which is in both Seastones and the clouds of Sky Island? Pogonin, Pyroloin, Pyramethium or Oligotin. So I actually used to know this emphasis on the past tense of the word used but it's definitely one of the P words. So my mind wants to say none of these it wants to say pyroglobin and I don't know, is that a real thing? I just know that this question has come up in some sort of one beast trivia before and so I'm going to go with the word that sounds most like pyroglobin which is pyroloin and you know what? Yeah, great, success, good enough. And not only that, I did just look this up afterwards and it's actually pyroloin so my weird pyroglobin tangent well it's kind of relevant. I'm guessing it was just misspelled by our cruel quiz master here. Question nine, are the numbers 200, 399 for the soldier zombies? Yes or no? Man, look, as someone who actively tries not to pay too much attention to Gekka Moria or anything related to him, I have to say, I forget. But we've got a 50-50 chance here so you know, that's a pretty good so we're gonna flip the coin and we are going to go with yes. It was not yes. All right, so I look this up as well and in case you're wondering the numbers 200, 399 designate the surprise zombies, not the soldier zombies. Soldiers of 499, not that either surprise or soldier zombies were relevant, ever. Question 10, where was the great Taftemple completed in the year 306 in the Age of Heaven? Was it Rainbase, Arbana, which I'm assuming is Alibana, Eru Malu, or Nanohana? Okay, we can work this out. So if I remember right, this is all part of the potential pure gibberish that Robin was spouting on the poneglyph instead of telling Crocodile what the ancient weapon was. But we can do this by elimination. Mostly because I don't remember there being a temple in Rainbase. There was a wonderful casino called Raindinners. There also wasn't one in Nanohana or Arbana. Like the big special thing about Alibana is the palace and the tomb, neither of which are temples, I hope, which basically leaves us with one option being Eru Malu, so let's see what we got. And it turns out what we got is delicious, correctness. Are the sea snakes which carry the ship above a Hancock called Yuda? Yes or no? This might be a tricky question because if I remember this right, Hancock ship is called like the perfume Yuda, but I don't know if that's about the snake specifically, but I think I'm gonna have to say yes because I will kick myself if it is correct and I did even remember the word Yuda, so whatever, we're doing that. And few. Who labeled Mockdown the city of ridicule? Willie Gallan, Joe Wall or Lewis Sarnott? Well, it's these guys again, except in this case I have no memory of this whatsoever. Who is Joe Wall and Lewis Sarnott? I mean, I'm guessing it's one of the latter two because Willie Gallan is definitely not quoted twice in the series, I know that much, that random scientist thing, it was a one-off thing, which is why it's so weird and sticks out, so we're just gonna go down the list because honestly, I'm not sure. Next up, it's Joe Wall's turn, so let's do it. Aha, this time 50-50 pays off, but I definitely need to look this guy up. And after some digging, I found this reference. It's in chapter 222 during Jai, which quotes and I quote this quote, log of the Jew Wall, which quite frankly makes him sound more like the wailing wall in Jerusalem, but it's such a weird translation, so is it not actually a person because surely that would be the log of Jew Wall, not log of the Jew Wall. In any case, it looks like Odo was clearly in a bit of a phase during Jair and Skype here, making up all sorts of famous quotes from world figures that we'd never hear from again. Really does make me wonder if Lewis Sarnott is going to show up in a third question because I have no memory of that name either, but he probably exists. Question 13, which two crew members have worn Luffy's hat besides himself? Robin Chopper, Anami Zoro, Sanji Zoro, Usopp Nami, it's that one. Or Chopper and Usopp. That's an uncharacteristically easy question. Usopp Nami, bam, next. 14, is the code for the lock on the fridge? Brackets on the thousand sunny, close brackets. I'm glad that was clarified actually, because we could be talking about any fridge, but is that code 7326, yes or no? I only vaguely remember something about this. Like if the question was, is there a lock on the fridge? Brackets on the thousand sunny? Then I would say yes. But I don't know if this is the actual code.  I could definitely remember a code. So we've got to go with yes, right?  Yes, yeah, yeah, we're gonna, yeah, good, good. You better be right. 15, which of these names could be seen on one of the gravestones at Whiskey Peak? Is it Mr. 14, Ms. Danger, Mr. Sacrifice, or Ms. Not Coming Back? Oh man, I'm not sure. I know it's not either of the first dukes. It was something funny. So with that in mind, I think I'm gonna have to go with Ms. Not Coming Back because I personally find that quite hilarious and oh, what? It was Mr. Sacrifice, really? Ms. Opportunity. And of course, I just looked it up and here is the grave of Mr. Sacrifice in all of his deceased glory. Although apparently in the anime, you can see even more names, which is staff members' names spelled backwards. That's pretty fun, I guess. 16, according to Dory and Brogy, how many fights have they had? Numbers, 50,002, 86,550, 21,684, or 73,406. No idea. I mean, they've been fighting for a century so we can probably use a special technique to work this out. I mean, what's it called? Mathematics? What is that like two, maybe three fights a day, depending on how the volcano is feeling at the time? So it's either 86 or 73. I mean, no, it's not a good, it could also obviously be 50, but I see big numbers and I want to click them. Gotta temper myself a bit though, so we're good to go. I think I'm gonna have to wait a little bit more to see if I can get the numbers right. Gotta temper myself a bit though, so we're gonna go for 73 and yeah. Oh, I can't believe I just stumbled my way into correctness there. That was definitely an unearned victory. I should hang my head in shame. Question 17, what is the money in Skypeer called? Berry, X-Toll, Sky-Duller, or Rubens? And it is X-Toll, easy, easy. I know this one because I made a video about the economics of One Piece and fun fact, Skypeer is one of the few nations in the world that do not use berries. Others include the Goa Kingdom and Wano, which I believe use gore and gold respectively. Because that's right, I am well-versed in fictional economics. Question 18, who named Little Garden? Was it Willie Gallon, Jew Wall or Joe Wall? It says Joe here, but it says Jew elsewhere. Or Lewis or not? I wonder which one it could be? Not gonna lie, I'm feeling pretty good about the answer to this one. So Lewis, it's probably your time to shine and bam, yay. All right, let's look you up because I don't remember you either. Okay, so this guy was responsible for writing something I don't remember in the series, a book called Brag Men, which was a collection of stories from the Grand Line. It's mentioned by Nami in chapter 115 because apparently they had a copy of this book about the going Mary. And one of those stories details Little Garden. 19, who gave the name Norala to the Skypean snake? So first of all, trick question, no one gave the name Norala to anything. It's definitely Norala. But for the purposes of playing along, is it Norland, Kargara, set or wiper? Okay, so actually as much as I'm making fun of the spelling of names here, this is gonna be a bit embarrassing because okay, so it's definitely not wiper because he wasn't alive.  It wasn't Norland because he was not that self-obsessed. He is the awkward part. I don't remember who set is, so I've gotta go with Kargara who according to this is Kargara. So let's see where that path takes us and I'm wrong as per usual. It was set and looking this guy up, his name is actually Seto, but I would not have remembered him anymore. 20, what was the name of the mushroom that Chopper gave Dr. Hiraluk? Wadaidake, Amiyodake, Fugovugo, or Poidake?  Is it a Poirworm? Hercules bug, Janiworm, or Kestia bug. All right, we can use logic here. Like not noodle logic, we can use actual logic. I don't know the exact answer off the top of my head but I am almost 100% certain that it was not a worm. And I also feel pretty good about it not being a Hercules bug because that doesn't sound particularly worrisome or poisonous in any way. Not that I know anything about like Hercules beetles or anything, but I don't think they're that deadly to me. So once again, by the process of elimination, I guess we are going with Kestia, doing it, and ha, zah, I did it. Where is Dr. Hiraluk originally from? Drum, mm, mm, mm, two M's. West blue, New World Island, what is it? What even is that? Sakura or Villa? Okay, so this is actually kind of a tricky question. I mean, first of all, there are only two reasonable answers, New World Island, Sakura and Villa. You're all being eliminated immediately because what even are they? What is Villa? But here's the thing, I'm pretty sure the answer is drum. However, is that too obvious because Hiraluk does also have a connection to East blue. However, I want to say that that's where he saw the Sakura that inspired him and then he returned to drum. Like Hiraluk left drum, traveled the world, saw a pretty tree, then came back to drum. It's gotta be drum, drum, drum, drum, and yeah, it's drunk. 23, how many rings are behind Bellamy's figurehead? What? I, oh, two, three, four, or five. So Bellamy's figurehead, like what are we even talking about, are we talking about the figurehead of his ship or is this referring to his Jolly Roger? I will say that in either case, it doesn't matter because I don't remember his ship or his Jolly Roger, so we're just guessing again. And I like the number three, it's nice and round in a very odd way, so we're gonna go with that. And no, it was not three, it was four. Of course, it was four because. Yeah, so it was referring to Bellamy's ship which is called the new witch's tongue which is such a cool ship name and you can clearly see four rings floating magically around the figurehead here. It's a really cool ship actually, which makes my final result 70 out of 100, apparently. So 16 questions, right? Seven questions wrong, which I don't think is too bad although it does notably say on the results that I have failed. So I have failed despite the fact that I have a certificate of achievement and I feel like this is kind of like walking up to the person who comes last in the race and deciding to immortalize their failure forever with a grand truth. Anyway, that was pretty fun. The quiz actually destroyed me with all of its weird details and if you'd like to have some more fun then do check out this video detailing Oda's one weird trick that holds the entirety of one piece together. Pretty massive stuff, so I look forward to seeing you there.


We used to date. I feel like this is his pet name for his junk. I really feel like that's Bill Dancers pet name for his junk. And he just put it on his product. Oh my gosh. I'm right by that bluegill. No, yes. Yes. I got it. I got it. I got it. It's a brim. You lost the brim. You lost. Well, one to one now on the challenges. Yo, what's popping people? Welcome back to another video. If you guys are new to the channel, please hit that subscribe button. Hit the notification bell and also hit the like button if you've been enjoying the content. Today, we got an interesting one. Got big Steve. Hashtag bring dad back. You know what's up. So we got big Steve out today. What is your idea for today's video? Like what do you we're kind of rolling with it? We're about it. We're outside of Walmart actually. So if you had any ideas, what do you think would be the juice today? Yes, we're going to go in here and see if we can find something that's creepy crawly and living. We're going to throw something on a barber today. Old school.  They were a lot of fun and it's been a while since we filmed one. So I was like, you know what? Maybe we should do that today. But we don't know exactly what they're going to have inside of Walmart. I don't know if they're going to have like the glow worms or the regular night crawlers, maybe some crickets. They have a bunch of different stuff. You guys are wondering why I'm using this too. It's like a little microphone. What do you think about that? Speaking to the mic. You know what I'm saying? Look at this. Got the adub merch on. Got the adub merch on. What's up? Got the big bass energy merch on. I expect a like and a share. You hear me? What's up? Yeah, bring it on. So anyways, wait, another thing. What do you want to say to the YouTube? Guys, go check out my new YouTube channel. I'm going to put the link in the comments below. You know what I'm saying? So yeah, go subscribe to his new YouTube channel. He's starting to vlog and make videos. As you guys can tell, he's got his little GoPro right there. So yeah, go down below, subscribe to his YouTube. Show some love. But anyways, we're going to go ahead and get inside of Walmart. See what they got. Go ahead and get everything that we need for today. Go back to the lake. Catch some fish. It's going to be a good time. Let's get it. Walmart time. I have yet to really go film any like Walmart and Academy videos or like Dick's Sporting Goods or like Bass Pro.  So I think they'll demonetize me, but you guys know what I'm talking about. I haven't really been going in the stores much, but should we go in here like this? Just like that. There you go. He's got the style right there. Ado's merch is all special for it. Yeah, this is going to be fun. We're going to see what we got. There's actually a ton of people out today. There's a lot of people outside. It's actually a beautiful day outside too. It's not too cold or not too, too cold. It's not too hot. It feels perfect. This door is closed. Please use our grocery entrance and exit. Why are we parked down here then? Uh, yeah, I don't know. Losers. Anything else you want to say to the camera since you haven't like been on the vlogging while? Yeah. Hashtag bring daddy back. Daddy been there, you know what I'm saying? You guys got to pop in these comments. You got to share the old man's love. So the boy will come home and take me fishing because I haven't been fishing in like three months. I don't even know if I could spell fishing anymore. So there's a lot of people watching right now that don't even know like, they probably haven't even seen you in the videos. Anything you want to say to them? Well, first crawl out from underneath your rock and check out big Steve. You ain't seen me in the videos. You just aren't living yet. You know what I'm saying? So I just love it. My son told me he takes me fishing. I just try to have some fun. I know I'll come off a little crazy, but I'm just out here having a good time. Yeah. All right. So we just made it inside the fiction. We just made it inside the fishing. Lemon and pepper. Yeah, that's lemon and pepper, man. Yeah, that's lemon and pepper. You guys already know the old juicy lemon and pepper brings back the days and it catches the fish. So there's one thing I noticed when we walked in here. I haven't been in this Walmart in a while and they totally changed it around over there where they got all the ammo and everything. And then they have this fishing. Oh, they have changed. Yeah, they changed it completely, dude. Completely. So they got the baseball cleats right next to fish and stuff. You know what I'm saying? Just in case you got to fish and run. Look at this, dude. I kind of like that reel. Looks pretty clean. It's the white and the green. Xfinity. Parrot stick? No. You want to make a parrot stick with it? No. That's a Berkeley rod. We got all the baits down here, but I don't know if we're going to be doing, you know, like I said, we need to find the live bait. That's the biggest thing, but there's a lot sold out. That's one thing during this whole, I guess you could say break that everybody's having right now. Everybody's fishing. There's a lot of people getting in the fishing, which is awesome to see because since the beginning, that's been my whole goal is to get more people in the fishing. So to see that people are out and getting fishing stuff and going fishing, when we were actually pulling up, we saw somebody walking out with a fishing rod too. Yeah, two young boys taking two rods out of here. I love it. Dad was with them. Dad taking fishing. You don't know what's going to happen if you ever take some boy fishing, do you know? Might turn into a disease. So we got some hooks. I think we need to look at this, but let's wait until we find the live bait. If we can find live bait, we're going to have to definitely come back and get some bobbers and some hooks because being bass fishermen that we used to bait, we don't have a lot of that kind of stuff around. So it could be down here. My camera keeps getting blurry for some reason. Please be it. Yep. Oh my God. What are these, dude? Look at this. I'll let you do the deed. These are the normal ones that they usually have and then they have those like red wigglers. These are the night girlers. Let's go ahead and pop one of these open.  Stick your finger in it, man. Why are you telling me to stick my finger in it? You stick your finger in it. Okay. There's just some pretty... There's something I can talk to you about. It's awesome. Some pretty big nasty worms. But then they have these. I've never seen these before in Walmart. What are these called? Dance and Rascals? The Dancing Rascals. Look at this. It's supposed to be Bill Dance's worm. Oh, I thought they were naming this after me, the Dancing Rascals. Yo, another thing. Bill Dance, I'm calling you out. You better respond to my Instagram DM. I sent Bill Dance a DM last week. You sent Bill Dance a DM? Yeah. Now you're going to fish with Bill Dance? Big rat worms? Yep. I feel like this is his pet name for his junk. I really feel like that's Bill Dance's pet name for his junk and he just put it on his product. It's a Dancing Rascal. I'm sure when he goes home at night, he talks to his wife. He's like, you ready for the Dancing Rascals? Uh-oh, those are some Dancing Rascals in there. Oh, yeah. That's what you call a Dancing Rascal. So what do you think? Are you thinking the Dancing Rascals? I feel like it wouldn't be a video without the Dancing Rascals. All right. What is that? Oh, those are the... Oh, they have the glow worms too. Remember we filmed the green glow worms before? But this one, fat, juicy red worms. The green glow worms? Yeah, and then purple, but I've never seen the purple.  I've never seen the purple before. I always see the green and then they have like the red ones. Like the red ones are just like normal worms at the end of the day. And these don't have to be refrigerated either. Remember when we filmed that? So what are you thinking? We're filming each other from each other. I'm thinking... Let's try the Bill Dance because we never used them. That's what I'm saying. I'm thinking these because we've never used them before. Have you guys ever used these two? If you try these out, I've never seen them before. Leave a comment down below. Like I said, it's been a minutes since I filmed a live beef video. So I don't know. Well, let's try these. Here's what I think we should do. We'll take these home. We'll get some bobbers. We'll go fishing with them. And at the end of the night, if we still have some leftover, I'm going to ask your mom to play with my big red worm. You see what I'm saying? You know what I could always do is if we had leftovers, I'd throw them in my garden because they keep my garden good. All right. That can be another part of the vlog. Let's do that. So we'll get two. We'll get two. That's 60. 60 big red dancing rascals. What are those things? I need some bottles on the camp. What kind of bobbers are we going to get? I'm thinking... All right. So we got options. Probably... I'm going to put my camera up here. Your camera is going to watch our camera. Do our camera go after your camera. Don't forget that. That's the last thing you want to do. Somebody had free dope out. I don't know. I was thinking just... There's some dipping. What do you think about that? It's just like the basic... The basic phone bobber. But they got the plastic red bobbers. Are we going to catch a bass? Are we going to catch a bluegip? Both. Everything. Everything that bites us. That's the glory of it. That's the glory of it. More than these? Yeah. No, no, no, no. We just need three. Three? Three is fine. You want to get... $3.16. You want to drive back here? Yeah, I'd rather pay a dollar and not have to drive. Now we need hooks. What kind of hooks are you going to hook with a wine? This one says for crickets here, I guess. It's called a cricket. So this is what I was telling Big Steve. So we got these bobbers. We got two packs open. This is the thing. We can go... There's a bunch of different options for hooks right now. We're fishing for everything. We're not just fishing for bass. We're going to fish for bluegill, whatever. This is the thing. We can go with like a standard, like smaller hook up there. But I'd rather go with these right here. As you guys can tell, you see how long they are?  It'll be this, Mr. Fisherman. Yeah. Why are these hooks this steel color? And all these hooks you keep talking about for pan fishing stuff are gold. Dude, that's over. I want to be honest with you. That's over my head. That's a question for the viewers. Pop comment below. Like why are these gold? Why are these gold and why are those brown? Maybe the pan fish like the bling bling. We got bobbers. We got that. Do we need any little clip on weights? Yeah, we do. I think we got a problem with the split shots, dude. Look at this. Their weights are all gone. So that's not good. Do you have any split shots at the house? Hail to the no, no, no. So tell me what we got, Noah. All right. So I got a secret with me. I'm not showing you guys yet. It's a fishing rod, but I'm not sure yet. I can't show you guys what I got. It is the quality. Two of the packs of worms and I double bagged this too. Just in case the last thing we wanted was these worms swimming around the truck. And then we got the bobbers and everything in here. They did not have split shots, by the way. So now we're going to have to figure something out. We got some swivels that might add a little bit of weight. I don't know if that's going to work. We're going to go to the house. Can they see what I bought? I'm holding it higher than that. All right. Come on, man. I'm a professional. We're going to go to the house and we're going to see if we have one some weights and two if we can at least rig something up that might work better. But now we're just going to go to the car, tag everything up, go back home, go out to the pond, rig everything up, try to catch fish. Let's go ahead and get it.  I'm tying a leader on to my braid with flow of carbon. What kind of notch are you tying? You need a uni? That's all I know, man. You need a uni for everything. You know what you're doing, man? No, you want to do it for me? You want to? Oh, I can't see so well anymore. You want me to? I can do it on video. I don't even know if I've... Or you can do it. Oh, you need a uni, guys. That's a deal right there. This might be your best chance of beating me with my knot break. You might not be able to land the fish. Might work to your advantage over here, Noah. There you go. You cut the tag in, you're good. Cut the tag in. Surprise you remember how to do that knot, man. I know it's been so long since my son took me fishing. So, Dad, we had a problem with the split shot weight. So this is his idea, by the way. This ain't mine. I don't know if it's a good idea. But look what he's trying to do. So there's no split shot weights. So we got some of these barrel swivels and he's going to put a... I just feel like it's not heavy enough, right? I don't know. I mean, it could help. I just don't know if it's going to help that much. It's going to work, so I'm paying attention. This is the Daddy Van Dam tips. Yeah. We should make a segment. We should make like a graphic. This is a Van Dam don't even know about it. We should make a graphic for the videos where it's like Daddy Van Dam tips and it's like a logo thing. Tips and tricks. Daddy Van Dam tips and tricks. So let me show you what I did. All I did was run the line through the swivel on both ends and then just tie it on this one end so the swivel stays on there. Dude, that's got some weight to it. What a genius. Then I'm just going to put my hook right here.  Then you're going to put the bobber like probably what? I don't know. It depends on if we're fishing up shallow or out deep. So if we're fishing with a brim or bass. Both? Oh, I think you should have to call your shot like pool, but... I don't know. I guess we'll see when we get there. Call it. Catfish. Catfish. I don't even know this catfish in that little. There's got to be catfish. I don't think they'll eat a night crawler though. Catfish always eat anything, man. So you guys know I bought her out in Walmart and I've had one of these before, but this is the old Zebco 33. It's just basic as it gets. This is the 33 authentic. It's the one that we had before. I went ahead and bought another one. I think it was like 20 bucks. The one I had before is just old and I just was like, man, might as well get a new one, especially for this video. If we're going to be filming some more little live big videos like this, I was like, let's go ahead and buy a brand new Zebco 33. We're all good. So what I'm going to do, I'm actually going to keep this line on here. I don't think there's any need to put any other line, but I'm going to put it through the eyelids. I'm going to go ahead and rig everything up. We didn't have any split shots, did we? You didn't have to refine any? Nope. That's fine, bro. I might end up doing the barrel swivel kind of how he did too, just to add a little bit of weight. Then we'll put a bobber on and then some of those hooks as well. So that's what we're going to do really quick and then we're going to go right down. All right guys, so we got the bobber.  My dad's over here with his combo. He just has like a little basic spinning combo. Now look at this. Look at how many brim beds and how many brim are over here. That is insane. I don't know if you guys can... You know what would be cool? Actually, let's try this. That's how I sent you a picture through. Look at all the brim right there, son. My sunglasses are a little dirty, but they can kind of see it. That is insane how many beds are right there. We literally didn't even need bobbers if we were going to try to catch some of these. Zoom in with that camera. Look how many brim are sitting in these beds right there. Yeah, they're just swimming around everywhere. Look at this baby bass patrol and the outside edge right there. Oh yeah, that is a bass. Huh, I guess we just got to get started. So I guess we just put some worms on and start smashing. I mean, this is kind of unfair. Yeah, I know. I was about to say this is just insane. So are we going to run some sort of challenge or are you just thinking just catch them? I don't know. The last time I ran a challenge with you, I ended up running a tattoo. So I'm not so sure about doing the challenge. Let's just try to catch them. All right. Let me get back in the rhythm of fishing before I challenge you. So tell them what about the little combo that you're using? This is just an old combo we had laying around. That's a Akuma reel and a Aurora Abu Garcia. Look, this is just garage stuff. I don't want to say just garage stuff I had laying around. So we rigged it up with a little hook, swivel on here for a little weight, which I see that we don't need now.  All right, guys. So it's time to get the dancing rascals. About my boy Bill dance and give them a try. This is actually going to be interesting. There's so many fish out there. There's a mixture of bass and bluegill all up on those beds. We got these awesome worms right here. Look how active they are. It's actually pretty active. Look at that worms looking awesome. We're going to go ahead and dig one of these up. Did you take your bobber off? I took my bobber off because I don't know if I feel the need for a bobber right now. You're going to have that worm? Yeah, I don't think. What are these things called? They're called dancing rascals. What did you just do, you nasty boy?  Dude, there's seriously zero need for this bobber. I'm taking my bobber off, at least for right now. And then if we start casting out in the middle for the bass, thinking, yeah, that's a big worm. We're just going to take a little piece of this. You got one already? Oh my God. That was ridiculous. Look how big that thing is, too. Oh my God. All right, guys, one thing that some of you guys don't know, I think a lot of you guys do, but my dad is actually allergic to fish. We talk about this every single time, but there's always new viewers watching. He actually cannot touch the fish. Like if the slime guts get, we need to sit down and make a video about that. We keep saying that, we never do, but this is the thing. He can't touch them at all. So every fish that he catches, I actually have to take off the hook. Look at that bluegill, man. Look at the detail on that fish. It's actually beautiful fish, isn't it? It's a big one. Give him a little toss back. There's so many. This is going to be like every single little pop. All right, here we go, guys. This is going to be my first fish. We're going to catch him real quick. Oh my God, there's so many. All right, watch this. Oh, there's bass everywhere, too, man. No way. I caught a bass, dude. Oh, look at that. Oh my gosh, he barely got him on the corner of his mouth. You caught a baby bass fishing for a bream. Yeah, dude, that's what I was saying. We never know. I know you got the big bass in you. That's how you got that big bass in you guys. Can't even catch a bream. So for now, if we're catching a bream, I'm already one up on you. I dropped them. I can't get the B2 up on you. Look how small that bass is. That's funny. So we got a bream and a bass now. You see him? That's a bass. Oh, it is a bass. He bit it that time. You're kidding, man. Yeah, it's a bass. That's how he's hooked. Oh, what? What'd you do? He got hooked in the gill somehow. You come off? Oh, no, I didn't. What? No, it isn't. Oh. He bit you the first time. Look at that, guys. We've dropped in where we've caught three fish and two of them are bass. So look at that, guys. Third fish today, two bass, one blue gill, which is awesome. Beautiful one. I was figuring out my last. Literally, there's so many fish that are around these beds. They're just everywhere. All right. So we both caught three fish now. We both caught a bass. Now this is what I'm thinking. So we caught some fish so far. He's actually just moved to the bobber on it, but I think we want to do a challenge now. So the first person to catch a fish, we're going to cast at the same exact time. First person to catch fish wins. Best out of three. I'm going to do it three times. Three times. Three times. Best out of three. First person to catch fish. I mean, two times maybe. Yeah, best two out of three. You want to do that? All right, let's go. Let me rig up real quick because I got to get another worm on my rod. So with that being said, I think we're going to put a juicy worm. So I got mine rigged up. Decent little piece on there. He's got his rigged. You got a big clump and juicy piece on there. He's got his bobber on. So I guess we're going to try it. Let's go ahead and line up. So we're going to cast out a best two out of three. We're going to cast at the same time. Let me know when you're ready. I'm ready. All right, let's go. Eat it. Eat it. Bobber like mad. Oh, you're about to get eaten. That fish is about to eat it. Oh, no. Oh my gosh. I'm right by that bluegill. Oh, oh, oh. There he is. No. Yeah, baby. Oh my God. Oh my gosh. All right, that's fair. That's fair game. Dude, that's how big it's one. That's daddy Van Dam one. Daddy Van Dam one. Oh, oh. Pissing everywhere. Pissing everywhere. Look at that. All right. All right. One to zero daddy Van Dam got the first one. All right, round two. So if you catch one, you pretty much beat me in this mini challenge. If I catch one first this time, this game over. If you catch it, then we got to go for round three. Yep. All right, let me know when you're ready.  You tell me when. All right, let's go. Oh my gosh.  I need some weight.  You're going to catch them right here. Yes. Yes. Yes. I got it. I got it. I got it.   Look at that. One, one. All right, that was fair. That's fair game. So that's one to one. One to one. Three fish challenge. One to one. Dude, these bluegill are insanely.  Oh, okay. On the race of the three, we both have one. All right. So this is the final round. If you catch a fish the fastest is the winner, period, right? Yep. Go. Oh, wait. Oh God, I just pulled it away from him. Oh my God. Oh my God. There was one chasing me right there. No, no, no. That was not a good cast. You're going to get eaten there. Come on, fishy, fishy, fishy. Hook me up. Final round. We're both in the strength zone. There he is. Oh, you're kidding me. Daddy man, damn for the win. All right. All right. Unless I catch one real quick and throw him on the bank before you. All right. You won that fair and square. Daddy man, damn for the win. Oh my gosh. Yeah. Are you good? Yeah. Did he get you? Hold him down. Yeah, I'll hold him over here. As many as I've lost to you. All right. That's fair. That was fair game. All right. So Daddy Vandy, I won that first one. He got that two to one W. He caught the first one. I caught the second one. He ended up coming in clutch with the third one. So we're coming up with another challenge. It's going to be the first person to catch a bass. All right. To catch a bass. Oh my God. You got a bee on your head. It's like one of those mini bees. Oh my God. Boys, do you see that? No. I think you're just trying to swap me. No, no, no. I'm actually serious. I had that sweet weed. That's why they said it. So first person to catch a bass. But if you catch a bluegill, you lose. That's going to be hard. I feel like I'm just going to destroy myself or I'll have to bat off of that one. That means you've got to not fish right around here? I don't know where I can sight fish one. Okay. All right. Let's get it. All right. While Big Steve is rigging up, I'm not going to cast yet because I'd be cheating. But I am going to scout out and see if I see any fish. There's so many bluegills swimming around here. But yeah, I've seen a few bass. But the problem right now is the wind just picked up and is putting so much chop on the water. And I can't really tell what's a bass and what's a bluegill right now. This is a gosh. See, there's three bluegill right there. So when we first walked up, we caught two bass before we even caught two bluegill, which is kind of crazy. But there has to be some more bass swimming around here. All right. I'm good. You got your bobber on. Dude, you're going deep, man. That's like a five foot leader. We're going fishing for bass, bass only. If you catch a brim, you're out.  If you catch a brim, you instantly lose. Yeah, I'm walking over here too. I'm getting away from these bluegill vets. Dude, this could be your win or lose right here. He's walking with you. Oh my gosh, there's a brim too. Yeah, that's got to be a bass. Really? It's a brim. You lost. You lost. All right. I guess we're one-to-one. It's just like that. I had a feeling you were like excited about a bite. I'm like, I want to be too excited yet until you see it. Well, one-to-one now on the challenges. What should we do now? I mean, should it be the same one? I guess just first person to catch a bass. Not the knockout like that. If you catch a bluegill, you catch one. But whoever catches a bass first, I think that's what we need to do. That is what we need to do. And I'm going to start walking. I'm going to try to find one. I want to find a bass. I just want to, like, sight-fish them. I think that's going to be the best option. I feel like some of this, like, slop on the bank. It's got, like, a few sticks here and there. I think that's, you know, where a bass would hang. Dude, there are so many bass, and I see another one. Hey, you see this right here? Watch this one. This is how you're about to lose right here. Yeah. Watch this. This is how it's about to go down. I see a bass right there. And he ate it. He ate it, dude. You have to admit that was so good. That was so good. That was so... Dude, that... There could have been a better way to win this full challenge. There it goes. I'm going to let him pull off in. You got to admit that was pretty impressive. That was pretty impressive. I flipped it perfect, and he came over and just rolled on it. Pretty fish right there. That's a W. So I won two of the three challenges. You won the first one. Oh my gosh. Let's go. That was the best way to win that challenge right there. It couldn't have been better.