Hi, this is Kathleen Dollar from the.NET Core team at Microsoft, and I'm here today with Rich Lander to talk about some tips for moving to.NET Core. How are you doing today? Great. So the way I kind of think about this talk is, I often meet with these big customers who come to campus and ask us for guidance. I'm like pushing.NET Core, and they're like, Rich, don't lie to me. Tell me the truth, tell me how it really is. So this is supposed to be how it really is talk for moving to.NET Core, right? We're certainly aiming that direction, and so we're going to be going into a few places you might not really expect us to go, including spending some time on making that decision about whether to go to.NET Core and when to do it. So let's start out. And no lying. We're not going to lie to you. We're going to try really hard not to lie to you. So we're going to start out like I said, should you do it in the first place? Should you pour it to.NET Core? How are you going to prepare for it? And then some tips about porting it, but that's actually not the biggest part of the talk. The biggest part is the setting up, which I think it's going to be the experience you have as well. Kind of like how to make the plan. How to make the plan? How to detail that down to being able to carry it out. So before we do that, I think we should start with why do it in the first place? What's good about.NET Core? Because then we're going to talk about some pain points. And I don't want to do that without first saying, why bother? And so these are some of the benefits for.NET Core. We think for a lot of people, the side-by-side installation, which is that's installation of the runtime, that also can be one of the pain points. But it's a benefit in that you can have two applications in the same space, two applications on the same VM or the same machine, and they're each running their own copy of the runtime. And don't interfere with one another? At all. Not at all. All right. It's also faster. It's cross-platform and open source, and it will be getting new features while.NET Framework is now stabilized. Yeah. It's faster though. One thing we actually forgot to say, it's faster and uses less memory. It does and that's super important because when you actually measure just one little piece of code, you can see the speed of that.  So allocations are super important for a couple of reasons. That's the main. But yeah, the simplest thing is, if you have a hosted environment with servers, you can pack more apps onto the same machine. Right. All right. Let's go. All right. So you can find out more about the .NET Core 3 features at this blog post, which did. So since Rich wrote it, he's pretty excited about that. So should you move? Big question. All right. We're going to look at a couple of considerations, and we're just going to walk through each of these. Yeah. There's just one tiny bit is, I've been talking to customers on campus, but also I've been to customer sites. I think mostly in the United States, but I'm moving to other countries too, definitely in other countries. This question is very real, because different companies work different ways, but a lot of times you have a higher level manager who's resistant to change, and they're like, show me why we should really do this, and is the risk that is it low? Yeah. So this is some of the things you can do to establish specifics about what it's going to take and where you're going to get value from it. We definitely encourage you to go. If you can find the value, and that's why the benefits slide is super important, and I hope that when you come back and consider this, you will explore the great things about.NET Core, but not in isolation. You want to look at those alongside the cost. So before we go there. Can I just say one more thing? Yeah. Back to these managers that are resistant that you couldn't have to prove this to. I was at this one customer, let's say I think it was in last spring, and we did this project with them, and the management was resistant, and then we did this prototype. We spent like a day upgrading their app. We were actually able to give them real numbers. They were like, whoa, this actually looks pretty good. This was back in- Was it performance numbers? Yeah, it was performance numbers. This is back in preview three. Yeah, and that's better. I've done a core. Yeah, well now we ship too. Yeah, it's great. Okay. So before we get into some of those specifics, I do want to look at some other concerns that are kind of things that aren't the right reasons to make a decision. So let's take a quick look at these. And so the first thing is, yeah, if you're worried about .NET Framework not being supported, that's not in and of itself a good reason to move. So it will be supported for a very long time. Yeah, I agree. I understand that in response to that, you might say, hey, but there was this thing, whichever thing it is, that comes to mind. And .NET Framework is actually really different than anything that's been out there before that's gone undergone a similar change. And the first reason is that it's a Windows component. And so it's a critical, it's part of Windows. Windows needs it. It's literally on the Windows DVD if we still have those, the DVDs. For those of you that remember what a DVD is. Yeah. So then also it's used heavily within Microsoft and it's in fact Visual Studio. Yes, that's an example. Visual Studio is a .NET Framework application right now. So and then the biggest reason I think is that this is not something, this change to .NET Core and .NET Framework splitting a bit here. It's not only to freeze up to do great things in the future with .NET Core. It is definitely to do that, but it's also to say there are, oh, we don't even have a good estimate of how many apps they're out in the wild. Millions. That's working. It's working and it's getting things done for people. And so stabilizing that aspect of our ecosystem is important to us and important to being able to set it for the future with this base of existing apps being solid where they are. So I think it's super important to think about there's great reasons to go to .NET Core, being afraid that we're going to pull the plug in .NET Framework. Is it one of them? It's not one of them. Yeah. A couple of other things. You need NT services. Cool. You can do that. Sorry. Oh, and then licensing. So if you're concerned about our license, we are MIT. And we think that that is a good license for business. And if you want to hear more about that, let us know. And we'll get rich to write a blog post. Yeah. I'll just say one tiny thing about that. And this is where I've talked to several customers, some of them very, very large. So our source is MIT, which is the part that's friendly to business. But a lot of customers want to hear from us that they're still installing Microsoft provided software. And when you actually go download .NET Core from the website, that's actually like a Microsoft build. And if you want to think of it as a Microsoft proprietary product, feel free. It is built from open source, but it's supported by Microsoft and it is a Microsoft product. So there's nothing scary there at all. So if you want to use the word open source, you can, some people really love that and it's true. If you want to use the word, like, you know, Microsoft certified and supported, you can use that word too and it's also true. It's both true. It's both true. We sign it, we also provide the source code for people like Red Hat to build it separately. So we work really hard to be on both sides of this list. We're kind of doing all the things. We think it's great to be both at once and we think we're hitting that. So Microsoft is still, you know, we're still, nobody's going to be thinking crazy. We're still a commercial software. We are watching it very closely. We approve every commit. We're watching it very closely. It's very safe. At the same time, we do take commits from the community. We're thrilled to do that and I think it's worked out really well. Okay, so let's get into those specific questions. And the first one is your application and active development because if you only open your application occasionally and it's to do very small things like change what the current year is, you're just not going to gain a lot. The new features. Well, there's the other side of it is maybe it's an enormous app that has a very slow rate of change. That's probably the one that you most want to think about is if you only have this one developer left who's working on this mega app, then that may not be the best thing to move to Dynacore. It has to be under active development and you kind of want to have some kind of team. And I want to kind of clarify that. It's because the active moving will put it under active development. And so if that's sensible, hey, then that's great. That's actually a perfect way to put it. Yeah, it's going to force it. So we'll talk a little bit more about thinking about that. The frameworks, we have some stuff that's not going to be there. Most things are there. WinForms and WPF there now in 3.0 and then there's the Windows compatibility pack will bring some more things in. So there's a number of things that are actually there, but there's some important ones that aren't going to be there. I think a couple of things of app domains are there, aren't they? Or is that completely? No, so the app domain type is there and some of the basic functionality, like for example, getting the list of assemblies, is there, but the fundamental concept of app domains is definitely not there. Right, so it doesn't make sense to do things in a particular way on Dynacore for some of these things. And so they're just not there. So that's, if you're in, if you're WebForms, you're looking at a pretty deep reconsideration of your application. Can I say one more thing about the last slide? You can always say one more thing, Rich. So one of the things we've been doing over the last years, last few years is, it's like, okay, we're going to bring more functionality into Dynacore that you used in Dynaframework and kind of our, and we definitely did that in Dynacore 3.0. We brought Windows Forms and WPF and those were obviously very big projects. That is the end of that journey, the journey of bringing more Dynaframework functionality into Dynacore. So we feel like we did a great job. We took a ton of customer feedback. We added, like if you look at between Dynacore 1.0 and Dynacore 2.1, we added 40,000 APIs and that's not even including what we did with Windows Forms and WPF. So we feel really good about what we did, but this is the end of that particular phase. So there's all these things on the right-hand side. Those are not the next candidates we're going to bring back. Those are going to remain on that list on the right. And now we're going to go do other things, but not more Dynaframework functionality. Right, so waiting to see if Web Forms or WCF. Exactly. Sorry. Yeah, it's just not in the cards. So, and there's some good reasons for these. None of this was arbitrary. It was all, we took a very deep look at all of these things and how it would impact Dynacore and where we felt that it was not going to come forward with enough compatibility without being inconsistent with Dynacore, it went on this list. So it's, yeah. All right, so the next thing is to talk about support policy, doesn't that sound exciting? Yeah, I remember when I first, before you worked here, I was telling you about the support policy. Do you remember that? Yeah, yeah, yeah. That's the MVP summit. Yeah, and I was like. I was talking to you and Julie. Yeah, so the support policy is different for Dynaframework and Dynacore. So I'm going to talk here for a minute about the Dynacore support policy. And a year ago, in December, not quite a year ago, we released 2.2 and then 3.0 we released, like right now, we just released it. Yesterday. That's where we are. So let's look at the schedule going forward, because we've announced the schedule. Yes, which is awesome. And we think that's a great idea, so you know what it's going to be. So first of all, in November, we're going to have 3.1 and we're calling that LTS, which is long-term support. And I'll explain what that means. Coming up after that, we're going to have a major release every year. And every other year, it's going to be LTS. So this LTS thing is pretty important. So you can think of it like a second train and along that second train track, we have LTS versions. And one of the reasons that this visualization is kind of important is that it's hard to jump across the track in between. So for example, if you're on .NET 5.0 and you want to get back to 3.1 because you want to jump across halfway through, you have to go back to 3.1, which may not be an easy thing to do. So your best bet is to pick one of these tracks and then be able to commit to it. That's the best way to go about it. So let's talk about the specific support policy and here's a link to it. It's, you can go read it and everything here is a visualization of that. This is, it's true, this is my picture. So first of all, what does LTS look like? The current LTS today is 2.1. And we have announced a special date for it, which is August 21st of 20. It was released 2018, so it will go out of support. August 21st, I think that may be 23rd there. I may have a typo on this slide of 2021. Well, that's a minimum. Yeah, it depends on when, yeah, it depends on when we ship 3.1, but I guess, I guess that will be the date actually. Yes, yes, it will. Yes, it is a special date for that one because it was, we were settling on the final policy right then and we've been discussed for a while before that, but that's when we committed to the policy, so there's kind of a special date on that one. All of these are minimums. We could extend support further. It hasn't been our pattern, so I certainly don't think you wanna count on any of these extending beyond these dates. It might happen. So 3.1, it's three years from the date of release. It's actually three years from the date of the release, unless we run late on the next release and then we expect to go a year past that, but the easiest way to think about it is three years. That's the easiest way to think about it. So what's the current then? That's what LTS does. Current track is 2.2, we'll go out of support on December 23rd of this year. Detonate Core 3.0, which is releasing today will go out three months after 3.1 ships. Go out of support. Go out of support, sorry. Yes, go out of support. Three months after 3.1 ships. We don't know exactly what the pattern will be around 5.0 and the reason is that we don't really anticipate point releases at this point in the 3.1 timeframe. We don't really expect. Meaning a 3.2. A 3.2, exactly. We don't have any plans on that. There's no plans for a 3.2 or a 3.3. We don't know what our plans will be for 5.0. So we could see a 5.1 or a 5.2. We just don't know yet. So that's what we can look forward to. So you can see that the support is significantly smaller and this is not to scale. The stuff on the left is a bit more spread out than the stuff on the right. Yeah, so the thing I'd like to add on this is if we look at say 3.0 to 3.1 in particular, the level of kind of migration cost between those should be extremely low. Absolutely. So in terms of the thing that I would be doing if I was trying to interpret this, like if I had a team building an application, I would just always stay on tip. I would just stay on the latest version and then my team would get all the benefit of all the latest features. And I know that the Microsoft team is trying to make those as compatible as possible.  Yeah, this is absolutely true because not only are you going to be getting the new features, so nullability is, you would get that if you are on 3.0 right now, if you're in the LTS 2.1, you don't get nullability, you don't get async streams. All the great stuff you're hearing about, you don't get F sharp 4.7, all the great stuff that we're doing, you don't get that. Or the new Docker limits support that we added in 3.0 or the much smaller SDK that's in 3.0. Right, performance, there's a lot of reasons to stay on the tip. However, we feel like it's important for it to be your choice, not our choice. So this is why we offer this alternative commitment that occasionally, once every couple of years, we'll mark one and say we'll support it longer. So if switching versions is a problem for an individual project, this isn't a company-wide decision, it's per project, if that's the right thing to do, go for it. We are running a little bit behind, so we're going to have to kick it up a bit. I just want to say that one more thing real quick is the dot-net framework. The arrow just goes right across. It just goes, it keeps going, okay. So we are going to kick it up because I realize that we're running a bit short on time. We're just talking too much. Yeah, we are, I'm talking too much too. So one of the things is that you're going to be managing your own security updates for dot-net core, and in dot-net framework, the security updates are part of Windows updates. We're not going to go deep into this. The reason it's sometimes on you deploying is that you had to make sure there was the right dot-net framework on that machine that you were deploying out to, but you always have to do that. Make sure it's there, and it won't be there from Windows. Windows update. From Windows update. Windows, it's just not part of Windows, and there's good reasons for that so that we can change it and we can move forward. Third-party dependencies. Ask, how do we ask today? We go to search engine. Go for it. Third parties mostly have a statement. Now let's prepare. So, preparing to dot-net core is going to have a couple of steps. We'll walk through these again. The first one though, you just want to move to a recent version. If you're back on 4.5 or even before, oh my gosh, any problems you have moving forward, settle that first. Right, because there were a few points in the dot-net framework journey where we made significant changes, breaking changes, and you need to make sure you've gotten through all of those waves of changes because 4.72 and later are the most similar to dot-net core, so that's really why it's so valuable to validate that your app runs successfully on 4.72 or 4.8. Yeah, and then you want to know how you're going to validate success. What does that look like? Test coverage is one great number here, but so performance metrics is going to be important too. We expect it to get better, but checking that's always a good idea. Yeah, so back to those stories that I told earlier. So those developers that I talked to, they had performance tests, which they ran on the old stuff and the new stuff, and then they just did basic arithmetic to figure out which one was faster. But if you don't have those things, then you're kind of just a finger in the wind setup, which is not really science. Yeah, you definitely don't want to be there. So evaluating architectural changes. There's a couple things here. We're going to bounce through this because I think the slide to come back to it, this is deep consideration on your part. We're throwing this out there, and then you can come back to the slide and say, yeah, I want to spend more time on that topic. So first of all, if you have a library that can target dot-net standard 2.0, you absolutely want to do that. That's what's supported on dot-net framework. You want to limit architectural changes during the port because if you say, oh, I'm going to change a bunch of stuff and port at the same time, it really made the whole effort is going to be crazy. It's going to be hard. And then it won't be obvious to everyone why the build is breaking. Is it because of my migration or is it because I actually made some bad plans or it just can be a mess? But before you move, you might want to look at a couple of things and one of which is the isolation of concerns. So if you're using WCF for one task, but it's spread all over your application, start by taking all that into one library so that you can replace WCF in just one place. That's what we mean by isolation of concerns. And then there's something called the dot-net portability analyzer. And I'm going to walk through this just real quickly. It's a Visual Studio download. You can get out that link. It's an extension to Visual Studio.  And I'm going to start with a portability summary. And I did two. These are both just standard dot-net framework applications for WinForms and web. This is a web MPC. And let's look at the difference. Right here, this number 34%. That says we're in trouble. ASP.net MPC, you don't just do a straight port on it. It's different work. We'll talk about that in a second, but you can see that number. If you look at... Get it back here. If you look at WinForms, you see 77.77%, which is still a little bit low, but you can immediately go and find out what you've got. And I think that I just don't have the right SDK here and that there's some... The work that I can do that's going to move that over. The way that you define Windows forms itself changes the way the project file looks between framework and core. And I think that's what causes this because... Well, yeah. You can see almost all that stuff is supported. Actually, all of that's supported. So this one was probably pretty close to 100%, actually. It would have been except that we changed from a dependency to the SDK. And that's what caused the problem. So I'm showing you this because we want to again show you where you might trip a little bit and when you see this, don't panic and think you're not going to be able to move WinForms. It's just that the way that we define it isn't this tool doesn't handle really well. All right. So portability analyzer? Yes. All right. So we did a little demo of that and going back to porting your app, what do you actually want to do? Yeah, this is the active phase. And we are updating these apps today. Docs. Docs. I'm sorry. We are updating the docs today. Right now there's a PR. We don't know the state of the PR at the moment. Right. But within the next 24 hours it should be merged and then the right content will be at that link. Right. So you want to choose the project to port. We recommend that you look at the ones with least dependencies and test projects early on. And then you'll change project files and code differently. Test projects early? Is that obvious? If you move early with them it's going to be, life will be better. Actually, so I don't think it is obvious. Oh, okay. So yeah, this helps shine the light on what the heck it is you're doing. So I think this is great advice. All right. Project files. Project files is going to be a big headache for you. We'll just tell you that up front. It's going to be a little bit of a headache on this. Right now, they actually showed something in the keynote that I just want to mention. In passing, Olia showed a tool and there wasn't much background given on that. And what I want to clarify is that's a prototype that is really got, it's going to work in some easy cases. And so we're trying to understand how you perceive that process of moving your project file. So we have normal channels that you can give us feedback on that, which is the upper right, give feedback in Visual Studio, or if you'd rather go to githubrebo.net.core, be a great .net github.net.core, slash core, slash core, slash core. All right. So you want to create a new project file and then allow globbing to bring in your actual files. That is standard libraries are ready to go. WPF WinForms, console, class library, they should be pretty straightforward. ASP.net is going to be a little bit harder. You're going to need to replace certain aspects of that in the IS integration pieces. Yeah. And you're not just going to want to try to make this a straight port. This is going to be taking the new ASP.net core, which is vastly improved. It's a fantastic piece of work. You're going to want to take that and then move your old code into it. I realize now that we made the slide slightly incorrect. It shouldn't say plan to replace IS integration. ASP.net core also has IS integration. It's just that it's slightly different. Right, right, right. So integration only in that where you are counting on these features, then they're going to be different. Yeah. And we still, you're still going to use IIS. You're right. We had a poor, and we have one more slide and then we're going to get to try to take some questions. We ran a little bit over here. Yeah. So web forms, we suggest that you look at Blazor. And the reason for that is that Blazor is an event model similar to the way web forms is an event model. And so if you go to Blazor, it's going to be easier for you to take your ideas forward. So should we move to questions? I think we should move to questions. I think we should too. Yeah, yeah, yeah. Are we at that time? All right. Okay, so moving to questions. So Rich, I thought this one would make you smile. It doesn't look like a question to me. Rich Lander rocks.  The first one. Let's see. Okay, so let's look at real questions now. Okay, let's see what's a good one. Is .NET standard going to move to V5 when we get .NET 5? I don't think we know. Well, I think the first answer is that's unlikely because we have a different numbering scheme for the two. Oh, do you mean will there be a .NET standard? Do you mean what the number? It just says whatever the question was. I don't think it'll be V5 and we haven't figured out our .NET standard plan going forward. Okay, let's move on to the next one from Bill. So in addition to the releases on their product plan, can we expect bug fixes and other updates on a fairly frequent basis? Yes. It's basically monthly. Yes. Monthly, great. That's easy. I like that question.


Thank you everyone for having us here. I hope you're enjoying the summit as much as I do and as much as we do Today we have a very diverse panel and I think all the panelists for for joining us today I guess we will start by a little one of introduction given the diversity of the panel So let's start with the other end of the stage If you want to introduce yourself Adriana Thank you. Hello everyone. My name is Adriana grow. I'm the co-founder of the sovereign tech fund in Germany Is that enough or should I give my little speech now? No, that's so can you talk a little bit about the organization? You're representing today. So what is your? Expertise in the domain or your interest in the open source security. Okay. Here comes my little speech. I think I'm Maybe a little bit the odd one out My background is not in tech or security Although I'm running a tech fund. My background is in public policy and governance so I started from the question who gets to decide the future and how do we shape it? And that led me to open source software. I think in this audience people may be able to trace My line of thinking from that end to this end In other cases I need to explain it, but of course and also listening to what Thomas just said How we develop design and use technology has a massive impact on our future our economy our society and with the sovereign tech fund we want to Given digital update, I'd say to how we think about the foundations of how our society works We want to invest in open digital based technologies with the sovereign tech fund that means digital infrastructures protocols libraries standards Software that developers use to develop software Because that's what innovation Services products also what we can do as Administration or a society relies on and it's not in the best shape Right now. It's communities that take care of it mostly. It's some companies investing And we believe that it's also a job where we should invest public money in the public's interest To make sure it works. Thank you Um So much for now, I'd say over to you. Thank you. Thank you. Thank you for having me here. It's been her pick I'm running the cyber security policy and resilience program at the German tech policy think tank stiftung Neue verantwortung and I I really hope I don't waste your time. I'm super new to the field of open source So bear with me and call me out if something's wrong that I'm saying We're coming from especially cyber security policy background and even more niche From what is the government's role in that and in that regard? We just launched last year a project Which is hopefully why I'm here to figure out better What if any could be the government's role in fostering IT security of open-source software and even more Detailed if you want we're looking at creating a blueprint and the blueprints were mentioned earlier and one of the panels for for national governments European government and others of how you can design an open-source program office, which is one Government let government coordinated whatever and more focused on IT security So of course we want to look at the Ospo model that has been established And we want to dig down on how that can look like if we get it more to the operational level and more to the security level and how we can integrate it virtually vertically and horizontally into the architecture of cybersecurity architecture of the different governments and how it can Support policy interventions and how it can help make regulation and policies less bad and More understanding of the open-source ecosystem and how it is married to the cyber security ecosystem Hello everybody, my name is Gio Kunz. I'm working in the open-source program office of Ericsson and My colleagues and I therefore are responsible for setting the policies and strategies That like in terms of how we work with open-source software and how we act in the open-source ecosystem I'm however a developer my background. So I've been Active in various open-source initiatives and forums and projects over the last 10 years and Very recently I focused more on the security aspects following the open SSF for Linux foundation projects focusing specifically on securing the open-source ecosystem and Obviously my interest here in this conversation is that well like from and from an Ericsson perspective obviously our products are build to build or End up in critical infrastructure as such securities has always been of Let's say a great importance to us and From that perspective I as a developer and as an Ericsson representative Very much welcome the initiatives that we see here at least the intentions of really now putting money and Things into practice to improve open-source security Terms of regulation, of course, I'm really happy to be part of the conversations because I think there's some quirks that still need to be sorted out, but it's good to have those conversations and I'm really looking forward to this panel and Talking to you later on Thank You Yoke So I'm Stefan of the Kiroli I go by Zach By day I'm a professor of computer science at the Polytechnic Institute of Paris and I teach and do research in cybersecurity and Software engineering by night. I do not fight crime, but I'm a developer. I'm a geek I've been a debion developer for 15 years. I've been involved in the open-source initiative and More relevant for for this panel today. I'm co-founder and CTO of the software heritage project And what we do at software heritage is that we are a non-profit initiative in which what we try to do is to collect Archive for future generations and make it available for everyone all the source code we can find. We have already archived more than 200 million projects and Everyone can actually navigate and find their projects that have disappeared from their original hosting site retrieve them and analyze them for their own reasons My interest for our conversation today is that I think there is an Important discussion to be had about where information about vulnerabilities of open-source software are located where they are stored and What can we do to make them more easily accessible for everyone that actually wants to build services to improve the security of All the software that exists in the market Hi, I'm Rebecca Rumble. I'm the CEO of the Rust Foundation So I'm I'm here because Rust is very sexy right now And you know, it's playing a really big part in a lot of the security conversations that are coming up now I'm really interested to hear what other people have to say And I'm also here to advocate for the role of foundations In in trying to find good security solutions for the common good I think it's really really important to have lots of stakeholders in this conversation And I think that foundations have a crucial role So yeah, I'm obviously going to be advocating very strongly for that But it's really nice actually to hear that there were other people here that are new to the space I came in this morning. This is my first time at this at this conference And it's really nice to see that it's the first time for other people as well There's there's new faces here. So it's nice not to be the only one And I think it's great that open source is influenced and it's It's prominence in the policy world now is getting so much attention. So this is really exciting for me Thank you. So I guess I'll say a word about me I'm head of security at the Eclipse Foundation. So the Eclipse Foundation is a European open source software foundation Our vision is to be the best in class in implementing the best practices in Supply chain security open source software supply chain security we We actually help our project improve the security posture of their supply chain and that's how I came in here to talk about the all the best practices So before talking about that we We are talking about open source security, but how exactly does does it actually differ from Standard or regular software security? Is it anything special or can it be? Treated just like regular software. So maybe it's like you want to enter that So that's actually a very good question because it's kind of polluting the discussion about the security of open source software So we need to avoid being falling in the trap of it is an open source specific problem So software security is a problem for all the software which is out there and we're in a society where there is more and more Software everywhere in our lives The reason why we are talking about specifically the security of open source software is that is because there is so much of it in all the Devices so there are a number of studies that they've shown that essentially every single IT product on the market be pure software or Mixed software and hardware contains some bits and pieces of open source software So naturally given there is so much of the software out there People are talking about its security But if anything given if all other parameters are the same open source software is actually more secure than the equivalent Proprietary software thanks to its inspectability so people can analyze it and And actually find security issues that help developers fix them So this is actually a good feature of open source software The other good feature of open source software is that its license terms allows everyone to freely copy reuse and Integrate them in in your product provided you respect licensing terms Of course and that makes it possible to a use at the very very large scale open source software and basically free and open source software is winning and The price to pay for this victory to some extent is that we need to you know worry more about the security of The software developing than we were used to do when open source software was entirely niche in the market And that's very good point Rebekah. Do you want to add to that? Yeah, I think trying to make a distinction is Kind of irrelevant, you know the security and software is security and software and as everyone has kind of said here today, you know Even commercial products are built up of various bits of of open source So it's really you know the key is how can we kind of bake these things in in the development stage for open source? Developers and maintainers rather than trying kind of bought security on at a later date It that has very much been the case historically, you know security hasn't really been baked into Learning in computer science courses. It's not really been seen as part like a natural part of the process or part of the process That's kind of automated. So it's easy so we end up with you know Components or products that are built of all these different things and then someone tries to bolt on security at the end Which is you know, it doesn't really work very well So we need a new way of approaching it and distracting ourselves by trying to define Whether it's different or not. I think it's yeah, it's just a distraction Yeah, so it's definitely an industry wide issue So then if security of open source software is not very different from security of software non-open source software Why is there such Discussion around the regulation that are coming that doesn't treat Open source software in a specific way if the security of open source is not different And so then what are the risks actually for open source if we treat open source the same way as non-open source software Maybe you want to talk about it Yeah I'd like to first mention one more aspect to the To add on to the to the prior discussion one more Very interesting point that kind of again is in line with showing that there's not much of a difference What we want to have between open source and Non-open source software what we want to have at the end of the day are secure systems, right? And of course that starts with developing the software that will end up in those systems But there are additional aspects that many of those of you who are involved in the security domain Community are aware of and that's like how do you operate a system? How do you configure a system right this this? Comes on top and is it completely? Irrespective of whether or not the software is open or closed and this I think is also where Regulation or this needs to be taken into account by regulation as well that it's more than just Has the software when built in a certain fashion or does it does this artifact? Fulfill a certain quality mark. It's like how is it used? How does it integrate into a bigger into your bigger picture? But then of course as you asked the why is open source so well so much in focus right now Well, I guess it's part of the reasons that like one and a half years ago We've seen one very famous example of open-source software Vulnerability in there which kind of again goes back to what I just said is somewhere between a configuration issue and the design flaw caused a lot of headache in the community and Out of that, I think the very good initiatives that were the good intentions that we see kind of started to emerge that we want to Now focus on open source software and securing it and the openness of open source software provides the Not just the benefit of being able to inspect it But I think it also comes with the what creates the responsibility for everybody using it that One can proactively or should proactively work with the open source community to improve that Their security posture and this again is one of those specific Properties of open source software that makes it so so great because it can also Spread the load now again across the industry to Work on improving this common good that open source software has become Thank you, then maybe as a newcomer to the open source Ecosystem so you may have a comment about that how can policy improve the security of open source software how does it differ from Regular cyber security Yeah, I think I think it has to find its role in the sense that We have seen regulation and not only like legislation but also policies in general Which are targeting or taking to account the tech sector Especially if it pertains to cyber security Which is just plainly bad and and I don't believe that most of them are designed that way because of lobbyist efforts And they are just accidentally bad because those that make the laws Do not have an intrinsic knowledge of what they are regulating because it's a complex issue, right? and then what what we end up with is something like in this specific term now the cyber resilience act and Martin Mentioned that earlier and I think also the eclipse put out a statement on that why that's a problem So we have two complex fields cyber security where we often get it wrong in the first instance when we look at policies and regulations and then we we bring that together with the open source ecosystem, which is also Extremely complex as far as I understand it right now, and if we bring them together There's a huge room for making mistakes if you want to regulate it So it looks very heavy-handed sometimes, but it might just be accidents because those that are designing it and those They are consulting they don't understand the complexity and what it actually means so We we have to We have to inform policy makers better And they have to take our advice and how to design the regulation and they have to better understand the ecosystem That's why I'm come back to the point of the open source program offices because if I have that then I should go there I should ask is that what I'm doing for the specific thing that you're doing which is open source Good bad or not and how can we change it and I shouldn't go then say the good bad They say no, it's not great and then I go away and keep it that way anyway, right? I mean then I don't need that So I have to be open to heed the advice But first I have to create that point where I can go and it can ask okay guys Well, you're not you're not lobbying for anything You're just there to tell us if that's gonna be really bad because we want to we want to have more security and we all agree on that But we don't want to stifle innovation and so we have to figure out something that works We cannot say well this open source. So there's no regulation touching it We don't you know, we want to make it more secure, but not with regulation or policy They should just do what they're doing and we hope it gets better But at the end of the day We also don't want to just over-regulate it and then we don't have innovation anymore The people who are doing it are afraid that they get sued in the call of law and they did okay We're not gonna provide stuff to the European Union anymore. It's too complicated.  Thank you So we were talking about regulations so actually in Europe we also Talking about digital sovereignty and the will of the European Union to reach digital sovereignty would Improving the security of open source software a way to Gain the digital sovereignty. So maybe Adriana with the sovereign tech firm. You may have a say about that Yes, I have so many thoughts coming from your discussion But let me focus on this point first because it's really important for for us to Explain a little how we understand digital sovereignty on one in the earlier panels. We also heard if that framework of digital sovereignty means Putting up a border a digital border around Europe then that's not what we mean And also not what we want The term is I think disputed especially also in the US when we talk to partners in the US and we say digital sovereignty. They're like And then we say Actually, it's about choice and it's not about saying those are the bad ones and those are the good ones It's about making sure that everyone is in a position where you can act and that means you need to Make sure that you have no strong single dependency where whoever it is a Single actor could just decide for you and you have no say and this is why we want to Invest in an open-source ecosystem in community in many actors. So you have a vibrant Ecosystem where everyone can make choices you you have Innovation but you also have security so It's about individual choice for us first and foremost But of course, it's also about choices for companies and governments to extend it to that level as well But it's not about us against them It's not about protectionism and it's not about putting up borders in the internet. No And if we understand digital sovereignty as strengthening the foundation in open source Then I think this is also a push for security and I guess this is also why I'm on this panel here because if we talk about regulation and policies And about how open source is more secure than proprietary software we talk about theory Because in the end it always comes down to the people, right? And we need to put the people in a place where they can Act so we need the maintainers the security researchers. We need people finding Security flaws. We need people fixing them We need people who have Capabilities to learn to exchange and for this I think it's crucial that we understand that we need more support also sustainability in the field and Coming back to what I said in the beginning. I think this should not just be up To private money and to the free time of people doing it out of passion This should also be something that we understand as a public's job to make sure it's there because we all rely on it And I think it's a really good idea to invest some public money Into this and not just money. We need the money To incentivize developments, you know more diverse in the field more new people coming in More open-source strategies between private actors and communities that are on eye level more Capacity building on the administration side All of this has nothing to do with just giving money somebody all of this is structural change But we can fund structural change or we try to it's not easy, but we're learning so Yeah, that would be my take on your question. Thank you What would be the role of foundations? Probably in this digital serenity Environment with the rest foundation provide what would the fund earth foundation provide in such an environment and such a goal So I'm in complete agreement with with pretty much everything you said there And I think you know plurality is one of our biggest strengths in open-source You know the sheer number of choice the sheer availability of different views different perspectives different experiences And different sources of funding, you know having a patchwork Of support makes makes our software much stronger You know proprietary software tends to be quite brittle in a way because it is only narrowly supported In terms of what foundations can do, you know, I am I Have been frustrated in the past by governments not just in in tech but in in terms of all kinds of policy areas there is a Tendency that oh we can leave it to the market to solve this problem Or we'll just leave the market to its own devices and they will you know Everything will be fine This always leads to gaps whether you're looking at countries where health care is privatized or education or all sorts of things You end up with huge gaps That people and services fall between and you have Non-profits or volunteers picking up the slack. We simply cannot afford to allow corporations in tech to to monopolize Security and our approach to securing the digital world They have an enormous enormously important part to play and we're very lucky at the brush foundation to have the support of a lot of big tech organizations But we can't leave it to them to decide okay Don't worry guys. We'll take care of the security over here and that company will take care of security over there between us It'll probably be okay That that's not okay. We don't know what's going on inside of those organizations because security is notoriously secure subject Disclosed is a difficult even amongst trust trusted people So, you know, you need foundations you need nonprofit actors neutral actors who don't have shareholders to answer to To be able to say do you know what for the common good? We're going to invest in this These these are initiatives that will help secure things better Investing in education and good security awareness in in computer science courses. These are things that are gonna help So, yeah, I think Where foundations come in where companies can't and where government governments can't is actually being able to say look We work with the maintainers. We have the maintainers on our board of directors. We work with them every day We know exactly where the pain points are and actually we can direct that funding in a way that is not Going to result in profit for one company or a distortion of the market in some way We're here to make sure that that the ecosystem is a good safe secure and fun place for everyone that wants to be involved Thank you So securing the open source is also securing the access of the source code to the source code because it's the main data Behind open source. So how how do you what do you propose with the the sort of heritage project? So I think we are all aligned on the fact that digital sovereignty is not about borders And that's very good point. I mean I'm glad to hear that we are in alignment, but it also means not being falls in the way we approach the Security of the open source of play chain And so when it comes to what can we do to secure an independent access to information that are relevant for the Open source of play chain. There are a couple of elements that they want to raise here So there are two types of data which are essentially needed and useful for improving the state of open source security The basic kind of data the first kind of data is indeed source code. So we need to have access to the source code actually quite a number of Vulnerabilities in the open source of play chain in the past were related to the lack of availability of access to specific Components or components that used to be available on some package manager repository Disappeared and that actually ended up breaking builds for a lot of people around the world so as it happens if you look at that let's say the geopolitical angle of Modern software development platforms you will notice that a lot of those platforms are operated by actors which are not located in Europe if you think of the the main player in Collaborative software developers located in the US you have other players located in Australia And also a lot of the package manager repository are actually operated by for-profit companies Which are not European companies? So it's fine there for now offering their services to everyone in the world and they're giving access to European entities to those data But it's better to cover our basis So essentially the first things in terms of digital sovereignty about access to open source code is making sure we have an Independent access to that source code if something happens and for whatever reason We can leave lose access to that information in the future. So on this specific point We are sort of heritage are archiving all the source code we can find essentially everywhere in the world and we're a European based initiative so the main copy of the archive is in France but we have a number of mirrors that are being populated in other member state in Europe So that's the first answer and of course these are just copies that are located in Europe They are not copies only for Europeans to they are open for everyone in the world, but they are in Europe So as a first line of service, they are available to every European citizen or entity So that's the first type of data guaranteeing access to the source code itself Which is needed to build products or also to analyze them to find and to fix vulnerabilities the second type of data which which matters a lot for Improving the the security of open source software is access to vulnerability information. So the CVE databases all the Databases out there that offers information like this specific version of an open source component is known or has been reported to be Affected by this vulnerability. This other version later on fixes the issue So this information is available open data right now But again is for the most part curated and distributed and made available by entities, which are not European entities So I think that the one of the next priorities strategic priorities for you in this respect is making sure that this information is replicated is copied and Cross-reference with all we know about open source software So of course, I think it's something where a software edges can play a role But more generally we need to think as a at an independent access to vulnerability information about all the pieces of open source code that are out there Thank you like so, yeah We think about the data the source code and the NVD databases and so on but what we see also for instance from the Expandation point of view is that digital signature is taking more and more importance in the security Securization and securing the supply chain of software and We see some projects some initiative about providing digital signature services of mine that are as easy as to use as let's let's encrypt functions to get web certificate very very easily, but it's all run and Operated by non-European companies. So probably having a similar infrastructure in Europe would be a way to Gain a bit more of serenity So great. Thank you. Thank you My next question would be a bit more like a closing question is what would be the next step so for all the The stakeholders so what would be the next step for the EU parliament or EU government? The the communities and the open source of communities and also the industries we have a view on that Of course and for me, it's that we understand digital infrastructure like roads and bridges to be part of our Digital common good that we need to sustain as the public and so we have Something like the sovereign tech fund but bigger and better at European level and we make sure that our digital Open ecosystem stays open secure accessible participatory as a foundation for our democracy and companies as well then any What's the big next step for the industry for the the communities? I think I stick with my talking points about the government's role in it and Be it the the European Government that has already created an Ospo or the national government that started doing it we need we need a point in in the government that that have both understanding of open source ecosystem and cyber security and Both all parties need to know that this point exists and how to approach it Two sides to that if I'm a government agency planning some regulation or just some policy Maybe I should know that I go to that place and I listen to these people because they know what to do right and then I take it back and then I include it and on the other point if I'm for example a security researcher and I find A buck in an open source software and I don't want to track down who the maintainer or who can talk to I should maybe also have the option Of having a government contact point where if I just don't want to keep it to myself And I don't have time to figure it out I just drop the bug there and I know that they take care of it that it gets put in a coordinated vulnerability disclosure process and Whoever is responsible will get the information and can actually fix it So this the single point of contact for improving Security in open source software must exist and we must be aware of it And it must be a very very low threshold to contact that Single point of contact because otherwise it's not just it's not good to just have it It needs to be approachable and we need to be aware of it And I think that's that's where we need to go at least from from the government's perspective I think that's where we need to go and as an offer to the entire audience I'm really super open is why I came here to get your ideas on it What kind of what kind of function it should be what policy interventions that can do and and what you see the government actually National governments the European Parliament actually doing in in that term and you can also tell me you don't see a road for them That's also fine with me, but that's why I'm here for Thank you John Yes, I am I very much agree with what This one just said Point number one really in order to create regulation that has the right impact It's important to understand the the workings of open source of the workings of security So yes, I would also recommend exactly the same starting and facilitating these conversations with The industry with but also the the development community then in terms of Regulation another thing. I would honestly like really wearing my my developers open source developers had I would really like to see that as was stated in the previous keynote that Will find a good definition that removes The open source ecosystem is such as much as possible from any regulatory burdens and instead Put it on the on the companies right that that's where it belongs as Representative of one commercial entity here and say yeah, well, we'll take responsibility for the products anyway So this is what should be regulated In combination with creating the incentives again for the commercial players to Again go out there and try to improve the baseline security of the open source ecosystem But those two things need to play together, but I'm a little bit concerned that Putting too much burden on the communities will stifle innovation. We've mentioned all of that it will I think have a detrimental Effect and this is not where we really want to go. Let's let's take the right organizations Take care of the responsibility then the Yes, I already mentioned it Organizations should step up the game in terms of investing in in the sustainability of the open source ecosystem or Try to understand how they can become a more valuable member so that sustainability is not as the sustainability of the open source ecosystem is not as strained as it currently is we We already know that there is issues. There are issues like maintain a burnout that that is really a thing so It cannot be that either regulation or Commercial organizations take this push to board security and kind of translate that into more requirements on the developers So again, that needs to come from the industry as well And I think this is not just added cost from a European market perspective learning how to become Proactive Collaborative and value-adding member of the overall open source software ecosystem Well, you gain competence. You know how to work with these things It makes it easier for you for your R&D organizations to maintain the software that you're building, right? so their their benefits there as well, and I think that needs to be realized across the market and I think then we have we are on a good track Thank you Thank you. So what would be the big big next step for the yeah So I want to propose this thought experiment to the people in the audience So try to imagine if you are a developer in your day-to-day job if you're not a developer talk to developer that work with you or for you and Try to imagine go through your day and every time you use a service So something which is not running on your computer Try to check where that service is located and who is operating that and what is their business model? And then try to imagine imagine a word in which not necessarily all of that is European and completely open in its data in software But where at least you have an option to choose something else Which is not that specific service, but it's another service implemented completely with open source software Operating only on open data and ask yourself and ask your peers what it will take For us for the open source community to get from where we are right now To that place in which in where you have those options And I think that's the the kind of mindset we need to have for you know the next ten years to improve the current sales of affairs and But to your point if we do that as a side effect We will indeed increase the you know the the community in Europe and the business in Europe that works in in this kind of On these kind of topics. That's just my concluding remark and proposal for an exercise for all of us Thanks for the exercise Rebecca any It's like the creeping death. I'm lost when it's why I've got to think of something original to say I'm gonna I'm probably gonna say similar things to everyone else. I want I want two things specifically I want harmonization of regulation, you know open sources global and I cannot be dealing with US regulations that say one thing and EU regulations say another thing and UK regulations say another thing and That's only just you know three areas. We're not even going into Asia So we really need at least some harmonization Even if everyone's kind of going in the same direction and it's on the same scale, that's okay But what we really really can't deal with is different, you know different territories going off in different directions It'll be utterly wretched for everyone and it will totally stifle innovation linked to that What I really really want to see and what I'm really looking forward to to one of the later panels is Sustainable funding for this work to be done. I'm fine with regulation I think regulation is a great prompt to make people think about things meaningfully and I think we should be doing that But you got to pay for it, you know Open source has been done for free for for too long anyway The the burden needs to fall on Companies on on people who benefit to actually pay for this work because it's not going to do itself And if you want good safe secure Products then you know put your hand in your pocket and make sure that those things are funded sustainably not oh Here's some money for like 12 months You know great. We've sold security in 12 months that that's fine then no it needs to be an ongoing thing security has to keep Happening we need to keep doing it properly. It needs to be properly funded and it needs to be baked into the regulations Thank you So, yeah, I would I agree with everything what I would add is do not put the burden of security on the shoulders of developers It's definitely not something that they have time or they want to do We need to sustainize open source to be able to have services and be able to help developers Think about security and do security, but without taking too much of that time thank you very much to all the panelists today and I'll leave you with Paula for the rest of the day. Thank you very much


Hi everybody, thank you for being here but thank you also for many of you accompanying me on the various events we had today. It's been a pretty jam-packed day and I want to say I've really enjoyed my first visit here as foreign minister, my first visit to Solomon Islands as foreign minister. We said when we were elected we would bring more energy and more resources to the Pacific and we have tried to do that. You've seen that here today, first with the vaccines announcement at the school. I was really pleased to go to St George the sixth school where we announced an additional 200,000 vaccines, this time pediatric vaccines for kids 5 to 11. This is on top of the in excess of half a million vaccines that Australia has been really pleased to provide to Solomon Islands as we work together to come through the pandemic and speaking to many of the staff at the school, the Department of Health and other staff obviously one of the major challenges here in Solomon Islands is logistics and I really want to thank the Australian personnel who've not only helped deliver the vaccines into Honiara but to distribute them because that logistics support has been really well received. We've talked a lot about being part of the Pacific family and we mean it and can I say to you I really felt that today when we went to Burns Creek with the health minister Togamana with Premier Sade, a Malayton community where you saw the Pacific family on display so Australians, New Zealanders, Fijians and young people from the community. Did you know that young people from the community helped work together to build that clinic? What a wonderful example of what we can do when we work together and it was a great privilege to be welcomed in the way I was. Of course this meeting I did have a constructive meeting with Prime Minister Sogavare. It was a wide-ranging meeting, a meeting that canvassed the breadth of our relationship. Obviously we did talk about regional security. Australia's view does remain that the Pacific family should be responsible for our security and the Pacific family is more than capable of providing that security. I welcomed Prime Minister Sogavare's reassurances that there will not be a military base nor a persistent foreign military presence here in Solomon Islands and I welcome his assurance that Australia remains Solomon Islands first security partner of choice and first development partner of choice. We've discussed a number of other areas as I said across the breadth of the relationship infrastructure, health, education, labour mobility and of course also climate change and one of the important things that has changed in Australia is that the Australian people voted for a parliament and a government that will bring much more ambition to the issue of climate change and I know from discussions I've had today but also from our previous experience as climate minister many years ago that for Pacific Island nations such as Solomon Islands climate change is real, it is a lived reality and we want to work with you to ensure greater resilience to that reality as well as Australia doing the right thing in its own economy. I'm happy to take questions. Dorothy. Well actually sorry yeah the young man who spoke to me at the clinic who's the youth representative from the community he spoke to me about labour mobility and obviously we are working with local community and with the government on development more broadly but what has been raised with me is labour mobility. We come to government with a commitment to strengthen labour mobility between our nation and members of the Pacific Island nations. I understand you know that's an area where we certainly can assist with opportunities as well as economic benefit to families and to individuals. Are you suggesting anything that they need to be considered? As I said in my opening we did discuss regional security and obviously that is one of the issues that the region has been discussing and you know I think the Prime Minister is aware of Australia's concerns and views but most importantly he is aware that Australia like many other members of the Pacific family is of the view that our regional security is a joint responsibility and it is a responsibility the Pacific family and as I said at the outset I welcome the Prime Minister's assurances which are the same assurances he's given publicly that there's the government does not intend for there to be a persistent military presence or or foreign military base here in Solomon Islands. I think you had a question. Well look that hasn't been raised with me formally obviously you know we would Australia's always taken the view that democracy matters and democratic conventions are important and that would remain our view. Those issues were raised in the meetings today and have been raised in my meetings in Fiji and Samoa and Tonga as well and I'm pleased that there's been a positive response obviously there are issues we want to work through including the one you reference which is how would we allocate as between different Pacific island nations it's a visa as you know is modeled on the New Zealand visa arrangement that particularly obviously the Polynesian islands have engaged with New Zealand in that way so we'll work through the details including how much how what is the allocation for each Pacific island nation with with your government and with others anyone more you go yes well I just so you can avoid with a little bit of history I was the climate minister in 2007 to 2010 when we were elected as a Labor government with a very strong position on climate change Prime Minister Albanese was the person when we're in opposition who drafted our policy for government so you you have the Prime Minister and Foreign Minister of Australia both who have a very personal commitment to action on climate but more importantly you've seen in the election the election of a government and a parliament where Australians do want stronger action on climate we've actually lodged our NDC at the United Nations or under the UN convention outlining a much more ambitious plan not only have we committed to the 50 percent as to the net zero by 2050 we have a commitment for 2030 of a 43 percent reduction that would lead to in terms of renewable energy I think it's 82 percent of our energy being provided from renewable energy sources so we are serious about this the other thing we want to do is to talk with Pacific Island nations about engagement stronger engagement including potentially holding a conference of the parties to to try and press the issue when when I was climate minister and still today I think that the voices of smaller island nations has been very have been powerful and authentic in the UN negotiations okay thank you very much I hope one more is there last sorry hello last one well look Australia will do what Australia thinks is the right thing to do all right we will work with you on your development on your health priorities on your education priorities on your climate priorities and on your security priorities and we have and we have under successive governments we have we have sought to do that we may not have been perfect but we are family we live in the same region your security and our security are interlinked and that's how we will approach our relationship with you thank you very much everybody it was great to be here cheers thank you I'll see you next time


Going on everyone Sam here with late in sports cards have been 23 tops definitive baseball hobby through box case number 12 Random division style Here is a look again at your random results as always combine those on the website under the results tab as well as the link That's in chat currently So good luck guys, let's get started and let's do it Come on see something huge out of this Otani roots cut that would be a ran or not a random Well, you obviously reach out, but you do hit that it'll be between Greg and Greg and Rob still not So weird It's like when I increased the font tell him Jake we've got an L central that is a say a Suzuki One of 40 nice one there. I know Okay, that's pretty good There's 23 of 30 that is Julio Urias and a West two-color patch Ooh nice ale East CC subathia, let's go 24 at 25. Love me some CC Cheers the auto That is the owner rich rich late and that's his last name started it back in 2012 I think 2011 2012 2013 around there, which one? Yeah, 2011 I think I think you're right. Yeah. Hey, thank you. Mr. Kyle picking up a spot in gold standard That's into the single digits as well We've got Shay Lingliers. That is gonna be 43 of 50 a a West That's what's dope, dude That's sick. Mmm. I See why yeah three of five going to the NL East. How about a chipper Jones for a five? Excuse me for a five pretty girls Jones. That's awesome Peter let's go Peter. Good stuff buddy Peter Adam with that one Take a chipper all day. Take it back this one 20 of 25 Cal Ripken, Jr. Ale East on that one that'll that is so cool as well. Love me some Cal, of course Cal Ripken, Jr. We've got 22 of 25 NL Central is Christian Yelich on the disgusting patch for a gold frame as well You know the frame. Yeah. Oh, yeah Some yelling in there. I'm jelly of that yelling. There you go True and NL Central again Johnny Bench Grats on that one NL Central the defining images. I believe that's cool. Sometimes they're numbered. Sometimes they are not Johnny Bench Trevor Larnack conception 101 says 2018 College World Series go there. That's pretty sick That's pretty sick. Alec Thomas just says go D-becks. Trevor Larnack. That's a twins legend Big-time twins legend there. I do it has some serious pop We got a red leave that's a red Yeah, it's like a red red patch That's nasty dude To god to a five and a last mookie bet that's gross so cool, man Wow, that's nasty as well and the one behind it. Yeah, this one's insane. That is clearly some sliding on that I know last James D and then going to Greg in the AL East one of one George Springer Nike swoosh batch. Let's go. Grats on that. What's up, Jace? What's up, Jace? So sick, man. Let's go Greg. Good stuff, buddy One of one George Springer on the ruby alright, I Know last again at 30 of 30 is Walker Bueller Keith my guy picking up the Ravens and flawless. Thanks, Keith down to 12 Nathan with a spot in the select mixer Thank You Nathan Big time big time for sure That is a Garrett Mitchell NL central three of 25 rookie auto on the green. I did see that Dev I did see that Pops is giving out a signed boy meets world Philly shirt Just kind of cool sign by like three of the main characters A nice one here 46 of 50 at least is a big poppy. Grats on that one. There you go again, Greg David Ortiz Karen Mitchell is a definitive all-star for sure Really nasty one here going to the NL East that is gonna be Michael Harris 27 of 50 on the RPA Grats again, Peter. Nice one there, buddy Congrats Peter RPA of the 22 rookie of the year in the NL Congrats on that Going to the ALE East Don Mattingly 19 of 30 Donnie baseball no random to do on that one either, which is awesome No, sir real man unreal Robert s Robert s man the second one of these we pulled now five up ten do a lot of each hero and show Hey, oh, Tony good Lord Robert. Congrats my friend. That is a monster monster Good stuff Robert again both in the ALE West so no random to do on that which makes this car a lot less stressful Grats on that man going to you Huge card. That's a third one. We pulled is it really powerful one, too.  He did. Yes. He did you're right That's the most up there Philip five of ten They pulled one on release day remember All right, they're not really stay like the Yeah, I know it's so nice. That's not a random to no choice or no chance involved in that one We got another protectors at the plate. It looks like we got something else.  Oh, it's sort of cheese man What's a Ruby? It's a one-to-one It's a one-to-one Lord Okay, well, let's get through these two first Get through the two patches first Start off NL East that is whoa That's sick man NL East Mack Scherzer the thrill is gone. That's awesome Tom That's so funny. That's sick four or five protectors at the plate is Ronald Acuna Jr. Dude, that's insane man. That's so sick. I don't know what that is. Yeah I have no idea what that is.  Holy cow. Maybe yeah Game yeah, maybe a sense for game used. That's what I was saying.  I Was gonna say I remember that you got the one-on-one burns to Shipe That's awesome Nolan Gorman rookie auto NL central as well. I know central feasting on that Let me thank everybody who took spots fill up with a spot in gold standard Brian with a spot in hoops Eric with a spot in gold standard hoops now down to eat and gold standard down to eat I believe no down to seven I believe now There's my guy Craig B. Geo six of 40 congrats on that one there Astros or al West Lay in with the Corbin burns monopoly Corbin burns definitive one-on-one monopoly. God, dude So sick right there We've got a five of 25 that is gonna be al East Dave Winfield Dave Winfield Grats on that al West or al East And al West Larry Walker Nice one there 10 of 10 on the framed patch auto. Look at the signature on that man That's incredible signature there incredible signature Take a look at the sick on this one too And then dual to 35 al East Eddie Murray and Cal Ripken jr. What a case this was man.  What's a case of? Definitive incredible stuff never disappoints never disappoints at all Yeah, that was a total banger of a case right there eat to go on hoops breaks next everyone It's a go on hoops breaks next Okay, again, that's the empty thing there Have a go on Nick Gotta get the the fix of definitive before the bar. I feel it feel it You're good almost done Was enhanced by the elevation bite by the elevation in Denver got those. All right Relics we had Seas Suzuki 240 a Julio Urias the 30 and Max Scherzer 30 All right, our sleeved autos are gonna be Johnny Bench David Ortiz Nolan Gorman That's a yeah Shay Langler's Craig B. Gio Cal Ripken Eddie Murray dual Walker Bueller Donnie baseball to 30 baseball Dave Winfield Ripken jr. Christian yellows to 25 cc. Sabatio Garrett Mitchell and Larry Walker 10 of 10 Really awesome mookie bets to a five game use patch kind of unbelievable That is Ronald Cunha four or five protectors at the plate game game. That's gotta be what that means. It's gotta be yeah game used Chipper Jones that is four or five For the Braves Michael Harris RPA to 50 and Elise Braves One-of-one is George Springer on the Nike swoosh a least the one-of-one Corbin burns and El Centro on the button and A of course each your own show hey five and ten Light card there. Whoo That'll do it for the break everybody. Thanks again for the fill next up is hoops just a few to go