Thanks everyone for joining us today. Welcome to the CNCF live webinar hacking cloud native applications through open source I'm Libby Schultz and I'll be moderating today's webinar I'm going to read our code of conduct and then I'll hand over to Arthur Oliarch security researcher with Palo Alto Networks a Few housekeeping items before we get started during the webinar. You're not able to speak as an attendee, but there's a chat box on the side Feel free to add and drop your questions there throughout the webinar and we'll get to as many as we can at the end This is an official webinar of the CNCF and as such as code to the CNCF code of conduct Please do not add anything to the chat or questions that would be in violation of that code of conduct And please be respectful of all of your fellow participants and presenters Please also note that the recording and slides will be posted later today to the CNCF online programs page at community.cncf.io under online programs They're also available via your registration link you use today and also on our online programs YouTube playlist post event With that I will hand it over to Arthur to kick off today's presentation Thank you Libby for the introduction so a good day everyone Thank you for joining this webinar My name is Arthur Liarsh, and I'm a security researcher for Palo Alto Networks One of the things that I enjoy I do the most is I like to look at different kind of projects which mostly open-source project and I like to peek into the code and Look into what the developers might do wrong and how could I exploit it and target application? Which are using those code in those packages or modules? So and today I'm going to talk about a bit about the security in cloud native open-source projects If you will have any questions by the end of this presentation Please drop them in the text boxes below and by the end of the presentation, I will try to address as many questions as I can So with that being said, let's get started Our agenda for today would be firstly we're going to go on a very high level on Why organizations shifting their applications to the cloud and how they shift in the services to the cloud? What is the open-source software role which helps them to achieve this goal? Also, we will take a look at some of the challenges and consortium organization might have when shifting the application to the cloud I will show you some vulnerabilities observed in open-source cloud native world and Show you even some examples on how I can use some of the vulnerabilities to attack an application which is running within the cloud We're going to talk about how we can reduce the risk and mitigate against those attacks even early in the development life cycle So let's get started Why organization choosing to move their application or services to the cloud? So there is a lot of reasons to do so and I decided to Briefly go over some of the reasons So it depends on how big your organization is it may reduce some cost when you're running your Service or application into the in the cloud. You don't need to maintain a server form You don't need to also maintain an IT staff, which is taking care of all the service, right? Which is quite trivial Also, you don't need to rent a physical space where you will place all the service and IT staff and will save some money On energy which always does consuming in terms of scalability you want that your IT infrastructure will adopt your business needs for example if you're planning to double the amount of users you have so if your service is Based on the cloud When your database need to grow you just space you go for more storage and you get it immediately and you don't need to build Before ahead of the time a new data storage or data or servers And you don't know if you're ever going to use it fault tolerance, which means If one of the components fails You will have immediately a backup available within seconds if you're running your service on the cloud And you don't need to maintain a physical copy Which is another data center somewhere of your service which cost you additional amount of money You just want to use your backup and when you need it and pay for it in terms of performance and regulations you want to be as close as possible to your audience and clients and Cloud service providers they have a lot of servers across the globe and this is how The performance can be improved because all the service are located in in countries where your clients are So like how Organization are achieving those goals how they start planning and shifting to the cloud So according to Gardner research that was made in 2010, which is a long time ago, right? But still somehow relevant to these days They came up with what's so-called five hours, which is a five approaches organizations are taking When they want to shift to the cloud So one of the approaches is called to rehost or also known as shift and lift Which basically means that you're taking your application which is installed on bare metal and you are reinstalling it into the cloud maybe you want to Containerize it and run it as a VM within the cloud right you basically taking our application and reinstalling it within the cloud The second approach is revise which basically means that you maybe want to take a small portion of your application and Adjust it to benefit from the cloud the provided services that what they have to offer Maybe you want to move your storage to the cloud for example The third approach would be a refactor where you are refactoring an application through Run on the cloud providers infrastructure, so you could benefit for more services that they have to offer The force a method is in my opinion more of a cloud native approach Which means that you rebuild your application from scratch you are taking all of your code and you rewrite your code So like you Building a new architecture of how your application is will look on the clouds You're basically you are being building for the cloud in the cloud and this is the place where open source software Tools cloud native open source software tools really it can come in handy being called because like you are going to Look for new solutions and sometimes you don't have the time to build your own cloud native solution from scratch So you turn it to some open source software available out there The the fifth approach I didn't mention here and it calls replace or repurchase Which basically means that you take your application you put it aside and you? bind a new application Software as a service which is will run on the cloud and made for the cloud So let's take a look what our open source software role with this With all this immigration process So first of all using open source will reduce your costs because now your development teams will need to find new solutions to new problems and adopt your application to To be a cloud native so in terms of development They don't need to build a whole new solution from scratch They just find the right tool and they adjust it to your needs You also don't need to pay for licenses for open source software, right? So it reduces some of the costs and because like your teams don't need to build a new solution from scratch It saves some time as we know time is money today, right? It's platform neutral, which is very important in my opinion when you build your solution with open source software You can run it on any platform. So let's say you're running your service on Some provider X and you want to switch later to provide your wife on some reasons you don't need to Rebuild your application or readjust it because your application is ready to go on any platform This is a really cool feature to be a platform neutral innovative in my opinion people who are participating in building new solutions and sharing it with the community They're looking to solve creatively some existing problems and They do it sometimes in a really brilliant way and they share it with the community and all the software becomes available to everybody So you really benefit from cutting edge solutions free to use There are different solutions to the same problem So you have a different tools which which basically solve the same problem and you just need the one which will suit you so you just not Having a one solution for some problem, right? Also, it maintained by people from a cloud native community where cloud technologies is not something new to them And this is where I find it really in educational because like when your developers start to starting that learning curve developing their applications For to be cloud native for example, if you are using some module or a package that you are not sure How you should implement it? So we just go to the registry which is open source For example github you open an issue and you ask a question and sometimes and some people from the community or even the maintainers We'll start to try to answer it or or people who already saw Or had the same issue will give you an answer that will can help you which and all of that together Makes the application migration to the cloud easier and faster So I saw some really cool research that was done by a cloud native computing foundation where they asked Some people from a lot of organization if they're adopting a cloud native open source projects within On production or they thinking to using it maybe they have some something or staging they're testing and The night numbers are really really high as you can see a Kubernetes is adopted by 96% of the people who answer the survey Which is in my opinion crazy. Also, I think that the numbers here are going to Be higher with the following years because more and more organization will shift part of their services All of their services within to the cloud So are there any challenges and concerns? That organization having when they're trying to shift their applications to the cloud so this kind of a trivial question because there are a lot of challenges and concerns and Let's say it just complex because now Your development team need to Rebuild your application from scratch and they are trying to ask a lot of questions and start like a learning curve They're raising a lot of questions like, okay What is a Kubernetes cluster? What's it's an atomic? How should I containerize my application? How microservices need to communicate between each other? What are role-based access controls? what the service may should we apply what orchestration tool we need to choose and All of these Questions have answers out there. So online. There is a tons of resources today where you can read and start building something but to take all of these pieces that available out there and Bring it together to make a working solution will take a lot of time which can slow down development process so lack of proper training were really slow down a development process and this is where like sometimes you start to Think or or maybe question yourself. Maybe I need to hire a new staff, which is more cloud Native oriented and stuff like that. So also, it's hard to choose the right tools because there are a lot of open source tools Available out there and you don't know which one best will suit your needs, which is also takes a lot of research All of this raises also a lot of security concern concerns And actually there is a cool survey again done by a cloud Native Computing Foundation where they ask organization about cloud Native security concern they have and one I want to mention here is a vulnerability management one Basically, let's say you built an application already you maybe you have it on staging or even a production and Let's say you applied some security out there to your application or service and you scan the images you scan your dependencies And now you have a bunch of vulnerabilities going on may have compliance issues and Vulnerabilities and packages you're using and you have like a long long list of vulnerabilities And you just need to solve them one by one So you kind of need to prioritize all those vulnerabilities and address those so this is not a trivial question Which vulnerability should I fix first? Because fixing vulnerabilities, it's very time-consuming and doing in the right way. It's very hard So sometimes just like updating the package version module version. It's not enough because it's can break things in your Development and it's not a great solution. Maybe there is a workaround available so all these things are really really time-consuming and vulnerability management is a very very hard task to do and this is I'm not surprised why it's like on top of the list also another Thing which quote my eye is that our organization been asked about security incidents, which is cloud native related. So Almost 50% Answered that they prefer not to disclose. So what will learn from it will basically learn from it that there was That pretty much high percent that that there was a security incident But they don't want to talk about it and the second one is the vulnerability exploited Which we will talk about today And I see this very important because when you're applying new technologies and new tools You are using open source packages and modules. You may be Using a not updated version. Maybe you are using a default configuration You can misuse many things and many things can go wrong and expose your a bigger Application and services to Security breaches and attacks So let's Take a look at vulnerabilities Which are observed in open source and what they are and what types of vulnerability is there so What I did I took a list of very known projects by clown native computing foundation which consists of more than 100 projects and I search for nvd database and For a github repository github advisories to see how many vulnerabilities can I find? So I found out that between 2021 to 2022 There were 164 vulnerabilities registered so and I try to To put them into a groups by type and we can see that there is three groups Which are really catching our eye one of one of them is like the Nile of service vulnerabilities Second one is code execution and direct retroversal Where where we're looking at direct retroversal and code execution vulnerabilities are almost always high to critical severity and you never want that your Application will be exposed to one of those vulnerabilities, right? So I Also think that if we will expand this research to all of the cloud native open source software the number will be very high and it's not like means that I Think like for example, I see I saw some Rising numbers between 2021 to 2022 and I think the numbers are getting higher as a security awareness Getting more attention in the cloud native landscape So I was thinking how hard is to pick some vulnerabilities from the list that I found to see and how Some application could be attacked. So I pick up some vulnerabilities from the list that I want to share with you and show how Some application running within the cloud can be attacked with them. So let's see some examples So let's say we have Microservices application running with a Kubernetes cluster and we have two services One is a public service and one is a secret service We have an envoy proxy which is handling our interest traffic and navigating whether to the public service or the secret service With some access policy applied. Also, we have a continuous delivery solution, which is a Argo CD Which is a continuous delivery cloud native solution And let's say that Envoy proxy is not up-to-date and it's containing non-vulnerabilities Also, let's say that Argo CD is not up-to-date and Argo CD server is publicly exposed with anonymous access enabled Just don't worry about the anonymous access and what it is. We will elaborate on it further and Just to say that anonymous access is not enabled by default, but we'll explain it later So in that in mind what can go wrong? So let me introduce you to a vulnerability that was found for envoy proxy So this vulnerability, it's took advantage of a URL path normalization. So the way URL path is treated is very important because once they are not normalized and treated well it can expose you for a different variety of security vulnerability one of which is the past reversal and By that I mean Where is no where is there is no a past normalization in place? For example a relative path like route public and a segment with double dot and admin can trick your access access policy In some systems a double dot segment means that you want to go to the parent directory Which in this example means that you will simply go not to public admin But double dot will go up to it to a parent directory Which is route and then you will end up with route admin if there is no past normalization in place If you were applying a past normalization It was ending up with route public admin without the double dot segment because it was sanitized and then you were not granting access to the resource So with that in mind and the attack scenario would be an attacker would grab a request with a crafted URL containing Relative Relative path containing double dot segment is the proxy will receive this URL and due to lack of path normalization The access policy will be bypassed and we will get to the research we should not get to So an attacker will see in an HTTP request containing crafted URL let's say your shop com public service double dot secret service and when it will be parched by a proxy It will say like okay, you want to go to the public service, but where you want to reach within the public service Let's say access access policy is allowing us to go whenever we want within the public service So it says okay. We're in the public service you want to go So it sees the double dot and secret service and since there's not normalizing the path It goes up to the root directory and navigate to the secret service and that's how we bypassed the access policy So if it will go into straight to the secret service by your shop com secret service We was denied the access by the access policy But as simple as that using double dot segment, we were able to bypass the policy and get to the secret service So this is a classic past rehearsal attack another vulnerability I want to share with you it was discovered for Argo CD project and more specifically for Argo CD server So this vulnerability could elevate privileges taken advantage of Jason web token authentication and basically Argo CD Trusted invalid claims within the Jason web token Basically Jason web token is a token which made up of three parts. It's coming in encoded part within the authorization header and Once decoded it gets the following Structure, it's consist of a header payload and signature Rather when the payload contain the claims claims are just parameters describing things about a user In most cases, it's a user. So for example, it can state that the user is not mean for how long this token is Valid and etc. So once Argo CD has anonymous users enabled Which can be enabled via the Argo CD config map yaml file the Anonymous users will get the default role permission specified in Argo CD Rubbock config map and Rubbock is just a feature which is restricts data to Argo CD instances and Default role basically means that you will have a read-only access to all of the Argo CD resources So in that in mind if we continue reading the description of this vulnerability We will see that the attacker window need to have an account on Argo CD instance to explore this vulnerability Also, he can impersonate the if he can impersonate a user a built-in user Which is admin account on the Argo CD and when he's escalate the privileges He will be able to get the privileges the same privileges on the cluster as the Argo CD instance Which is by default the cluster admin. So basically with forging a GWT with some Forging GWT claims, which is just with talking claims, which I talked before Which I talked about before you can become a cluster admin which basically allows you to delete and add Or or manipulate in some other way as resources on the cluster, which is pretty crazy So the attacker will send a request with forged WT containing invalid claims and When Argo CD authentication will trust the forged GWT token It will allow us to become a cluster admin now. This is really crazy once This can if this can happen This is a really cool vulnerability also because Argo CD sometimes receiving and full information from some GitHub repository, right and this is where another attack vector That can be shown to the to the attacker now now he maybe can later exploit all of the CI CD pipeline So another thing is that some vulnerabilities can hide And if you remember the first vulnerability that introduced you is was that passed through our solver and ability within and with proxy So what's so big deal? So this vulnerability was first reported to Istio in February 18th by security researcher, so Istio Investigated it farther and they found out that the issue is within the envoy proxy Istio If someone don't know it's like a service mesh where it's injects and void proxy as a sidecar to each Pod within the cluster. So you see how it's complex It gets one project which is using an envoy proxy becomes vulnerable Because the other project have been normalization issue so Istio reported this issue to an envoy proxy team and in what proxy and in white opened publicly available issue on the GitHub repository and If we will look closely at the issue that was open So we a technical person can read through this and say hey I can I can pretty much understand what's going on And I maybe can try out and write some and pass through our cell exploit for and see if it's working And if I'm an attacker and I know that My target is running Cloud native proxy even if I don't know if that in web proxy or other proxy Out there. I maybe want to target all the publicly available cloud native Proxy repositories right and see for a scan for issues and pull requests that are available publicly To see if there is any hints that can point out to some security witness, which I might exploit So after the issue was realized and the severity was realized by the more team They moved to a private fix process which is was already after 20 days after the issue was pushed So there was a 20 days gap. So someone could pick up an exploit And if you do even if you think in that attackers is this not enough days for an attackers to do something So there was already Not related to avoid but there was some Stories out there that some some some things escalated less than two days So Hidden vulnerabilities as whole often subject for example the vulnerability. I just talked about Pastro Velser and what proxy this issue on GitHub was available before even the CV was assigned to the vulnerability so this is a really big subject and Two buddies and colleagues of mine have a great talk for Linux foundation Which is called hidden vulnerabilities in open source, which you can watch by typing this hidden vulnerability and open source on YouTube or just check for the link below Just another small thing to add Not always there are to do this hidden vulnerability subject Sometimes there are vulnerability But there is no CV and the reason is that sometimes developing teams are not aware enough that What they fixed was a security issue that can be exploited Unless someone points it out to them so there are a Lot more reasons to why this happens and There it is like explained in the hidden vulnerabilities in open source Talk so you can pick and see more information So how should we reduce the risk? How should we mitigate as much as we can against those attacks? So first of all, it is always great to have a map of your application and its building blocks You want to see which types of packages modules? or tools you're using within your solution and then you want to check for updates and release notes for those entities and see if there is some release notes related to security that you might address maybe there are Some work around and no fix yet. If there are fix maybe you want to patch and update the version also strongly advice through to go to Security advisory of your of the projects you are using most of the cloud native open source project are Repositories are on GitHub and GitHub is maintaining a security advisory you and this is a publicly available to have also API and You can search for a project. You're using a module or package and and see for non vulnerabilities also, you can go to NVD and look for non vulnerabilities and CVs within that database Also, there are a lot of scanners in open source available. So you can scan for images or dependencies so you can see if your Direct or transitive dependencies have some non vulnerabilities, right? So as you can see For example, we talked about Istio and the vulnerability for envoy proxy was reported from Istio team because Istio team is making use of envoy. So Scanning for that is really really important another great tool is SCA tools software composition analysis tools are There it's like a Methodologies that show allows you to track all of your open source modules packages and tools that you're using within your project And also those tools sometimes really Developer friendly so you can think of how you can integrate them into your CI CD pipeline So you can regularly scan for those dependencies and packages and modules and packages and discover the vulnerabilities early in the CI CD process and software development lifecycle Also, those tools will help you to prioritize risk. We should talk before right? So one of the issues and great issues for security teams or engineering teams is that after scanning for the Vulnerabilities, they have a long list of vulnerabilities. So they need to know what to prioritize first And and what to fix first sometimes it's not about the critical vulnerability But it for the vulnerability that this can be mostly exploited on your container For example, if your container is exposed to the network and running those high privileges even medium severity vulnerability can be a really danger Also all this information which is gathered And Can be shown through a CA tools are maintained by security researchers behind those tools, right? So if you remember for example, there's hidden vulnerabilities topic that they talked previously There are security research team which dedicate the time to find those vulnerability and then they integrate this in the CA tools and once you're using them you'll get trashed for those vulnerabilities even before they get assigned CVs and this is how you can really really mitigate and Reduce the risk from your application being exploited or exposed to cyber attacks so This all I have to say for the moment Thank you for listening and If you have any questions, I would like to answer them Thank you Libby Okay Anyone have any questions they want to pop into the chat for Arthur Give them just a minute or so see if anybody comes up with something. I See some problem in the chat. So I don't see the chest I'm watching it and I don't see any questions give everybody one more minute. Is there anything else you want to add any? Ways to contact you or places they can opt in to find out more information Well, if no one has any more questions, thanks everyone for joining us. Thank you Arthur for the presentation and These will be online later today The slides and the presentation will be on the website So thank you everyone for joining us. Thank you Arthur and we'll see y'all again next time. Yep Thank you for the opportunity. Thank you everyone. Have a good evening. Good day


Hi, my name is Steven Smugin. I'm the current chairman of the Apple Steering Committee. It's a rotating task. I got it for today. Today, I'll be giving you a short talk on the State of the Union of Apple. I'll be going through these slides rather quickly because we'll be doing it in 20 minutes so that there can be a time frame between for the next talk afterwards. Just a quick couple of definitions we have. I'll commonly use terms in here in case anybody wants to know why there are short acronyms. Today, we'll be basically going over the state of what is going on with Apple in the last couple of years since the last time I did this talk and hopefully we'll transition into the next talk, which will be a workshop on what we want to do with Apple and related build systems in the next year. Hopefully a bit sooner. Okay, what is Apple? It's as it can be as it's a milk, a generalized meat grinder of packages. We take packages from Fedora and people will take certain packages from Fedora, rebuild them and stick them into a repository that people who have enterprise Linux, which would either be Centos, scientific Linux, or the granddaddy, Red Hat Enterprise Linux will then use. The packages are usually packages we do not have inside of REL already. We focus on REL server, so things there may be stuff in REL workstation and such, but if the package is in REL, not in REL server, then we will duplicate the package in Apple. It's we just reached our 10-year anniversary. We've been doing this for Red Hat Enterprise 4, 5, 6, and 7 various other little things over time. We've done pretty well. I just talked about the packages we generally want in this release are what we prefer to be stable or LTS packages. There are ones that are really short-lived. They don't tend, people put them into Apple and we usually, they end up being pulled out within six months or a year because the both the people who are using Apple and the maintainers are too disparate in what they want. Things like Seth and Gluster have tried to be in Apple at times and they usually do not last very long because it's just the lifetimes of those packages and what people are wanting the same. These are, I'll give points to whoever can name one of those people on that picture. Islamabad is the first name of the guy in a stove hat. He built bridges. He built stone steam engines. He built a vacuum-tuned type of a loop back in the 1830s. Didn't go very far, only about 20 feet, but people use Apple to build things, big massive things that all through infrastructure. Currently, Apple is a growing, is a large, large part of everything that Apple Fedora produces. This graph here shows all the different releases we have in Fedora over time. The blue colors are the Fedora releases. That's about 20% of all, when people check in every day, 20% of everybody is checking into the mirror managers, our Fedora people. 80% are systems running Apple somewhere. It's about 1.2 billion per day and growing. Architecture-wise, it is mostly x8664. There are, there's a growing number of PPC, but it's not very large. And I put 0.2%, it's that was just a rant of the last 10 days. x8632 is falling off. In the last year, it's gone from 7% to 4%. Growth-wise, this package here goes EL7 systems, then we will see EL6 boxes. So there's a big giant drop right there. And I get asked usually, so I put this in. That drop is the day that Centos moved EL5 to Vault. And every system that was automatically doing YUM update for EL5 stopped checking it. There's a, over time, people had to hand move to say checking the Vault versus go to the main site. You can see individual IPs that were showing up a lot beforehand going back and pulling stuff out, out of the Vault. But, and then once it started, once YUM started getting a good configuration that we've been checking with us. But, generally, the drop there was every Centos 5 box in the head Apple enabled and going away. The boxes up below, either were configured to use some other mirror or were railed boxes. Why are they using Apple to build big over-engineered bridges that are incredibly stable? This is Firth Bridge in Scotland. It is a massively over-engineered bridge. It survived multiple bombs during World War II, directly landing on it because even though it was built way before any of those blockbusters that were built, the people who engineered it wanted it to not fail on the first or second or third of any high winds, high tides, train running full speed off the tracks, etc. People who build enterprise packages with Apple want stuff that is stable and well built. It's very hard to pull out exactly what packages people are using. But, you can kind of get a general idea. The ones that get pulled in, they look at, do a YUM install off of one of the mirrors, usually end up either a branch package or a core package that these things require, or a branch off of it. The R packages are incredibly installed every day. When we had Python 2.6 in REL 5, it was the most number one package installed. When it went out into life, Apple 5 saw a large drop of people installing things versus just checking in. Configuration management, mostly it's system and tools, and then the infrastructure they need to deploy things underneath those system and tools.  What have we done as a steering committee over the last couple years? This is a time-lapse photo, because I didn't want to try and do a live gif in the presentation, because it messes up on a lot of these But we've basically been breaking a lot of things that we did not break in the past. Some of this is us and some of this is our upstream, our upstream being Red Hat Enterprise Linux. Things that we did right, we got ARCH 64 and PPC 64 LE added to the architectures and they worked without a charm, without a problem. People, Peter Robinson and the people working with him built a ton of packages before we even had to, worked out all the problems before we had, and basically it was a turnkey drop-in. There was some stuff in mirror manager that needed to be dealt with, but it was much smaller than we were expecting. PPC LE 64 is in our small set is well-used over the 64. He had a successful end-of-life of EL-5. People will come into the mailing list and stuff saying that EL-5 is broken. I can't get this package. And it's usually because of the sento's problem. Once I get them aimed at fault versus aimed at stuff, they can install this package on us. It's our archive that we moved everything into archives. People still need packages daily. We have people installing EL-5 packages daily. The guy who isn't here, who's on the committee, Avidj, I think has a bot. Just every time somebody answers, he just starts replying back how to turn vault on or enable EPL-5. Because if you go to our website, we don't tell you how to get the initial package anymore. We've been dealing with massive changes in 7.4. Rail 7.4 has been very painful. There was a long split between us and sent us because sent us had to rebuild a whole bunch of stuff outside of stuff. But even inside of our things, we had packages that had been pulled into rail that had been in our stuff, and we had updated beforehand, not knowing that it had been pulled in. And packages have been dropped from rail that haven't been moved into Apple. And so various things that we're expecting things have broken. The repo closure has a list several dozen long. Our big change that we're having to deal with soon is that Ansible is moving to rail extras, so we will not be updating it internally. That was our fun toy. You will have to find some other way to update it quickly ourselves. Many other packages have been moved in and out, as I said, various fonts that had been in rail before are gone. And this presentation found most of them. I had to rebuild packages so that I didn't get to tie fonts. Things we haven't done that we've said that we would look at doing, and it's looking like we may never get done. There has been an long outstanding request for X8632 and ARM32 being built in Apple by using the ARM trees or the sentos trees. The differences in the build systems and our own how Koji works is looking like it's too much of a change that we can do inside of our own build systems, and we will have to find some other way of doing this. Another big problem that keeps coming up is that we remove packages when they're orphaned or dead, and people still use them. They don't care that the package is no longer seeing security updates. They don't care. It doesn't do whatever it says. They have build scripts that deploy several thousand systems with that package. Currently that we get them to get it out of Koji, but we need to find a way to get that better done, done better, gooder. It needs to be gooder, because gooder is not good enough. That's another request that Average seems to have a canned response for, of how to find stuff in Koji and get it. A lot of the Rail 5 stuff are packages that we remove beforehand that they want out of Koji. Where are we going to go next? This will actually be our next talk. The next talk is a workshop to go over the state of things that we would like to, well, I would like to as the Royal Weed, because I stood up here in front of this, and the other guys decided they would sit down. You've been very good. You've been holding back. In this next workshop, I'm looking at wanting to put in extra packages and sent us an epic tree. Archiving old packages regularly so that people can find old packages in a way that is usable for them. Using an optional tree structure for packages that are hard to install parallel wise. Currently what we do for certain packages like Python and such is we would try to install Python 2.7 and 2.4 on the same system using user site lib and then try to have it separated out. It is a lot of maintainer help. That made it so that no one wanted to update things and it made broke a lot of other parts and building stuff. This is not meant to be SCLs. SCLs are something completely different, and I'm not trying to replicate that. This is a single use of optepel to put certain packages in, so there wouldn't be like six different PHPs or whatever. Or if somebody wants to parallel install PHPs, that may be the case, but we're only going to really deal with one of these things. And only one will be active. It's not like there will be alternatives and all that kind of stuff unless somebody really puts in the work for that. And then we need to talk about all the stuff that's going on. The rest of this building is going to affect rail 8. I have no idea when rail 8 will come out. I have no idea what was going on with rail 8. I keep my ears closed anytime anyone mentions that. I don't want to know. Someday there will be a rail 8. It may be actually rail A for all I know. Let me just take the bottom bar off. But there will be a next generation rail. When that rail comes out, the stuff that's going on in Fedora for the last two years and probably how many years in the future will be in that. We need to work out how Apple is going to manage or deal with stuff in that kind of world. I don't think we're going to jump on any one bandwagon. We will try and see if we can jump on what bandwagons we can drop on. Whether it's modularity, containers, or some other thing. I expect we will be doing the same thing we've done for the last 10 years for most of the packages. Just because most of the systems we have are still talking about SunOS 4.4 from 1993 as the good old days. And that's how they like the world. And that's okay. I think the 4-button 1, 4C was better. That's fine. Okay, questions. I actually left time for Heckling. Hello. I do not in this talk, I have it as an email, send it off the list. There's three tickets I put into rail N. I did not find the packages that rail had dropped until I noticed it when I started doing the talk. And the comforter font that had been in there, there was one or two fonts that had been in, I was doing the repo closure to see what was broken. I went, there's fonts things are requiring. We never had those fonts in our stuff. And so they need to be in rail or two of them. I think they're probably in extras or something at one point. Not a really care about package. Okay, I do have access. I think you have access to speed data. The reason we keep access to the data a bit locked down is the data, some of the data we have has IPs and other information that people consider personal information. And while I'd like to make sure that when I give any data that it is been wiped to that, so that I don't cause the door or any other group side issues where somebody says, well, law is in there. I didn't say that you could use law. We are currently it is done. And I'm pretty sure that some of most of the stuff is clean. It is also tied in with the AW stats, which is clean. So I don't have, I haven't separated them out completely. Once I get those separated out, then that part will not be behind the curve or spiral.  I hadn't been asked where I was supposed to give them beforehand. So they're on my laptop.  They will be made available. A general talk right, which turned into a 20 page thesis that I'm writing on all this stuff, which is in much more long form, will be a blog with all these slides tied into it also. So there's more information on what this slide's meant. Yes, sir. There is no way to track specific path to model. All I can do is I can go through the downloads. Young does not give you any information about what package was being installed. Young only says, pull down the metadata, give me a list of mirrors that are close to me. And I will go to that mirror and pull down all the packages I needed. Sometimes what I found is I was doing this and testing it out. Sometimes if a system only needed one package for a whole stuff, you get the package they wanted. If they needed 20 different things, you will get a ton of packages being pulled in and all their dependencies and all those sort of stuff. And it's very hard to tell on a lot of these packages they need to depend on each other, what the request was.  And if somebody has a partial install of those packages, it's... Now, if there's a large enough R data thing, and somebody who knows how to massage data, you probably can clean it out. Okay, I've got three minutes and the guy is going to beat me with a club. All right. Anyway, so I can't pull out... This data that I pulled here was a best guess. I went through six months of data. I looked at all the things I then sorted of what was asked for off of our own mirror boxes the most. I then went and found all of the internal IPs and all the build centers like the CentOS build system to pull in packages from Apple. And I disallowed those because I figured a build system is going to pull in everything and we can't... I can't... There's too much noise. This all came out from that. R, then I went and did some reverse stuff, which is the part that I... I... Where I'm feeling kind of clumsy because I don't know if I'm...  But NASA, CERN, things like that. Climate Bay and fail-to-ban and security stuff like that all over. Rackspace uses a hell of a lot of that. NGIX and Node.js. A lot of that. You come out of AWS and things. Not just everywhere. Configuration management everywhere. After you get to the first... There's like a 10 packages, maybe 10 packages that have like a high number of hits. Most of those packages are actually Node packages, not leaf packages, but limb packages. They are all required by other things. So I had to... Then the next set are leaf packages because a leaf package... Multiple leaf packages might pull the same limb package and that bumps the limb package up. Pulling all that out, I got these. If I went for the other stuff then lib something, lib something, lib something would be our most used packages. It's hard to get real data. I can get some off of sub-mirrors. Some people will give me some data off their mirrors and I can kind of do that. The problem is a lot of the mirrors also end up being... They only see half the transaction. They may see only some of the downloads and then for whatever reason. So you see this thing where somebody pulling a package and you're going, that package makes no sense or they pull in the same package 30 times because they didn't get the package all the way downloaded. This type of data is really noisy. So I really would like to have find somebody who knows how to obey that doesn't give you dinosaurs and that. This stuff, like I said, I can make available. It's this big CSV file that I'm going to redo as a large JSON or MongoDB or something because the big problem with my thing is it's an AUX script that I wrote to go through this three years ago for a... Somebody needs to do a talk in two hours and I need this data and it's been added on and added on and added on. It's like four AUX scripts so and a Python thing and some other stuff all kind of tied together. Yes, it's become very temporary. So like one of the problems is, is the way I broke it up, the PPC data is all PPC data. It doesn't re-differentiate to PPC 64 and I have to go through that with a separate script. So when I'm looking at the other data for the computers for all of Fedora, most of the PPC users are Apple Mac users on Fedora 12. They're pulling the PPC 32 down. They don't. They don't. They've never upgraded since then. Yeah. But the other problem is that this data is representative. It's only useful in that you can only use it for determining sort of what's going on. Most of those PPC users are mirroring this stuff. They're going to have a mirror locally. I'm not going to see it most of the systems like the ARM boxes or anything like that. They're going to have it in the satellite. They'll pull Apple into their satellite and all their PPC boxes. I mean the Lawrence Liverbott Miller systems I know of that are PPC. I don't see them. I see one box. I know there's 70,000 of them in the cluster or something like that. So I don't want people. I don't like to use these numbers too clearly because it can be where people go, well, you know, we shouldn't focus on that anymore. Although x86 32. Anyway, I'm done. Thank you for your time and questions. We will now go to our next talk.


Hello friends welcome to this session on polynomials and we are going through the Problems related to zero of a polynomial So in the last session we learned what a zero of a polynomial is zero of a polynomial is the value of the variable Which makes the value of the or which reduces the value of the polynomial to zero, right? That is what we learned now here is the question which asks you to prove that or show that a Given value of the variable that is in this case x equals to one is a root of the polynomial or The zero so we did not mention last time zero zeroes are also called roots The name is root so root or zero are interchangeably used So the question is show that x equals to one is a root of the polynomial 2x cube minus 2x square plus 6x minus 6 Okay, how to prove this or how to show that The x equals to one is a root or you know Zero of a polynomial. So basically what did we learn we learned that if so this is a solution so if x equals to a is a zero or Root now we know another name root of a polynomial of a polynomial poly normal then Polynomel which polynomial px. Let's say px then P of a is zero That is what we learned so that means if in this case x is x equals to one is a root of this polynomial Then let's find out Let's find out P1 Right px equals to one So what if what is the value of px if x equals to one? So this will be simply 2 Into 1 to the power 3 minus 2 into 1 squared Plus 6 times 1 minus 6 Isn't it so you have to simply substitute x by 1 ok so let's find the value This is 2 minus 2 plus 6 minus 6 and hence This is indeed 0 so since P1 is 0 so we can write since P1 Since P1 is 0 therefore 1 or x equals to 1. Let's write it like that x equals to 1 x equals to 1 Is the 0 root of px Hope you understood this right. Let's take another example. So in this example We have to show that x equals to 3 is a root of the polynomial px equals x square minus 7x plus 12 Let's try to show that how to do that. You know already now So what you need to do is you have to simply find out p of 3 and Check whether it is coming out to be 0 if p3 is 0 then 3 is the 0 or the root of the polynomial Px so what is p3 folks p3 is 3 squared minus 7 times 3 Plus 12 isn't it? simply deploy x equals to 3 or substitute x by 3. So what is this 9 minus 21 plus 12 Indeed it is 0 right therefore P Since p3 is 0. So you should you should write since since P of 3 is 0 therefore x equals to 3 is a 0 of or root of Px Okay, so with these two examples I think now it's clear how to find out or how to show whether some variable value is the root of a given polynomial


Hi everyone Joe for josephyscasebreaks.com. We're gonna give away some immaculate 2018 immaculate football random team spots Inside this prism football hobby pack break. Let's do the break itself first before we give those spots away A big thanks to this group for making it happen. Appreciate it All 32 teams are in let's roll it randomized names and teams one and a five six times each one two three four five six and then one and a five six times the teams two three Four five and six All right, so there's the first half of the list right there. No trades and There is the second half of the list right there Now let's just alphabetize this up and let's print it out and let's find to figure out which pack we're gonna do the pack Is gonna come from a fresh box. All right, there's the fresh box of 2019 Here is the final printout hot off the presses and let's Just this little bit here And let's see which box we're gonna do and so the future filler packs breaks for 2019 prism football will will all come from the same box all right, so from I Guess here's what we'll do first. There's one two Deserve from top to bottom one two three four five six seven eight nine ten eleven twelve So we'll do one two three for the top six four five six for the bottom six And that's gonna be four one two three four five six will be bottom six And then we'll do one two three four five six So on the dice, we'll go one two three four five six Simple as that This is random as it's gonna get and it's gonna be five so one two three four and five Next pack, I'll just grab a pack as randomly as I can last time All right, there's an auto coming out. I think it's an auto. It's flipped around. It's the ante Thompson Not the cardinal we want to see here in 2019 But still an auto going to Matt Not randomized the cardinals Maybe his teammate is somewhere in Those other packs. We got another one box break loaded up or a one pack break loaded up And we're gonna give away immaculate spots in that one too. All right now. Let's gather everybody's names here New dice new list and it'll be the top six after Seven we'll get immaculate spots 2018 immaculate football spots Good luck one two three four five six and seventh and final time So after seven top six so from seven through thirty two Sad times But there there will be at least a couple more opportunities And there's still full spots available. So if you want to give that a go give it a shot But thank you for trying top six happy times to you because you're in that 2018 break Joe is happy So it's Steven Matt Joe Thomas and Matt congrats to the top six. We'll see you in that 2018 break Maybe a little bit later tonight. Ask these case breaks.com


When your drivers are not up to date, there is a chance that you will not be able to use various attachments with your PC. So how to update all the drivers with just one click? Simple. Go to smartdrivercare.com and click on download now. As the software downloads, click on re-scan under scan drivers. In a while, all the drivers will be scanned and you will be informed about the number of outdated drivers. Choose to update all and every outdated driver will be updated. You can even choose to update individual drivers from the list below. All done. Now you can even take a backup of the drivers in case you want to roll back later.  Click on start backup and all your drivers will be backed up in the folder you have just selected. Now click finish to end the process. Now you can go to restore to get the old drivers back. Choose the right folder and select restore now. A warning sign will appear on the screen. Simply click OK and later restart now. If you go to action center, you can find other recommended software by Sistweek. We hope you have learned how to easily get your drivers updated. If you like the video, don't forget to like, share and subscribe to our channel.


Hey everybody, welcome to The Waldoch Way. I'm Jessica. In today's video, it's going to be a look inside the Julia Rothman Companion notebooks. I don't know about you guys, but I feel like owning these books is almost like a homeschool ride of passage. Like, we all own them and they're sitting on all of our shelves because you're not really a homeschool mom if you don't own them, right? But here's the problem that I have with these. They're gorgeous and I love all of them. I love the nature, I love the farm, I love the food, I love the ocean, and I love getting them out. But I just don't get them out as much as I would like because I don't know what to do with them. And they're gorgeous and when I do find the time or the way to incorporate them into our lessons, I'm always like just in awe of how beautiful they are, but I just don't know what to do with them. And so I have a solution because I finally found companion notebooks for all four of them, for the nature, for the food, for the farm, and for the ocean. And the companion notebooks basically take each of the books from start to finish and turn it into a notebook for your kids. So what gives them an activity to do to notebook their way through each of these books. And that makes me so excited because I told you guys recently about how we do a nature in our homeschool and we love getting outdoors but it's a little more difficult to do that in the summer. So I cannot wait to incorporate those notebooks or the companions to these into our homeschool for this summer when we can't get outside, we will still be able to do nature by working our way through all of the gorgeous Julia Rothman books and I can finally get them off my shelves.  Follow along with the topics in the Julia Rothman collection using written narration, drawing, labeling, and more with these companion notebook journals. There is no prep work involved. You simply grab the copy of the book and your notebook journal and work at your own pace. One of my favorite features of each of the notebooks is that they all feature tons of extra printables that relate to the topics at hand. So at the very beginning, you get general ones and then at each chapter, you get ones that are associated to what you're learning about in that chapter. As you can see here, the notebooks follow along the Julia Rothman Anatomy books perfectly. Something really awesome is that right now, if you buy the bundle of all of the Julia Rothman companion notebooks, the nature, the farm, the ocean, and the food, you get a fifth bonus free notebook and that is the birding notebook which is a companion to the Audubon birding adventures for kids. Using the birding notebook alongside the Audubon birding adventures for kids, you will learn about 25 birds as well as their habitats, beaks, feathers, and more. You can document your birding activities in your notebook and portfolio and use the journal pages for bird walks.


It's like there's two ways of looking at things. You have Muslims that never come to the mosque except through Eid. You can look at that in two ways. You could say that, these people never come to the mosque and criticize them. Or you could say from a different perspective, at least they're coming to Eid. I would rather them come to Eid than not have any association with Islam whatsoever. At least they're coming to Eid. Our Prophet ﷺ said that the hour won't come until people no longer stay in the earth, Allah, Allah. I used to be, because I've had a very privileged, to be around people like this from the beginning of my as-salam, that when I was at UC Berkeley, I was exposed to people, Muslims, that I was like, oh my God, I was so shocked. Some of these people, I don't know if they've ever said, Allah, Allah, Allah, once in their lives.  But eventually you will be a person of paradise. So there's two ways of looking at things. And that simultaneously, while we encourage people to follow the sharia and to give rights, and at times you have to be, because if they're taking people's rights and they're cheating, no, you have to come down hard at certain points to warn them from what they're doing. But as you warn them and so forth, is that you never make them despair from Allah's mercy. You know, I would, I would, it's like, they ask Shukr Abu Bakr bin Sadim, is that what do you do if you make dhikr and that you never concentrate in your dhikr? And some people might tell you, what's the use of it? Don't make dhikr. Shukr Abu Bakr bin Sadim said, no. He said, he says, thank Allah Ta'ala that He is Zayyina Jarehate min Jawahra had bi dhikri. He said, thank Allah Ta'ala that He made one of your limbs, at least remember Him. He said, because even if you're only mentioning Allah with your tongue, that your heedlessness not making dhikr is greater than your heedlessness making dhikr. So in a sense that, obviously, that's not the ideal state. The ideal state is to be present with Allah and to have adab and so forth. But there's always two ways of looking at that. So it's both are true in a sense. But at the end of the day, that I just have a lot of compassion for the people of the time. It's very difficult. You know, I had a deep conversation with this, like with Sheikh Faraz and that we were talking about like how difficult it is for Muslims in, excuse me for mentioning countries in places like Syria and in Pakistan and in India, in other places in Afghanistan to live an upright life and just to not take rushwa and to be in Egypt and to actually have an honest income and not have to pay someone off and not to do something haram to make your business go like, it's very difficult.  But it's hard for people. The bureaucracy and the red tape just to get the simplest thing done is hard for people. So our time, you have to have a soft spot for people in a deep mercy. While at the same time, principle is principle. But what happens is if people don't have that mercy and they come down on these people they push them away further and that becomes the difficulty. So the fine line between the two is a time and place for everything.


Welcome to the weekly recap. Today is Friday, December 2nd. Hope everybody had a great week of trading. Put on a lot of trades this week, took off some, did some adjusting trades. A couple housekeeping notes I just wanted to mention. At the request of some of the subscribers we've decided to, we're gonna put a little bit more commentary related to each trade. So when you get a text message, it's still gonna go out as just the trade alert. But when you log into the site under the post that we go over here, you're gonna see a little bit more commentary on each trade going forward. So let's jump into the trades starting with the trades on Monday and go in order that we made them. So the first one we made was in XLF, where we sold a straddle. So if we took a look at XLF where we're at, we're still well within our range. Implied Volatility has spiked up a little bit since then. So our profit line is down a little bit, but nothing to do here except for weight. If we go to the next trade, which was a closing trade in EWW. So this is a trade that we put on back on 1121. So last week, and we took it off seven days later for a nice profit, almost 40% of max profit for about $105 profit total. We did an opening trade in Ford slash ZS, which is an iron condor in the soybean futures. So if we take a look, take a look at ZS. As you can see, we're up a little bit of profit in that trade still well within our range. Hopefully we can get a little bit of a move up in soybeans next week. Take that off for a nice profit. Next trade we did was, I sent out an alert earlier in the week, there was some issues with the some coding coming through on the text messages. We've got that issue fixed, working with the developer, so that should be all set and good to go. If we move on to the next trade here on the 29th, so on Tuesday, we sold a strangle in Ford slash ZB, which is the bond future. So if we take a look at the bond trade, as you can see, we're pretty well centered here still within our range, nothing to do here except for weight. After we took off our EWW trade, we actually, a day later, we ended up putting another one back on in the January cycle. And so that one was just put on, so there's not going to be much to do here. We're up a little bit of money in that. As you can see on the charts, volatility has had a nice contraction. We've got to go to EWW. Volatility has had a nice contraction. After the election, we're starting to see some fear ease in Mexico. And so we're still well centered on our trade in EWW. So moving along, the next trade was an adjusting trade in CL, which is the oil future. This one needs a little bit more explanation just to make sure that you're clear on what we did. So essentially what we did was we had a strangle on in the oil futures. And it looked like this. Now price had a huge move to the upside and it breached our short call. And so that's when we needed to adjust. And so we did so. And so essentially what you do when you adjust a strangle is we're rolling up the untested side, right? So we're rolling from the put from where it is up to the 30 delta. Now the thing you want to remember is you want to make sure you know how many days are left until expiration. In this case, there was only at the time of doing this, there was 15 days to expiration. So we don't want to do it in that same January cycle. We want to roll it to the February. So what we did is we rolled that from what looked like this. And we roll that to the 48.5 call and the 47 put. So now it looks like this. So now we've got a little bit more of an narrow range. We still have room for oil to pull back and give us a profit, but by extending duration and rolling our puts, our untested side up closer to the money, we collect more credit, give ourselves more time to be right on the trade. Now if oil keeps moving up, you know, we may have to make another adjustment, but as of right now, we just sit and wait. If oil makes a decent move down, we get more of a contraction and volatility. We'll be able to take this trade off for profit. Now we also have another strangle on in oil. Oil is a great trading vehicle. As you can see, we're in the profit here. Well, within our range, nothing to do except for weight on oil. So let's go back to the trade list. Move on up. So in GLD, we had an adjusting trade and GLD has been really on a pretty good size move to the downside. As you can see, gold has just been falling, but implied volatility has stayed high, which makes it a great trading vehicle. So if we look at gold, we've got this iron condor on here. So we've got that. We collected more credit by putting that on. Then we've got the two put sides still there. So we've got this put side, which is down. If we get a move up in gold, we'll take that off and end up collecting more money on the trade. Then we've got this other put spread from a previous iron condor that's well in the money. Probably not going to come all the way back, but you never know. That's why you keep it on. There's not much else we can do with this because it's going to be a losing portion. But that's why you continue to put on iron condors and take off the winning side. So as gold moves down, we take off the call side, take in that profit, put on another iron condor. It kept moving down. We took off the call side, took off that profit and put on another iron condor. And so sometimes you have to manage these trades for one, two, maybe even three months. But that's the value of this adjusting because we want to take advantage of that high implied volatility. We don't want to exit our losing trades because when gold had a massive move like this, there is a chance that it could come back up. And we want to be there to take advantage of that. So this is the best way to manage your iron condor trades is continue to collect that credit, take off the winning size of your iron condor, put on additional iron condors and continue to massage and manage that trade until it until it makes sense to take it off. And that's typically a once implied volatility contracts. So keep keep sticking with that that process. And in over time, you're going to have a very profitable equity curve. Just sometimes it seems like it takes a while but don't don't get discouraged. Keep keep doing the necessary adjustments and it'll work out in the end. Let's see. So those GLD I mentioned we added that iron condor. And we moved that out to the January cycle because there is less than 15 days left in December. In QQQ had a nice profit there back on 11 four. So November 4, almost a month ago, we put that trade on. And we sold that for an 86 cent credit. We bought it back here on December 1 for for 31 set debit giving us a profit of $55 per contract. We had four contracts about a $220 winner on QQQ. So that was a nice trade. Let's see another adjusting trade in XBI. So let's take a look at XBI because this needs a little explanation. So what we had on was we had on this trade here, where we had, we had rolled one of the sides down, we rolled the calls down. And so we were just continuing to wait. And we got down to the point where we only had 15 days to expiration. So that's our point when we want to start looking to either exit the trade or roll to the next to the next expiration cycle. As you can see an XBI implied volatility still continues to be above that 50 range. So still a good position that we want to have on. So all we did was we simply rolled that from December to January. Now the the nuance here that I want to point out is in in our December trade, we were at the 64 call and the 62 put. But when you go out to the January cycle, there there's no 64 strike available. So what we did is we moved that to the 65. Okay, so you just go to one strike in either direction. And that's and that's just fine. So we we took off our December trade, we rolled that to January. And look what look what happens when you do that. Look how much wider the break evens are. So I'm going to go back and click on that again. Look at where I've got the the break evens on our December trade marked with these hash marks with these price slices. When we move it to January, what's what happened? Not only does our break evens widen extremely, but our profit potential goes up as well. And so now we're giving ourselves more duration, we're giving ourselves more time to be right. And and we're we're staying in the trade and trying to get a winner out of that trade. So we'll we'll continue to monitor that and send out any alerts that that makes sense for XBI. Next trade is another adjusting trade in XLU kind of same story. If you look at XLU, this is where we were before we made the adjustment kind of a tight narrow range. If you look at XLU implied volatility is still great, you know, we're getting 90 on the IV percentile. So we want to have a position on an XLU. But we're down to that point where we're 15 days or less to expiration. So we wanted to roll out to the next expiration cycle. So we just simply use the same strikes. And because it was pretty well centered, and we moved out to January. So again, look at what happens to our break evens when we roll. Our break evens went from where these price slices are all the way out to these red hash marks, right here to way out here. So it gives us a much wider range, gives us a higher profit potential. So now we sit and we wait for a contraction in volatility so we can take this off for a profit. Or if we need to make another adjustment, we will. And we just continue to play the game. Let's see next trade was in GDX. This was a trade that we made today on Friday and this was an adjusting trade. And same thing we simply got a nice move up in GDX today. So we were able to go from this to and we just simply price was way down here. I thought we were going to potentially need to make another adjustment, but we had a big move up in GDX today up almost three and a half percent. So we it was a great day to roll. So we rolled that up widened out our break evens gave ourselves more time to be right. And so now we continue to wait. And lastly, we put on a new opening trade in XLV. So let's take a look at XLV. Just put that on. So no profit, no loss, still right in the middle of our range. And so we'll see what happens in XLV next week. As you can see we're going to put this on Ivy percentiles at about 53 had a slight contraction down at 50, but nothing to do in XLV at this point. So I hope that was helpful. If you have any questions, please feel free to post those in our forum. We're really trying to get members to start posting questions instead of emailing us post them in the forum. That way we can answer more quickly and other subscribers other members can also jump on there and and help you answer any questions that you might have.  So anything that you need to have answered, feel free to post in the forum. We'll talk to you next week. Have a great weekend.


What's going on, everyone? Sam here with late in sports cards. We're up in one box at 2022. Petite Prism football hobby for Mohamed. So good luck here at Mohamed. Let's do it. Brilliant. J. J. Jennis. Quan, Briskar, Hyper to 175 for the Bears. Not going to sleeve every rookie right now, Mohamed. I will denote which ones need to be sleeved and top-loaded. Jameson Williams and David Bell. Same with your inserts. All of your numbered stuff and hits, I will sleeve now. Silver, Treston, Ebner. Rookie for the Bears. Got a purple-powered Forrest Buckner. 11 out of 49. Quan, Briskar, it's Rick Woolen. Silver all-out is Jalen Hertz. Purple, not purple. Blue Ice, 299 is DJ Moore. Color match for the Panthers. Carson Strong and Jake Ferguson. Bailey Zappi, emergent. Red Wave, Kyle Hamilton, 149 for the Ravens. Cool one there. Again on the Rookie there as well. Skyler Thompson and Jahan Dotson. Silver, Coleal Mack. Orange, Marshall Falk for the Rams, the 249. Nice hit there. Congrats on that. Some Vetsauce for you there. Derek Stingley and Alante Taylor. So we've got our first auto coming up. Silver, Jimmy G. We've got Tori Holt, 25 of 25. That's awesome. On the Camo Auto for the Rams. Nice one there. Part of the greatest show on turf. Let's go. That's sick. There you go, Muhammad. I love it, man. That's so cool. Flashback Auto. Malcolm Rodriguez and Drake London. New recruits, Desmond Ritter. Orange, Jonathan Taylor to 249 for the Colts. Samir White, Louis Seen. Orange Wave. Come on, let's make it a big rookie. Big rookie. DJ Moore, Hype, Kyle Pitts. It is to attack by Loa. Not bad. Orange Wave, 1360 for the Dolphins. Kind of a secondary color match as well. Very cool. Ikemaquanu and Isaiah Spiller. Red Wave Auto coming up in here. Silver, Ray Lewis. You've got Tariq Wullen. Nice. 78 out of 149. One of the probably the biggest steal of draft, I would say, right here. Tariq Wullen. Fifth rounder on the Seahawks was like a third in rookie of the year voting, I would say. That's awesome. Congrats on that. Romeo Dobbs and Troy Anderson. See like a finite come out of here now or a case hit. Purple Harrison Smith to 125 for the Vikings. Troy Anderson, Calvin Austin. Two packs left here. Oh, nice. Navy Camo coming up. 225. Silver Brilliance Mahomes. We've got Chris Jones. Navy Camo. That is 21 of 25 for the Chiefs. Very cool. Congrats on that one. We had a Isaiah Pacheco and Devon Lloyd. That's been good smack. What's going on, man? Been good. Silver fireworks, Aaron Rodgers. Purple Ice Tyler Boyd to 225 for the Bengals. Jack Jones and a Brock Purdy to end it. Not too bad. That'll do it for your break there. Thanks as always, my friend. Get them right out to you, buddy.


Hey everybody, Sean with jaspyscasebrakes.com here doing a 2020 Panini Select Blaster one box break, 15 spots, everybody gets two random teams in the break. The blaster itself isn't the crazy thing. We're also giving away a spot in Sterling 2020, random hit number two. So whoever gets the spot in this will end up getting a guaranteed hit out of a top Sterling 2020 box. So here is the box itself. We're going to do a randomizer as far as the list. Me? No one. Yeah, they're a dark team. What do you say? No, everyone else is doing that, but except for baseball, baseball, they're still flying around. Look at that balloon. So since we're going to double this up, what in the world is happening? What a weird year. 2020. No, but Cody Belger missed on a pitch that he thought was like the beat pitch. And then you can hear me all, ah! So 15 names from... So we don't know like crowd noise, it's like you're going to hear stuff like that. Chad down the Jeremy, we're going to double this up.  And then we're going to take the teams from the Diamondbacks down to the Nationals and we're going to do a dice roll. New dice roll. See how many times? We're doing a five and a five, ten times on both lists. One, two, three, four, five, six, seven, eight, nine, ten. And 10th and final time from Anthony down to Tyler. On the teams, ten times, one, two, three, four, five, six, seven, eight, nine. And 10th and final time, the Nationals down to the Red Sox. Ryan Harrell to give us many reasons why you should not go without insurance just in case you wanted to check the chat later. Blaster box break here, so we're not going to go crazy as far as listing everybody's names. You can see, make sure it's all on tape. Boom. I'm going to randomize, sort this out by teams. Here's the blaster. They might, yeah. I think they're still working on getting the challenge right. Ryan, I used to work for an auto insurance company back in the day in the claims. I know what you're hearing. Yeah. Three packs. Gonsolin, Tommy Pham, Scope, Jeff McNeil and Eduardo Escobar. Tommy Pham, Scope for the Padres. That is Ryan Harrell. Paul Goldschmidt to $199 for the St. Louis Cardinals and Jerry Magno. Alberto Montesey, Silver for the Kansas City Royals. Ryan Harrell, Alberto Montesey, Sensation, Silver. Also going to Ryan Harrell. And Brock Burke, Scope for the Texas Rangers. Going to Ryan Harrell. So Ryan Harrell break for you guys. Now we're going to randomize the spot in Sterling. We're going to use the original list of names, all 15. And top name, we'll be getting the spot in Sterling, random hit number two. So you can see Chad down to Jeremy just once for each person. And Dice Roll, we're doing a six and a three, nine times for the free spot in Sterling, 2020. Good luck, everyone. One, two, three, four, five, six, seven, doing it nine times. Eight, and ninth and final time, name on top, Ryan Harrell. Congrats. Is that for a winning spot? Yes. Ryan Harrell with the free spot in Sterling, 2020. Ryan and I are going to be best friends. That was the blaster box. Select blaster box number 16 with a free spot in Sterling, 2020. Random hit number two. That'll be coming up right after this. If you'd ask me to casebreaks.com, I'm Sean. See you later.


Welcome friends, welcome to the session. Today I am going to tell you a story. Bycon India 2012, my first open source conference. I was feeling totally out of place. I was hearing all the alien words like patch, commit, bug, etc. Suddenly I heard something familiar, licensed. I just ran towards the conversation and I heard all the conversation, all the legal conversations to be precise were ending up with I-A-N-A-L. What does that mean? So before going to the story, a statutory disclaimer. A talk shield is not a legal advice. If you need a legal advice, please contact a lawyer. Before the story begins, a little bit introduction of the storyteller. Hi, I am Anvesha. I am a lawyer by profession. I am a pie lady. I am an organizer at Pie Lady's Pune from India. I use Python to shape my legal projects. I work as a blogger at Python Software Foundation. I also write my personal blog at anveshadas.in where I translate legalities to English.  So the love for Python runs in the family. So back to our story, I-A-N-A-L. As I said, all the legal conversations were having these I am not a lawyer phase. After that, there was some respect kind of look for me. There was some safe distance kind of looks for me and not to forget. Some, oh, I feel sorry for your brother kind of look for my husband. All these things together made me interested in the legal field of the open source world. So both the lawyers and the programmers use language as a tool to achieve our goal. But both of these species does not really understand what the other is saying. So let's begin the session with the hope that we'll be able to understand each other in a better fashion after the end of the session. So what is this open source world is all about? This open source world is actually made of two things. Firstly, a technology. Secondly, a good community. A good community consists of three things. Contributor base, a very strong contributor base. Secondly, a strong and just administration. And thirdly, the strong licensing model. Here comes the tricky word license. Now let us understand what is license. So when I asked a few developers what do they understand by the term license? This is the blank look I get most of the time. Some developers told me licenses is something that protects my code. It's very smart and apt. I don't care about license. It bores me so true in most cases. A federal upstream said that very sadly that I have to fill up the license name unless they won't match my package in Fedora. So he was very sad about the fact. So what is actually license? What does a license do? Let us take a very practical analogy. What does a driving license do? Driving license gives us the permission to drive a vehicle on the road. Similarly, a software license gives us the permission to do certain things with the software. Who gives us the driving license? It's the motor vehicle authority. And in case of a software, the owner of the software gives us the permission. And under what authority he gives us the permission? It is the intellectual property right called copyright. What is copyright now? If we flip the word copyright, that is right, copy, right to copy or right over a copy. Therefore, the definition of copyright goes like this. Copyright is an exclusive right to use, distribute, redistribute, sell the original creation granted to the creator for a limited period of time. There are things like artistic works, cinematograph films, sound recordings. These are the purview of, these comes under the purview of copyright. So having said that, it may frown some eyebrows that how come software comes under the purview of copyright. So what does a developer do? How the developer, the developer solves a problem and how the developer will solve a problem. It's his or hers personal choice or expression. That very thing, personal choice or expression makes the software copyrightable. So now comes my project. So as a lawyer, I was, I am interested in the legal part. So I just analyze something. For that, I need to explain this slide. Pi PI is the Python package index. It is the official third party repository for Python, the programming language. Presently it has more than 10,000 packages in it, if I'm not wrong. It has one lakh packages in it, sorry. So here comes my project. As a lawyer, I was very much interested in how the licensing scenario works. Why, how come a developer is choosing a particular license and not choosing the other one? What makes him choose that one? How many projects are there without any license? Then I started this project. I wanted to analyze the licensing scenario of the Python ecosystem. As I said, Pi PI is gigantic. I just cut it, the gigantic volume of the Pi PI shot a bit. I chose, I wanted to choose top 2,500 packages of Pi PI. Then comes the problem, which are the top 2,500 packages? Pi PI provides, then this thing came in. This ranking system gave me a nice list of top 2,500 packages. Then I needed the license name. Pi PI also provides a JSON API. I queried that and I got the licensing name for each 2,500 packages. I wrote a Python script for that and I got the license name. After that, when I got the license name, this is something the scenario looks like. I got all these license names and this chart, which makes me understand that BSD is the most used license. After that, it's the MIT, GPL as in the GPL family as a whole. There are all the GPL versions in it. Apache is also 12% and there, if you can, a public domain is there and if you can see, 6% is no name. What is this no name or unknown? Where Pi PI can't provide any license name, it gives unknown or no name as license value. There are a huge number of projects, a good number of projects which doesn't have a license name. What I'm trying to do is that I'm trying to send a pull request to all these packages. This is the license you should write. You may want to write the license name. Presently, around 20 patches have been merged and the project is still going on. Now, we got all the license name. Now, let us understand what is the name, what is the software license? A software license is a legal document, it's boring, I know. But software license is a legal instrument which gives you the permission to do certain things. That is, use of the software, how you should use the software, how you should sell the software. All these things related to the software, all these conditions are written in a software license. Now, let us divide the software license. What are the different kinds of software license? We are going to divide the software license in how much restriction they are putting on the users. The first one is the commercial license. The commercial software license is something which is very heavy duty and it gives the users very little freedom. The source code is with the owner of the software. It remains with the owner of the software, the authority, usually. And all the rights of the user is provided in a end user's license agreement called ULA. The user can agree to it by signing it, by signing it or by just checking the box in certain places given. Or just by opening the disc, that is, it is called the shrink wrap or licensing. The gaming software, when you open the box, you are basically agreeing to the terms of that license. After that, it is the public domain. If commercial license is on this end, public domain stands on another pole, on another extreme. By public domain, you need to understand that public domain is not a license. When you are putting anything in public domain, what you are basically doing is that you are waiving all your rights.  Public domain, your software becomes a public property. There are basically three ways by which anything can come into a public domain. Firstly, there are certain things to which intellectual property rights does not apply. Secondly, when the time period, the copyright is given to the owner for a limited period of time. When the time period is over, secondly, the time period is expired. And thirdly, when you are waiving your copyright, that is by submitting into public domain. How you can submit into a public domain? Firstly, you can write it as public domain, the license as public domain. Second or another thing is that you can choose for a license.org or you can go for CC0, that is Creative Common Zero. Now, here is commercial license, there is public domain. On the middle part, it is open source. What is open source? Then as the name suggests and we all know, source is open. It's open, but what does exactly mean? It means by open source licensing, we are generally promising as provided by OSI. We are promising ten things as written in OSI. We are going for free distribution. So we can use our software as we wish to. And the source code has to be available. The derivative work, so if you consider your software as pizza, so not only you are giving the pizza, but also you are giving the recipe. And whoever gets the pizza, he will have the right to make his own pizza with it. You can do whatever you wish to do with your pizza. You can play with it, you can throw it, you can whatever you wish to do. So now we are going to divide these open source licenses. There are academic licenses which come from the academic institutions. These academic licenses are MIT and BSD. These are the example of academic license. So what does academic license do? Academic license is basically, it is really permissive. It puts very little restriction on the end user. And the difference between MIT and BSD is that BSD has a specific binary distribution clause while MIT doesn't have one. The next one is the permissive license. As the name suggests, permissive license gives you a lot of permission but less than academic license. In permissive license, the example of permissive license is Apache. In Apache, the permissive license does have a clause for other intellectual property rights also. Like in Apache, there is a clause called grant of patent license which provides a specific clause for patents. So if you are using a software for which a company has open source software, for which they are using a particular algorithm which they have patented. But if they are opening it in Apache, so you can use that software and you won't be threatened that the company will sue me for using that patented algorithm. There comes the reciprocal licenses. The reciprocal licenses, as the name suggests, these licenses are something you have to do some duties in reciprocity. GPL is the one for that. GPL actually gives us full freedom. The freedom to run the software as we wish, the freedom to modify our software, the freedom to distribute the software licensed under GPL and the freedom to redistribute the thing with the modification one has made. So now we have got a little bit in the slides from all the licenses. Now it's the best practices for the developers which what they can do. First one, choose a proper license based on the use case.  You are choosing the user base. So if you are writing a library or something like that, a library or module, you should choose something which is more permissive in nature so that people can actually use it. A license file, there should be a license file in your source code. The license file should not only have the license name but the whole license text altogether. Now here I want to mention that MIT has a clause that you have to mention the whole license text. Unless you are mentioning the license text, the terms of MIT won't be applicable. So for that you need to mention the whole license text in your license file. You also have to mention the copyright header. As you can see it's the example of request module where the copyright header is there and the license has been mentioned as Apache. There should be a set of .py, which provides the license in the set of functions. You can license as Apache. Also in the classifier you have to provide the license name. Mention if there is a reading file or something introductory similar to that which mentions all the project details, you should mention the license name and direct the license file from there. If patent is your concern, then Apache is the one for you or permissive license is the one for you where they have a separate clause for other intellectual property laws. Please do not invent your own license. Lawyers actually they do know a little bit. So they have written down certain templates. You can use license as templates. So please do not your own license and please do not merge the licenses. So if you are taking MIT and if you are putting a certain clause in it by your own you are basically not following the MIT. So please do not invent your own license. Try to choose from what you have. This is very important. Please keep your funny bones aside. Actually I have come across a license where it has been written. Don't be evil. There is another license which like buy me a free beer. So these things does not really go with the license document and these have other legal implications. I can give you an example that there is a particular case where the developer who has invented the license didn't really understand what is the difference between a condition and a covenant. So he has written it and after that the license was not applicable and he had to give away the software. Open Source Initiative has a very nice listing of what are the available licenses. So you can choose from there. Also Federal Project has a very nice listing. It's not working. This is choose and license from there. Choosealicense.com. There you will be having all these small things which you can actually read and choose a license from there. Choose a popular license. By choosing a license you are not only choosing a license or a making boundary but you are also choosing a community with the people you want to work with. There are certain licenses by which many people can relate. There are communities around those licenses. So choose a popular license which is popular in your community in the field you want to work. So with that I have come into an end and thank you. I guess this will be a little bit of help. From the next time onwards you will be choosing a license. Thank you. Questions? I'm just wondering with respect to things like this data how will the licensing apply? So for example you can write a code which basically analyzes someone else's data but will the license also apply to someone else's data in order to create some kind of program? So what you are writing on the source code the copyright will apply. There the software licenses will apply. So I guess what you are trying to say is that if I am working with someone else's data if it is permitted or not? Yes. In a sense whether it is permitted or not, whether it is kind then open source the codes without releasing the data. Without releasing the data? I am not very... In the ignore file I guess can you keep that thing? Two different things. Your data may be having a different license and you may have to buy it. But your source code has a different license which is a completely different thing. So the source code thing that comes under intellectual property law and working with data, someone else's data it comes under the purview of some other law it varies from country to country.


A priest of the Catholic Church and governorship aspirants on the platform of the all-progressive Congress APC in Benway State Reverend Fr. I since earlier has described a suspension order by the bishop of Bocco-Catholic Diocese William Aveya as a normal practice of the church laws. Fr. Ali has said that, as stated clearly in the letter of suspension, he is only suspended from celebrating public Eucharistic Masses but remains a priest of the Catholic Church forever. While making a public statement to journalist Ian McCordy, the governorship aspirant stated that he was fully aware of the decision of the church right from the day he took the decision to answer the overwhelming calls of Benway people to contest the governorship of those states. Having understood all that and known terms of the letter that came, I think in conscience it is an appropriate and right judgment that is made. It's not about me. The church is about salvation of souls and something tells me from above that the choice is not from me and about me but just about the poor people who have been suppressed, oppressed, forgotten and rejected. People, my people of the state who have been totally abandoned by our current regime. It is not in the bad light that later came. The church and the Roman Catholic Church is a political because we have all groups of memberships or partisan politics into the church. So if now the church chooses to be political partisan, there's something will be wrong. So it is in good faith that the lift that will serve me and I have assured my vision for the church and for ensuring that the right thing is done. I already knew the repercussions that would come. Please no one should throw any insult on my leadership of the church. It is my primary constituency after this mission of political salvation of this of my state. I'm going back into my constituency. I love my priesthood and I should be very clear.


And it's time for the long-awaited review of the lekkie micro trail pro Carbon fiber trekking poles now listen this channel and for everyone in high school or everyone in college like believe it or not There's a whole other genre of running that you might not even know about called ultra ultra running ultra marathons We're talking everything from 50k so 32 miles all the way up to yes There's quite a few races now that go up to 200 miles and even yet you can even get into like nice six-day races It's crazy stuff. Well in a lot of these races You are actually required to carry trekking poles with you basically for safety like the biggest race in the world for as far as Exposure and popularity in the ultra running world is a hundred and forty kilometer race in France it goes into France Italy and I think dips into Switzerland as well. I think don't quote me on that. It's called UTMB ultra ultra trail du Mont Blanc and you have to carry trekking poles in that race But for me, I made a little mistake I was training for a race last summer called run rabbit run 100 and I did not read the rule books in that race It's a hundred mile race. You're not allowed to use trekking poles So if you are interested in trail racing ultra running and you're Yeah, you have to basically you got to do your research because each race has different rules as far as whether or not you're allowed to use poles And we're not gonna get into the topic of whether or not you should be using poles in this video But I just want to say that I picked these up last summer and I love them I love them. Basically, I had plantar fasciitis in 2018 and I think the only reason that I was able to Attempt the hundred mile race. I didn't finish but I attempted it was because I was able to train with these poles And so these shafts here these carbon fiber shafts Both of them together weigh 13.4 ounces. That is pretty incredible Very lightweight like you don't even feel them in your arms, basically and they fold down So what's also nice? They fold down to basically 14 inches a little over 14 inches. So good for travel However, I have heard you got to make sure you can get it through security Unless you're okay with packing it under the airplane and now lekkie sells these poles You can't adjust the height just so you know you have to buy the correct height in advance Based on how tall you are. So I went with the shortest because I'm not the tallest guy in the world So it starts at 110 centimeters and I believe goes up to 135 centimeters for this particular pole And this trekking pole is just so well engineered. I just don't even know like okay the cork Let's start with a cork on the grip Very like even when you're in the middle of summer and it's hot out and you're sweating a lot in your palms You still have like I don't feel any slip at all even when this cork gets really wet from your sweat And then moving from the cork up here to the top of the pole. Oh my goodness Got to be the got to be the best feature of the entire pole. It's the lekkie trigger shark Locking system where basically based on this this glove wraps around your hand and you just lock it in And then it's there in your hand And then what what happens then is it takes the pressure when you're when you're pushing up the mountain It takes the pressure off your wrist off your wrist So you're not putting a lot of torque on your wrist and it distributes that That that power through the entire arm rather than just on your wrist And then on the bottom of the poles these carbide tips no issue like no issues at all as far And I've gone over some pretty rocky terrain with these carbide tips because I live in Colorado Like we're talking they are tough and even the basket here is still holding up pretty darn well Like and this little teeny tiny basket on the bottom. So Um definitely made for dirt over let's say snow even though there's a good chance I'll be using this pole next weekend at the America's uphill race and I will just say this They help they help a lot with going up hills now. Okay. I wasn't going to bring this up But I think I will I would recommend Not training with poles if you don't have to Now listen sometimes you get into some crazy terrain that is really steep and you really do need poles To help you get up some of these trails and you want to keep that running motion And I have a pretty strong upper body for my Height and so that's why I was really excited to use the poles for the 100 mile race because my legs They're strong, but at the end of the day, I don't have tree trunk legs So I wanted to get a little help from my bot my upper body strength And I would though Listen, we're runners. Okay, so I think if you can Strive to train more so without the poles And then if you are in a 50k, although you don't really use poles in 50k's too often It's more like 50 milers 100 milers for sure big big races Then when you get to the starting line and you get the poles You're going to be feeling so strong in your low in your lower legs That when you get the poles to push with your upper body, it's just going to help a ton So I don't like to rely on them, but they do serve a purpose at a particular time in your training and your racing But just know as I already mentioned some races do not Allow them and as far as my final thoughts oh and by the way keyword Lecky, can you spell it? Lecky, uh, that's the keyword. Thanks for hitting it up Would I recommend this pole 100% and listen, I don't have a ton of experience with trekking poles But I've probably put 200 miles into this pole these poles and frankly I see like nowhere and tear like they're just I can tell the design and the build quality Is there like I'm telling you like no issues at all Okay, maybe just a like a teeny tiny little dink in the cork there. That's it. That's it So I would highly recommend and the question of the day for this video Of course has to be have you ever used trekking poles? How was your experience whether hiking or running like you know mountain running like it could be either I'm just curious and what was the brand or the model that you used I'd be really interested to to really learn more because again I don't use them very often right now because I'm not getting ready for a 100 mile race.  Believe it or not It's it's march 1st when I'm recording this so good news That means summer is around the corner and you're gonna be hitting those trails and you know, it's good to think about Okay, what is the it's not too early to start thinking about what is the gear that I'm going to need For the to be the best that I can be In these ultra races. Ha good times good times in the studio or the polio. No, god I love That wasn't funny. That wasn't funny. Seek beauty work hard And love each other. Oh lekkie. I don't know how to pronounce it lekkie lekkie. Maybe it's lekkie lekkie. We'll call it See you tomorrow