Hey, this is Brett, and this 2021 GMC Sierra 2500 Crew Cab Long Box Work Truck is stock number 12795Z. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used heavy-duty truck headquarters. This 2021 GMC Sierra 2500 has the 6.6-liter V8 gas engine. It puts out 401 horsepower. This truck has been fully-safetyed and inspected by our service shop per the state of Wisconsin inspection process. It has a fresh oil and filter change. All the fluids have been checked and topped off, and this truck is 100% ready to go. We're going to go all the way around in this video, inside, underneath, start it up and take a look under the hood. Summit White is the color. We shoot all of our videos in 4K, so if you have HD capabilities on your computer, tablet, smartphone, or television, I highly recommend turning them on right now. Because it is your best way to check out the quality, condition, options, and cleanliness of the truck before seeing it in person. And if you like the video and how we do things here at Summit Auto, in the lower right-hand part of the screen, there's a subscribe button to our YouTube channel. Consider clicking that, and then click the bell notifications. You'll get updates every time we do videos here of our new and used inventory at Summit Auto. This one comes with the steel rims. Very nice condition. Firestone Transforce LT245 75R17 tires, and these tires have probably about 70-80% of the tread left on them. Frame and underbody is extremely clean. This is a one owner out of North Carolina, so it's never seen salt. Driver side front fender is in excellent condition. It does come with the LED headlamps. Front bumper is in excellent shape. I didn't see any dents or dings on there. Looks really good. Light lenses are nice and clear, and the hood is in fantastic condition. No dents or dings on that. Comes with the gloss black grille, and that is in nice shape. Passenger side front fender, no dents or dings on there, and the passenger side rim is in excellent condition as well. As you go down this side of this 2021 GMC Sierra 2500 Crew Cab Long Box, take note of how clean the body is, how reflective and mirror like that paint is. We take these HD videos, so if you are far away or even if you're close by, and you just cannot make the trip down, you can still see the truck here, the truck and have confidence in the vehicle that you're looking at before you even get here. So when you do get here, there's absolutely no surprises, and you can make a smart and informed buying decision from wherever you're at. And if this video helps you make that decision, let your salesman know that you saw the video that it was helpful, and that Brett sent you. Very clean down that side, this back room is in excellent shape as well, and the back tires look like they have probably about, I'd say, 50 to 60% of the tread left, maybe a little bit more. So about the same as the fronts, maybe a little bit more. Frame and underbody, exceptionally clean, very little to no corrosion, has all the remaining factory exhaust, and the underbody is very clean on this truck, does come with the side box steps, and the lower rockers and cab corners all look really good. You may have noticed it has a huge ladder rack on it, looks like it's all stainless steel or maybe aluminum, but it's in nice condition. Tailgate is in excellent shape as well, it ain't seen any dents or dings, and the rear bumper is in very nice condition too, does have the rear bumper steps, full towing package which includes a receiver hitch, four pin and seven pin wiring, and it does have the drop down tailgate. Bed is in very nice shape, just a little bit of light duty usage, comes with a toolbox, and it also has a 120 volt 400 watt plug-in. You also get LED bed lighting back here. Tailgate shuts nice and solidly, and as you come around the driver's side just as clean as that passenger's side, no dents or dings on the box, and for full disclosure this back rim is in excellent shape as well, and that pack, this back tire has just as much tread as the other back tire. Down the rest of the side of the truck looks really good, no dents or dings on the cab, or the doors, does have the telescopic tomers built in directional signals, they telescope out like so, and then they fold in manually. Inside the work truck package comes with the black vinyl interior, you get the 40-20-40 split bench seating, there are no rips, there are no tears on the seats, they are in excellent condition, does come with the heavy duty rubber floors, auto headlamps, push button four-wheel drive, tow haul mode, cargo lights, that's how you turn on those LED bed lights, and it does have power windows, locks, and mirrors. We'll hop inside, check out the miles, radio, and everything that this truck has to offer on the interior. Alright, we'll check out the miles and everything inside, it has 9,453 miles, you do get the digital spinometer, instrument cluster is very nice and clean, does come with cruise controls on the steering wheel, and it also comes with the six-speed automatic transmission with the optional tap shift. Comes with the GMC infotainment system, you can see you get Apple CarPlay and Android Auto, so you can project your cell phone to the screen, and if you have a nav system on your phone, such as Waze or Google Maps, then it's like you have Navi on the screen, but this one has AM, FM, and Sirius XM radio capabilities as well as your Bluetooth, and this is also where your backup camera shows up. Down here are your climate controls, your power drop-down tailgate, stability control, hazard lights, that's how you turn on that plug-in in the bed, and it does have a 120-volt, 150-watt plug-in inside, USB, USB-C, and the factory brake controller. Heavy-duty rubber floors, passenger side seat, and floor are in excellent shape. I don't think this truck's ever been smoked in, the headliner is in fantastic condition, and for being a work truck, this one has not seemed to have been worked very hard. You get map lights, on-star and SOS buttons up there as well. We'll take a quick look at the back seats, and then we'll start it up and take a look under the hood. Back seats are just as clean as the front seats, no rips or tears back here, it does have the latch child safety system for any child car seats you may have, fixed glass rear window with the built-in rear defrost, those headrests do fold down for better visibility, and these seats fold up for better storage, and it's almost completely flat back here. You do get child safety locks on the back doors, and the bottoms of the doors all look really, really good. We'll start it up and take a look under the hood, we'll also check out that backup camera. It starts right up, no check engine lights or anything like that. Backup camera is working nicely, and they've worked really hard on these gyms to make those cameras pretty crystal clear. I would personally like to thank you for checking out the video today, and hopefully from this HD video, you've been able to verify the quality and condition of this truck all the way around there, all those LED headlamps and running lights, they're in nice shape, really bright, and it does have the clearance lights up top. Under the hood we have the 6.6 liter V8 gas engine, engine base very clean, runs very smooth. Once again, this truck has been fully safe and inspected by our service shop, has a fresh oil and filter change, all the fluids have been checked and topped off, and this truck is 100% ready to go. There is your emissions sticker. Shock's to do a nice job holding the hood up, and I would highly recommend this truck for make quality and condition standpoint. And to see more pictures of this 2021 GMC Sierra 2500 Crew Cab Long Box work truck in Summit White, you can go to that website right there, www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at summitauto.com. And if you'd like to check out more HD videos, you can go to youtube.com slash summitauto. Remember to like, subscribe, and share on this video and all the videos that you see there. Click the bell notifications. You'll get updates on the videos we do each and every day here at Summit Automotive. In fact, in a second you'll see a link to subscribe to our YouTube channel on the upper left. The link to more GMC 2500 truck videos like this one on the upper right, a link to this vehicle on our website on the lower left, and a link to one of our latest C2 videos on the lower right. Click those check us out, and we are super excited to help you with this Ultra Clean 2021 GMC Sierra 2500 Crew Cab Long Box Work Truck in Summit White Clear Coat. Thanks again for checking out the video. Remember to like, subscribe, and share.


Hey guys, another comment video here. Admittedly, the last episode was actually a lot better. Okay, no. Seven years of this tube just seemed weird on my head. Hang on. Oh yeah, it's the overhead lighting. Using this lighting setup is not the best idea. Anyways, I'm gonna be doing more comment read-throughs of the last episode of Supernatural. Admittedly, the episode was a lot better than was originally expected and why there's a lot more positivity in the comments. So I'm just gonna read the good comments and see what we go with. Again, I'm not gonna read the names, I'm just gonna read them off and then I'll post the ones which I think are the funniest ones. I did like this episode much more than last week, which is embarrassing really.  I feel the reunite the boys, Cass and Jack would have meant so much more to me. So emotion is literally taken out of the show for me. I viewed that part of the end when Jack returned so barely, so inconsistently, like it just was there, it was tacked on to the end. We still don't have any idea how death brought him back. Again, for the third time in less than two seasons. How about the ending of the series with Chuck being the son of God? No, that's actually kind of an interesting sort of idea. However, I very much doubt that they're going to try and do that because everyone else is associated Chuck as God, everyone, literally everyone, cosmic beings and all. There's no way. Amara already has addressed him as her brother so I don't think that's gonna happen. It would be an interesting twist, but however, it would make absolutely no sense. Of course, the one time I'm counting on Dab to give me some roast worthy material, he gives us a pretty decent episode. Minnily it wasn't him though, it was a few different writers. That being said, this is sort of what I was waiting for in the final season. Is it perfect? No, but I felt that I did a proper job of referencing past episodes with the pool hustling while giving us a complete image of the gods of our characters have been fighting since the beginning. A nice way to wrap up these monsters' existences and give our characters their mojo back. If anything, this is closer to what a hero's journey actually is. Not comical stupidity, but real sacrifice and a failure even when they tried their best. Jack's reappearance was certainly lazy, but at least Alex will actually be in this season.  Also funny to see after 15 seasons, Dean still returns to self-deprecating and sacrifice, believing his brother is once again better than him. Heroic are a character trait that has been ingrained since season two. All in all though, I'm happy and I feel like I could be satisfied with serious finale if this was on the same level for the nine remaining episodes.  I'm not arguing that the writers couldn't have done any of a better job with the absolute butthole that they got put into. I liked how they got out of it. I like that Sam and Dean are working together towards the same goals. It was fun to see them play well at pool, even though it seemed to disconnect from the prior episode, yeah. I've been looking forward to seeing Jack coming back to self-save the world, but having to eat hearts to gain power, that's to gain everything the show is though, even though the Gregorian are monstrous angels. And Dean accepting Jack, eating hearts and not being scared about him, accidentally exploding people when he gets mad. I love Mary. Just because Cass said it was okay, wow. Dean went from hating Cass to accepting anything he does without question. So I don't know, we'll see where this goes. Yeah, I can see where you're coming from there, cause again, this is like constantly turning around on itself.   How far we have fallen. Supernatural's time slot has now been replaced by a Riverdale spinoff that appears to be a musical aimed at female audiences. The boys had a good run and now it's over. I feel like this episode, however, another hiatus is stupid, just ended already. Oh yeah, I guess that there isn't an episode this week. I guess it's gonna be moving to Monday. The end of all television shows. Is it going to Monday? Is it going to Friday? I don't know. Didn't Jack create like 10 angels back in the last season? I think they were used to heal heaven.  I'm very much waiting for heaven to be acknowledged considering the big nail biter that was established. What in the last season? Heaven is basically team minus countdown to exploding if any more angels die, which by the way, if more angels die, I'm gonna be very surprised to see if heaven doesn't explode and they just totally forget about it. Alaska was pretty, am I being sarcastic? This actually had a huge train because I was just talking about how it's probably a pit meadows and then talked about how there's different areas in BC, particularly just really the bottom left hand corner of BC, Metro Vancouver is where it's shot. And then someone pointed out that, wait, Jeremy you live in BC? And I was like, I swear, I thought I've established this several times. It definitely gives Sam and Dean a boost of power that they need. That is the luck of demigods had in defeating feats bigger than their own. I love Sam lost the rematch against Fortuna. Had he won it, would have been felt forced. It was interesting to see how the gods came to be with a show enforcing Judo Christianity. It's good to have Jack back, but it definitely makes it obvious he is meant to replace Chuck. Death in season five said he'd reap God and it just makes me wonder if we are actually going to get a happy ending for the show.  I think. The show has started to go downhill ever since Ketch was killed off. Oh, this guy, this guy trolling me. Actually pretty good trolling though. He's done a good job for a long time. And what's funny is too, is everyone like took him seriously afterwards yet. If anyone's like looked at this guy's comments throughout all of my videos, you know this dude's been pulling my leg. He's a good sport. So Dean can't do anything without Chuck, but somehow he's great at pool. I hated this episode. I felt like last week's was better. No, no, no, no, no, no. No, if you're talking about the logic of the last episode, yeah, this episode makes no sense in comparison because of the stupidity that the last episode gave us.  Like if you want an example, look at what happened with Rise of Skywalker.  And then it essentially made his own dumbness. Like there were some good parts in The Last Jedi that could have crossed over, but instead he just got rid of everything and then just tried to remake his own thing. And then that's exactly what happened. At least that didn't happen as badly here. It actually was a more of a positive outcome. Pretty good episode. Jack's back. I'm confused what Jack is at this point.  I guess death can resurrect, but can she put your soul back in? I doubt the writers even know it and it probably doesn't matter at this point, but I never really understood how Jack has had an afterlife after his soul was gone. Is that the angel part?  It's been gone for a long goddamn time. Is it just me or Sam the true hero? Because it seemed to me all D wanted to do was get their luck back and leave. But yeah, I will say that Sam has always been more of the moral high ground between the two deans about getting the job done. He has some moments here and there, but Sam has always obviously been the much more emotional character and they've had opportunities to make him more of the better character. Sam essentially is actually the better character in terms of like a down on paper sort of concept. And he's had some moments even after season five because he was obviously the main character with the whole fighting the devil thing. But in season nine, was he the one where he was thinking about closing the gates of heaven or you know, gates of hell and he just wanted to die? That was some pretty good stuff considering just the latter seasons have always kind of been like me. Pretty sure they'll tell Jack that killing God is not a good idea, replacing him maybe, but certainly not killing him. Plus, does Jack know about Amara? Surely Billy told him that if he kills God, he would have to kill Amara too or the universe would be out balanced. Plus surely Amara would have issues with Jack attempting to kill her brother.  Admittedly, yeah, like I still don't know what they are going to do with this. I don't know how they are going to get themselves out of this situation because they've established in previous seasons that you can't kill God, otherwise the whole thing will go into complete imbalance and they can't track him.  I think this episode was better, but that's not saying much. Watching him play pool the entire time really felt boring to me. It felt like the production was trying to save money, although the Fortuna Garlas had some pretty interesting lines, that was the highest point for me. I much prefer watching the story she was telling instead, but I know that they never do that. Well, one frustrating thing about it at the end though was when they had that random girl deliver Fortuna's message to the boys just to cause a little twist effect. I think it'd been much better if the goddess had said those things herself. Yeah, admittedly, I've heard a lot of bad things that happened with the first three episodes in the Ladner. Admittedly, they did have some budget issues there. I guess, I don't know, I like the pool stuff. I thought they did some cool, that camera dynamics. The fact that you can tell it's them actually playing pool for almost all the shots. Maybe they might've had a few where they had a stunt pool guy, but I think that they did pretty decent. I like the work on it. It reminded me of the color of money and the hustler. So I thought they did a decent job. Admittedly, yeah, pool can be kind of boring, but when it's shot this way, especially on a television budget, I thought they did a decent job in making it entertaining. Anyways, guys, that's all the comments I've got. Thank you guys for giving me your comments. Admittedly, this wasn't as funny as the last one was because obviously the episode wasn't as bad, but we'll see when Supernatural returns next week. I don't have cable. I don't check the Facebook that often. Trying to keep up with this has just not been the boo for me. Anyways, guys, I hope you enjoyed this video. If you'd leave a like, that'd be great. And if you're interested in more, maybe subscribe. I'm gonna be continuing on. We've gotten nine episodes left, so we'll see. Thank you guys again for your comments and very much appreciated. Anyways, see you guys next time.


Hi, Nisha. Hi, John. Hey, Michael. See, I'd be glad to know it only took me a couple of days to get over the whole time zone situation with alarms and multiple alerts that it is actually now. Hey, Richard. Good morning. As I said the other day, Richard, I was seriously impressed with that T-shirt. I need to find that online. I think it was swag from Reinvent, I think. Like two years ago. So you can reach out. It's one of the big security vendors. I was thinking if I could hunt it down, give me a second. It probably sold still. It's a quality item. What's that? Who knew it could get fashion advice from the middle of a CNCF working group print? It's probably the least expected of all outputs in this group. Did we scare everybody away with the talk about this? I wasn't sure whether it was sort of coming up to Easter and people taking time away or whatever. It's been fairly light on the ground with multiple different meetings and things. I haven't heard from Emily or Anders actually. I think they may be away. Yeah, Emily's on vacation. Yeah. I think she comes back next week. Give it a minute and then kick off. It's Blake. Hey Blake.  They're all great. And it takes something to be a tercer right now. Tercer? Like it was, it was like really like, you should, what about, I don't know, it's fine. I'm not sure I can face going through pages 24 to 40 again today. I got to tell you. I didn't make them all the way through yesterday. You know, it's significantly better. I was talking to Alex. Yeah, I'm still convinced that parts. It's actually that first. The introduction is way more concise. We decided, we decided the structure we even wanted to do. I think it was a problem. We just. We started with that and say, it's automated. And came to it backwards. Yeah. Right. So let me. Is that you anonymous crow? Hmm. Adding, adding in more sentences, Blake. No typing. I'm typing, but I was. I was editing existing sentences. Got it. Got it. All right. So I'm looking back through some of the notes. And I know that. A number of you were good enough to, to also go through. And do a review. There's certainly a group of us got together yesterday. Myself, Alex. Blake and Richard to go through pages 20 to 40. And do some pretty heavy. Commentary and adjustments that document is the same. It's sort of getting in the shape. Alex coming in. Excellent. I think we still. Have some way to go on that piece, but we'll see. In terms of, in terms of going through is in this, providing a single narrative. Can I ask maybe. Rich Marina. I think Alex as well. Was that really your intent as you went through it? Or is it more just editing it from top to bottom perspective? At least for me, I think I, I mostly just went through and read the whole thing top to bottom. I made a couple of like minor, like grammar, like changes in line and then just listed kind of general inconsistencies I saw. But I wouldn't say it's like a full. Like single narrative. Right. Rich. Marina. We just lose Richard. And then we just lost Richard. Okay. So we still need to do the, the single voice narrative. In terms of. Areas of the document, the choppy. I think. Like you, me and Richard are probably. Chewing on 20 to 40 still a little bit. Let's face it. But. What about the rest of the document? I guess from, from your review. Everyone else. Are there comments that we need to add in? I note that from. Pages one to about 20. There are. Hardly any comments in there at the moment. Yeah. I'd say that a couple, I think the biggest. Things we can do to get it kind of in shape is there's a lot of the. Risk assurance levels missing. Closer to the end of the document. Yeah. And then in the very last section, there are a couple of like section headers that don't have content filled in. I think those would be like the two biggest things to get this whole thing in order. And then there's a lot of little things as well. But yeah. Yeah. I think I added a chunk or at least created the suggested edits for they may have been merged in actually. Or deleted one of the two. Or lost somewhere in between that. But so let's do that. Let's go in high medium risk. We can certainly do that part of it. The other bit that I kind of wanted to highlight was the actual recommendations that we've made. And whether we actually agree to that. I think that's a good group because I think that's pretty fundamental. Right. If we've got someone here we disagree with, or we're missing something, we should probably evidence it fairly promptly. Yeah. So it was actually. Hi, Magnum. Welcome to the group. I think it was. Last week. Oh, the 22nd of March. I sent through a document and all it was supply chain recommendations. Yeah. And all I did was I just pulled out the recommendations, put them in as bullets just so that we could sort of stand back a little bit and figure out, look, all things being equal. These are the actual recommendations we've made. Do we, do we actually agree with this? Or are the chunks were missed? Right. Just wondering if we can spend like five minutes just reviewing that to see if we've actually missed something. We agree on it. And then we can add that into the paper and move on and then look at the high, medium and low recommendations at the bottom. And then figure out any recommendations. Yeah.  To like the. 22nd of March. I'll also see that. He just replied to the thread. Yeah. Yeah. It's not the prettiest of formatting. Yeah. It gets there, right? And this is literally just copied out of the headers. Right. So if we start at the top. That was the top. I don't know. Individual items. Is it possible for you to share the screen? Yeah, I can share the screen too. One thing that sort of here that I was not quite seeing where we have it is do we recommend container scanning specifically? Anywhere. Yeah. Yeah. So. The elicit is tools at the very end. And sort of mentioned indirectly a couple of times throughout the document, different places. You know, distinct from Sastin dust. Yep. I'm trying to figure out if that's a set. It overlaps with other things as a problem because it can perform, can perform vulnerability scanning. And can perform configuration scanning. But I was actually wanting to reference it from the bill pipeline steps. So. No, I think you're right. No, there was a Claire anchor or whatever we list. Some tools at the very end of the document and table, but I don't think. I think it deserves a first class possible. Automation is probably where it belongs because that's where we have software scanning. Yeah, you're right. It overlaps with all these. The thing is it's the tool that performs them as a problem, but otherwise. Oh, so I have thoughts on this. Sure. Sure. Yeah. I've noticed that there are some things in the controlled environments section that. Well. Maybe contradict with the container section in the okay. With regards to scanning. That's right at the bottom of the document. That was what I had said I do is put an appendix at the bottom of the document and then list out all the stuff over there. Now. Container scanning. Because of the way containers are built. You know, is, is not something that someone can totally rely on on. So I think. With regards to containers. We could. I would recommend, you know, taking the results with a grain of salt. I would never say it's the only option, but it's what you should do. You should use static source code scanning if you can, but there's nothing to say you can't do the other one. In addition. Yeah. Yeah, what it mostly comes down to is when you're building from binaries, it's the only option you have frequently. Yeah, I agree with that. Yeah. So it's, it's defensive depth. And that's what I was going to try to say actually is. My recommendation might not be container scanning. It's performed configuration scanning and perform. I don't know. I don't know. Not as bomb from source, but as bomb from what's actually installed. So it's not. If you could accomplish the same thing by other tools, it's not strictly container scanning is my recommendation, but it would be. Figure out what you actually have in your containers and figure out if you're containers are configured correctly because that is vulnerability. So yeah, Yeah, the application layer also, right? Like it is, there will be some level of overlapping between the S forms, but it can be a heuristic approach here. Yeah, all these overlaps slightly, and I don't know if that's a problem or not. Yeah. It's like, we're not enforcing, we're not enforcing anyone to use any of the kind of SAST and DAS solutions here, right? No. We're just providing some guidance and, okay, these are the ones that, if you want, these are the ones that are available, right? You can either do DAS, SAST, or you can do both, or you can also do container scanning, right? So I think that's a good approach. What drove me to recommend this is I was gonna get to, I was working in the section of the build pipelines, where we're saying build hardened images for your build pipeline. If you're not building from source, the only tool you have available is, Yeah. and it won't hurt anything to do it in addition to it, to SAST analysis on your standard pipeline. Yeah. So, yeah. And there are a lot of open source tools available for that, so. We have a list at the end of the document already. We have that on the container security map as well, I think, not just for open source, for commercial tools. So what we're doing in the container security map is we're doing CNCF tools, then open source tools, and then commercial tools. So, yeah. So let's add that in. I think that's a good shot. Perform, I mean, in terms of verbiage. Yeah. In addition or when it's the only option. Right. But yeah. Often only option. Yeah, yep, yep, yep, yep. Cool. Other thoughts, anybody else? I have one with that secure authentication, right? There is a usage of PAD for a CI CD pipeline, which is not really weighted against SSH to say that, you know, that should go as a recommendation, right? So if we can't put the pros and cons for both approach, I think in my view, we shouldn't recommend, I mean, just blindly recommend one option, right? So. Yeah. So there is a consensus, yeah, go ahead. I think what we got down to is we didn't care as much if you, this Pat, I mean, that text went back and forth a lot, but it was used to unique credentials for the pipeline. I'm sorry, Vinod, Vinod, can you put your mute? I don't know what ice cream van you're next to or something, but. All right. Yeah, I would be happy to, I think we're saying Pat still, I think perhaps relax it slightly to still say a unique credential for the pipeline, not shared, because that was what Pat implied, but if you do SSH with a unique cred, I think you're just as good. So, yeah, I think that's a decent one. Should we state use unique credential and then as like a subcategory? No, I think we can drop the last one and turn it into that. I think that's, we're having a discussion or arguing about the last one. Sorry, I had to turn off my son's tablet. So you put up just unique credential. I think we should mention short-lived unique credential. Like that is important. Oh. No, it is using a long-lived credentials, shared signals are not good for any automation. Short-lived or even better as a femoral? Femoral, yeah. That's harder, but I'm sorry, I just made this time. Bum, bum, bum, bum, bum, bum, bum. And how do we cut this, right? So use the short. I have to drop for another meeting, I'm very sorry. No problem. So how do we cut this though, right? Use the short-lived credential and then effectively slightly adapt the usage of Pat to highlight that's an approach? Pat, it is complicated, John. Pat is not a standardized increment that's across different vendors. So, yeah. So most of the vendors are doing a long-lived shared secret. It is just like an API key. It's, yeah, so, yeah. All right, I'm just going to say that we need to add that one. Okay, let's sort of move on in a bit. Is that all looking good? Fair fine, third part artifacts and source libraries, dependencies on libraries, makes sense for high security. Makes sense. Vulnerabilities, management, licenses, composition analysis. This one jumped out a little bit. The controlled environments, it was kind of often in their automation piece. Secure materials, when we come back to it. Yeah, maybe scratch it for the time being or let's color code it somehow. This one. Yeah, not enough dirt to warrant. Like, what does that mean, right? And I think there's a whole lot more controls and controlled environments. Right. It just optimize, use a container optimization strategy. This all looks so much more real once it's on a Microsoft Word editor. Just so you know, and what we're doing at the moment is just we pull, so we've done huge amounts of editing. Huge amounts of editing over the paper and such. What we've done here is pulled out the actual recommendations we're making to see if we actually believe the recommendations and see if there's any gaps. Okay, awesome. Yeah, we want to make sure that we actually believe in what we're saying at a high level, right? Oh, I have one a little bit up that I just read. So the building libraries from source section. I feel like that could probably use, like, build them from source or use reproducible libraries. Because I think if they're already reproducible, it's a little bit redundant to have to build them yourself. Basically, like, I think the idea is to have some kind of verification, but I don't think that's the only way to have some kind of verification that the resulting artifact comes from the source code. Yeah. I think especially with the six store and everything, there is a possibility that you don't need to verify everything from the source, right? So is that, I mean, we've got reproducible builds in here as well, but I mean, is that in the similar sort of section suggests that well, behind security environments, you can either build totally from source or rely upon a reproducible build. Yeah, exactly. Like, I think in the real world right now, mostly you'll be building from source, but I think that's another option as these things progress. We can certainly reference it, right? By the way, I'll run in and just add that, just putting people next to these things so we actually have someone to get on with it. Vinod, do you wanna take the ephemeral one? Yeah. From container scanning. Who wants to take the container scanning one? I can do that. Thanks, Magna. And I'll just delete that. Okay. Right, so we had loads of verification as you'd expect on the secure build pipeline. I think we did this one to death. The first recommendation feels very ambiguous to me. I don't know if it's a headline to the rest. Well, any configuration security, we can probably tighten the language, right? Let's see what, I'm gonna look in the update. Where is that? Securing build pipelines. Oops. Like third line item says, cryptographically guaranteed policy adherence. That feels much more concise. Yep, just trying to find the section. Alex, I think you're on mute. Are you talking? Yeah, sorry, sorry. I thought I had unmuted. Looking at it in the dark, it looks that validate the configuration security of the system after deployment. Recommendation looks pretty minimal as well. And I think it probably is mostly covered in the cryptographically guaranteed one. So it might be a candidate for cutting. Yep, I'm fine with that. Any other take is just deleted? There's one more, which is validate environments and dependencies before using, using what? Seems like a truncated sentence. That might have been me. Oh no, that really is the actual sentence. All the environments and dependencies before. Before using verification, before deploying the software. Before using the dependencies. Before usage, I guess. Yeah, usage, yeah. The build environment sources and dependencies come from secure trusts, I think it's a valid recommendation. It's just a really bad statement. Usage. And on the first one, would that, would that be, yeah, the one that you're saying to delete there? Is that something that, for example, I have my binary or my container image and I have that on my artifact repository. And once that's deployed into production, I do some kind of like hash validation. Is that related to this first recommendation? Unfortunately, I've deleted it and now I'm more than happy to put it back. But I think that one was more sort of post instantiation of what you've actually done. Just make sure that it's secure. So we're gonna automate the tests to make sure that you're happy with the security posture of what you just sent. Okay, so it's not, it's not just like a checksum of what's deployed and what was generated by the source code. No, I think it's much broader and it's like admission controls more than that. I mean, I guess the way that I'm thinking or was thinking of that one was like, you've stood up your, it's like the power on self-test, right?  You've done, or your pipeline, you've done everything you can to make sure that you've secured that thing.  Not just check to make sure configuration files are set up, but can you connect to it via HTTP? Can you just manually insert some step or something? Yeah, it could even use formal methods to, hey, does this actually have this set of inputs? Or does it have metadata at all? Does that metadata match what you're expecting? So now it's deleted it, maybe I put it back. So that would be more like a brief detection of your infrastructure as code, right? I think it's more than that though. I think it includes that but it's more broad statement is that I wanna make sure that it, I wanna provide efficacy testing. I wanna prove that some of the two, and this point, you know, almost to the formal reasoning perspective, I know what these inputs are, I'm gonna put these inputs in, I'm gonna run this build or scan and I'm expecting it to show this output or I'm gonna flat out try and, try and delete one of the stages, it's supposed to be immutable, so it shouldn't allow me to do that and just validate that I can't do some of that sort of stuff. So part in total is giving you some of those things at every build stage, right? I think this is more like runtime at the station of providence. Well, in my mind, this was more just make sure that it isn't broken, right?  Did you? Yeah. Great, it looks like there's a lock on it, but can you open the door, you know? So it seems to me that's more like testing your instant response plan and from just an example there, but it would be more related to something like chaos engineering, right? So break stuff and see how it behaves. It's closer to the chaos engineering, it's closer, just run a suite of tests against the thing to see if it really is secure. Isn't it more like a regression testing, like? Yeah, kind of, but it's security regression testing, it's like, you know, it's like, if you think of an infrastructure, we should probably move on a bit, but think of infrastructure as code, right? You've got an S3 bucket. You know, I've written some terraform to secure the S3 bucket and I can see it says, make sure that it's encrypted and it's only, you can only connect via HTTPS, but as a test, just try and connect it via HTTP. Does it work? That's what you really care about and that would prove the efficacy of the controls we just implemented. Has it just come back to this one? But yeah, it's tracking that in practice there are no deviations from what you think. Yeah. From what you did. I can put it back and put more verbiage into it. I'm also happy to delete in it. Okay, I'm happy to tag team on this one with you. So you can go to the first pass and I come after, we can go to Async or... Yeah, sounds good to me. So, re-add. And then, because there's some cool stuff you can do in there actually. All right, so a test each stage. What's here? How are these two different? We've merged them already actually. They're fine. Yeah, that was right. This was after, right? Cool. You're still in the build pipelines. Can I go? I just noticed this control environments thing. Which one? Above the securing the build pipeline. You're gonna delete that for now. Okay. Yeah, would you want, or do you need to keep it? No, I don't need to keep it. I actually raised a concern about it in the original document. So... Use, I think we fixed it. I think this is kind of objective to build repeatability. I would like to describe the section in detail in appendix one. John, I'm sure you have plenty of perspective on highly regulated environments. I don't know if like controlled environments is too ambiguous, but we would like to call this air-gapped. And then we can talk about, well, reproducible builds are a key there. Also, well, people are not pulling things off the internet. So how do those things make it into the environment? And everything at that point, whatever goes into the repository in the air-gapped environment should be strongly attested. A lot of things can be said about that. There's several different dimensions, but should we spin it that way? I think we should actually, and I prefer the air-gapped. So your suggestion is to change the name of it to air-gapped? Yeah, and we talked about air-gapped recommendations, which there's several, because you now have like intermediate repositories so you need to trust and the artifacts in there. How can you tell they actually come from where they presumably come? And this is kind of an open number that kind of worms here a little bit, but I think it's a valid one. I like changing that to air-gapped. Is there a list of additional recommendations? And I guess my question is, who's in a position right now to add those? Because I think that's really valid, right? Air-gapped environment, how do you actually inject those, that software, other than the artifacts? It feels like at this time you really can't. You have to like lift and shift your whole pipeline and build environments over to the air-gapped environment if you wanna make everything work. Well, that's not, is that how it works? I mean, I'm not that familiar with truly air-gapped environments. I guess that's probably one for Blake, Colin, perhaps yourself, Anders. Sure, I can take initial step at it. I could benefit if there are additional threats to mitigate. So like, what are the vectors for release tampering? Is that like, what's the impact of compromise developer account credentials? Because we can say in air-gapped environments only do things that have been signed and you can validate out-of-hand and follow like, out-of-hand validation of those signatures. It feels like a great topic for a slack thread. Yeah, yeah, yeah. But it also feels like a good rabbit hole, right? Because I think I just, no, I think it's a really good call, right? Do you wanna have a shot at it? And maybe, I think call would be great to a pine on that. I'd like to chip in or probably look at that. But if I put you down for initial pass, Anders, and then I'll follow up with Cole, perhaps, see if he's interested. Yeah, thanks, Nisha, for drawing attention back to this item. I'm glad we were visited here. Yeah, yeah, really good. Yeah, Cole might say just set up a mirror of Docker Hub or Artifactory. He's very pragmatic, which I like. So I'm going to need that. Hey, it's still air-gapped. It's just an air-gapped Docker Hub, yeah. Yeah, or use that Amazon tool that clones connective environment to offline environments. I forget what it's called. Use teleport, too. Teleport. Oh, right, yeah. OK, shifting on a bit. So where were we before? Ness, were we down here, I think? Authentication, roles, short-lived workload certificates, secrets management, women, securing the artifacts themselves. Is this in the wrong place? No, it's not. In securing the actual deployment, we're pretty light on securing deployment. But any thoughts? I think I agree with all of that, to be fair. Can you just scroll up a bit? Sure, sure. Oh, actually scroll down so that the text is up. Yeah, sorry. Oh, that's the end of it. That is it. Yeah, that is the end. Oh, OK, I thought that was a little more. Yeah, since we're giving explicit project recommendations, should we also say use open policy agent, use Aspire? Not sure. That's an interesting one, because I think we've sort of slightly shied away from it. Sorry, Magna. Sorry, yeah, use container signing or artifact signing, yeah. And then we provide over here some tools that do that, but point directly at our tools, as CNCF tools, I'm not sure. They can have other options, right? And sometimes they prefer the enterprise version of that because of support and other things. So yeah. So let's talk categories. You say policy engine for policy. Yeah, exactly. You're an admission controller, right? So something like that. So keep the compliant to station engine that also distributes credentials and can act as a PKI. Yeah, you kind of disappear into madness, right? I know, how did we do this in the container security paper? Because we're in the middle of the CNCF, right? I mean, I think we should state the generic, but also reference the specific, especially within the CNCF. It's like a first or identifier. This is a gap. But I'm interested in how it was been done in the other papers. Does anyone know? I think we can do whatever we think adds the most value to someone writing the paper. And our view of the world is very cloud native, right? Yeah. We got this reality of, or the reality around this is these are the things we see really close to us. Therefore, those are the ones we'd recommend. So I think it's fair game to call out explicit things because people read these things like, oh, conceptually, this all sounds great. But what tools should I be using? Yeah, totally. I think we need to draw the line between referring to a company specifically or a non-open source project, perhaps, but I think that's reasonable. Yeah, we don't want to do what the CNCF decorator did for secrets management and say, go use cert manager or go use a recommendation as to adopt, vault, but to explore a cert manager or AWS KMS. When those things are not even secret stores. Right, that's, yeah. Wow, really, OK. Yeah, I'll share the link, yeah. No, I didn't, wow. I have to go on the TOC call, the last one, to try to get that retracted. Wow, that's not great. OK. So isn't it better to use the generic term and give back samples, right? Yeah. Instead of giving a title, it will look like that secret manager in a mind map. I like people will think that it is just, you know. Yeah, I think that's what we're going to do, right? So, you know, use some form of artifact signing. It's probably not even a tough approach. It's probably notary, right? Or use a schema for metadata. I'm not sure if we want to discuss it just for first. That's a good distinction of the nuance at play, but the update framework is a spec. It's not an implementation. Yeah. So it's good general advice to give, follow the principles or the ideas that this framework seeks to standardize. Yeah. We could say use artifact signing approach that implements that the update framework. And it's not a explicit go use, like, we're still safe of the lines of no kick makers. Yeah. Cool. All right. I think that's reasonable. I will make a few of those notes. I'll put that back into the Slack and go and have a couple of first sabs. I think there's a bit of homework there. A few people too. Right. Got a few minutes left. Or what I was going to do then is to look at the actual, well, two things. One, go through and look at the assurance categories that are blank and make sure we can add them in. Two, I think Blake, myself, and probably Richard, are going to just finish off some of the chewing on 20 to 40. I can then integrate the feedback from the different reviewers. Thanks for sending that through yesterday. That's cool. But from what we talked about earlier, we don't really have. We haven't really gone through and done that single voice element of it. So what I would suggest is if we do a bunch of edits, because I think I'll probably get everything I've just referred to done over the weekend. But then I think we're probably at the point where we need to lock it and then give it to someone to do the single voice over. You think we're at that sort of point? Apart from, Anders, there's a couple of little bits that we're going to have to add in there. I feel like it's closer, John. I mean, just seeing the edits from today, I'm like, this is so much more readable. They're still not in a single voice yet. Right. Yeah. On a scale of 0 to 10, what's the readability score, Richard? Six. I'm at about a six at this point. It's at least one of my notes was like when I got to that section, it was like starting a new paper. And now it actually feels like it works with the previous sections, which is good. It feels like one cohesive paper. Yeah. It'd take a day. Yeah. We are getting into the length. I mean, I get that we'll probably have derivative works that will be the condensed. This is all you need to know. You know. The ontology, the supply chain ontology. Let it simmer. I actually really liked the graphics Emily made and like that whole section. I think that that could be on its own. I really do think it could be a standalone. If you don't understand what build pipelines need here, take a minute. So yeah. Someone has to submit a proposal to O'Reilly. Might as well be you. There we go. But John, in terms of the next steps, I mean, we have, I think edit wise, we're mostly focused at this section with the recommendations, right? We Alex, I guess we don't have, we definitely, we don't have coal or or Blake anymore. But the the preceding sections, do we need to go over that at all anymore? It feels very concrete now, this, this whole area. There's a couple of recommendations. Yeah. I think with between the four of us, we kind of hammered that yesterday. I'd say. So it for for this section, it's really just these, these, these recommendations. Make sure they're all sound. Yeah, exactly. And I think too, I think it was Nisha's point. The reality is right at the bottom of the document. There are a couple of, you know, a couple of orphan things. I think these couple of things that could do with an owner. Yep. But I think in the next 15 minutes, if we just get the assurance category and risk category and everyone's happy with what those are, we'll add the feedback we just had in today. We can do with someone to adopt these two sections and finish them. And then I think we need those three people that go through and just give it the once over and put it into a single voice. Cool. And if we don't get around these, we can, we can have some text that conveys, hey, this is not an exhaustive list. These are some other considerations and these become bullet items rather than like fully spelled out. There are other things you should also be thinking about. Yeah. Yeah. Who to just to finish this up then, who's going to own the deep, who wants to do the D bomb S bomb and who wants to do the sharing of S bombs? So it's basically D bomb. Any owner for that? I wonder if this whole D bomb thing is mature enough to be recommended. I don't know who added that in. I'm also curious. I don't know what D bomb is. I'm going to throw that out there. It's a digital. We have a lot of in TOTA. We have a lot of in TOTA sprinkled throughout. Yeah, it does feel like there's, there's one. It feels like a very, I saw that in a couple of the recommendations where it's like, oh, this is a TOTA language that's being crept into general recommendations. No, it's actually not. But what it is, is actually this one, really. It's the, or my view of it is, it's the sharing and exchanging of S bombs. D bomb is a mechanism of doing such. Okay. There are other things available and D bomb is certainly fairly early in my view. But if we are, I think this is reasonable because I don't know necessarily is a particular solution for it. Maybe that's a gap when we highlight it, but we have to have the ability to share the S bomb data securely. Yeah. And what's good about that is it's, that's a generic recommendation, right?  We know what S bombs are. Organizations can figure this out, how they see fit, right? If other tools emerge in the next couple of years for doing so. Right. We can even references a couple of things going on, but we do need someone to own that one. Anyone want to own and fill that one out? I guess I will. Excellent. Many, many thanks, Nisha. So I'll put you down for that one. Do we want to throw D bomb in the glossary? That's probably a good idea because right now there are a lot of folks who are asking what is this D bomb? So. Yep. D bomb is looking a little bit poorly as well actually. We probably, sorry, the glossary looks a bit poorly as well, still. All right, cool. So we've got those two things. 12 minutes. I was curious, sorry. Hi, teacher. Yeah, I was curious about the bullet points under ensure clients can verify the freshness of files and there's a comment that they need to be converted into recommendations. They're basically about validating S-bombs and total metadata admissions controllers, so on, right there. Your clients can verify the freshness of files. Yeah, but the bullet points with the, yeah. Those do need to go somewhere. Yeah. I haven't got down to this bit. Well, that's interesting. Are these, why aren't these actually recommendations? Or are these recommendations? I don't know. I would expect that, you know, if anyone wanted to validate any of the supplemental artifacts such as signatures and S-bombs, they would validate the signatures. On the, on these things. So I would expect that if anyone is creating an S-bomb along with an artifact, they would sign both the S-bomb and the artifact. Yeah. So I think these are, sorry. These are different. These, and this is probably what you're saying, but these are not connected, right? They aren't connected. I think that a leftover from when the section was first kind of put together and we were thinking of what needs to go under securing deployments in general. And also if, I think this is similar to what Nisha was saying, but if someone is using, if we've already made a recommendation that they need to use in total, they need to do, you know, create S-bombs. We may not need to go in detail about actually performing verification or validation, but maybe we could kind of combine all of them into one section saying perform a verification or validation workflows for all of the metadata you've generated so far. Yeah. Yeah. I think we could combine this with the previous one, right? Instead of ensure clients can perform verification of artifacts and metadata or something like that and merge it like in the previous category. Yeah, that's probably right because that's exactly what you're doing, right? You're validating. That makes sense. Yeah. For, I can only really speak to the in total verification workflow here and we do have a, I can drop in the link to that particular one, but I don't know how we want to point people to the right places in general. Well, like John said, I think that, you know, linking or adding verification to any kind of signage recommendations is the way to go. I mean, the only reason you sign a thing is so the person receiving the thing can verify that you've signed it. And then you don't, you can't really verify anything if it's not signed. Yeah. I think there's a bit of a little bit of increased verbiage that needs to go in there. And we can delete those too. But good spot, right? These are kind of orphaned. So we do need to update that one, unfortunately. I, yeah. I can, so I think, okay, sorry. I really don't want to make this very in total specific, but I do want to note that the recommendation there probably goes beyond just validating the signature on the metadata files because in total has its whole verification workflow as well, the link in there files are matched against each other. And total is a state of the art. And in the absence of that, we have nothing else. So you do need to fly the path towards that and exemplify it. Do you want to take a go with Disha at expanding upon this one? Oh, I can, I can give it a shot. I think I, okay. Do you want to take a look and we can just review it or change it or what about this last one? Admission controller potentially ordered only to start on this. I'm not actually sure what that really means. I think we should get rid of that because the Kubernetes admission controllers is an implementation detail. If anyone wants to make an admission controller that does the verification for them, they can. Wait, are you saying that not everything cloud native is written and go and deployed to Kubernetes? Is there any world outside of that? I'm being facetious. I was wondering in this paper, we're gonna acknowledge that. Okay. In total is written in Python. Go implementation. If you want, you can make a go implementation. Oh, there is one, right? Yeah. Yeah. And didn't they just rewrite tough and rust recently? I'm sorry, there's a, oh yeah, yes. Yeah, I saw that. That was quite cool. The Roth per bottle rocket. Yeah. John, you're talking about assurance being a piece that's missing. Was that what we just covered or is there another section of assurance? No, I think there is that missing, but I think we can just add that further up. You mean the comments we had about the build pipeline? Mm-hmm. Yeah. I wonder if that's like a higher level section on its own, which is incorporating formal methods like S&P filters, automated reasoning, provable security, kind of like to add like net new stuff. It's not really general guidance, is it? I can make the verbiage and we can figure out maybe where we put it. Okay. Get feedback on that maybe. Yeah. I don't think it is missing. It's just, it's wanna, it is an element of it, but I... Yeah. And the biggest challenge with any of that is, well, setting constraints to the scope of policy, right? To this non-pollinomial. So by when will you, like, yeah, you really need to constrain the problem. And I think constraining it along supply chain might be a way to grow rather than talking about all software. Yeah, exactly. Otherwise you'll never end. Okay. I think we've got to the bottom of that. We've updated the, that list. We haven't had time to go through the different assurance categories and we've only got three minutes left. What I'd suggest is maybe does anyone want to have a go at it and dedicate themselves to just adding initial thoughts around the assurance categories and risk categories and then add a comment back onto Slack for review? Any takers for that? We're looking at kind of, I think it's from down here practically. Where is this building systems? Does everyone know like what makes something high over moderate that we're going to take a stab at this? I may be sounding silly here, but I don't even know what assurance and risk categories are. I think we have a definition at the top of the paper, I think somewhere. Yes, it's in the top. I think Marina also raised this point in her review that she sent in, but a similar point that I would make is I'm not sure reading through this of any situation where those are going to diverge from one another. So I'm wondering if there's any point in having those as two separate, but I think it's worth defining them as two separate things, but in our recommendations, I feel like they pretty much are always going to be the same. So maybe we just put in one level and however we want to phrase that level, but put one thing in. Alex, to that point, should we just write a sentence here that all the recommendations below are either moderate or high and then we just get rid of the byline underneath each of the items? I think we did have one sentence that says there are no low. Yeah, I kind of agree with the risk and assurance thing because I think it's useful to stating that there's a problem or there's differences at the top, but actually kind of almost state a single one. But I think there are situations where we have moderate versus high, certainly when we get to those controlled environments. It'd be interesting actually to see if all of the highs are actually corralled effectively in the air-gapped environments. I don't know if that's actually, no, it isn't right here, right? Well, we could leave it to the sermon of the reader, but it looks a little bit of a pie chart to have for every single item, assurance categories, risk categories. That's what I'm saying. I think we just have one, but I think there is a difference between moderate and high. We just need to ensure we define that. Should we have it at all? Do we have it at all, you saying? Yeah, what if we remove the risk category? And sorry, what's the other one? You scrolled it. Assurance, I think it's assurance, I think it was. It looks like great metadata for like a companion file to check in on GitHub, but... But what are we saying though? Because there is, I guess if we, I think we need some level. I agree, we probably don't need two, or from my view, I don't, it gets lost really, whether we need assurance and risk. So maybe just have one, but I think it's useful to have one of them to say it's moderate or high. Okay.  I think even for the moderate ones, they are moderate slash high. A lot of it is, well, we're trying to get people to improve their posture. So we want, yes, like you're gonna have higher degrees of assurance and like we want you to know the risk that goes with it, but it's almost implicit. So... I guess the one that jumps out to me is the rebuilding your libraries from source in that most people are probably not gonna do that. But in the environments that are, depending on what your definition is, like highly secure and super, super regulated. And even then only the absolute top of the top. Yeah, that's a great recommendation. You definitely do that. But if people read the paper and think, wow, the recommendation is we actually wanna rebuild the source for all of our libraries that might give the wrong impression. Yeah, so how about I suggest the following and I volunteer to do it. Instead of having it assurance categories call and risk categories call I can collapse this into one sentence. Yep. Before the paragraph to say for this particular item, we want you to know that the assurance category is between moderate and high and the risk categories are for such. It's softened from like a just looking at it and not actually reading through. And we have a little bit more room at qualifying that. Yep, I'm good with that. What does everyone else think? We might be splitting hairs here. I think it's beneficial. Yeah, in turn to agree. Hello, Andy, have you been here all along? I came in bang on the half past four. So I caught the latter half of the discussion. Well, half past my half hour. Good to see you. Yeah, good to see you too. I'm not sure if it was a time zone issue or a retoddiness issue. You're an hour late and we're closing the meeting. Really? Yeah, I did it last week. Don't feel bad. Oh, thank you for having it. We had this discussion and... I told you about it. It's like I was an hour late for that meeting. I missed security last week. Well, there you are. Same deal. This whole time zone thing. It's a killer. Yes, that was a slightly different answer to your question then. I have been working away for the last hour but just not on the call. It did occur to me as well. Ah, okay. The one constant is the still beer o'clock for you. There you go. I don't feel as bad now. It's good. Safety in numbers. Good. I think that's a great idea, Anders. Yeah, that's cool. We're a couple of minutes over but I think we've... I think this is really coming together. I think the sort of focus really on 20 to 40 made a big difference. Then we just need to collapse all that stuff in and then we're in decent shape. What we didn't identify was who was going to go top to bottom with the single voice commentary. Does anyone want to take a shot at that? So we had Richard, Alex and Marina on the hook for that. I can also... I'm wanting to do the same. Yeah, I'm wanting to do the same. I guess that the approach that was taken rather than single voice was just actually manually editing stuff. Unless I misinterpreted that. It is. Right. I haven't done my review yet, so I will go through with a more of a single voice when I do it. Right, right. That's what I thought is some really, really good reviews and commentary that need to be factored in but not as much just from a single person perspective. Yeah, it's really about Ward Smith-ing and giving it an editorial review. Yeah. Cool. All right, same reviews. Great if people are up for that. And I will certainly do that too, as you really self-understand. Great. We have Andy. We can use some of the Queen's Royal English incorporated in addition to yours, Don, just so we meet the standard. I'm happy to represent Her Majesty in her absence. Yeah, I've got a couple of book deadlines coming up soon. Which is why I'm not instinctively jumping in. But I am happy to be in there. Just you understand what I'm trying to work my way around. Yep. That'd be awesome, Andy. Thank you. And if we left it to you, the graphics would be all sorts of cats and massive amounts of very cool animations. So if you just stick to the verbiage, that'd be awesome. Very good, yes. Great. OK, thank you. We're a little bit over, so apologies for that. But thanks so much for your time. And I'll put notes in the Slack and we'll take it from there. Don't forget appendix one. I still don't have any container opinionated people to review that bit. Andy Mardin. I certainly qualify for one of these things. All right. OK, thanks, Andy. Right at the bottom. Thanks for reviewing, Andy. Sure, thanks. Sorry I missed your message the other week as well. Yeah, I will get it. OK, thank you. See you, everyone. Thank you, everyone. Thanks for your time. Good to meet you. Thanks, everyone. See you later. John, you want to talk about KubeCon? I've got to jump to another call I'm supposed to be hosting, but I can certainly ping you back on Slack or. OK. And I know it's later than Friday for you, if you want to talk early Monday or whatever. I'll be on for a while yet. No worries at all. I'll be here for the rest of the day. Great. Thank you. Talk to you soon. Just wait.


This video is going to be a little awkward to shoot because I want you guys to be able to see what I'm doing But I also want to show you what's going on on the screen over here So we're going to try to do some screen-to-screen action here But what we're looking at today is how to from the shell so you can do it in a shell script or just from from your shell Your command prompt Record audio from multiple audio devices. I have multiple audio devices hooked up to machine some of them are disabled But currently active I have my USB microphone here I have this USB headset here, which also has a microphone and then I have my analog just audio card in there which obviously has inputs and outputs and So how can we record? from maybe these two microphones at the same time to individual files so I can layer on mix them together and that's what we're going to be looking at today. So the first thing we do is look at our audio devices and Also see what's available from those because you have multiple options like instead just recording from this microphone We can record the output to the headphones too, which we'll look at in a second But we're going to start off with this command. Let's see. It's Look at my notes here. So it's PACMD, so I'm using pulse audio. I should probably say that so in this particular scenario We're using pulse audio, which is very common on most Linux desktop systems for audio and And we can use this PA for pulse audio CMD. So pulse audio command We're going to say list source outputs and we're going to enter and it gives us a bunch of information about all our audio cards But that's a little overkill. What we want to do is we want to narrow that down So we're going to grep and we're going to look for just lines that say source and Cullen in this case sensitive there. So Let's see So that now is down a little bit more now You'll notice, you know, even though I say I have three devices set up currently your seat. We're seeing five zero through four here Devices listed and you'll notice certain things like these first two I have almost identical names This one's a USB C media electronics Incorporated but one says output and one says input both of those are this USB Headphones set But one is the microphone the one that's labeled input is the microphone where again the output is the output going to this audio So if I'm playing music or a video or something some audio out to this headset I can say record whatever audio is going to this headset So that's one way to record audio from the output of different programs Although that's every program that's being played to this headset in future videos We might go over recording individually from certain applications So you might have three applications making audio, but you're only recording from one But that's the difference between those two is the input is the microphone the output is what's going to this device So let's just start off with microphones. So we're gonna add to that same command We're gonna pipe in we're gonna let's say we'll sort unique and then we'll grep for input and Oops, sorry Grep for input and there you go. We get three devices. So we have Number one there is my USB headphones. The second one is the analog audio card in my computer Actually, it's the on the motherboard and then my other USB microphone here So if we want to record from one of those we can choose to a using FFM peg So I'm gonna say FFM peg and right now I should be in an empty directory So FFM peg and I'm gonna say dash F pulse meaning that we're using pulse audios audio interface because pulse audio actually runs on top of other Audio Processes but right now we're focusing on pulse audio and I'm gonna say dash I for the input that we want and that would be this Number so whatever source it is. So let's say we want to record from my headphones here That's a number one here. So let's go ahead and say one and Then we want to map that Think of the mapping as like a track if you were using a multi-track recorder so we say map zero and Then what file we want to output to I'll say zero dot MP3 in this case But you can use whatever file format FFM peg saves to and I hit enter It's gonna start recording as you can see I go. Hello. Hello. Hello tap tap And then I'll hit control C does finish that actually Q might be a better option than control C for that But it's not a big deal either way, and I'll just use MPV. I'll say MPV Dot zero dot MP3 and I can play that file That was that microphone and now if I wanted to record let me go ahead and delete that file MP3 and I'm gonna run that same command, but now I can give it another input So I'm gonna say dash F again for pulse because I'm still using I mean you can record from multiple different audio divide Processes if you want I guess but again, we're saying pulse. I'm gonna say dash I and I Let me list out my inputs again. So Running this command again. So again dash F pulse Dash I for input and this time we'll do my other USB microphone will say for for input for it'll say dash map One so I'll be our next track there and we're gonna say one dot MP3 And now I hit enter it's recording from both these devices. So I can go test test test one two three Test test test one two three and if I hit Q this time I now should be able to list out and see that I have two files there and I think quickly use Audacity I can say audacity that MP3 zero that MP3 and then I will say discard that last project Yes, and then I'll say import audio and I'll choose the other audio file and you can see I have this top track is from my headphones and the bottom track Here is from the other microphone, and if I play them together And you can see the difference in the audio files In this top one when I was closer to that microphone, it's louder when I was closer to the other microphone It was louder now do keep in mind That although this seems synced up if you're using different devices I mean these are two different devices from different companies. They might record at different sample rates You might get out of sync after a while So play around with see what happens with your devices But I mean if you're trying to record a whole song and you got a whole band and you're using different types of input It might not sync up just a warning to you there Unless you have equipment that's meant to work together or similar enough So there's the example of that. I've got the two microphones there I don't have a microphone hooked up to the input on my onboard audio, but let's go ahead and Show you let me see Try and think of another example and again you can continue adding more and more to devices, but if I was to again list out all my Inputs and then I can also list out my outputs here There we go, so again I can play audio out to my headphones or out to my speakers through my internal Sound device and I record the audio going from there So if you wanted to record the audio going out from the device Usually there's better ways to do that like if you're trying to rip audio from like a YouTube video you're very often using YouTube DL to download the audio download the file and Pull out the audio and then convert to whatever format you want rather than doing it this way but for some reason You needed to record the audio Output from a device for whatever reason leaders quick and dirty You don't know how to download the file and you just want to record the audio It's the same exact setup except for you just change the source number to one of these outputs So if I want to record the audio output of my headphones here, I can just do this I can say instead of input one, which was the microphone on here. I can say input zero And I can say map it to one and I can give it, you know, I've named the MP3 or wave file Whatever I want we can say Headphones wave if I wanted and of course you can give it more parameters Exactly how you want to format the output of the wave or MP3 or or flak file or whatever you want But go ahead and enter there and now it's actually recording the audio going out So if I was to play audio on this with with whatever as long as it's going to that device because I can switch between my different speakers If it's going to the headset it'll record it there So I can press play on like five different applications and the audio is playing out that headset It would now be recorded to that. I'll try to put a link in the description to my notes on here And go ahead check that out. So if you're using pulse audio and you need to write a script that's going to record from multiple microphones Maybe you're just going to do a quick interview with somebody and you want to record your microphone and that or Or you're I don't know talking to someone on Google Hangouts or some other chat program where you can do voice talking And you want to be able to record it real quick with a script You can write a script and click and you can record the their audio So if I was hang outing or Skyping or whatever program you use With somebody and I want to record the audio separate I can record my voice from the microphone and their audio out to here to separate files And that way later on when I'm mixing it together I can adjust the volumes and our voices are on separate tracks, which is nice Which of course you can do with a lot of different programs Especially if you're running a jack D on your system if you do a lot of music Creation you probably have jack D on there, which is great. And yeah, you can use audacity or Hard or or some multi-track recorder But if you just wanted to have a quick little script you can click and it starts recording from set devices You can use this in a script. I thank you for watching. Please visit films by Chris calm That's Chris the K. There's a link in the description also link in the description to these notes on what we just did Also, please visit my website my patreon site patreon.com for slash my likes 1,000 I appreciate your support. You can also support me on my website through pay pay pal or Patreon and you can sort through all my videos from both my channels on my my website films by Chris calm I thank you for watching and as always I hope that you have a great day


Here at Mystery History, we cover the unexplained areas of antiquity, either ignored, avoided, dismissed, or simply given an incomplete or often illogical historical lifeline of existence by mainstream academia, particularly those which we have covered of significant size, quarried from many miles away, now often immovable and once transported and either erected or placed atop one another seemingly effortlessly. We were, in a past series of investigations, looking into an interesting quarry within the Basda cave system on the edge of Turkey, a place with particularly good granite and a proven source of stone for numerous megalithic sites many miles around. Later, proven by us via the preserved linkages in tool marks to have been used by more than one group as if they had coalesced at this particular site. Yet, as mentioned, we have long argued that not just one advanced civilization capable of moving and cutting these incredibly monumental megalithic stones, or indeed precisely cut them, have been and gone, and we feel we have and continue to provide sufficient proof of these claims. The Colossae of Memnon, said to have once sang at sunrise, are both made of stones thousands of tons in weight, yet are eroding to dust along with countless others, yet clearly once precisely cut, just like all the other stone ruins we cover worldwide. Yet, sites like Petra and the polygonal casing stones found in some most curious of places such as the Pyramids of Egypt, preserving stones in a similar condition to the Colossae. Certain stone monuments of gigantic size found and stored in near perfect condition are found in these same areas, as if somehow spare catastrophe. Does this prove a sudden great flood? They, regardless, we claim, prove several cycles of activity at stone cutting creation. Were some monuments submerged and therefore preserved under the sediments, like those secretly removed from the Pyramids and Sphinx during initial investigations? Did the ruins claimed as similarly dated not, or were they attacked by a geological event? The perfect preservation of some of these statues must eliminate sandware as a possibility. The pursuit to the answers to these questions become closer, and we feel highly compelling.


Hey guys, thanks for watching. That was a short one today. I'll see you next week in my Tai Chi on Sundays and Chigo Meditation It's Sunday Tai Chi with David Wong Once again, we're gonna do a little warm-up Some Chigo exercises breathing and movements and we're gonna do the 24 move form You have questions Put them in the comments Hey guys, so that was the warm-up and then now we're gonna do the form Tell me what you guys want to learn.  Hey guys. Yeah, I don't know why it's laggy probably internet connection I'm gonna show you how to do Something very therapeutic with your dog. You have a dog So in Tai Chi, there's a practice called Tai Chi walking so You can do Tai Chi walking with your dog like this. So that's Tai Chi walking for the horse and backwards Also do Bagua walking So if you have a point in the center, usually you walk around the tree. Let's walk around anything All right, so that's my Tai Chi Sundays at Chigo Meditation David Wong and Moko We guys enjoyed the session and if you wanted to join me. I'm doing Tuesday nights workouts doing JKD Wing Chun and boxing heavy bag and basically doing aerobics punching training Or getting in shape and losing weight and technique So joining me Tuesday nights for that and see you next week Sunday for more Tai Chi A good one use the Chi and Hey guys, so that was the warm-up now. It's time for the 24 move form Hey guys, thanks for watching. So that was the Qigong Tai Chi warm-up sequence and the 24 Tai Chi form So you want to learn more just ask in the comments Give me your questions your comments suggestions what you want to see and Use the qi to prosper. I'll see you next time Hey guys, thanks for watching. If you stayed up to this point. That was the warm-up. So let's do the form So that was the 24 move form Tai Chi If you have any questions make it in the comments Make sure you like subscribe and Follow this channel. I'll see you soon in the next session. Hey guys. Thanks for watching. That was a short one today I'll see you next week in my Tai Chi on Sundays and Chigo Meditation It's Sunday Tai Chi with David Wong. Once again, we're gonna do a little warm-up Some Qigong exercises breathing and movements and we're gonna do the 24 move form You have questions Put them in the comments Hey guys, so that was the warm-up and then now we're gonna do the form Tell me what you guys want to learn.  I Told I'm gonna show you how to do Something very therapeutic with your dog. We have a dog So in Tai Chi, there's a practice called Tai Chi walking so You can do Tai Chi walking with your dog like this So that's Tai Chi walking for the horse and backwards Also do Bagua walking So you have a point in the center Usually you walk around the tree. Let's walk around anything All right, so that's my Tai Chi Sundays at Chigo Meditation David Wong and Moko. We guys enjoyed the session and if you wanted to join me I'm doing Tuesday night's workouts doing JKD Wing Chun and boxing heavy bag and basically doing aerobics punching training Or getting in shape and losing weight and technique. So joining me Tuesday nights for that and See you next week Sunday for more Tai Chi A good one use the Chi and Guys, so that was the warm-up. Now it's time for the 24 move form Hey guys, thanks for watching. So that was the Qigong Tai Chi warm-up sequence And the 24 Tai Chi form So you want to learn more? Just ask in the comments Give me your questions your comments suggestions what you want to see and Use the Chi to prosper. I'll see you next time Hey guys, thanks for watching. If you stayed up to this point. That was the warm-up So let's do the form. So that was the 24 move form Tai Chi If you have any questions, make it in the comments Make sure you like subscribe and follow this channel. I'll see you soon in the next session Hey guys, thanks for watching. That was the short one today. I'll see you next week in my Tai Chi on Sundays and Qigong meditation. It's Sunday Tai Chi with David Wong Once again, we're gonna do a little warm-up Some Qigong exercises breathing and movements Then we're gonna do the 24 move form You have questions Put them in the comments You guys, so that was the warm-up and then now we're gonna do the form. Tell me what you guys want to learn You like you guys like this Tai Chi sessions on Sundays Hey guys, yeah, I don't know why it's laggy probably internet connection. I Told I'm gonna show you how to do Something very therapeutic with your dog. We have a dog So in Tai Chi, there's a practice called Tai Chi walking so You can do Tai Chi walking with your dog like this So that's Tai Chi walking for the horse and backwards Also do Bagua walking So you have a point in the center Usually you walk around the tree Let's walk along anything All right, so that's my Tai Chi Sundays Qigong meditation David Wong and Moko You guys enjoyed the session and if you wanted to join me, I'm doing Tuesday nights workouts doing JKD Wing Chun and boxing heavy bag and Basically doing aerobics punching training Or getting in shape and losing weight and technique So joining me to a Tuesday nights for that and see you next week Sunday for more Tai Chi Good one. Use the chi and prosper Hey guys, so that was the warm-up now. It's time for the 24 move form Hey guys, thanks for watching. So that was the Qigong Tai Chi warm-up sequence and the 24 Tai Chi form So you want to learn more? Just ask in the comments Give me your questions your comments suggestions what you want to see and And use the Qigong prosper. I'll see you next time Hey guys, thanks for watching. If you stayed up to this point, that was the warm-up. So let's do the form So that was the 24 move form for Tai Chi If you have any questions make it in the comments make sure you like subscribe and Follow this channel I'll see you soon in the next session Hey guys, thanks for watching. That was a short one today. I'll see you next week in my Tai Chi on Sundays and Qigong meditation This Sunday Tai Chi with David Wong Once again, we're gonna do a little warm-up Some Qigong exercises breathing and movements Then we're gonna do the 24 move form You have questions? Put them in the comments Hey guys, so that was the warm-up and then now we're gonna do the form. Tell me what you guys want to learn You like you guys like this Tai Chi Sessions on Sundays. Hey guys. Yeah, I don't know why it's laggy probably internet connection I'm gonna show you how to do Something very therapeutic with your dog. You have a dog So in Tai Chi, there's a practice called Tai Chi walking so You can do Tai Chi walking with your dog like this So that's Tai Chi walking Put your forearms and backwards Also do Bagua walking So you have a point in the center. Usually you walk around the tree, but Let's walk around anything All right, so that's my Tai Chi Sundays Qigong meditation David Wong and Moko. I hope you guys enjoyed this session And if you wanted to join me, I'm doing Tuesday nights workouts doing JKD, Wing Chun and Boxing heavy bag and basically


There are a couple different ways that a welfare check could come into the scenario of a missing person. One is if you as a reporting party have concern for your loved one, but you don't live in the same residence. You can call the local law enforcement for the jurisdiction in which they live and you can request that officers go by and check their welfare. That does not involve a missing person's report. That's basically just for your peace of mind to know that person's okay. The other kind of welfare check is when someone has already been reported as a missing person, if they are contacted by law enforcement, then that becomes the welfare check by that contacting officer. That officer will let the person know that they've been reported missing, let them know who reported the missing and make available to them that reporting person's phone number. They will also then check to make sure, based on what was reported initially, the person who was reported missing is okay. They don't need medical help. They don't need a ride somewhere that they're not the victim of any kind of criminal activity.


The PMSA003I is an I2C-enabled sensor that measures air quality by reporting the concentration of airborne particulate matter in three different size groupings. It's housed in a sturdy metal box, so of course we'll have to take a look inside and see how it works. First, a built-in fan draws in air at a fixed rate of speed. The air passes through an inner channel illuminated by a laser diode, and particles in the air cause light to scatter. An optical sensor positioned below the channel measures the deflected light. The relationship of these measurements to the known wavelength of the laser is then used to calculate particle sizes by a proprietary chip. The chip then sends results out over the I2C bus. Once again, proving that lasers are awesome.


Hello everyone, I would like to share with you some good news. I received an unsolicited email today about my YouTube channel and That unsolicited email stated that my YouTube was selected one of the top 15 YouTube accounting channel to follow for 2019. So this is excellent news great news and here's the Ranking I happens to be number one. Thank you very much. Thank you for your support without you my viewers my subscribers I will not be there. So what I ask you to do Please continue supporting the channel by subscribing by sharing Connect with me on LinkedIn. If you don't have a LinkedIn account, please connect with me on LinkedIn I also have a Facebook page. You will find all the information in the description below and also find my email If you have any questions email me stay motivated spread the word around. Let's grow together. Good luck study hard


Welgiwch i'n gweithio teimlo. Yn rhan oedd y dyfodol yn ein ffwrdd, yn ymddorol y fideo yw'r ffrindig yma, yn ymddangos i'r ffordd a'r ffordd, y ffordd yn y ffordd y mae'r ffordd yn olygu. Fel oedd y rhan o'r ffordd, yma i'r dyfodol, ac ystod ar y ffordd ym ni'n gweithio'r ddefnydd. Ymddangos i'r ffordd y mae'r ffordd, rydyn ni'n gwneud y link ar y dedysgriffyn. Marco Sylvar yn ysgolwyd yma Etern's 1-0 victory over Arsenal at Goodison Park yesterday! He said he was absolutely delighted with the performance but the desire to work hard was key in Everton's victory. He's absolutely right that Blues performed fantasticly well against Arsenal but it was down to that hard work pressing trying to win the ball back before the good football took over from that. Everton were dominant in the afternoon game really. Mae'r ystyried fod yn gweithio'r golau. Mae mwynt e'na gwch chi'n sefydlu taneth gweithio yn ysbryd. Mae'n ffordd o'r holl, mae'n ymdweithio mewn ffawr isiogol. Mae'n holl ei tydd yn trun swydd. Be wertho'n ffordd i'n ffordd i'r holl. Mae'r holl ei ffordd o'n ffordd i'r holl ymd Auroraia, a ma y gallwn ei wneud mwy o ysbrydol o'r opanydd. Mae'n eisiau beth o'r rôl y tîmar. Gwne, y gallwn yn mynd i yn rhaid am ymateb yn yw ddweud ond felly rydw i chi'n gallu ddweud o dw i'n du cael"? Ond e'n dweud i'r Domyn ac yn gwneud i And rydw i Andre'i Gomes, bo'r benard ddweud ar hyn yn cael y byddai. Mae'r tanigai yn dechrau gyda Cullman yn mynd i gweithio ymddangos, felly mae'r gweithio mewn gweithgvent o dda a'r Chymo. Mae'r drwy'r bobl i ffordd i ddim yn ddod amlwgion.   Gallwch ddweud i gilydd gyda Gylffi Sigurddson i chi gafodd gyda'i gwasanaethau o ddweud o gyda i gwasanaethau amdano yn ei gweithio cyd-fwng-fwng, gyda ni'n chi gweithio yw bod wedi'n werth o'r ffwng-fuigol. Iddyn nhw i gael eu gwreithio hefyd yn cael eu ddau i gweithio ar gyfer y team, ac mae'n oser am ddweud i gweithio o'r gweithi'n gweithio ar gyfer, ond we can hear here. Let's hope we continue this win-and-run. Kertrwmour has said any decision regarding his future will be made in the summer. He said he's really happy at Everton. He's enjoying his football and he's looking forward to the Blues finishing the season strongly. But we'll have to wait until the summer before any decision can be taken on his career. Obviously he said earlier in the season he wants to remain a Chelsea. We'll have to see what happens. Obviously they've got a transfer ban. It might be difficult to get him full-time, but I'm sure that Everton and Marcel Brands will be trying to exercise that decision and trying to bring Zuma to Gooderson Park on a permanent basis. A player who is on loan at another club but has been mentioned that's coming back and being part of the Everton squad is Nicola Vlasic. His agent has said that Vlasic would like to remain at CSKA after this season. He said negotiations are on the way, but it's up to Everton really at the end of the day. Marcel Brands or Marco Silva had said last week that he hoped that Vlasic and Ongykuru would become part of his first team squad in the summer. Who knows? I suppose Vlasic is being playing every weekend. We'll want that guarantee of regular game time as we've been demanding so therefore it is probably appealing being able to stay at CSKA and be a big player for them, but he's Everton's player and at the end of the day you'll have to do what he's told, I guess. A reporter today that Marcel Brands is ready to axe Morgan Snidlin in the summer. I don't suppose that comes as any big shock really. Snidlin has been in and out of the Everton squad this season even though lately when he's been called on he's produced some good performances. He is higher in it at Everton than if he's not really getting in the team every week. It makes sense given his age that Everton would try to move him on. Marcel was linked earlier in the season with a move for the 30-year-old Frenchman and I suppose if they're interested in the summer that could be a possible destination for Morgan. Snidlin. Everton centre forward, Genc Togson has been linked with a move to Fenerbati today. It's reported that their president has a good relationship with Bill Cernite and they'll be trying to get him on loan. However, it's also been reported that Besiktas are readying a bid because they want Togson to return to them. I should imagine he'd probably favour going back to Besiktas out of the two clubs, but again it'll be dependent on what kind of package they come up with this summer. Everton have been linked with a move for David Neres at Ajax. That story broke over the weekend. He's given an interview to South American press saying that he's just leaving all of that up to his agent at the moment. The 22-year-old winger has scored 10 goals and got 10 assists for Ajax this season. Obviously, we know that Marcel Brands is looking at South American players. He's looking in the right age group and Keir Djorachaban is agent and he has links to Everton apparently and that's why they feel as though the move may go through. But who knows? Again, it's all speculating at the minute, but Neres does fall in to the right age bracket, although the fee of around 45 million euros for the right winger might be a little bit too expensive. Obviously, Brands was asked about the Lozano earlier in the season, his fee allegedly around 45 million euros and Brands thought that may be a little bit too high for Lozano. So again, it's a watch this space as we go forward. That is it for today. Make sure you subscribe, press that button now and take a sec. Give us a like on this video and if you want more videos, get over and join the Everton community on Patreon. Thank you very much for watching. See you later.