Hi, everyone, and welcome along to this talk. Thanks very much for coming out this afternoon to hear about security standards. As Ian said, this is our talk. It's too much to choose, making sense of a smorgasbord of security standards. Both of us picked the title before we realized that we have problems saying that word. So we will try not to say smorgasbord too many times. But we're OK so far. So who are we? I am Rory McEwn. I am a cloud native security advocate at Aqua. And I try to help out in various places in the community. One of the reasons I'm doing this talk, or I was very excited to do this talk, is one of the things I do is help maintain the CIS benchmarks for Docker and Kubernetes, which is something I've been doing for about five years now. And that's kind of where I got a lot of ideas for this talk. Hi, everybody. My name is Anais Orles. I'm the open source developer advocate at Aqua Security. Before that, I was working as side reliability engineer. I'm also a science ambassador. And I run a YouTube channel where I explore different technologies. Now, I got started in the security space when I was joining Aqua. So all of this is still fairly new. And that's also why I got really excited about giving this talk because it gave me the opportunity to dive into security standards. So I hope to take you along and then you find our talk interesting. Cool. So where do we start? I actually want to take one step back and say, why do we start? Why do we actually care about security standards? For me, this comes from, well, I'm guessing that a lot of people here, maybe even everyone here, is running their workloads and their applications in Kubernetes clusters and their running production environments. And once you've been running a production environment with Kubernetes security, with Kubernetes for a while, one of the questions someone is going to ask you is they're going to say, is this secure? You know, you're running all your workloads if what you've got is secure. And they might say, well, you're going to tell me it's secure, but how am I going to prove it's secure? You can you prove that this is secure? And that's where security standards come in, right? Because you can say, well, it's not just my opinion on what security things have to be set here. This is an authority who has said that this is the secure way to run this platform. So that's, I think, why we're interested and why we want to think about what standards are, how they work, and which ones we might want to use. So we're going to take this through three steps today. We're going to talk about making sense of security standards, a little bit about what they are, how they work. Picking the right one. So we said there's a smorgasbord. Let's see if we can pick out which one makes most sense for you to use. And to do that, we're going to talk about how they work and why your Maya may or may not want to use them. And then, and Ace is going to really help and take us into the practical side of this about securing your cluster. You've picked your standard. Let's talk about what tools and techniques you can use to actually apply that. So what is a security standard? This is, there's lots of different definitions. This one will work for this talk. Guidance for vendor or third party on secure configuration and hardening of a product or service. So this is going to be some authority. Maybe it's the vendor or the product. Maybe it is an independent third party who are going to say, this is how you secure this. This is how you make this a secure because basically almost no software products come out of the box super hardened down. They tend to come out of the box in a fairly easy to use model and Kubernetes is no different, right?  So typically you're going to need to apply more security in order to lock stuff down. So we're going to get guidance from third parties on how to do that. What type of standards are there? Because when I was looking at this and what I've been thinking about this for a while they're essentially in my mind two different types of security standard. The first ones we got are checklists, right? And you can spot a checklist because it will typically have specific guidance in numbered sections with specific actionable settings like you will set this setting to this value. It will have a fail and it will have a pass. So it'll have audit guidance and remediation guidance. So that's a compliance checklist. And those are really targeted at people being able to say is this product configured in a way that complies with this document?  So a hardening guide will cover the same kind of area as a compliance checklist but it probably isn't as prescriptive. It might mention key security standards, you know, flags or settings but it won't mention every single one. You know, it might just talk at a more high level. You should look at this area. You should consider this area. So one of the problems in assessing against a hardening guide is hardening guides are typically not written in that way. They're not designed to be pass fail. They're more designed for you to read, think about and apply. So those, I think, most of the ones we're going to talk about today fall into those two categories. So what do we have for Kubernetes? There's actually a variety of options which is our smorgasbord. We have the NSA guide. I'm sure people will probably have seen this, it got quite a lot of press when it came out. The NSA have produced a security hardening guide for Kubernetes. There's two versions of this 1.0 and 1.1 so they're keeping this up to date. That's a hardening guide. We then have, as represented by the vendor logos, vendor hardening guides. Typically, if you're using a major distribution of Kubernetes, you will find that the vendor will produce some kind of security hardening document for you. So AKS, EKS, GKE, OpenShift, all of these, if you go to their website, you'll find hardening guidance. We then have a couple of checklists. The logo of CIS isn't brilliantly visible. That's CIS. So this is the one I've been helping maintain for a long time now. This is a compliance checklist. This is a CIS benchmark. The CIS, if you haven't come across them, is a center for internet security. They have a wide variety of these benchmarks. They're vendor-neutral and you can get them for pretty much every product, but a lot of different products. In the computing IT ecosystem, we'll have a CIS benchmark. And then we also have the DISA Stig. So the DISA have come up with a essentially compliance checklist, which is really targeted at their users. But it's similar to the CIS benchmark. Down the bottom there, I've got the logo for the Kubernetes project. Now at the moment, the Kubernetes project itself doesn't have what I would call a full hardening guide. We've got lots of great documentation about security and there's stuff you can go and read there, but it's not really structured in the way of a hardening guide. With that said, I'm gonna do my punt for SIG Security Docs right now, which is we do have an open issue to be starting a hardening guide. So if anyone comes away from this talk, motivated in thinking, you know what, I'd really like to see one of these from the Kubernetes project. We'd love to meet you. We have SIG Security Docs meetings regularly, totally come along and we'll happy to help. I think it needs to like broken down and split up. I think we can totally do it and we've already got some good starting points. One option you won't see here is you won't see logos like PCI up there. So a lot of companies, I'm sure if you've been out in the floor, they'll talk about doing PCI compliant Kubernetes if you're in payments industry. PCI doesn't currently have any Kubernetes specific guidelines. People can take the general PCI and they can apply it, but that's their opinion of what Kubernetes compliance looks like in PCI. There is a PCI draft document, which has been in draft for a quite a long time now, which might come out hopefully this year, which will cover that gap. So there's no actual PCI guidance for this at the moment, but people will still talk about that. So that's kind of like our available options, what we've got to work with. So having said that, which of these should you choose? Which if any of these actually makes sense for you to apply to your environment? Now, obviously if you're regulated, that question might be answered for you by your regulator. They might say we expect you to apply X or Y, but not everyone works in a regulated industry, not everyone has that. So there's a couple of questions that I think are worth talking about, and there's also a couple of things that are definitely worth knowing about the standards process. First one, which distributions of Kubernetes are covered by the standard? There are 132, I want to say, the last time I looked at the spreadsheet that gets maintained, different Kubernetes distributions, product services, which give you Kubernetes. Not all of them have got a standard. CIS benchmark covers QBDM, AKS, EKS, GKE, OpenShift, OKE, which is Oracle, and ACK, which is Alibaba. So if you want to comply with CIS benchmark, and you've got one of those, you can find the document which actually applies to your distribution. If you're using any other type of Kubernetes, you can still try and use the CIS benchmark, but just be aware that some of the findings might be false positives, and they might be false negatives, because it is not designed for those. So things like file paths, you know, we will say, for example, admin.com should have permissions of 600, and we expect to find that in ETC Kubernetes. Well, if you're not using a distribution that puts it there, that setting and check doesn't make any sense at all. So first point to be aware of is CIS benchmark careful what distribution you're using. DeciStig does not specify its distribution, but when I read it, it's QBADM.  It's about as close as you can get to vanilla Kubernetes. Again, if your distribution puts things in different places from QBADM, be aware that your tools might not work properly, and your checks might not work properly. NSA is generic. It's a hardening guide. It's not a compliance checklist. They do have some specific file paths, but typically they stay away from that, which is great, because it means you don't have to worry about this too much. And then, of course, we have our vendors, and vendors generally is only their distribution. So that's one challenge. If you want to standardize on using a vendor's hardening guide, is the hardening guide only generally applies to their distribution, right? Microsoft are not going to write 130 different CIS style checks for different distributions. They're going to focus on AKS completely understandably. That's their product. So that's the first question. Is your distribution covered? Second question, which versions of Kubernetes are covered? This one is important. The Kubernetes project adds new features and removes features all the time, right? If we think about some of the things that used to exist in Kubernetes and don't anymore, Insecure API port. From 123, I want to say, definitely in 124, the Insecure API port settings on the API server do nothing. They don't work. But if your CIS benchmark, or you use an old version of a security standard, and it says you need to have the Insecure API flag set to nothing to avoid it being set, well, you might have a false positive. Your person runs a check. They say, hey, you've got a finding for this and you don't have a finding for this because that setting doesn't exist in Kubernetes, that version. Pod security policies. If your standard talks about pod security policies, it doesn't apply anymore if you're using later versions. PSP is deprecated, forever doesn't know, and it should be removed in 1.25. So it's important to think about what versions of Kubernetes are supported by the standard you use. CIS benchmarks. We have benchmarks for 123 and 120. Typically, we do it every three versions, which is a resource issue. If someone's thinking, I want to see a new one for every version, come and help. CIS is an open community. We are more than happy for someone to come along and say, I want to do a new CIS benchmark for every Kubernetes version. DeciStig. Undefined includes options not present in recent releases. So I would recommend being very careful if you do have to use the DeciStig. I found at least one check that references Kubernetes 1.12. So challenges, they're pretty out of date.  In standards world, do you have the resources to go back every four months and re-update the standard? Do you have even to do it every year? And sometimes there's a lot of bureaucracy in changing standards. So be very aware if you're going to use that one, you might get some checks that make no sense whatsoever in modern Kubernetes. NSA Harding Guide. Again, this is undefined, but generally up to date. I would make the point of make sure you use version 1.1 of the NSA guide because they fixed quite a few out of date issues. They got a lot of good feedback when the first one came out. Things like they were using the old insecure versions of the scheduler and controller manager ports, which made no sense in modern Kubernetes again, but they fixed all that in 1.1. So if you're doing an NSA thing, make sure you use 1.1. You should be generally fine. Don't know how up to date they're going to keep that. I hope, obviously, that they won't maintain that, but I've got any insights into that project. So, the last thing is what areas do they cover? The first question after yourself is what is actually covered by the standard I'm using. Hardening guides typically can cover wider areas. So Hardening Guide, for example, the NSA guide will talk about security incident and event monitoring. It will talk about threat detection. Things which you can't really make prescriptive guidance on. I can't tell every company in the world this is what you should do for a seam for Kubernetes because that obviously doesn't make any sense. How could I do that? It's specific to your environment. So Hardening Guides are good because they can go slightly wider, but at a slightly higher level. But the downside is they won't tell you exactly what to do. They'll just give you pointers in the right direction. Configuration benchmarks, however, typically look at just the product. So the CIS benchmark looks at just the product. The Docker benchmark looks at just the product and they stand alone. So the Docker benchmark assumes you're running Docker standalone. It doesn't assume you're running Docker as a CRI in Kubernetes. And so some of the settings, again, don't make any sense if you do that. There is a gap currently in Kubernetes, which is that there is no CIS benchmark for container to your cryo. So this is a gap. I personally would like to see it filled by some kind of CRI guidance in the Kubernetes CIS benchmark, but that has not yet been accepted as a concept. So again, be aware of what these things won't cover. CIS benchmarks are quite limited. Things you can set in Kubernetes, not all the stuff you need around to make a complete environment based on Kubernetes. So you might end up needing to mix and match. But that's kind of like two, there's kind of three questions I would be asking myself when I'm thinking, which of these things, which of these makes sense for me? But let's talk about the details now. So how do we actually go about securing our cluster and choosing a tool that can help us to see whether we are compliant with one of those standards? Well, the standards itself, they don't help us to secure our environments. It should start far earlier when we are in our development process that we integrate with different tools to see whether or not we have certain vulnerabilities, misconfigurations present in our environment. So we can, for example, integrate different tools into our processes. Another way to go about it is to adapt our current processes or workflows to become more security focused as well as assigning ownership within our team, whether those are specific security teams or we have somebody within each engineering team focused on security, but ultimately the process of securing our environments starts way earlier before we think about security standards. So who's responsible for actually implementing those tools? Well, like most things, it depends on our team, on who's responsible for it, who has to know how, who's available, as well as our objectives. One thing we all struggle with is finding somebody who has to necessarily know how to actually implement those tools, understand them and then implement them and build upon it with our environment. And other obstacles to implement security standards, to follow security standards are competing priorities between different teams. So one team might want to check whether or not we are compliant and other team might just want to go about, let's release the next feature. Another thing is budgeting, whether you're using vendor solutions, such as Aqua Security, Sneak, or you're building an in-house team, you will have to allocate budget and other resources to implementing security solutions and checking for security standards. The other thing is vague and generalized guidelines. So while CS NSA provides us with a checklist, kind of steps to follow, it's not clear, it's not to the point of like what do you actually have to do. And then the last thing is difficult to use tools and platforms. We don't just want to add new tools to our existing stack that we then have to maintain, that we have to understand, that we have to maybe use even separately from our existing tooling. So those are the issues. And then, which tools are actually out there? Which tools can you use to check for security standards for your compliance? Well, they're different tools and they differ in the following aspects. So the first one is installation. How do you install the tool inside of your cluster? How do you operate the tool? They mainly differ between CLI tools and those are different to your usual CLI tools. CLI tools that check your cluster for compliance, they will install Kubernetes resources usually inside of your cluster. And that's across different tools, the case. Now you can also install Kubernetes operators. You can install Kubernetes manifest to have those resources living within your cluster. Then the other thing is the way that those Kubernetes resources operate within your cluster. What types of resources are there? Are those jobs running inside of your cluster? Is it an operator? Then the scan coverage, depending on which tool you use, you will get a different outcome ultimately from the tool, from those scans. And then do they integrate in your existing environment? What tools are you already using and do the new tools integrate with them? And then the focus, are those tools focused on engineers, on cluster admins, or on security professionals? Now let's look at some of the CLI tools that are available to generate CIS reports. The first one is Coupage, which is an ACO security open source tool that is used across different vendors that are also built upon Coupage. Now here you see the Kubernetes resource that basically has run the CIS report scans. So with Coupage, a CIS report is gonna be generated for each node. If you have a three node cluster, you will have three reports. If you have a one node cluster, you will have one report. And then you can describe ultimately each report and you will have a Kubernetes resource. So Coupage really generates Kubernetes resources inside of your cluster. If you run it as a Helm chart, as for example, part of the starboard operator, then you would have a COD cluster resource that you can then use. If you can also run it instead for the CLI, but in this case, we're using the Helm chart.  Should I clarify it real quickly? Okay, most hands go up, just clarify it really quickly. It's basically an operator automates human processes within your Kubernetes cluster. So this is what the starboard operator will ultimately do. It will continuously scan every three hours or so your cluster to generate those reports. Now, some of the highlights of Coupage, it works as a standalone tool or you can use as part of the operator. There are multiple different installation options. You can also run it as a Kubernetes chart just by itself if you don't want to use the entire operator and it's used across companies. Now, the next tool is CoupBacon. It's a project by a coworker of mine that I came across who's here also in the audience. So if he has later any questions, you can also approach him, I guess.  Now, it's a fairly new tool from what I could see when I was doing my research, which means that you can also probably contribute to it, help shape it. Now, it creates or it has specific CAS scans for different cloud providers. So from what I could see, the goal is to add more of a time and it runs either as CLI or as a job inside of your cluster. Now, moving on to NSA reports. Starboard also has now an NSA add-on which basically creates cluster compliance reports inside of your cluster. So before the starboard operator, you could also generate NSA reports and it's the same thing to the CIS reports. It's ultimately a custom resource definition that's living inside of your Kubernetes cluster once you generate it and you can query it like other Kubernetes resources. Now, with the NSA reports, they are part of your other cluster audit reports with starboard, like I mentioned. And you can ultimately, because it's a Kubernetes research, it allows you to integrate the reports with your existing tools. Like other Kubernetes resources, it's not a separate tool that you have to use and maintain. Then it also creates cluster compliance and cluster compliance detail reports. So there's a more detailed report than this one that will be generated. Then the next tool is Cubescape by AMO. Now, you can install as a CLI tool or also as a home chart. From what I could see, if you use the home chart, you will have to sign up to their hosted UI to get the token and then install the home chart. But you can also use it to the CLI and this is the full output that you will receive but you could also get a really detailed output if you add additional flags. And with the submit flag, you can push the reports also from your CLI to their dashboard. Now, this is ultimately the resource that will be created in your cluster. There are several jobs that will run every once in a while to perform the scans. So CLI tool, they are integrations for the integrations with the UI possible. They are plans from Cubescape to open source the UI but I'm not sure if that will be also a hosted version or if you can also self-host it then in that case. Then another thing is that Cubescape is producing human readable output. So it's far easier to see what's going on versus checking out the custom resource definitions from within the cluster. So the target audience is a little bit different. It's more focused on engineers and cluster admins versus security professionals who would want to build upon the scans and the tool itself. So I think personally that's suitable for multicluster environments if that's what you want kind of out of the box open source because you can ultimately install every cluster and then aggregate it within the UI. Now, other decision factors that you might want to take into account like mentioned is how much does this tool integrate with your existing environment? Will you have to maintain the tool itself? Or can you actually build upon it and integrate in your existing for example observability stack? So this is a screenshot from another demo I did where I basically visualized the vulnerability scans from starboard inside of a Grafana dashboard. So I basically used starboard exporter to get the metrics out of the cluster and inside the dashboard. And similar you can do with other scans from starboard. Cool, awesome. So that was essentially kind of the, there's a couple of different takeaways I think hopefully come across from what we've been talking about today. Security standards are useful, right? They're useful because you might well be asked for this external validation. Whilst you can have, I always say that there's a difference between security and compliance, right? I can be secure without being compliant and I can be compliant without being secure. So for example, I could be secure because Ian here could be running my cluster and it's going to be secure. But if Ian doesn't write everything down, it might not be compliant because someone can't walk in and go, I've checked all the things that've been done. I can also be compliant because I follow a checklist but if that checklist isn't appropriate, it doesn't cover everything, I'm not secure. So security standards are helpful but there should be taken as something you use as a starting point. They'll give you advice about where you can go, the sorts of things you should consider. I always recommend against where possible, taking those being the only thing you do. Don't just say, I've done the CIS benchmark, I've been through it, I checked or crossed everything, good, my security is done because it's not. With that said, I also recognise that you work in people working in compliant environments or regulated environments and you're going to get asked to prove it and having something like CIS benchmark where you have gone through and said, which of these apply to me? I'll do them, which of them don't apply to me? I won't. And as long as you can explain that to an external security auditor, hopefully they'll take that as being a reasonable indication that you've done the work necessary to secure your environment. It's important as well to understand with the tools what they do and don't do for you. What Anais showed was these tools are very useful and they'll deploy in your cluster and they make some checks, but they're limited in what they can do depending on how you deploy them. So for example, if a tool only checks the Kubernetes API, it can't do checks that are on the local host. It can't say what file permission you've got because the API doesn't expose that information. So again, taking a bit of time to try and understand what these tools are gonna do for you but also what they won't do for you will make the whole thing more useful and will give you an idea of what you know, what you shouldn't, shouldn't be doing. So yeah, I think tools can definitely be helpful in that regard. So just two links, we've got them up there. Slides will be up on the site, they kind of weren't because we were finishing them yesterday but the slides will be up on the website on Shed. So that's there as well. And I think that's awesome. Do we have any questions? Or are we all good? Is it Friday afternoon and everyone's thinking about their flights home? We do have time for a question or two. Anybody? But there. Yeah, so what the question is, what about the workloads running in the cluster? In addition to the cluster control plane itself and the cluster nodes, you need to do security checks quite rightly for the workloads. The answer is yes, some of the scanners will do that. Off the top of my head, I wanna say that I know that Trivie, we didn't talk too much about Trivie but Trivie actually has just added support for doing exactly that. And I'm fairly sure Cubescape does as well. What you can get a scanner to do to check the security context settings of all your workloads and to see which of them aren't optimal. Obviously here, one of the things I'd recommend very much looking into if you haven't already is pod security standards, which is a generic guidance around here, all the settings and they've got some ideas about levels. But yeah, you're right. I would say things like Trivie do do that now. So they've added that. So essentially, if you think about like what's actually needing to be done here, from a technical standpoint, this isn't super difficult. Pool YAML, check YAML for setting, return, good, bad.  So yeah, definitely two, I'm pretty sure Cubescape does. So yeah, they do cover workloads as well from that perspective. Whether the standards do mention it as well. Thanks. Yeah, no, no, several questions. A good question. What other gaps do you see in the market that you'd like to have a tool for or built so that other people could benefit from it? Are there other things beyond the things you showed So the question is what gaps do I think we are or do we think there are in the market of things you won't want to fit a tool in? I would say for me, I suppose in open source, it's a question of whether we can cover more of the distributions. I think there's a slight concern to my mind now that, you know, I can blithely say it covers QBA and a couple of others, but there's people running lots and lots of clusters that aren't covered. The challenge is, you know, we need someone to actually go through and do the rule writing. I think there's some engines out there, but rule writing I've all seen is like maybe not something people are as fond of because it does get, I've done it myself a bit, it does get a bit boring when you're writing rules for an entire product. So yeah, I think coverage there, and I think maybe as well some slight cross cluster coverage. I don't, the open source tools at the moment don't as much do like comparison, you know, this cluster is better than that cluster or this cluster over time. That tends to be more where the commercial software I think plays at the moment in that kind of like long term, you know, my cluster is doing like this and then it went like this and you know, so. You mentioned earlier correctly that the different versions of Kubernetes have different security relevant default configs that the benchmarks need to keep up with or maybe behind and you need to make sure you run the right versions. Is there anything on the Kubernetes side to make it easy to know what security defaults change between releases and those security relevant settings so that if you are running ahead of the benchmarks that are provided, as you just mentioned it. It takes a while to get those rule sets updated so that if you're trying to stay like current with latest case releases, you could update your compliance benchmarks to align. So the question. Without having to dig into the code and like. Yeah, so the question is around, I hope I've got this right, is as new Kubernetes transactions come out, is there any way of keeping up to date with the new defaults and chain settings that have changed? I'm going to say that I haven't come across one. I hate to say I read release notes. I honestly reading the release notes for each version because typically security settings will be mentioned in there. I know that's not like a nice answer. But that I personally, what I tend to do is read release notes and kept. So I'll read the kept coming to each version and say which new things are going to land in this version and then do they come out? Are they going to make a change? You're right though it would be nice if that was perhaps like presented because I think the information is definitely there for sure. I just don't think that it's necessarily like summarized in a nice way. So yeah. I'm passing the mic to the next question asker, but hi, I co-chair Six Security and we do actually in the most recent couple of releases anyway, have as part of the release blog a summarization of security changes. And so I think that's the thing we're going to continue to do. Next question person, sorry about that. Thank you very much. A follow up question to the first one regarding workloads. You said the tools, for example, Starboard scan the cluster API or like the API at given times, I think it was three hours or something. What happens with workloads that ran in between two scans, for example, like one of jobs that could have malicious payload? Are they picked up upon? Are they considered or are the tools just looking at workloads currently running? Do you know how this is handled? What I would say is that, man, I need to correct me if I get this wrong because I'm just thinking about how I know how it works. The answer is they wouldn't pick it up if the workload wasn't running at the time the tool ran. What I would say for that is typically the control I'll be looking at there is admission control. So typically, hopefully, so in my world of what does the cure Kubernetes look like? You are running the same checks in IAC before thing goes live. You're running the same things in CICD to make sure bad things aren't happening. The same thing in admission control and then the same thing as your scanner. So hopefully, you know, there's other stages that you're gonna catch that at because you're right. Otherwise what you would need to do is actually have something which reflexively ran. And in terms of the open source tools, back to the question about gaps in open source tools, I don't think there's one that will reflexively scan. But I would hope that everyone, hopefully everyone who's running in production is running admission control. If you're not, I thoroughly recommend that that should be the thing you should go and look at doing immediately after this conference because that's how you would stop things like that happening. We have one more minute and at least three more questions. So I'm going to arbitrarily pick one of you and encourage all of you to talk to them after. Both of us are on Twitter, by the way, for follow ups, totally happy to try and help. And arbitrarily picking the excited person in the front. And Nate, from your research on DX of security tooling, what do you think the trend is towards the change in developer experience with these new security tools and this new generation of tooling? I don't understand any of the questions from IPM, I'm so sorry. Can you repeat the question? My question was just, what do you see as the trend in terms of the developer experience with security tools? Are they getting easier to use? Do you think that's part intentional or is that just an outcome of the rest of things getting more mature? So the difference of the developer experience between the different tools. Okay, so how did it differ? So I mean, the main thing is really like, how do you want to operate a tool, right? You want to run it more automated and you just want to have kind of the aggregated source and you don't want to check the cluster itself or the CLI, right? Like I, for example, prefer not to have the output in my CLI and I would have to, I don't know, take it somewhere else from there which is very complicated and annoying. So what I would do is I would integrate into an existing dashboard or into my observability tools. That would be my ideal case. Now, from the user experience, a lot of these tools are not documented in the best way and that's also something we're working more towards the open source projects at Accra because a lot of them will mention like, here's how you run NSA reports but a lot of people who get started with those tools and that's, for example, mentioned in the case of Cubescape, they have a lot of young new users and I would imagine that they would struggle having just kind of the output of like, here's how you run the command and that's it and no further explanation of what you do with the output then. So answer the question. Okay, thank you. We are at time. I would like to encourage everybody to give our amazing presenters a round of applause for this amazing talk.


It is available for 2022. So these are gonna be kind of specific types of credits like most credits basically are. They're gonna be for specific types of things. The government typically deviating from the general concept of an income tax. Remember, a general concept of an income tax would mean that you would allow deductions for those things that you needed to consume in order to generate revenue because the tax should be based not on gross income but on net income. That just makes sense from an income tax type of system. That makes sense most clearly in the Schedule C. That's why we have an income statement on the Schedule C. But the government wants to incentivize us and nudge us in other ways as well, which leads to deductions that have nothing to do with expenses that we needed to consume to generate revenue and then this whole concept of credits, which is outside the whole income statement altogether, which are other ways to kind of put in other things in there, which will confuse things but also allow the government to provide incentives which you may be in favor or not in favor of any given incentive. All right, so we have the alternative fuel vehicle refueling property credit. That's on form 8-9-1-1. This credit applies to the cost of any qualified vehicle fueling property. So for more information on that one, if that applies to you, you can see form 8-9-1-1. Look at the form and instructions on the IRS website for any of the credits that might be applicable to you. You've got the alternative motor vehicle credit. That's on form 8-9-1-0. For more information for that, you can go to form 8-9-1-0. Biodiesel, renewable diesel or sustained aviation fuel mixture credit. Obviously that's quite specific for the credit. You've got form 8-8-6-4. If you wanna take a look at that in more detail, biofuel producer credit. That's on form 4-6-7-8. So you can check that out on the IRS website. Carbon oxide sequestration credit. So obviously some of these dealing with the global environmental kind of stuff.  This credit is for carbon oxide that is captured at a qualified facility and disposed of insecure geological storage or used in a qualified enhanced oil or natural gas recovery project. So in other words, we're dealing with the carbon. It's one of the major greenhouse gas type things. One way to deal with that is to try to reduce the carbon emissions in the first place. Another way to deal with that is to try to grab the carbon that is in the air and take it out of the air is how I understand it and bury it or something or store it somewhere so that it's, you know, that would be the other concept. So if you're dealing with that stuff, you might be able to get some credit money for it. So for more information, you could see form 8-9-3-3. Credit for employer social security and Medicare taxes paid on certain employee tips. For that, you've got form 8-8-4-6. This credit is generally equal to your employer's portion of social security and Medicare taxes paid on tips received by employees of your food and beverage establishment where tipping is customary. So clearly, if you're in an area where tipping is customary a restaurant, the tip situation causes all kinds of weird stuff happening. So you can, you wanna try to drill down on how you're gonna deal with keeping in compliance with the tip situation while also being competitive in the industry. So the credit applies regardless of whether the food is consumed on or off your business premises. So for more information, you could see publication 8-8-4-6. Credit for employer differential wage payments. That's on form 8-9-3-2. This credit provides businesses with an incentive to continue to pay wages to an employee performing services on active duty and the uniformed services of the United States for a period of more than 30 days. So someone needs to serve on duty. So then if you keep them on the payroll, that's kind of like the incentive for that particular credit. So credit for employer-provided childcare facilities and services, that's on form 8-8-8-2. This credit applies to the qualified expenses you paid for employee childcare and qualified expenses you paid for childcare resources and referral services. For more information, you could see form 8-8-8-2. And then there's the credit for increasing research activity. I'm doing research on emotions and brain activity. It's form 6-7-6-5. This credit is designed to encourage businesses to increase the amounts they spend on research and experimental activities, including energy research. Energy research, that must be with those energy drinks or something I've been experimenting with those. Just kidding, that doesn't qualify. That doesn't qualify. Red Bull doesn't qualify, I don't think. So for more information, you could see form 6-7-6-5. So then you got the credit for small employer health insurance premiums, that's form 8-9-4-1. This credit applies to the cost of certain health insurance coverage you provide to certain employees. For more information there, you can look at 8-9-4-1 form. Credit for small employer pension plan startup costs, that's on form 8-8-8-1. This credit applies to pension plan startup costs of a new qualified defined benefit or defined contribution plan, including a section 401k plan, simple plan, SEP plan. So these come up fairly often for obviously small businesses because that's one of the biggest benefits that you can provide to an employee and also it's often beneficial to the employer so that they can put more money into a 401k simple SEP type of plan than they could otherwise do in like an IRA if they don't have that set up. So you might also be able to look into the credit for small employer pension plan startup as well for that. So for more information, you could see publication 560, retirement plans for small business. You got the disabled across credit, disabled access credit that is form 8-8-2-6. This credit is a non-refundable tax credit for an eligible small business that pays or incurs expenses to provide access to the person who have disabilities. So you're doing something specifically to provide more access. Access denied. Access denied. Ramps, you know, having an elevator that's suitable for like wheelchairs or something like that might be something that would come to mind. You must pay or incur the expenses to enable your business to comply with the Americans with Disabilities Act of 1990 for more information there. You can see publication 8-8-2-6. Distilled spirits credit form 8-9-06. This one sounds interesting. This credit is available to distillers and importers of distilled spirits and eligible wholesalers of distilled spirits. For more information, you can see form 8-9-06.  That sounds, I mean, okay, that's interesting. So I thought they taxed you more. They taxed you more for distilled spirits sometimes but in any case, I'm not in that industry. I don't know the ins and outs of it. Employee retention credit for employers affected by qualified disasters. You got form 5-8-8-4-A. You may qualify for this credit if you continue to pay or incur wages after your business became inoperable because of damage from certain federally declared disasters. So now the government has been trying to put in these items to try to keep employment up even in a situation where you don't need the employees, where you'd normally have to lay them off. And I'm kind of curious on what the actual end result of this is because it's trying to keep people on artificially into particular areas and incentivizing people to do that and whatnot as opposed to trying to change things. So I don't know, it's kind of interesting. I'm curious to see if that's having an overall net benefit in the long run or not because usually you would like to transfer whatever changed just to make the transition period as easy as possible so that people can go on to whatever the new thing is. My concern with these kind of credits are that the downturn from whatever disaster happened could end up being permanent which means you just kind of and if you just pay people to be stagnant in the same situation instead of moving on to the next situation may not be beneficial all the time. But employer credit for paid family and medical leave form 8994 this credit applies for wages paid to qualifying employees while they are on family and medical leave subject to certain conditions. For more information you can see form 8994.


Good afternoon everyone and welcome to the Stock Swoosh Show Play of the Day. This is Matt, wonderful, wonderful Golden Gap. So happy back in a groove where things are going to massive numbers. Love that. Ernie's using his full swing. Feels like normal world now again. Here it is, July 17th. Everything worked today. Everything worked today. So that's the ticket. It's like Christmas in July here for Golden Gaps today because everything worked. And you could have done everything basically. And I rated so many things this morning. It's not even funny. And I'm actually still in some of this. And it's working and it's holding. But I'm out of actually quite a bit. So let's go over it. This is the mat. One of the reasons that I really like this mat. Look at this. This is going to keep going. One of the reasons I really like the mat today is because it was a good gap. It rated well according to my 26 point rating system. Number one. Number two. When I studied the chart and looked at it, I said, boy, this is really actually good. And I also know a lot of traders typically tend to buy these types of cap downs or they don't do them at all. And they don't short them. But this was a short today. It was a good quality short. And you really knew how to, you needed to know how to read the gap today to short this. Which I do know how to read gaps and how to reprice. It was a great short. A great call. Great entry in here. And it's working. And it has a lot of potential for this afternoon to play out. And I usually don't hold anything into the afternoon. But this is worth it today. This is worth it today. Next number is 36, then 3550. The stock could go to $35 today. So it is worth it for me to hold a portion of this down to a bigger number this afternoon. Absolutely. 100%. And I really had a lot of conviction in this. And I was patient with it. I waited it. And I stayed right on top of it. I didn't move off of it. And I did the right thing with this. It was a great call. Perfect, perfect, perfect entry here in the mat. This couldn't have gotten a better stop, actually. The stop on this I was anticipating being fairly large. It was much, much, much, much better than expected. Here it hit. Rolled all the way over. So I got out of a portion of this into the first drop in the morning, which I think is the right thing to do. But the market is not doing anything to help us today. The market is against us today. This gap is on its own 100% to go wherever it wants to go to. What I loved about this gap was that this gap was either going to work today based on institutional selling or not at all, because traders weren't going to short this. And some traders tried to probably buy this at different points today. And it's not along. It is a short. It was a good bearish gap. It is a good bearish gap. This has a lot of potential here this afternoon. I'm really going to be watching this, watching this between now and 12 o'clock. I think this breaks a load of the data before 12. Look, it's trying to do it right now. 20 cents for the lower today. This is going to be a huge trade, if this goes to one of these bigger numbers. I mean, I'm already upbooked nicely now. And I put the stop. I even lowered the stop in this. I lowered the stop in this then for the rest still to be positive. But if it would have taken me out over 37, and it just had a big rally in there and did not take me out. And this is breaking down again. It's just set up in the 15 minute. Just set up in the 15 minute here. And it held. This is going to break the low. Nice call. Nice call in this today. And I'm sticking with it. So if you want to hold something to the bigger number, to the dream target, if you want to do it, there's no way things don't just go straight down usually right to the huge dream target. I mean, I'm not saying that they never do, but I'm saying it's rare.  You know, and you just got to be aware of it. But to hold something to a bigger number sometimes is so rewarding because the money can be really, really good. You can get another dollar out of something sometimes. And that makes a big difference. Even if you don't have the whole position, it makes a big difference. Really makes a huge amount of difference. So a really good gap today in math. This is a nice chart. It's a bearish gap. And a lot of traders didn't do this today or didn't give it the credibility that it really had because they don't know how to read gaps. And people lots of times see these things and they say, well, this is a big gap down here and they want to go along it. This was a nice gap today based on institutional selling and that's what's creating the moves and that's why this worked so pretty, so beautifully, so well, so quickly. It's because it just got sold off. Selling, selling, selling, selling, selling. Good gap. This is the Stock Swish Show Live. My name is Melissa Armoff. If you'd like more information, if you want to learn how to trade gaps and if you want to learn how to trade stocks and if you want to learn how to reprice and trade, you can email me at melissa at thestockswish.com The next golden gap class is July 26 and 27. There was a ton of things to do today. You could have hit it all today and I had the list in the room and read it, I think, five or six things I'm going to remember now. My two top picks worked for the shorts, though, right out of the game and it was a good day. This is in tomorrow's Friday. It feels like Friday today, though. So I'm going to be following the math down and through, okay, following the math down and through with the rest of what I have of this and we'll see how it plays out. Nice, nice math here. Can't lose in this now. Lower the stop underneath my initial price, but, you know, I'll be thrilled if this thing goes to the dream number today. So have a great day, everybody. Have a fantastic day. This is Melissa with thestockswish.com. Email me if you'd like more information on the upcoming gap class. It's Christmas in July today for the Stockswish Show Live trading room with Matt and tons of gaps working. Have a great day, everybody.


All right, so Some of you have heard my testimony About about ten years ago that I started coming to this church Edgar had preached the gospel to me I Did well externally for a time, but I was full of pride hiding my sin If I did talk about my sin with the brothers, it was very it was in a very general terms and never with any specificity Not to anyone And I struggled with the churns with good reason. I was hiding a very secret sin For two and a half years. I was living a sexually sexual Morality and walking according to the dictates of my own heart lying to the brothers and pretending to be something that I was not The day that Jimmy Texanor died I was crushed by the weight of Austin Thinking that I was taken in the camp and that Jimmy died because I was hiding my sin It moved me to confess the sin in my life But I didn't repent I got put out of the church because of my sin and I continued living a moral life for about two years I still didn't know whether or not I was saved and I needed to know but instead of turning from my sin And turning to Christ I dove head to person to the world. I Consumed myself in drunkenness in drugs and sexual morality. I Intentionally seared my conscience so that way I would not be convicted by the word of God that I knew I tasted much of the world But it left me empty There were a lot of things that I wanted in the world and it promised me many good and fulfilling things I indulged but I was left wanting I partook but it gave me depression and anxiety. I Saw it after my idols, but they were all false and left me with no joy All I found was trouble hurt and worry I thought that I could grab myself a piece of the world of this world and then return to the Lord with it And I was wrong a Significant event happened in my life the ending of a relationship that filled me with Worldly sorrow I reached out to someone I knew my old best friend me the Cummings and she pointed out my sin My repeated insanity and she directed me to call Pastor Rick So it was finally time for me to start working on my repentance I Called Pastor Rick I told him that I was done living my life living life my way that I was done with my sin We began to meet up about every other week and very soon Edgar started coming as well They preached the gospel to me faithfully pointing out the holes and errors in my thinking I was doing all that I could to turn from my sin in my own strength But I was having an incredibly difficult time I felt deep I fell into deep sin so many times over those few months I kept failing over and over again, and I can remember thinking to myself on the drive to meet with Pastor Rick and Edgar I keep sitting. I'm not improving. They're gonna ask me how my week was and if I tell them They're gonna tell me no. Well, you keep sitting bro You're not taking these things seriously. Why are you wasting your time? Why are you wasting our time? Why are you wasting the Lord's time? You don't want the Lord.  We're gonna stop meeting with you. I Was really scared of that I Got I got one I got an hour every two weeks to meet and talk with someone about my soul, and I needed that so much I had much reason to lie to them and to say everything's fine.  So So I determined that Even if it means that they stopped meeting with me that I would confess my sin And when I did through many tears Pastor Rick said to me know all I'm very encouraged You didn't have to tell me these things and you did I thank God that God's not like us that he doesn't think like us. I Was trying so hard to repent and believe but there was something very wrong in my thinking I thought God would reject my coming to him. I Knew Christ came to save men, but I didn't believe that Christ came to save me But God is not like that the word of God teaches that if you draw near to him He will draw near to you and I held on to that promise with all that I had After several months the Lord granted me faith and repentance He forgave me of all my sins and I was free because Christ was bound and suffered in my place I've not incredible strength in the Lord's in the Lord strength to fight sin safety and comfort and prayer and a deep desire for the word I had to zeal to preach the to preach Christ to the world God has replaced my heart and changed my desires I've cut off and gouged out sin for my life rejected many a great temptation and in my whole and in whole heartedly pursuing Christ Doing all that I can to make my calling an election short praise God for I'm no longer asleep to my sin I've not been perfect It's not been perfect, but I no longer look to self but only to Christ and his finished work on the cross I look to Christ The world promised me much but lied and was unfaithful to me, but the Lord is faithful God does not lie and he offers eternal life And now because of Christ I get to partake in the work of Christ and preaching the gospel I'm a peacemaker reconciling men with God in Christ And he has united me with you all the body of Christ and I get to worship the Lord with you all and partake in the sweet graces of God Hmm Brothers and sisters as I run this race keep watch of me. Don't let me go I Do firmly believe that Christ will keep me fast and that I am in the palm of his hand But I must hold fast until the end Brothers keep me Keep me in your in your sight and especially in your prayers I wish to continue to avail myself of the means of grace as much as is possible and I need you Not be negligent negligent to remind me always of the hope that we have and of the knowledge of our Lord Jesus Christ Watchman watch out for me and I'll be watching out for you because I love you And I am so very very grateful to the Lord for bringing me to where I am today to be united with you all in Christ Based upon your evidence Thanks to the Lord Jesus Christ Repentance in faith burning from sin to trust him alone Based upon your commitment to serve the Lord Jesus Christ Remember a cornerstone man of church I baptized him my brother With a father a son and of the Holy Spirit Buried with Christ in baptism


Today's video is sponsored by Squarespace. For a long time now, I've been on the lookout for a used Nikon D810A at a reasonable price. And I finally found one. It's right here. I bought it. And for anyone that doesn't know, this is sort of a legendary camera. It's Nikon's only 4A into the astro specific DSLR world. And it's a full frame, you know, really high megapixel beast of an astro camera. And I got a chance to try it out the other night. But it was one of those nights where clouds were rolling in, so I only got off a couple shots. So I thought this would be the perfect chance to do another single shot challenge where no calibration frames, no stacking, just one raw exposure off of a DSLR, and we'll process it together and see what we can get. So I'm going to make the file and my intermediate files available to you. Check the link in the description. So if you want to process along with me, you can. But of course, it's a challenge, so you can also process it however you wish. You don't have to follow my lead. One really cool thing about this camera is that without doing any kind of things with intervalometers or menus, there is actually a mode on the camera that allows me to do 15 minute, 10 minute, any length exposure, basically. So I can shoot a 15 minute exposure just as a straight up normal exposure with this DSLR. And you know, or probably many of you know that most DSLRs and mirrorless cameras are limited to 30 seconds unless you use a bulb timer. So I'm going to jump on my Mac. And in this video, I'm going to use Pixinsight and Photoshop. I don't know if I've ever used that particular combination in a processing video before, but it's actually a combination of software that I use often. That's usually sort of my go-to is Pixinsight and Photoshop. So we'll give that a whirl. Okay, here's the Nikon file. .nef is the Nikon RAW file ending. If I press Command I, we'll have some information about it. We can see it was taken by a Nikon D810A. I was just talking about and the exposure time is 15 minutes. It doesn't know the f number because this was taken with a telescope, but it was an f5 telescope at 300 millimeters focal length. And if we just take a look at the picture in this state, it doesn't look like much. We can see the bright star on Terry's right there. And what is that? M4, the Messier 4 cluster, globular cluster. But we can't really see much nebulosity. It's basically blown out. But through processing, I think we'll see a lot more. So let's go ahead and open this. I'm going to open it up with Pixinsight, which is a paid program that they do have a generous free trial if you're interested in trying it out. And the way that I have my Pixinsight installation set up, it does not automatically debayer RAW files from DSLRs. So if I zoom in, you can actually see the bear pattern of red, green, and blue pixels. And this is a grayscale image. So the first thing I'm going to do here is I'm going to debayer the picture by going to process and choosing debayer. And I'll just leave it on auto and just drag this little triangle onto the picture. That's the most surefire way to execute a process in Pixinsight if you're new to the program. You can see Pixinsight does give you some nice ideas of what it's up to. So the first thing that it did is it detected the color filter array pattern is RGGB, meaning that's sort of the order that the pixels go in. It's now done. Pixinsight has this handy feature. Well, even though this picture isn't stretched yet, as we can see, we can go up here towards the top and click on this little button that's like a radioactive symbol and it's the STF Auto Stretch, Screen Transfer Function Auto Stretch Tool. And if I click that, we get this. And this is very normal. A lot of people, when you're new to astrophotography and you're using a tool like Pixinsight or CRL, when you see this, everything's green. You might freak out or something because it looks so weird. But this is actually something that happens all the time in astrophotography. But let's say we did want it to display more correctly. We could actually just open up the Screen Transfer Function process and unlink the channels so that it can equalize the red, green, and blue channels and do that and it looks a lot more normal. Okay, so that's sort of a baseline of what we have here. Of course, we're going to want to bring out the colors and things a lot more than this. You can see there's just maybe a little bit of vignetting or something weird going on. And because it's a DSLR, I think we also have a little bit of a mirror issue here with these dark lines at the top and bottom. So the first thing I'm going to do is I'm going to crop this a little bit. I'll probably crop more later. So I'm just going to open up Dynamic Crop and just, whoops, just crop off the edges just a little bit just by dragging in from the sides like that and then I'll execute that. Nope. Just by dragging in from the sides and then I'll hit the little green check mark to crop it. Okay, done with that. Next, what I'm going to do is I'm going to use something called the Automatic Background Extractor and this helps with just sort of the unevenness of this field. I think it's darker on this side and brighter on this side because that's how Rowe Ofiuki, this object, was setting. It was setting into the light pollution over here. So I'm going to use that to even out the field. So I'm going to go to Process Background Modelization, Automatic Background Extractor. And this is actually a very useful tool, but if we just use the defaults, it will be way too aggressive. So first thing I'm going to do is I'm going to increase the box size and the box separation quite a bit because this is a huge image and it's fine to increase those. Then the main thing I want to do is I want to turn down the function degree. This is how aggressively it tries to fit the model basically or create a model. So I'm going to turn that down to two and then for the correction, I'm going to choose Division and then we'll just drag this triangle onto here and I'm sure if we look at the background model, it'll be mostly, oh, so that's interesting. I don't know why it's so, why it's like that, the vignetting is so off because it wasn't on when I used the RA, interesting, with the same telescope. Sorry, I'm just sort of thinking out loud. But that looks off now because that's so green over there. Okay, well, this didn't work out quite right. Let's see what went wrong. Or maybe that is right and this is just the glow of the Milky Way.  So I'm guessing that that really is the glow from the Milky Way over there. And it's just appearing very green on my screen. So I'm going to use Noise Reduction SCNR Green. I'll set it to something pretty aggressive, like 50%. Let's try that. Yeah, I liked what it did. So I'll run it again. Okay, so we're getting somewhere. It's a little bit boring because it's pretty desaturated and just sort of flat. But next up, let's do a fun tool in Pix Insight called the Masked Stretch. I don't know exactly how this works, like what it's doing behind the scenes, but I know it uses 100 iterations by default of some kind of stretching algorithm. And to use it correctly, you have to first define a preview of basically just empty sky. So I think this area looks pretty good right here. I did that. Sorry, I'm sort of rushing here. Let me delete that preview. To add a new preview, you click on this button up here. This is the new preview mode.  And you draw it right on like that. Then I can pick the preview in the Masked Stretch window here, and then just drag it on to the image to apply the Masked Stretch. Okay, and it's done. And it seems like something wrong happened, but it's actually just that I didn't turn off the screen transfer function before applying the Masked Stretch. So we can turn that off now by just going up here and clicking on the Reset Screen Transfer Functions button. Okay, and so this is the result of the Masked Stretch. And you can see that it didn't stretch it very aggressively. But what I find the Masked Stretch does well is retain nice color everywhere. Like you can see even the core of Antares here, which is a very bright star, didn't get blown out yet. So it's very good about retaining star color in this initial stretch. But then I usually find I do have to stretch a bit more. But sometimes I'll... I'm not going to do that this time, but I just wanted to let you know. Sometimes I'll create a copy because it really retains some nice details. And then I'll sort of copy and paste those details back in.  So anyways, this is the result after Masked Stretch. And I'm going to go ahead and go right on and stretch it some more. So let's go into Histogram Transformation. I'll bring up the preview, the real-time preview by like clicking this little empty circle right there. And I'll choose this. And then you can see in the real-time preview what it's going to do. I'll go ahead and stretch it like that.  So this looks very flat, but it's now stretched I think enough. So I'm just going to finish here a little bit of the sort of the stretching process with the Curves Transformation where we can apply a gentle kind of curve. I'll just bring up the real-time preview again where we take the shadows down. But then right above the shadow level we're going to bring it back up. So something like that. Perfect. Okay, so I mean this is already looking really good. Just I mean we haven't really even done anything major yet. Just background extraction and stretching. Stretching with three different processes just because I sort of like bits of each one. But next up let's go ahead and make a copy. So to make a copy in Pixinsight you just click on the little tab over here and drag it out and it makes a copy. It calls it a clone. And with this clone I'm going to apply a star removal process. And for the most part in my videos so far I've been talking about StarNet plus plus, but I just want to show a different one here since I have bought it. This is Russ Krowman's Star Exterminator. And to use it you just drag the triangle onto the image. And it uses its own neural net and training model that is different from the StarNet one. So sometimes it works better for me. Sometimes it works worse. So I keep them both and try them both. And it's really nice having both actually because sometimes one will do much better than the other. It really depends on the image. One thing I can say the Star Exterminator does better on is anything with diffraction spikes. It cleans those up much better. Okay, so it's done. There is our Starless version. I don't know. This over here is still looking a little bit green to me, but I might just crop that out anyways because I sort of just like this central part of the image for the most part. But anyways, I think we're done now in Pixinsight. We're going to move on to Photoshop, but we're going to go ahead and save these two files. And I will make these available as well if you want to just skip right to the Photoshop part. So let's call this stars. Save it as a TIFF file. 16-bit TIFF. And we'll call this one Starless. Also save it as a 16-bit TIFF file. Okay, and then I'm going to take these two files, right click, and open with Adobe Photoshop. Before I jump into Photoshop, let me just share a little bit about today's sponsor, which is Squarespace. Squarespace.com is a really easy to use website builder that I think you should give a try if you need a website because it's quite affordable and I've never found a website builder that works this well. It's just seamless. So I'm actually in the website builder right now. I just want to show it to you here because you actually see your website live. You can just click through your website and let's say I want to edit this page. I can just click edit and just like that I'm editing it.  Like there's no waiting. There's no coding. It's just it's pretty amazing how well it works. If I want to add more pictures, you know, it's just so simple. I can just click upload images, find my pictures, and upload them. And then they're live on the website. I can add descriptions, links. I can do all of that. And this was a template that I picked. It didn't take very long to find a really good looking template that worked. What I really like about it, I'm just going to say done with this one, is there's just so much built in that was easy. Not even easy, just there. You know, like I didn't have to find it like I have with other website builders. Like I wanted a contact form. That's something that almost everyone would want. And it just worked. I just, you know, you just say I want a contact page and it's just, it's there. It sends the form to your email. You don't have to deal with spam or figuring out which plugin works best or anything like that. So and that's just my feeling with all of, I've seen of Squarespace so far, is that everything is there for you. If I wanted to add a store, it would be really easy just to go ahead and add and set up a store. Because it's all right there. I don't have to, I don't have to think about, okay, I have to integrate PayPal and do all this stuff. Squarespace has thought through all of that for you. So anyways, I've recently added some of my pictures from Scotland. If you want to go take a look, nicocarver.com. This is all built on Squarespace. And if you are interested in having your own website with your own domain name, like I have nicocarver.com here, you can just head over to squarespace.com slash nebula photos. And you can get a free trial. And then after the free trial is up, if you want to continue, you can use the code nebula photos and get 10% off your first purchase on Squarespace. There we go. And I'm immediately going to combine them. I'm just going to take this stars picture, press command a to select or control a on windows, copy it, command C, and paste it command V. So now we have star list on here and stars on top, just like that. And then I'm going to take the stars layer, and I'm going to change the blending mode over here from normal to screen. And at first, that's going to make, you know, the whole picture quite a bit brighter, which is actually sort of nice for working on the picture. Because now I'm going to go back to my star list layer. And I'm going to add some adjustment layers above it. So first, I'm going to add a curves adjustment. And just play around with that, add more contrast. And then I'll add a saturation adjustment. Add saturation. Then I'm going to do basically the same thing on top of the stars layer that affects everything below it. So once again, I'm going to reset the black level, add in a bit more contrast. I'm going to be a little bit more careful with adding contrast here, because I don't want to blow out the stars too much. And at this point, whatever happened with this corner is just not going to be really recoverable. I don't know what exactly it is. Maybe flats would have fixed it. But anyways, let's go ahead and crop it out, because I don't want to deal with it. So I'm just going to crop so that that is no longer part of the picture. And I'm also going to crop on this side. Let me zoom in so you can see what I'm seeing. Because there's a little dark spot there, probably on the sensor. There's some more sensor spots over there. Flats again would probably work with those. I should also just clean the sensor, it seems. But instead of dealing with those, I'm just going to be really lazy and crop them out. Because I think this central part of the image is what's interesting anyways. Now, when we zoom in, you can see this picture, even though it is 15 minutes long, 15 minutes is not a huge amount of time with a dim object like this. So when we zoom in, we can still see there's plenty of noise in the image.  And I like to do that with the camera raw filter. So let's go ahead and make a new from visible command option shift E on Mac, or it would be control alt shift E on Windows.  Okay. And then let's apply the filter. So camera raw filter. And I'm going to go down to detail. And I'm going to apply plenty of noise reduction and camera noise reduction and just a little bit of sharpening, but not very much. But plenty of these. Okay. Maybe I'll add a little bit of vibrance to yeah, just to that helps with the blues, bring up the blues a little bit, a little bit of saturation, not too much. Okay, I like that. Let's go ahead and click. Okay. Next thing I'm going to do is I'm going to do some weird stuff with masks. So I'm just going to use the image itself to bring out the brightest parts of the image. So you'll see what I mean here in a second. I'm going to add an adjustment layer. We'll just add a curves adjustment layer. Then I'm going to click on this image, select it command a copy it, hold down the option key or the alt key on windows and click on this mask and paste it in there. And it turns black and white because masks have to be black and white, but we're actually just using the image itself to create a mask. And then anything that I do in this curve will be applied more to the brighter parts of the image. So I'm just going to increase contrast on the brighter parts a little bit by doing a small s-curve there. And then I'm also going to increase, just holding down option, I'm going to replace that mask or it'll be alt on windows, alt and drag. You know what? I'm going to actually feather out this mask a little bit. So it's a little bit like this. So see here's before feathering. I'm just going to feather it out a little bit so that it's really just applying to the nebulosity. And I'm just going to increase saturation and lightness of the nebulosity a bit.  And then I'm just seeing, I know they said that was the last thing, but I'm just seeing the corners look a little bright. So I'm just going to do one more curves layer. And I'm going to apply a circular gradient to this. So it's just going to be affecting the corners mostly and not the middle at all. I'm just going to crop one more time because the corners are still not exactly to my liking. Let's see if this helps. Yeah, it's helped a little bit. I don't know. Every time you process, the colors are a little different. This overall is maybe looking a little too magenta to me. Yes, that was the issue. See that? This is where it was with magenta. And I think, I know the problem. It was applying that SCNR green twice earlier that messed up the color balance of the overall picture a bit too much. I should have just know that I was going to crop later. This is the correct color balance, but it was like this. So this is mostly just knowing this field well enough to know, oh, there's not enough green in this image. Anyways, that was a mistake earlier. Should have realized at the time, but now it looks a lot better. Okay, so I think we're done. This is my final interpretation. Again, this was a single exposure challenge. I know that was a lot of nonsense I was doing here in Photoshop, but hopefully you got something out of it, just watching me process live and sort of talk through it. Again, everything I now have on my desktop, let me get rid of this, these two files and the raw file, I'm going to put up online for you to check out yourself and play around with. And if you do process it, feel free to share it on social media and say, you know, this is Nico's single exposure challenge. And this is my interpretation because I'd love to see them. At this point, I want to thank all of my wonderful patrons over on patreon.com slash nebula photos. And if you're interested in seeing your name in the credits of any of my long videos, any of the videos over 20 minutes, you can head over to this link and support me there. The support of the channel starts at just $1 per month. And then I also have a $3 and a $7 tier. And there are a number of benefits included for signing up on my patreon. These include a vibrant discord community where people post their photos, get photo critiques, help each other with gear and processing and everything related to astrophotography. And we also have a monthly challenge object that's a friendly competition with some prizes. We have a group project if you want to work on something collaboratively with others. And finally, there are some exclusive videos including a monthly live Q&A that's always recorded and shared right on patreon. So if you sign up, you can actually already watch 10 of those monthly chats. And then lastly, like I said, you get your name in the credits of any video longer than 20 minutes. So the link again is patreon.com slash nebula photos. I hope to see you there. Till next time, this has been Nico Carver, Clear Skies.


This is a story about a living legend. A legend that dates back to the Indus Valley civilization. A legend that has captured the world's imagination and a legend that grows more dynamic with each passing day. Presenting India's most iconic garment. The handcrafted Indian saree. The Indian saree's first international debut was in the 1950s when Valentino created the saree dress. Ever since, the saree has ruled the international red carpet and even made little appearances in Hollywood films. Back in India, Bollywood chronicled the changing face of the Indian saree with simple handcrafted cottons back in the 60s giving way to shimmering sequins, heavy-duty embroidery and of course, the eternal song and dance attire. The sensuous saree. But what is it that makes this unstitched garment so popular with style icons? Let's ask its true ambassadors who've always preferred the saree to the famous little black dress. Saree for me has obviously been a favourite choice in terms of whatever I was asked about the most elegant formal wear. I've always been partial to it. It's the one garment that does complete justice to the woman's body. It celebrates the woman's body, accentuates her curves and it has that nice tease element, you know, where it covers the right amount and shows the right amount. Every region therefore brings forward a trunk full of sarees. Each with a formidable identity and a strong socio-cultural influence. Not only region, but in some places even from village to village there's a different weave, there's a different saree and I think that that's what's very interesting and yes, it's a visiting card but it's also a history book because each saree tells you about that region, about the community that made it even about the sort of the geography of the place. The art of Kantha stitching, for example, has been kept alive for centuries by the women of West Bengal. Using a needle and thread, these women narrate their dreams and desires in a Kantha saree. The Kantha saree is a more recent phenomenon. In earlier times, precious silk and muslin and even pieces of old sarees would be patched and stitched together as quilts and because this was done at leisure, these women expressed their emotions through the running stitches. Banaras is often called the oldest living city in the world, a symbol of the Hindu Renaissance and a melting pot of Indian civilization. It is the Aryans that get credit for introducing brocade weaving to Banaras. At that time, real gold and silver threads were used to make brocade which was worn exclusively by royalty. Banaras started off more as patkas which the men used to wear as scarves or the ladies used to wear as sort of oldenies or for their langas and skirts.  They were even weavers who came from China, they were weavers who came from South India and it became a very living place. The silk saree tradition of Kanchipuram, the temple town of Tamil Nadu goes back to the 3rd century BC when the Pallava dynasty started ruling the territory. The handcrafted tradition is based on strong contrast colors with stark golden integrated weaves known as Zari. In most households here, weaving is a family enterprise, a skill and technique handed down from one generation to another. There are two small rivers flowing at the outskirts of Kanchipuram. One river by name Pallar, other river by name Behavadi. From those days on, still today, we use only those river water for bleaching and coloring the silk thread. The water gives shining to the silk thread. Interestingly, the garment that goes back to the Indus Valley civilization still has the ability to reinvent itself. Many Indian and international designers have given the saree a modern twist. Today, trousers sarees, sarees with belts and jackets are probably a more practical answer for the contemporary woman. As is the Chotu saree designed by Sabyasachi Mukherjee. For research of costumes for the Bollywood film called Ravan, it stars Aishwarya Rai and I had to dress her up as a woman who was trapped in a tribal village. And as I went, I saw that a lot of them had almost simple geometrical sarees in very small lengths, primarily because I think it was easier for them to move around the forest. And I decided that why not crop the length of the sarees because that would be a radical change. And here would also, you know, one of the big complaints that I felt I've heard about the saree is that a lot of people say that, you know, you can't really run up and catch a bass in a saree. But in a Chotu saree, you can actually wear a pair of sneakers and you can. So whether it's a traditional or an in-your-face modern of tar, the saree never fails. We have changed from a nine yard saree to a six yard saree. Today we are wearing a two and a half yard pole. You know, the whole Indian look of, you know, wearing a necklace, wearing bangles, wearing jean earrings and a saree is just spectacular always. The saree is the only garment that celebrates you the way you are. You can refashion it to your own needs. Saree is much more than a bit of fashion. It's something which actually held society together and led to so much of the cultural and aesthetic development of this country. And perhaps for many more centuries to come.


What's going on everyone? Sam here with Layton Sports Cards. We are ripping 22 Panini NXT WWE hobby for Alex C. So good luck here Alex. It's high game for the Padres. Wow. If you want to find the Doctor's Padres. No, I honestly, I did not know. To be honest, like I never watched the original Hulk and this was like intriguing me how bad it was. Really? Is this a shield? No, it's just the original Hulk. Oh, the original Hulk. Gotcha. Gotcha. That is an Ashka on the goldish looking card and Shinsuke Nakamura. The Braves and Phillies. Put that one on and see if that, well the Braves and Phillies one. See if this one, this should be it right here. Yeah, that'll be it. Cool. Thanks, sir. Thank you. Uh, that is who we got here. Angela Dawkins and James Drake. Gosh, Jeremy. Yeah, I can get it. I got to do a couple more orders and then I can get you in for sure though. That won't be an issue. Caleb speaking for me. What did I miss? Said Don has lifted a lot of cards. He collects what he likes. I know, I was just wondering like why he said that. I know, I think because you're talking about Luminance. I'm not you like Luminance. Face. Big Luminance guy for sure. Biggest Luminance guy I've ever met. You don't like your things. No, nothing wrong with it. We've got that's Io Shirai, 55 out of 199 on the red. I wish, like the only thing I wish about Luminance is like they just weren't on their approaches. Yeah. That's it. Yeah. Casey Catanzaro, NXT. That is a signature. It's a nice one there. That is on card as well. That's actually a sweet picture. Which one? Yeah, the Shirai, yeah. Like the one we saw off the road. Yeah, that one's cool. Bass on there. Bass. I love how you might want to start getting the updated legacy silvers. Those are pretty cool, honestly. I like that they're pro uni. I'm all in on that. We've got Andre Chase, 46 out of 149 on the blue doing the curb stomp. Yeah. Honestly, I like a lot of the stuff that's in Chronicles. I don't love retail Chronicles, but Pobby's fine, man. I get that all the time just to rip something. That is Carmelo Hayes on the, not sure what that is, but Camo looking thing. Yeah, no, if I'm itching to rip something, I'll buy Chronicles with the intent that I know I'm not going to be able to resell any of it. Yeah. Some prism at Target, the other guy actually. Bass. I bought a Blaster. Which Target? The one in Apapka. On Orange Blossom, yeah. It's like my home Target. Bass. We've got Wesley, 30 out of 49 on the Jersey card or the Superstar Warn slash used material. Warn slash used material. And Bailey. I thought I was thinking of the one on 436. What's that near? I still don't know the road names here. It's near. It's next to, it's like almost right across the street from Oahuas. Oh, that's the one on 436. Yeah, that's the one I'm talking about. My bad. No, I was going to say, there's one on 441 or Orange Blossom. Cruise Del Toro, 91 out of 149 on the blue. Bass. Dude, Discluminates fake WWD. You'd be all in on that. I would be all in on it. Hazard arrow, though. We've got, that is nice. Rock Hell, Gonzales, 6 out of 25 on the Highlights. Well, so they try to do their own little tie-dye. Yeah, I was going to say, it's kind of, yeah. It's the number. That is on the back is Drew McIntyre on like that little camo type thing. I was going to say, yeah, it's at 25, so it works out. That is a gray Becky Lynch and last pack of the break. Good luck here. Alex. That is a purple rookie of Kit Wilson, 1 out of 99. Very nice. That'll do it for your break there. Alex, congrats on the hits, man. We will get them right out to you. Thanks again.