Well, let's go ahead and get started. We've got a lot to talk about today So I'm Jeff Shapiro from Linux Foundation and this is Gary O'Neill source auditor, but you guys may know me from SPDX So welcome everyone. Thanks for coming. So We're gonna be talking about S-bombs today And I know there have been a number of sessions about S-bombs and maybe some of you have already seen some of them Maybe you haven't our goal is to give you a primer to give you enough information So that you understand how to read an S-bomb use an S-bomb and generate an S-bomb So these are two definitions that we chose Which I think give a good really good Description or summary of what an S-bomb is so NTIA is the national telecommunications telecommunications information administration, it's one of the government agencies that's creating these One of the specifications for S-bombs Based on the new mandate to supply S-bombs to the federal government They say and I agree a software bill of materials is a nested inventory. It's a list of ingredients. So it really is a Exactly what what it says just it's a list of everything that goes into your application your package your service Gartner who does a lot of research Says S-bombs improve visibility transparency security and integrity Of all the software in your supply chain and all of those things are important S-bombs it's S bombs should be human readable But they have to be machine readable if they're not machine readable They're not very useful because we use tools generally we use tools to generate and consume S-bombs They give a list of your components and dependencies. These can include source files packages libraries binaries Things that you can put into a container Essentially anything that can make up a software system can and should be in your S-bomb Includes some basic and vital component information such as the author of the package The name the version enough information that you can Identify where it comes from and you can get provenance information about that component It's important to note that the components that are in your S-bomb can be open source closed source proprietary For internal use they can be you know written in-house They can be Acquired from from anywhere in the world So why are S-bombs important? So we talk a lot about security vulnerabilities You've heard not just with S-bombs, but in general why of supply chain security and checking for vulnerabilities and is is critical license compliance is Actually one of the main reasons why S-bombs were originally developed many years ago Maintainability we talk about provenance about where your software comes from Reproducing builds etc and new in the last couple years is government policy So security vulnerabilities you want to be able to track vulnerabilities. You want to know if they exist on your system License compliance is it has always been important Regarding knowing which licenses apply and finding any license conflicts and just to repeat maintainability is Really about increasing the reliability and reproducibility of your of your builds and now the government says if you want to deal with us You've got to supply S-bombs, so there you go now. It's not just about supplying them, but hopefully they're using them too. That's another matter So let's talk a little bit about the the standard formats that are out there You know there's actually three standards at the NTIA mentions in their document It'd be nice if there was only one but as with many standards, you know, there's many to choose from You know, what's important is that you use one of the standards now I'll go through these three, but I will say that there is some collaboration going on across these different standards I work with people from OASP and the cyclone DX community to try to make sure we can do round trips and write tools To be able to translate between them So it's not as bad as you think because there is some collaboration going on But these are the three choices you have. I'm I'm involved in the spdx community. It's an ISO standard We're working on 3.0. It's a very large community We support a large number of use cases that are out there and also a lot of file format So there's the standard the vocabulary and then there's the different file formats that are supported So we support everything from a simple tag value format to RDFXML even a spreadsheet Which the lawyers love to consume spreadsheets as their as their standard formats Cyclone DX is from the security community. They're pretty focused on the security use cases They support JSON XML and protocol buffers as the file formats and then SWID is a NIST standard that focuses on software identification So let's talk a little bit what I want to do in this talk is get right, you know kind of get right down into the details I've gotten a lot of feedback from the community that says S-bombs is too hard. There's too many fields I'm looking at the spec. I got to fill all the stuff in. It's not that bad if you want to just do the minimum amount It's actually pretty darn simple and I'm going to go in and show you some examples of exactly what that looks like So this is from the NTIA. It's the minimum S-bomb for it to be a viable S-bomb to be used So these are the these are the things you need to have so the supplier name Who is supplying you the component now? I want to separate out the supplier of the of the Of the of the S-bomb itself from the supplier of the component that the S-bomb describes So the supplier is a supplier of the component that's being described by the S-bomb then of course you want to know the name of the Component it's important to know the version because it got to be very specific and this one the other unique identifiers This is if you've heard of package URLs or CVE's there's lots of ways to identify it This is critically important for being able to correlate it to databases like vulnerability databases and satisfy the security use cases I Would encourage you to use as many identifiers as you can find because One database might you know recognize a CVE another may recognize a pearl if you put both those in the S-bomb You stand a much better chance of being able to find your vulnerabilities Dependency relationships you need to know what are the dependent packages and how they're related And then you have the author of the S-bomb data itself and then when was the S-bomb created? So basically being able to track information about the S-bomb now Jeff and I would like to recommend a couple of additional fields beyond the Minimum one is some way of verifying the component a hash or some Mechanism to be able to know that you can you can look at your component and say yes That's the same thing that's described in the S-bomb Download location Where did they actually get it from again? That's helpful to be able to go in and verify that it's the right thing and then license information so beyond the Identification of the package. What is the license communicating that can be really really helpful to your downstream users? so I'm going to go in and give a little demo of Exactly what's in an S-bomb and I'm just going to do a minimum desk the S-bomb this here is just the Structure you'll see this in the code in just a minute But at the very top is the creation information about the document the package information file information in the relationships So with that I'm just going to switch over Well, well Gary switching. I want to mention we will be posting these slides on the sketch website after the talk So you guys can go there and download them. I noticed people taking a few snapshots. There's a reason that you've seen these These tables again and again and again in all the sessions here at open-source summits because they come from the NTIA and So it is the government specification and that's why that's why we're all talking about it. Yep. Good. All right So here here's this is a complete S-bomb. This is all you need to do to satisfy the minimum as 38 lines Question yeah, sorry Let's oh, can we make the font a little bigger? I'll see if it's not as easy as you would think but I will try to do that quickly Let's see And it's a few clicks away. Give me just a second. I'm almost there It's Eclipse. There's a lot of options Okay, see that's 12 let's try bumping it up one there. How's that? oops, I Just got to get rid of the dialogue and then we're back. Oh, right So we mentioned the the document information That's this part of it right here, and I'm just going to go through what all these different fields are It's a little hard to drag well without my mouse. There we go The first thing the spdx ID that's just the identity by the way I'm going to be using spdx JSON as the example because I know spdx the best being part of that community JSON is probably if it isn't already it is quickly becoming the most popular format that's being used for spdx So and this was all hand written by me So it's not really that hard to to build one of these things just and we will be posting these Samples on github as well right so you can go take a look at the examples later So in the creation information we have an identifier for the for the document itself, and that's just a it's always spdx That's document. It's important to know what the version of the spec is so that you can validate against it So we got the spdx version, and then here's the creation information This is the author of the sbomb that NTIA minimum requirements So you got the timestamp, and you can see it was created by me The name of the sbomb itself, so it's not the name of the package or the component It's the name of the sbomb We also like to communicate the license of the sbomb itself, so that's the data license That's the license of the sbomb So if you're giving it to somebody else, they can quickly see what it's licensed under license of the data And then this document namespace is a unique identifier so that if you get an spdx document You can look at this and make sure that that's exactly the one that you're looking for So if you're referencing an spdx document someplace else, you can use this as a globally unique guaranteed unique identifier So that's the pack. That's the the information about the sbomb itself And then on the packages Information here, so this is the information about the component and It's got an ID the ID just has to be unique within the within the spdx document It's got a name again one of the minimum requirements the supplier one of the minimum requirements who supplied it in this case I'm using as an example one of the tools that I maintain which is the Java tools within spdx So the organization that supplies it is spdx a little confusing because it's an spdx document Don't be confused by that. That's also just happens to be the supplier here The package file name, which is the file name That's actually downloaded and then this is the verification information I mentioned that would be useful as additional information So that's the checksum of the package itself the download location where I got it from and then these external rafts These are the other identifiers that we can use to correlate to the databases so in this case I used a package URL and then there's one other key piece of information that we need which is There's the package, but in many cases you have a document that has hundreds or thousands or even tens of thousands of packages What's the top? What's the root of the sbomb that I'm interested in? So we need a way to say this document is describing this package and we do that through relationships So the relationship here just says that the spdx ref document Describes the spdx package and that's all we need and you know now that we have this we can actually just go into the We can actually go into the online tool and just see if we if this actually does Validate and Sorry, I thought I had this at the right location. So we have this online tool Which is which you can get to a tools.spdx.org and you can just drop the the sbomb into it And let's just do a we tell it as JSON Validate and We see that it's valid now It's a valid spdx document, but it is it doesn't meet the minimum requirements There's another little feature on the tool here, which is the NTI a conformance checker and this will actually go through every one of the different Packages that are described and check every one of them to make sure they meet the the minimum requirements. So if we do that Greg that over and That's valid. So That's it there there you have a minimum sbomb So if you're a maintainer of an open-source package, that's all you need to do if you do that a lot of us will be happy because now We got high fidelity information that we can bring into our project So when we send downstream, you know Information we can include the information that you wanted in the sbomb very precisely and very accurately That's all you need to do But you can do more which we'll be getting into next Let's see here and let me just mention that while Gary wrote this sbomb by hand just typing it in to Demonstrate how simple it is typically you'll be using tools Of course, you've got a large software system with hundreds or thousands of components You're going to use tools and we'll talk about those too and there are tools available to generate your sbombs so a Number of you have seen this diagram before this is the software lifecycle again. This comes from the NTI a I did not write this myself and This is not to demonstrate the complexity of sbombs This is to demonstrate the complexity of software lifecycle so there are many phases in the software lifecycle and The main point that I want to make here is people think well, when do I use an sbomb or more importantly? When do I generate an sbomb and the reality is any Single any anywhere on this software lifecycle is a is a is a valid place to use or generate your sbomb So I want to talk a little bit about internal versus external use a Lot of people think okay. I want an sbomb So that I'm writing an open source package or component and I want to generate an sbomb to help my downstream users First of all, thank you. That's what we want you to do a lot of people think okay I want an internal sbomb because I am a corporate enterprise and I want to track vulnerabilities I want to make sure that I'm you know up up on license compliance That is an extremely common use case Both are important if you want to generate one sbomb Great if you need to generate an internal one and you don't want to share that information with anybody outside your organization for Confidentiality proprietary reasons. That's fine. Just be sure you're generating an external sbomb For anybody that's consuming consuming your software So the generation itself as I said that you can generate an sbomb just about anywhere on the software lifecycle Two of the more common times to generate an sbomb are during development When you are writing all of your source code There are lots of tools out there the the SCA tools that scan source code repositories and They will generate an sbomb based on all of your source code There are also tools out there that are See ICD tools that you run when you're doing your build that will generate Sbombs based on your build. We'll talk about that a little bit more Doing it during the build is usually a great time to do it It's important to know that you know sometimes, you know Hopefully someday everybody will be generating sbombs And you will never need to generate an sbomb for somebody else's software because they will do it themselves for you That's ideal and then you'll just be a consumer You'll generate your own sbomb for your own software that you're that you are writing and you will make use of The sbombs that everybody else gives you follow the components that you're that you're getting from everywhere else But I Unfortunately, that's not the way it is today so there are times when you need to generate an sbomb for things that you receive that don't have them and That can be tricky I believe you're up. Yeah, I think there's one slide. Did we miss something? Okay So I wanted to talk a little bit about the yeah, I think we're missing a slide there But that's okay. I can wave my hands a little to make up for it. The let's talk a little bit about the tooling It's actually my favorite topic. I love writing tools. I use tools and First thing I just wanted to mention is that the the bill as Jeff mentioned the build tools is the ideal place because it's got Visibility of all the code coming in and it's got visibility about what's being produced so it's the best place to be able to generate tooling and There's a few tools out there that can help Both in in SBDX and some of the other standards you'll find a lot of tooling that plugs right into the build environments That's there. So within the SBDX community. We have a maven if you're part of the Java maven community We've got a plug-in for that. We got a plug-in for gradle. That's just about out SIFT has a get hub action and a tool that's out there for generating that and we have an sbomb generator that the SBDX community supports that covers a lot of different build environments as well So that's the ideal place to be able to put it But what do you do if you get software that doesn't have an sbomb now now? It gets a little bit more challenging because you got to dig into the code and try to find out what's going on So we're we kind of break the tools down into three different areas There's tools that look at the build metadata. So these aren't the build tools You're not doing it at build time. You're doing it afterwards But perhaps the the code that you're bringing in has some of those build artifacts the maven POM files the gradle files You know the the python build files or make files see make files whatever they are There's a lot of tools out there that'll look at that build that data and what they're really good for is finding the Dependency information that's there. They're not so good at looking at the source files typically But but they're very very useful and typically pretty easy to run and reasonably accurate then there's Scanners that look at at the file level and search for strings most of these are used for doing license analysis They don't typically identify the actual packages and package versions But for doing the license portion of sbombs actually do a pretty good job And there's a few good tools out there for doing that and then this last section is what we're calling the source snippet scanner So these are tools that actually inventory a huge database of available known open source files and Can actually look at the code that you know the inspect the code that you're bringing in Compare it to their database, and they'll try to tell you Exactly what version and what package and so from that you can actually pick up some of the other important metadata And be able to bring that into the sbomb the problem with these snippet scanners is there's a bunch of false positives So in some cases, you know, you might get two or three hundred possible Matches because not only is it finding the actual code that that it actually is but it's finding the code in other Dependencies and you know it's imported into other projects So these typically require a human to be able to go in and look at the results to find out exactly which one it is By the way, I heard a talk earlier that said it's impossible to find what the root verse. That's not impossible That's what I do for my day job is I can look in fact. I've done this so much I can look at like a list of three these three hundred day Oh, I know what that is, you know, I've done this so many times So it is possible to do it, but it's it's it does require humans So a little bit more involved a little bit more expensive. So this is just a few examples, you know within our community the Open source review toolkit or tea is something that looks at some of the build metadata The open s-bomb generator sift sneak there's there's quite a few others And if if you have a favorite tool that does this it's not up here. My apologies I'm just giving you just a few examples us out there Source license scanner. There's a number of open source tools that are out there Phosology is probably the original one written many years ago Scan code toolkit is another one that's widely used and then the source snippet scanner most of these not all But most of these are actually commercial tools because it does take quite a bit to be able to scan and maintain a large database So there's a few examples of that So it's also worth noting about the tools that today These tools are excellent both the commercial and open source tools but in my experience most of these tools are really good at One of the one or two of these things, but not all of them I think that we're still waiting for some of the tools to be good at doing everything and A perfect example of that is source versus dependencies. You hear people talking about scanning source code for license compliance For vulnerabilities Scanning no, I won't get into the details But you know you can scan source code for for actual vulnerabilities in your code Which is different than scanning dependencies for known vulnerabilities the source scanners that check for vulnerabilities are If they're sophisticated enough, they're actually finding flaws in your known or your common flaws in your source code But these are not CVE's that are already out there in the database So we scan source code We scan dependencies for all of your third-party dependencies all you know is as deep as you can go in your dependency tree The point I want to make here is that to get a complete for an S-bomb to get a complete picture of What is in your system? You really need both so just doing source or just doing dependencies isn't good enough Because let's face it engineers copy and paste source code and they plop that source code into their repository So you've got third-party components in your source code repository that you're compiling Linking building into your packages, and then you've got binaries libraries artifacts, etc So to get a really complete S-bomb you need both So let's talk a little about how this relates back to S-bombs So you've scanned your source you capture that you want to include that in the S-bomb itself. So how does that actually work? I'm just going to go back and give you a quick example of that and Switch over to an S-bomb with source So it has the same package information we had before so I'm not going to go through that Basically what we do is we just add in a file section So every file that you identify by the way these can get quite large You know you can imagine with a lot of source files, but each one has an ID again It's unique within the document you have a check sum for it so you can do the validation on it And then and then the name of the file and that's basically it now There's a couple other things that we need to do we need to be able to tie the source file to the package It does no good to know that these source files are laying out there You really want to know these first files belong to the package. So again, we go back to the relationship. We have the We we still have the spdx document relationship from before but now we have the s the spdx package Contains the spdx file and that's how we do that now There's one other thing I'll just point out briefly is within the package sometimes It's really convenient to be able to know that that you'd be able to validate all of these files really came from You know that that package that the contains is really right so we got a little Algorithm of doing checksums as checksums essentially to generate this thing called a package verification code and You can add that into the package if you like the package metadata and basically what that lets you do is if you if you Calculate this based on the source files you have you get one number you look in the s-bomb. Oh, it's the same number Okay, it's valid. I can move on saves a little bit of time So I think the the next thing I wanted to do is talk a little bit about the dependencies So now we collected these dependencies. How does the dependencies look within the spdx or or? S-bomb files, so so if we go back to the packages, it's pretty straightforward We already went through what the packages look like so we're just adding another package now I got to give you a little bit of a caveat and you'll understand why in a second. This is made up spdx tools the thing that I maintain does not contain this component And you'll know why this is important in just a minute But I just I just threw that in there as an example of a dependency So it's got some of the same information from before and again We go back to the relationships and we're going to say that The the package that this s-bomb is describing is Dynamically linked to this spdx ref now one thing we can do now that we have this information with the metadata and by the way I have the package URL of this as well of the of the dependent package we can actually go in and start running running this against some tools and There's a tool that that we worked out called the spdx to osv and it basically just takes an s-bomb and It goes and queries the open source vulnerability database I believe Google maintains that and and generates an output, so I'm just going to run that quickly This is my one dependent on the on the internet, so I'm always a little nervous about this part of the demo It looks like it worked. Okay now if I if I just take a look at it It's like oh dear Something came back if there's no vulnerabilities. It's an empty file. That's a good thing But oh my looks like that dependent package has some kind of a vulnerability in it So so now we know we got something to worry about So this is just a little bit of a demonstration on the security side of it of the usefulness of being able to collect those external references and the dependent relationships And let me go back to the presentation So talking about security You know, this is one of the most important use cases. It's out there You know we I've already talked about how we use it to correlate with a vulnerability databases the more external references the batter I've said that three times I'm going to say it three more times because I think it's the most important thing to keep in mind if you're generating s-bombs Use those external references and I just wanted to point out You know if you're if you're interested in other security use cases We got a really nice how-to guide. That's actually part of our specifications So now I just want to give an example of so We found a vulnerability. What if you want to communicate that to your downstream users? Which is kind of convenient to include in the in the spdx file I'll just show you how that's done and by the way, these are all spdx 2.3 Versions so this is all using the the current spec that's out there So we talked about these external references, you know the package URLs and that we have a category of external references called security And we have a number of different types of security Information that you can actually include in this so basically what we do is just add another external reference We say that it's a security type and in this case I just took the the CVE that that came out of the OSP and just included that in the s-bomb now when your Customers get your s-bomb your users or downstream users They can look that up and know that that vulnerability is there in 3.0 by the way we're really extending that and There's a lot of work. I see it all over there being done on VEX which actually lets you describe whether your software is actually vulnerable or not or whether you're impacted or not by these Vulnerability just to be quite useful So the other really common use case for s-bombs that we've talked about a few times is licenses a License can apply to a code snippet, which is a Fragment like a cop you copy and pasted something from somewhere It can apply to a single source file an entire library or everything in an entire container so Licensing is is complex and we're not going to go into details about licensing, but it's important to know That you need license information To make sure that you're not risking your your your intellectual property so what we want to point out here is that the spdx spec in particular has two different Classifications of licenses for the packages and components in your s-bomb. There is the declared license Which is sometimes? People talk about it as the detected license that is specified by the author of the package So that is whoever whoever provides that package or component to you says This is the license often these are found by scanning tools and then there is the concluded license The concluded license is the license that the person or tool the author of the s-bomb itself Says I'm using these components and this is the license that I believe applies to this component in the s-bomb that I just generated Now why are these different? Well, usually they're the same usually they aren't different, but the important thing is Sometimes a component probably a simplest use case is you get you get jQuery From out from the it from out there on the internet and you're using it in your system And jQuery is dual licensed under MIT or GPL and you say oh, I'm gonna choose the MIT license So the declared license might be MIT or GPL and your concluded license is MIT because I choose to use it under MIT So that's just one example, but they're typically the same but they can be different And I just want to make a plug here for spdx license identifiers. These are not in the s-bomb These are in your code, but they're used by tools to make sure that the licensing information in your s-bomb is accurate So these spdx license identifiers are machine readable Please put them in all of your source code every single source file every file header and Your s-bombs and everyone else's will be much more accurate when it comes to license data So now let's see what licenses look like in s-bombs So going back to the whoops, I think I missed it. There we go Going back to the and this will be my last detail. You're probably getting tired of seeing these these very detailed ones But this will be your last one So there's there's these that the concluded and declared licenses apply to both at the package level and at the file level So within the package The package information. I think I got to scroll down a little here You'll see these new fields. There's your license concluded and the license declared That that Jeff just just described. There's also a little bit of a shorthand little convenience field license information and file many times When you're you know when you're going through a compliance process They'll want to know what are all the licenses that you found in the files themselves as an extra check So you can actually put those into a nice little array or list there and include that in the package and then in the files We see the same information of the license concluded and the declared license is called license info and files in here as well But that's the that's actually the declared license. That's there So that's pretty much it as far as the is first passing along the license information within the within the document Let me switch back to the presentation So so that's it. That's it. That's the last example I appreciate you guys listening through all the all the gory details But I'm hoping that by going through the details you can see that it's really not that hard You don't have to have lots and lots of fields to build an effective s-bomb. That'll help your downstream consumers In terms of what's next we're very busy on spdx 3.0 We're we're doing we're building some additional what we're calling profiles for the actual, you know being able to track the providence of the actual build of the software and Also another profile for how the software is actually used and and that's important in areas like safety Where you want to be able to communicate The software is only valid until this particular date after that date. It's no longer supported. So you should upgrade so Information like that. I think one of the most interesting ones is the s-bomb for AI There is just so much going on in that field and the team has done I think just a great job of capturing what kind of information should be communicated about AI and And when you get into AI, of course, there's a lot of data that's associated with AI So we have a profile specific to the data that's available as well And then the the other area that we're working on we just spun up a group to look at the s-bombs for software as a service So this is being able to represent service information So if you're going out on the internet to acquire a service, what would be the s-bomb equivalent although s-bomb in this case Maybe service bill of materials as opposed to software. So That's the future. So, you know, where do we go from here? first start using s-bombs today and and if you're if you're Getting s-bombs from your customers. Don't just put them on the desk actually use it to find vulnerabilities use it to validate that the license information and Also use it to make sure you actually got the software that they think they gave you as well So there's a lot of uses for s-bombs. You can have today ask for s-bombs from your suppliers You know, even if you're an open-source user ask for it for your from any of your dependencies that are there and join an s-bomb community Cisa spdx. We're a very open and welcoming society of Like-minded individuals. So you guys, you know, all of you are welcome to come join our community and Open SSF has an s-bomb everywhere program that would be glad to get some additional help So that's it. I think we have two minutes for questions. Yeah, so these are some additional resources the government specs Some of our spdx specs and and descriptions of tools that we showed you and more There's a great research report from our Linux Foundation research group on S-bombs and cybersecurity that I encourage everybody to take a look at as I said, we'll post these slides To the sketch website. So you Right after so that you guys don't have to worry about writing all this down now questions, please I saw you guys are working on spdx for software as a service Would that would blockchain fall under that or would you guys be adding a category for that? That's it doesn't fall under that blockchain currently. Oh, well, I shouldn't say it doesn't we don't know yet You know it could fall into it in future. We're just getting started But but but in terms of like you there's there's actually there was a proposal Five years ago to use a hyper ledger and blockchain for certifying s-bombs that mark easy put together I still think it's a very cool and great idea, but it never really took off I might have been a little ahead of its time, right, but but it's I like to follow up on that and It was too early Yes Yeah, it's very interesting stuff though. So one of the things that I think is a Is a concern is that in some cases we might have an implosion between all of the s-bombs for AI? cybersecurity and blockchain We're actually talking about adding metaverses and other You know simulation type environments that that produce massive amounts of data which thing can make massively smarter AI I think at some point, you know just the the hashes that are used to secure the s-bombs itself Can be under fire and we should start thinking about layers of post-quantum cryptography in here because I'm not gonna put you know any menacing vibes out there, but it's it'd be easy to overwrite And if there isn't a way of representing that my version of these s-bombs hasn't changed underneath in you know Three different minor revisions that nobody really paid attention to yeah. Yeah, I could see Something happening there, but I would definitely recommend blockchain s-bombs because I feel like a lot of the the science is missing behind The the reasons for putting some of these tools together, and I think specifically for AI This is probably your only defense for enforcing ethical Standards, so I I agree with everything you said I would welcome Contributions along those lines too. I think there's a lot of really interesting work that could be done there And and I think it's important as well other questions Back here Good question So you mentioned that there are tools going one way generating from source code the s-bombs and From make files and whatnot You are there any tools going the other way around where you define everything in s-bomb and then just generate the infrastructure for you Know the bills and stuff like that Yeah, I don't I don't have an answer but I don't I don't know of any personally Like a stop 360 or false lights they actually doing it's of this process in the other way around the important s-bombs there To actually catalog the entire project and produce the result in s-bombs with the other created data It's just this is born in in some way because normally companies has suppliers suppliers Don't provide to you the source code to be analyzed they provided the resulting s-bomb from their product So you need to some way catalog in your things So there tools mostly that least mostly open source that do this process right now It's not it's we are a bit far to be completely ready for that But it's pretty good that the latest worker for my side in the case is double 360 comes from Toshiba It's been measured right now So you can fully integrate an s-bomb coming outside and create the entire part of the project Yeah, and false light was another one. We saw a demo of yesterday I'll mention one that another one that is this really simple is There's a spdx converter tool that's in that online tool I was giving a demo of earlier you can convert it to a spreadsheet and that can be really useful because looking at Json Doesn't work for lawyers, but they love the spreadsheet. So that's another tool you can question in the back here It's interesting to see that you're looking at S-bombs for AI S-bombs for data It actually is very similar to an effort that's going on in the US Department of Defense called the extensible bill of materials Actually seems very similar. They're at talking about Data bombs and AI bombs and a lot of other types of things. I was wondering if you're aware of that. If not, there might be some synchronization there. Yeah, I do you know Karen? I'm not on the in those working group that I see Karen if you don't mind me picking on your Karen Yeah, let's maybe talk after this. Yeah, and then I'm certainly aware of the extensible bomb and you know, and you know, there's hardware bombs there's you know, and the fact that you know, there's there were earlier sessions here in Vancouver about you know the about those and About the fact that some bombs Can some components can be in multiple bombs, right? You could have things that that are shared between different types of bills of materials So, I mean we are certainly focusing on S-bombs is in software bills of materials, you know in in our discussion here But yes, of course, all of those are very important as well Other questions, maybe one more question anybody up here. Yep. Go ahead Here you go. Sorry. So more is this more about logistics. So if where should S-bombs be housed and if I find Some error in an S-bomb, how do I go about reporting it? Yes both good questions I'll take the easy one the second one first. That's why we have the creation information in the S-bomb So if there's an error, you know, you look up the creator of the S-bomb And it should have enough information that you can trace it back and contact them and let them know That that there's an error In their github have a specific place that for for S-bombs They're actually starting to put it so that you know somebody a consumer like myself knows immediately where to go to find And the S-bomb for that software. Yeah, and that that's that's the the more challenging one because you know We're I have a I have an opinion of where I think they should be stored Let's let's hear your opinion. I'll give you my opinion is there's already a place for the artifacts for the Packages are stored so MPM has a repository Maven has a repository just put the S-bomb right next to it So when I download the artifact I can download the S-bomb and if you do the verification Information that we recommend you can make sure you got the right stuff together, right? And then you know you can put check sums on the S-bomb to it all works great There's definitely other opinions that we should have like a massive Repository like maybe the Linux Foundation should should host a big massive repository where everybody can check in Yeah, yeah, so there's there's a there's a lot of different approaches to it Unfortunately, there was a lot of different approaches, so there's not one consistent approach. So very good question. Yeah Yeah, very related All right now we're already a little overtime, thank you very much everybody if there are more questions after come up and see Gary And I were outside. Thanks


Welcome back everyone, I'm John Furrier with theCUBE. We are here live in Las Vegas for SAS Innovate 2024, along with Dave Vellante, my co-host and co-founder of SiliconANGLE Media in theCUBE. And I'm pleased to have Jen Chase here, Chief Marketing Officer at SAS. This is her show. She is the leader award-winning CMO. Jen, great to see you. Thanks for coming on theCUBE. Oh, it's excellent to be here. And thank you for being here. We love it. You guys have great guests. They're like great, we call them great talent because they're great on camera. They know their stuff. They bring a lot of A-game to theCUBE. We appreciate that. So all good. Technology is infiltrating marketing. I want to get your thoughts on this because I know you think a lot about this. AI, you see all the use cases. Oh, I can write your literature for you. But there's a lot more going on. And what's your vision on how AI is helping you and other marketers? Because there's a lot of heavy work that could be done but you still need to have creativity. You got to have great messaging. You got to have great player. All that's got to be there. Take us through your vision. Yeah, well, you started off with talking about how technology is infiltrated marketing. And I think that's 100% true. And gone are the days where marketing was creative only.  I think if they were to tape Mad Men now, it would be mad tech. Really, we have to be thinking about technology as an enabler for customer experience. And so that's really how we look at generative AI. I think it's imperative that CMOs now are setting the vision for how they want to apply generative AI, not only in their marketing department but actually leading that conversation too across the company. There's a lot of risks and a lot of rewards that will come from AI. And I think the more the CMO can be involved in those discussions with the customer experience at the heart of it, I think the better outcome you're going to get. Yeah, and you know what's great talking to some of your folks like Brian and your team, the team here at SAS, they see this generative AI as a generational categorical net new category. Yet you're leveraging all the SAS customer data and workflows, so there's an acceleration of value. On the marketing side, it's every generation you have the next thing happen. So you had the Mar-Tech stack. Oh yeah, email marketing inbound, you do all that optimizations, a lot of quant jocks out there going, okay, as the lead's converting, what is the lead? So a lot of stuff went on in marketing, the Mar-Tech stack as it's been called. What's the, because now we got another abstraction that's going to maybe simplify or abstract away the Mar-Tech stack and create net new capabilities. What are some of those things that you're eyeing? Because that looks different, but the game is still the same, you know? But it's different stuff going on. How you do it. How you do it. What is the generative version of that? Absolutely, absolutely. So as we look at the use cases that we want to pursue with generative AI, we're starting with what do we want to accomplish? What's the value we want to bring into the organization? So every new use case is being weighed against, is that going to make our marketers more productive? Are we improving the marketers experience in how they do their job? Is it going to improve our time to market? It's going to make us faster, which we think will give us competitive advantage. And then the third dimension is, how is it going to improve customer experience? And I don't think we're having that conversation enough about generative AI. Everything is about how do you make content faster? How do you do things faster, but to what end? And so we're challenging ourselves to really look at those three dimensions. One use case we've got in practice right now is how do we create promotional assets from an original piece of content? Whether that's a webinar or maybe it's a long form white paper. All of the derivative assets you want to create to promote that, can we do that faster with generative AI? And so we really, we think that's a real solid opportunity for us. So reuse and repurposing. Exactly, exactly. And so to your point about marketing still going to require, you need to be creative, right? That's where that comes in that original piece of content. And then it's the promotional assets. Getting those done faster, we think is a really effective use case. So excited about that one. Do you think of it as equally creative and quantitative? How are you thinking about that as a senior marketing team? I think it is. And one of the things that I want to guard against is if everybody's using ChatGPT to write a promotional asset, every company is going to look the same, right? And so we really need to make sure we continue to differentiate ourselves in the market. And so you have to have that creativity. And I think there's actually going to be a higher value put towards creativity and marketing as an outcome of this. So a lot of things that we see happening are like linear things are going away, like training content. You have this kind of content, sales content, all this content out there, ways to measure insights. Is it working? So you have analytics. Now you have things like knowledge graphs and neural networks. You mentioned original content and reuse. And then you complicate that with how do you get your message out? There's so many channels. So we might live in a world where there's some autonomous automation around identifying organic channels of distribution, paid channels of distribution. I don't yet see that fully developed yet. What's your vision on how that evolves? Because what you're getting at here is we shoot original content, you have all this data, you got to make sure they're in the right places and is it the right data? Or is it hallucinating? So what is your vision on this? This is an important cutting edge topic. People are really trying to figure this out. Yeah, a couple of thoughts. I think as marketers start to apply generative AI in kind of market mix modeling, which is almost what you're talking about earlier on, I think it's going to be just, one of the enduring qualities of generative AI is going to be how we engage with software and that it's done more in a prompt-based way. And so another use case that we're actively pursuing is how do you, in customer intelligence 360, look at your audiences, understand your customers better and you don't have to be a data scientist to do that if you have the ability to interact with the software through a prompt-based way. And so I think that's a really exciting opportunity moving forward that you're going to empower even more people in the marketing organization to be a champion of the customer. So that to me is a... Yeah, I saw Pamela on your team. I think she runs Combs and all the AR and PR stuff. And we were talking about the power of organic interaction and how people are sourcing information from their peers or they see the marketing misses out there and sometimes if they want messages delivered to them they might opt in for that. So there's kind of this progression of non-linear progression on the organic side that was traditionally earned media, paid media banner ads and whatnot is changing. So the role of paid, earned and owned media is evolving and changing. What is your vision on that? Because I think this is, I see a lot of marketers leaning on old playbooks like, oh, we're going to pay someone to amplify our message or be a mouthpiece for us. Or I'm going to put, this is our media, our brand and then earned, we just have people pitch journalists that no longer exist or those kinds of things. How do you see that the new earned owned and paid? Yeah, in fact, I would say we think about it as payzo. Paid, earned, shared and owned. So shared is how do we activate our employee base to be sharing more content on SaaS's behalf? You said they were, they're talent, right? They're subject matter experts. They have incredible credibility in the marketplace. We want to make sure that we're really empowering our employee base to be ambassadors of the brand and the technology throughout. So I think about it from a payzo perspective. So you're for your employees becoming active socially and tweeting and retweeting, LinkedIn, reposting, Reddit posts. Oh, great. Yes, absolutely. We have training programs in place. We have a tool that we use internally in order to help enable and empower that. Some are going to say, some are going to lock that down and say, you can't speak, you're not PR trained, only spokespeople. So you're like, go, be good judgment and... Absolutely, yes. We have a tremendous amount of trust in our employees. We provide them with the tools that we want to make sure they're empowered and enabled in order to have effective conversations. But each employee is a brand supporter for SaaS. Well, send that talent to the queue. We'd love more talent to come on the queue. We'd love the experts. So... I've got about 12,000 people ready and waiting. She's going to love that job. So notwithstanding this notion of reverting to the mean, maximum vanilla marketing. So I get that that's a risk. But there's stats out there that a lot of people are afraid that AI is going to take their job, especially in marketing. I'm curious as to how you think about it. To me, AI makes me smarter. So I don't want to be dumber. So I don't want to go backwards. So that's cool. But how do you think about that as a market?  Sure, it's such a great question. IDC published a report that said in the next two years they expect 30% of mundane marketing tasks to be automated through generative AI. And I am here for that. You're here, yeah. That is going to allow us to elevate and provide even more higher value back into the organization because we're not doing mundane tasks. At the same time, two out of three marketers are concerned about their jobs and whether or not AI will take their jobs. And what I am saying very clearly to my organization is it is not AI that's going to take a marketer's job. It's going to be a marketer who understands how to apply AI that will. So my job is to enable and empower my organization to use generative AI effectively. We've invested a lot in what we call lifelong learning for marketers. I mean, marketing's changed more, I think in the past two years than it has in the past 10. And so we need to make sure we're keeping our marketers really just very current on technologies and setting a standard of this is what it looks like to be a modern marketer and how we expect you to get there. You know, I love about the key was going to riff on topics with subject metrics like yourself and marketing. Last year, Brian Harris gave me a demo of a digital twin factory tour. He's like, look how cool this is. This is an actual digital twin. So I have to ask you, do you see a day where there's going to be a digital twin for this event or your customer experience?  So I could imagine in a world where you replicate all the work and investments in this to have a digital version. Do you ever see that day coming soon? Yeah, I mean, as we went through the pandemic, we certainly created many more effective virtual experiences. So we got pretty good at that, I think as a marketing profession. What we do love about this event though is the conversations that you can have and the people and I mean, events are really about those connections you make because you can stream this content back in your office but to have the dialogue right after a presentation or to make a connection with a peer. Yeah, the virtual events are kind of like individuals, more like a passive consumption. The people component is huge here. Like if we can replicate that, that would be like the key thing. I mean, that's, to me, that's, digital twins are possible. And you can just say, you know, do something, but if no one shows up. Yeah, I mean, What's your biggest excitement and fear of the AI? It's a lot of unknowns. So you have to take some chances, which means you got to be prepared to innovate and be situational aware of what comes at you. What's your biggest excitement level? What's your excited about? And then what you might, you're watching closely. Yeah, you know, what I'm excited about is I do think we're going to make as a society tremendous gains applying generative AI and AI technologies, whether it's improved healthcare, just a better quality of life for everyone. My biggest fear is that we do, we need to do this responsibly and make sure that we're being fair, we're removing bias and being extremely transparent with everything we do with AI. And personal information, security, those kinds of things are, that's the responsibility part, trust me. Do you worry about our capacity to govern AI at some point, maybe not this year, next year, but maybe 10 or 20 years from now. If AI is smarter than all humans collectively and we're growing computational power exponentially, that's what I worry about. It's like, okay, that's so unpredictable. Maybe you don't have to worry about that for a couple of years, but I think it's coming, actually.  Well, actually, with healthcare these days and technology, you're actually only eight months older. So we're compressing that, who knows? Maybe we'll go backwards, you know? I mean, I think the integration of AI is going to be a top priority and you got a good handle on it. What's your plan for the next year? You guys run a lot of events, you get a lot of customer events. What's your vision for the next, what do you have in your to-do list this year and then next year? And how do you see AI maybe putting the toe in the water or maybe integrating in? What's your plan? Well, immediately after this event, we take it on the road. So we are going on tours called SAS Innovate on Tour. So we take a version of this to 14 different cities across the globe. And it's a great way for us to meet our customers in their backyards. And so we're really excited about that. And then we will do this again next year in May in Orlando. So we're already making plans for 25 and 26 actually. When I think about some big initiatives that we're putting into place, certainly want to do more to raise brand awareness for SAS. I think we've for 47 years have been quite humble and we've got a lot to boast about. We've got some great technology and so I'll be doing a lot of work around improving our brand awareness. One area that I'm excited to explore more generative AI is our website experience. I think that a web experience can be completely just reimagined with generative AI. So we're going to be rolling our sleeves up and thinking about that very differently. And those Innovate around the world, those are one day events? Those are two day events. Two day events. Two day events. Really, wow. Two day events. I'm going for it. So there's 28 days of this after this. 28 days of goodness coming around the world. You have all your sleeves picked and dates are all locked and loaded. We were locked and loaded as of January one because we wanted to make sure our sales teams when we had our company kick off knew exactly they could go back to their offices and invite their customers immediately. We are locked and loaded. Well, congratulations on a great event. Great to see you. And of course you guys do that great program. I was lucky to be invited. Thank you for having me. Yes, love to have you come back. Yeah, I hope to have a good performance like I did last time. Although, I got a hole in one. No, I'm definitely kidding. No, I didn't know. You got a net hole in one. I got a net hole in one. Excellent. Because you handicap. Never had that before. That's pretty cool. You're relying zero on that shot. First shot. I knew the rest of the round. I'm trying to carry it, everybody. You guys are a great company. And again, I think what's impressive is you guys are announcing firsts. Subscribe to models. That's the first, okay? Production workloads with customers. Those are firsts. So you got a first going on with the team right now. So that's going to be a big part of what you're doing. And we're using this event as our opportunity to launch our new product. So you could expect that in 25. You could expect that in 26. That's our plan. All right, so next year we'll be sitting here. What are we going to be talking about? Ooh, I think we're going to be talking more and more about quantum computing. You heard a little about that this morning. I think there's more legs to generative AI that we'll explore. I mean, we announced this morning Datamaker in synthetic data. And I think that's going to be something that will continue to have a richer conversation about next year. Great. Jen, thanks so much for coming on theCUBE. Thank you. Thank you. All right, I'm John Furrier with Dave Vellante. We'll be back with more coverage of SAS NOV24 after the short break. We'll be right back.


What is your Marvel Squad? And welcome back to our channel. Disclaimer before I start anything with this video, do not vape. Don't do any of this stuff. I'm only doing it for this video purposes.  I'm just going to be making Mariah think that I am vaping. And she knows me more than anyone, okay? We've been dating for six years. I never smoke. I never vape. I never do any of that stuff. So the fact that I actually have a vape and I went to the store to buy one today is going to tweak her out.  Why are you vaping? She's honestly probably gonna get really confused and upset with me. Cause I've always been against it. I just don't do it. I don't condone it at all. And I feel like it's just so unnecessary. Like I'd rather have a nice cocktail at a restaurant or at home rather than do this. I don't know. Everyone has their own purposes. But let me just tell you the story. Before we start this video, I went to the vape shop. I literally just got out. I'm sitting at the post office right now. As I was buying this, they're like, all right, what do you want? And I'm like, well, I just need a vape. I don't know what to get. I don't know. I've never bought one before in my life. So they're like, okay, well, you know, this one's good for starters. And I'm like, I don't care. All I need is a vape. And he's like, okay, well, do you like menthol? Do you like no menthol? I'm like, dude, I have no idea what any of this means. Like this is just all new to me. Long story short, he ended up pointing this one out. I bought it. And do you want to know what this guy says before I leave? I guess this is the thing that people do. He's like, hey, why don't you open it up and test it out so you know it works so we don't have to get you a different one. And I'm like, oh my God, wait. So I have to hit this thing now in the store. And I've never really hit a vape in my life. This dude literally straight up was like, yeah, take it out, try it.   Like I don't want to do that. I ended up just saying like, oh no, it's fine. I'll just, you know, I'll just take it, like whatever. And he was just like, okay, you don't want to try it out. Like what happens if it's broken or it was the most awkward interaction in the world. Good thing I'm never going to go back to that vape shop because it was just hell awkward. Like they were looking at me like I had like five heads. Like why is this dude coming in here? And he doesn't even know what he's talking about. But today I am going to be vaping, like I said, in front of Mariah to see how she reacts. I am so scared. I am literally like, she used to be a partier. She used to be a crazy girl back in the day and she did vape a little bit. But I have never really vaped in front of her ever. I've never smoked in front of her really. Like she's absolutely going to freak out that this is going to be my new thing that I'm starting. And do I know what I actually found out? I was like looking at this thing and testing it out. This is how I'm going to get away with it. Watch this. You could literally blow in the back of this thing. You don't even have to like puff it. You can blow in the back and it'll push out smoke. So my thought process is wherever she is, wherever I set this up, I don't know if I'm going to do it in the car or not because we do have to go like grocery shopping today. Like when she's not paying attention, watch this. You can blow in the back like. And it puts out, it puts out like smoke. Like you just vape. It's crazy. To me it's crazy because I've never, I never do that. What I'm going to be doing is while she's like not paying attention, I'm going to blow in the back of it.  What's wrong? Like I have a vape. Oh well. And we're just going to see what her reaction is from there. God, I'm like literally shaking. Like I'm super nervous. I know this might not seem like a big deal but like I don't smoke and she knows that.  Oh, okay. Well, I just want to run you down to full rundown and what I'm going to actually be doing. I don't have to puff it. I'm blowing it. Which is super dope. And then we're going to get Mariah's reaction. We're going to see how she reacts to me, the vape. It just sounds so weird. I feel like I shouldn't be even holding this. I don't know. But mama squad, I hope you enjoyed this video. I hope you enjoy her reactions. It's going to be super funny. I can't wait to watch this back and see Mariah's reaction to actually like getting pissed at me probably. But give this video a thumbs up right now. Hashtag TVL in the comments because we're coming back today. We're coming back strong. We've been doing a lot of challenges lately. So I had to throw in this prank. You guys have been literally asking for this video. Okay, so this is for you. Everyone in the comments. Everyone in our DMs that has been asking for this video. This is for you. Enjoy and I will see you next time I'm with Mariah. God, I'm nervous. Wish me luck. I'm going to need it. All right, I just made it home guys. I'm going to text Mariah to come outside. Ready to go. Oh my gosh. Hey, they also came with this cool lanyard. So I put it on the lanyard. I don't know if I should. I don't know, should I? I feel like I'm going to make it more flashy. Like I'm actually joining the vape line. Hey, everything looks better with a lanyard. So I feel like this, I don't know, maybe it's too flashy. I don't want her to like see it right away. I want to kind of be like more low key. Yeah, I'm taking this off. It's too much. Besides, I've never seen people wear a lanyard with a vape before. So she said, okay, coming. Okay, we'd have to act normal, act casual. Hey, damn, you look good. Thanks. I like her hair. Woo, they're hot. They look so good. I'm going to start the camera. So we're just going to go to the grocery store. What else are we doing? We're just going to go to the grocery store. Yeah? Yeah. All righty. What is going on in the squad? Welcome back to our channel. I hope you guys are having a great day. We're about to go get some Starbucks. And let me just say this is going to be the second Starbucks run today. So is Starbucks everyday? We literally went and we only got breakfast this morning. So now we're probably going to go get a drink. Yeah, probably. You want a drink? Yeah, I kind of want a drink. Yeah? You know, I'm trying to cut it.  I don't know. Pink drinks just like, I don't know. It's just so refreshing. Well, it's like, you know, it's like coffee.  Like, get it all cut. It's so good. But we're going to be out of here. We have a lot to do today. We've got Aaron's to run, things to do. And yeah, so I hope you guys enjoyed this video. So say thank you. You look cute though for real. Thanks. You look really good. It looks good. I love curl hair. Mariah, you look so good with or without curl hair, but I'm telling you like, I'm a sucker for curl hair. I always wonder why it takes girls so long to get ready guys, but then you see them come out and literally, huh? What is that in your hand? My phone. No, it wasn't. My phone. What's under your armpit? Nothing. Chill. What do you have in your hand? Nothing. Babe, nothing. What is that? Why are you snooping? Just let's go. I'm not snooping. I was looking into the camera finder and I see this blue thing in your hand. What is that? Let me see it. Nothing. What is it? Nothing. Can you just not, can you just stop? Is that a babe? No, it's not a babe. Give me, is that a babe? Oh, look at the kitty.  Look at the kitty. What? I can smell it. Why are you vaping? Why are you vaping? Why are you mad? No, no, no, no, no, no. Why are you hitting it right now? Why are you vaping? Let's roll down the window a little bit. No, seriously. Can you explain it? Wait until you get that. Oh, my God. Why are you vaping? Why are you so mad? You know that's so bad for you. Why are you, babe, stop. Chill. Give it to me. No, Mariah, stop. Give it. Why are you vaping? You need to pull over right now. Why are you tweaking? You need to pull over. Stop tweaking. It's not that big of a deal. That's not even funny. I just, it tastes good. You literally dissed back in Jordan for vaping. Why are you doing it? They don't smoke. Okay. Why are you, like, you might not, but people change.  Can you not do this on camera, all right? I'll turn the camera off. Why are you vaping? We're not showing that to the model squad. I wasn't even going to and then you brought it up. Okay, why are you vaping? What made you want to start vaping? I don't understand why you wanted to start vaping. Why are you vaping? It's not funny. Can you stop? Can I stop? I'm not trying to be controlling, but why are you vaping? Because you're stressing me out. You brought it back because I'm stressing you out. Let me do me. Babe, we talked about this. It's like the fact that you have to stop hitting it. I'm just chilling. There's a note. Stop. Stop. Why are you doing that? It's not a big deal. It is a big deal. Stop.  No, don't take it. I'm going to throw this out the window. Don't throw it out the window. I'm throwing this out the window. Why would you, why do you need this? Because it's just, I'm chilling. Why would you spend your money on this? I'm chilling. I don't even know why you're so mad. You just got to chill and relax. Babe, you know this is not good for your health. I know, and that's why I never did it before, but I'm just chilling right now and, you know? No, babe. You're stressing me out. You always, you know. You are stressing me out. I just don't understand why you would biobate. And when the heck did you even go get this? When did you go get this today? Because I've never seen you use this once in my life. Today. I just wanted to try. Why did you go get one? Why? I wanted to try it. Come on. But we don't smoke. Why are you smoking? Because, I don't- Especially this. This is even worse for you. It's not that big of a deal. It's the baddest cigarette. It's not even that big of a deal. Just give me back. Please stop. No, I am not giving it back. No, go, no. I am not giving this back to you.  I'm not trying to be a bus kill. Like, I understand. Just trying to have a good time. If you were, you know, you had to like start smoking something, but like, come on now. All right, I'm shutting this off.  You're embarrassing. You're embarrassing. That whole video. You just ruined the whole video. How did I ruin the video? Because I'm trying to talk to them. And you don't even tell me that you're smoking. Oh my gosh. You just started smoking. Can you stop this? How long have you been doing this for? Without me knowing. Just today. Listen, listen, listen. If I just make this clear, I am not controlling, and I'm not trying to control you right now, but the fact that we've literally discussed vaping, like, we've literally discussed this. No, Park. Give me it. Park. No, I don't want you having this. Why the f**k would you keep this? Give me it. Just give me it.  Okay, so why are you so mad? Like, I'm just trying to have a little fun.  Maybe these are so bad for you. Okay, come on. These are so bad for you. Come on, give me it. No. I need it. You don't need it. You know what, just point at your mom and be if she found out you were doing this. Oh my god. No, no, not, oh my god. I really, I talk about it all the time. Ruin your health. Thank you. Ruin your health. Thank you. I appreciate it. You know what? I'm not going to control your life. That's what you want to do. I can't even believe you right now. Why? I don't understand you at all right now. What? I'm literally just chilling. In my nose. Like stop blowing it in here. Open up the window. At least until I'm out of the car. Open up the window. It's not that big of a deal. It's literally just like, do you ever go to a bonfire? No, it's not like a bonfire, baby. It's, oh my god. Dude, seriously. I just don't understand why you're vaping all of a sudden. Can you do one? No, I don't want it. Okay. I'm not getting addicted to that. I'm not addicted to it. I just like getting it. It'd be different if you were like to prescribe marijuana because you needed something to help with your anxiety. But like this is like actual vaping. Like this is like so bad for your lungs. Babe, I just miss like high school and stuff.  I feel like this makes you... No, you never did that in high school. So why are you bringing up high school? Don't say that.  I don't mean to be rude. It's like I'm like controlling you. But come on. Like why are you vaping?   You didn't even party. No. No, we're not filming. I'm turning it on right now. No. Like, I'm cool. It's actually nothing happening. No, I'm not acting like nothing happened. I'm not filming right now. I'm just trying to understand why you're vaping. Stop, babe. What are you doing? Stop. That was like... Like how many hits are you gonna take? You're not even hitting. That was like a firework.  Babe, can you just let me do it? All right, deal. Like, you know I always talk about vaping and stuff. No, you don't. You've always dishon vaping. You see all those commercials about how bad they are for you. So why are you doing it? No, you've always dishon vaping. You need some. No, I don't want any. You need some. No, I don't want any of that. No, I don't want any of that. I'm not actually vaping. You are vaping. I'm not. What are you talking about? There was literal smoke in the car. What are you talking about? Did you even see me pumping it? Yes. It was a prank. You're joking. I wasn't vaping. Look, you're gonna blow it to the back. I'm just blowing.  Go like that.  Oh my gosh. Pull over, go over. Seriously. Are you mad now? No, I'm annoying. Why would you even buy that? Babe, it was a prank. I'm not actually vaping. It was a prank. Look at it.   I just bought this to mess with you. I don't actually vaping. I don't even want to vaping. I don't even want to vaping. I've never even vaped in my life. That's why I was confused. Why all of a sudden started vaping? You always talked about that. Like how it's bad for you. No.  Babe, I'm sorry. I just had to. Oh yeah, you had to. You guys spent our money on a vape for a reason. It's just funny. It's just funny. I'm sorry. Do you forgive me? No, I don't. That's nasty. Why? That was cool though, right? I figured that out. I don't know. I literally was just like, I saw holes in the bottom and I'm like, I wonder if you could go the opposite way. I'm not gonna actually inhale that. No, I didn't. But do I know it was funny?  Yeah, try it out with the duds. And oh, you do know. See Mariah used to be a part of your back in the day. Yeah, so I already know. Uh-huh, yeah, uh-huh, you do that. I just wish people didn't have to do that. I just want everyone to have good health and I just feel like vaping is just so bad. It is. It is. And then, you know, everyone, like I said, everyone has their own reasons, but we just don't do that. We just don't do that. We just don't do that. That's why I was shocked. Because I'm like, where did this come from? We've been dating for six years. Why are you vaping? We've been dating for six years and you've never seen me like that. No, I never. And the fact that I had my own. The only time I've ever seen you like that is like during like certain occasions when you're just puffing someone's or someone's. Just messing around like, oh, you know. But I've never actually had my own. No, it's so weird. I was so awkward. If you could see the security footage of me like buying it at the store. Really awkward? So awkward. So awkward. I do not even want to. That footage was getting very, because that was embarrassing. Very embarrassing. Well, thank God, because I was- Yeah, we could throw this out now. I turned it off. No one should be vaping. Baby, I'm sorry, I love you. I understand that. This girl always has something on her lips that she never want to kiss me. I put my makeup on it in. Unless she want- See? I can't really kiss, I got my lip filler done. Can't really kiss. You have sparkly lips all over. Maybe I can- God. Any time she gets her lips done.  I just put lipstick on this whole point of putting makeup on. Yeah, ugh. So why are you kissing me then? So I respond, I hope you enjoyed this video. I'm sorry, maybe I had to get you with it. But everyone was asking for it. Everyone was requesting it. You know what?  Oh yeah. But I hope you guys enjoyed. Make sure to give this video a cute thumbs up. Hashtag Team Bill in the comments. No, don't hashtag Team Bill. Hashtag Team R.I. because that was really far. All right, all right. We're ending the video. I hope you guys have a great day and we will see you in the next one. But until then, peace. Love you guys.


So thanks for your time. First of all, can you tell us what is so cool about working on a roller coaster? I get to build dreams It's somebody's idea and we put it in it in the cut we take the concept and we put it in real life And then everybody gets to enjoy it. That's what's so cool about it and it worked for amazing company You get a work in the air where most humans don't get a work You know we usually birds are up in the air or stuff like that So it's kind of neat climbing and building something from the ground up and continually working up instead of just flat-toeing out It's more like working on a jungle gym to be honest get a run around play around climb around. It's like climbing trees And I don't know you get a swing of hammer all day you saw us. It's a good time So now the park is open. Have you have you visited the park now? Yeah, I went Sunday for opening weekend. We went for a couple hours of the whole crew and I that was pretty wicked There's a lot of fun rides. What rides have you ridden? I rode the pure platform 13 That one was pretty neat with the queue line being like a theme queue line. That was different Have you ridden Goliath as well? And I wrote yep, that was the very first one of the day That's how you started off that was best breakfast there is yeah, I was gonna say that was awesome So many air times in that I rode skydiver really which gives you a very unique perspective of the ride here When you go up in the air, it's like you're standing on thin air You're standing there for a split second and you can just see everything when rode Goliath and started out the skydiver there That was the best ride. It was glorious. It's glorious. Yeah, it's good ride loved it I'm probably gonna do it again this weekend. So cool. Can you tell us what you guys are working on right now? We're working on a 270 degree double inverted corner stall, and it's super fast and super amazing So that's the worldwide unique element. What do you think of it? I think it's gonna be amazing and it came out of Alan's brain somewhere and it's gonna be super fun This is him then the worldwide unique element in on taint a 270 degree double inverting corner stall That means a turn of 270 degrees three quarter that position holds in a very short time and then it turns 270 degrees back Two inversions in one element. It's crazy


Yeah, you have to use all the chairs even the ones where you can't see us because they're behind the post We're attempting a video this we might put it on YouTube While you feel better wasting your precious tax time on something you could have seen on YouTube But they don't get what we never put on YouTube is that ten minutes before we spoke eight minutes before we start legit The dancing is never on though we had an outtake We were in anime Boston in Boston doing a lecture where we judged an entire season of anime We reviewed it before it came out Just by being jerks and guessing about how bad these shows are gonna be And I had the camera going and the camera picked up someone in the audience saying something really stupid So we uploaded that The guy was basically like I don't know I get into these new shows, but then they get really popular and I lose interest Really someone else watching it made it bad Yeah, so by that logic like if Rooster Teeth is starting to fill up the panel room the people in the front have to start believing this is too popular Hipsters aren't just in New York. There's a dude. They're definitely hipsters here because I've seen so many single-geared bicycles around Wait, no wait, I should say like an American Melbourne Listen if you guys don't want to say the R. Just don't write the R there. It's that simple You mean like a lot of ever in writing to a typing so like that key right up like that gh and thought is it foggets You can just replace it with a reload key because that's the only thing time you're gonna use it when you reload weapons I mean is it geek niggas? There we go. Yeah, it's gonna fill up. We filled it up. All right These people are desperate for facts that even come to this panel. Well, this is the first one ever here They're acting like it's the first facts ever. Yeah, so listen our cheated ways. How many of you have ever been to a facts before ever? Oh, there is this okay really none of them have ever been to a tax before wow, so they don't know Anyone have an empty seat next to them raise your hand is the empty seat in the back there So you can let one person in oh There's one over here sort of in the front behind the post I Partial view hey listen don't dis partial view. I saw Book of Mormon partial views We still got six minutes before we started the junior Say a little bit of story time. We got six minutes. This is not the panel yet So basically we flew here from New York where everyone's jerks apparently Especially us We've got every pack since oh eight and we've lectured every one of them and when they told us hey It's gonna be facts in Australia. We were like Maybe we should go to that one maybe yeah, I almost didn't go almost I would have been here all by myself. It would have been double awkward. Yeah, but then he was like I'm going I was like Yeah, I'm going to Have my boss. Yeah, unlikely that we will return next year unless you guys want to give us like $5,000 No watch next year's a little bit to like the bigger convention center.   Are we a hundred percent full now? Yes, we still have four minutes to Does anyone know who we are or we just like two random shmucks. Oh, yeah All right, it's what I like to see I like to see no one knowing who we are doing a show like this It's kind of like when we're in New York like we expect a lot of people we know to show up Seattle less so but people still show up But when we're in Australia, I did not expect to run into so many people where I know who they are And I know about how half of them are yeah It's like usually I walk around a packs and it's like hey Scott. Hey Scott. What's going on?  Hey other person whose face are recognized from like the last pack What's going on here? I was like, yeah I already know me know like four people who are gonna be here and that's it and it's just like I walked down It's like hey Scott. I know you. I'm like, oh my god So this is not the panel again Yeah, don't don't leave yet.  It's like I can just go to another packs in a month I will be at another packs in a month, but you won't be we gotta start writing a lecture for that one If you I'm serious If you feel like you're wasting your time in here just walk out and go somewhere else and have fun and let Yeah, no, we will not be interrupted or insulted or whatever now We will not have time to take questions at the end of this So we can purpose if you have questions one. We'll have some business cards up here You can grab I wasn't gonna fly here from New York with flyers and To if you know like they don't like bringing advertising materials to customs for some reason. Yeah Well, I got the business visa whatever at least yeah, I didn't ever turn visa. That's uh, I'm getting trouble We're speaking here technically this is not getting paid for this and it's also it's a hubby I'm like a web developer We still have three minutes. We're gonna kill time for the real Working Wall Street, right? If we work for like a game company this would count as a business trip, right? But we don't so yeah, we're just two dumb guys So you might say guys that might realize but in America PC gaming was kind of dead for a long time It's only recently coming back and we heard Australia was the land of PC games Apparently we're right so far everyone we have met like what's your game and they're either like counter-strike Starcraft PC game. They're like consoles. Yeah, that's for babies in America people are like the opposite Pretty much. It's that time two minutes. The Steam sale brings the world together I got messed up because in New York It folds over at 1 p.m.  He actually said yeah, watch out. It changes over at 3 a.m. I'm like, oh Save me. I wasn't you know uselessly checking at 1 p.m. Like it's the same Yeah, 25 hours of flying we got here yesterday morning. Yeah, who here is flown to the u.s. That's an Australian. Okay, all right I've never flown that far before a food is real Your people apparently are a people of taking meat and wrapping it in pastry and I approve of this highlight You're not a people of breakfast though. I was born in Detroit. I grew up in Michigan Now I live in New York in Michigan. We have a weird food called a pasty. No one in America knows about this thing Except I've seen them in like three bellies here We still got a minute and 40 seconds So how many of you went to the keynote Did not raise your hand that was a mistake every packs go to the keynote That is kind of the opening ceremonies of the convention. It goes right into the game in Tycho Q&A Which is not what you think it is. It's not just people asking boring questions. Oh time to start 25 for three seconds.  You're gonna find a place with 18 teen Verizon in the states next time I come here in 20 years I'll get all right ready. I'm gonna do this now. We're gonna start for real for real I'm really I'm Scott. We're the host of Geek Knights radio show about nerdy You can check it out all there if you enjoy the next hour or so and you like it go to that website the last I Don't know thousand episodes of our show that are basically just like this are on the internet tons of videos of lectures from other packs I think 15 of our packs lectures since I wait are online. Yeah, I mean if you don't go check us out in the internet You're probably never gonna see your hair from us again, so That's the website to go to we're here today because


In Rostov region of the Russian Federation, a pipeline used to pump petroleum products from a local oil depot to tankers in the area of the Ozoff Seaport was blown up. The Defense Intelligence of the Ministry of Defense of Ukraine reported on the night of April 6, 2024. In the area of the village of Ozoff as a result of the explosion of a pipeline that pumped petroleum products from a local oil depot to tankers in the area of the Ozoff Seaport, the loading of tankers with petroleum products was suspended for an indefinite period. The report says, the object was used by the aggressor state for military purposes, to support the waging of a genocidal war against Ukraine, the department noted. Loading of tankers with petroleum products is suspended for an indefinite period Ukraine has been attacking Russian oil refineries for months. Defense Intelligence Chairman Vasiliy Malyak noted that due to Ukrainian drones hitting Russian refineries, oil production and refining in the Russian Federation was reduced by 12%. The Institute for the Study of War noted that the recent attack by Ukrainian drones on an oil refinery in the Republic of Tatarstan indicates a turning point in Ukraine's strategy of striking targets deep behind Russian lines, British intelligence is convinced that Russia is unlikely to be able to protect all its oil refineries from attacks by Ukrainian drones. These impacts cause financial losses for Russia and affect the domestic fuel market. Ukrainian drones attacked the Morozovsk military airfield in Russia's Rostov-Oblost on the night of 4-5 April. The silly Golubev, the governor of Rostov-Oblost said this. Witnesses reported numerous drones and counted more than 60 explosions. Several districts have beat cut off from the power grid after it, according to Telegram channels Russian 6 aircraft destroyed, 8 damaged after Ukrainian drone attack. The attack on the Morozovsk airfield was carried out by the Ukrainian Defense Intelligence together with the military and Defense Forces front-line bombers Su-24, Su-24M, Su-34 were based at the airfield, these are the types of aircraft Russia uses to drop KABs on the positions of the Ukrainian armed forces in front-line Ukrainian cities. Golubev confirmed a large-scale attack in the Morozovsk district. He said that the Russian air defense units were repelling the attack. Morozovsk is a military airfield in Russia's Rostov-Oblost, located three kilometers southwest of the city of Morozovsk. The airfield is a base of the 559th Guards Bomber Regiment of the 1st Guards Mixed Aviation Division of the Russian Air Force. Front-line bombers Su-24, Su-24M or Su-34 are stationed at the airfield.In December, drones attempted to attack the military airfield in Morozovsk, where frontline aircraft were stationed. Putin's Backbone Belarus provides large military assistance to Russia in the war against Ukraine. The Belarusian Military-Industrial Complex is assisting in meeting the needs of the Russian Army on the front lines. How and why Lukashenko's regime became one of the key allies in the war for the Kremlin is explained in the material by RBC Ukraine. Since the beginning of the large-scale aggression, Belarus has become a key ally of Russia in conducting military operations against Ukraine within the first seven months of the full-scale war. According to the Belarusian Hajun Project, Alexander Lukashenko transferred over 65,000 tons of ammunition, hundreds of T-72A tanks, BMPs and Ural trucks to Russia, only when Belarusian depots were depleted due to Putin's appetites. Other countries, primarily Iran and North Korea, have become the main suppliers of ready-made weapons for Russia. Russia utilizes the full range of services from the Belarusian Military-Industrial Complex, but the key assistance lies in the restoration of military equipment damaged as a result of combat actions. Back in 2022, at the beginning of full-scale aggression, 60% of Belarusian military goods were destined for the Russian market. Today, this figure has increased even more. Currently, 120 Belarusian plants and design bureaus are involved in the production of 1,600 types of military products and services for the Russian Federation. In contrast, 940 Russian enterprises supply about 4,000 items to 67 Belarusian military enterprises. There is no other sphere where cooperation between these countries is as close as in the military sector. Moreover, analysis of open sources suggests that the production of the Belarusian Military-Industrial Complex is increasing. The Belarusian defense industry has also switched to military rails today. Hundreds of thousands of workers are employed in the plants, who simply cannot be unaware of where the products they manufacture are going. However, military enterprises are perhaps the only sphere where one can earn a more or less decent salary in Belarus.