You just bought championship championship trophy.   Well, not necessarily here Yeah, we've got the move Yeah, a new spot. Yeah, what a builder.  I'm gonna set up my studio and up. Do it trap-hole studio All you need is is a corner. That's it.   I Mean whatever you need to do Do it Just do it Just don't take long like you just do it all at once.   I watched the two best podcast is all in them Exactly. I don't know how to put it together. Speaking of podcast To another episode Rendition Christmas special Black history moment SoulTree Award E.T. Award hip-hop award I don't even man What's gonna let that sit right there for a second J-Win stop the celebratory music, please I don't want people to be thinking we celebrate without but it is a very Monumentous is that word? It is now. It's a monumentus. I Feel like my nigga DC would love that word if he was here right now It's a monumentus Moments you're gonna drop It's a monumentus moments right now I Got my guys in here that's gonna come drop some game like they always do because they out here making people lives better They're telling you how to go from zero to a hundred real quick They helping you put your life together financially even if they not I'm telling you they are today dropping so many gyms Every way you see him bro, and they always in the right spirits and they always in the right mindset And these is motherfuckers I just love to be around because they always bring so much positivity and knowledge and I believe damn everything they say because the voices that My guys right here in the trap with me today If that's how people introduce y'all, but I feel like y'all such a strong duo that that's that's the movement That's the name it's a brand. That's a fact tell them tell them who we are. Yeah, um, I'm a shot Yes, I'm sorry from Ernie a leisure. So I earn your leisure is a movement that we started like roughly two years ago today today Somebody get the celebration music I'll tell you what I'm saying to grab the liquor Even if we don't drink the liquor I want the liquor around Go grab me some liquor more bottle Bring some bring the liquor bring the liquor the liquor Two years So it's one of these things man We just started a financial literacy Platform to talk about finance and investing in a language that when you did it guess what it was Monumentous Moment Yeah, so, you know, we've been rocking and rolling ever since it's a platform We talk about investing and real estate and all of that and I think it just costs so much traction because you know For a long time people were left out of that conversation Like, you know, the average person might not be watching CNBC or watching listening to Bloomberg But they check us out because we speak how they speak we dress how they dress and it's like Oh, this is actually something that I can actually do like it's not as complicated as they made it seem So, um, you know, we obviously work with great people like our brother Wall Street Wall Street Travels I ain't mean to cut you off But you was flowing this shit, but yeah, so that's that's really what it is It's a financial literacy platform started as an Instagram page before we've had a podcast and we had a podcast Now we got a podcast network online university all kinds of stuff. So yeah Congratulations on Starting in our dining my dining room tracks and to the world man. It's crazy. Like we tell people story. We're eating at night Well, he's Jamaican.   It's a it's still a few that y'all ain't reached yet I know because they ain't they they've been they've been sleeping and not watching the show like that because we don't went to Another plateau we did this so much Congratulations picked up a lot of new hangar owners and people who trying to figure out what the game is Like we want to reintroduce some of this g-shit to him. She wanted everybody to have the same opportunity Well, I didn't know I didn't know Somebody that was like we asked the other day. Who should we have on a lot of people said earn your leisure? Like you need watch the first one. That's how you know fact man, but that that's how it is man and We believe in that like it nobody's gonna check it out before it's their time, right? Like we can spit the message out. We could put it on YouTube We could put on IG but until somebody physically and mentally has a mindset to listen There won't be time for them to listen anyway So when they hear it in the state town they can gravitate toward it take the knowledge and execute You see what I was saying how calm this nigga boys Now I used to talk to Cal's a teacher for like 13 years So so it only makes sense that you're doing what you're doing. Yeah, it's kind of crazy the way it worked out like Shadi's a financial advisor. I was teaching. I'm an educator So it was like, all right bet. Let's put those two things together. Dangerous minds take five. Let me ask you this shot. When did you get? Good with the money. I mean, I know what I mean when I said me When did you get good with the money? So, you know, I had hoop dreams growing up Okay, so I thought I was gonna be you know in the league. So I always loved business I never wanted to work for anybody.  So I'm like, I gotta figure something out. You know, I'm saying I'm Crushed and yeah, basically I got a communications degree. So it's not like I'm gonna be a doctor or lawyer Like yeah, I'm saying from a state school So I came back and I started a commission job as a financial advisor You pretty much can get hired because it's commission. It's all commissioned 90% of people's not gonna make it But me I never I looked at it like I didn't really have an alternative not to make it Right, so I just learned as much as I possibly could and it was crazy Like I said, it's a real dangerous minds type of vibe because he was teaching in the Bronx and He like yo, can you can you um, I never understood why he wanted to be a teacher to me That's like in me breaking into jail.  What's wrong with you?    So it's like once they got up the hang of it we just we started up every summer for six weeks We had a program to teach kids. It was his program I kept taught financial literacy and they was just like in competitions with each other like it was amazing to see Them actually catch on to that those children are rich right now Yeah, and then that that kind of just birth Where we are now so financial literacy is like that's my background finance his background education You know, I help with teaching him a little bit about business. He taught me how to actually teach. It's a lot harder Yeah, and it looks like they're going they try to get these kids attention. They 14 15 years old It's not that easy with their own problems and weed and they But the common denominator was money because at the end of the program we was gonna pay him like $500 or six weeks of Internships that's better stimulus pack. Yeah. Well, that is like they got six on it Right these kids work for six weeks and got five hundred and so it was their first time They were they was gonna encounter money So I was like bet if it's the first time at 14 15 they gonna have any money Yo, let's tell them what they could actually do with it instead of just saying yo Let's back to school. Let me get some jays. Like yo, could you start a babysitter? Like they have to come up with business plans to create their own things and actually like if it was good We almost treated like Shark Tank was like, yo, if it's that great, you know, let's try to help them pursue this even further So, yeah, it was dope man. So when did you get good with the money when I get When he started teaching me more about it, man, I'll be honest with you man I didn't value money the way I should have I didn't really understand it It was like it wasn't taught in my household, right like West Indian background Finances weren't even talked in the household And so like getting credit cards and and actually getting paid from the jobs like it was like you get it you spend it and then Just watch it learning more from him and learn from all some of our friends It was like I I got a better understanding on my own, but I had to learn something. So like, yeah I ran up my credit card. I had to go to fault and have a payment plan on it I was getting accumulating student student loans at the time So it was like all these things were happening these big financial decisions that I was like damn This is crazy until I sat down was like I I got a map my life out like I'm about to start a career in teaching I got to figure this out. And so like he his first client the first thing he did was like, yo I need you to be my first client and I'm like, yo, it's my brother. Of course I'm gonna be your first client and so he was my I'm his first client And so he became my financial advisor was it like it's kind of crazy But like that's how life worked for us.    Yeah, that's dope That's dope man. When would you say you got good with the money Wall Street? That I came home from prison. Yeah So, you know, I did the 10-year stretch.   How did them stocks do when you was locked up? Well, I ain't get it was after I got locked up. So when I caught the charge, I still had bread and so I won't touch it So I was like, all right, let me get out the mug.  Like that's how wealthy people get rich Like it's not an overnight game for everything I did in the streets was just quit You know I'm saying like we need the money right now And then he was just like if you don't if you let the money work for you over time It's gonna buy back everything you want. And so one of the biggest problems everybody I knew had was a man who had no money and everybody who I knew was working They still had no money.  Yeah I can't get no money at work. So that wasn't really add nothing. It's gonna be a chapter in my book No money at work Even if you work two jobs, you just selling more your time man I never meant nobody working two jobs that was doing better than somebody working one job I Lot of niggas don't even understand you probably would be better off if you quit that mother just quit it And you just cuz you're gonna be forced to figure shit out real quick You got to figure it out. So I was just like, all right cool But then my back got put against the wall cuz you know one thing when you get locked up like one thing that happens So after I did it ten years I came home I got back in the streets that what I knew even though I knew about the stock market, right?   Nobody can't beat the game.              I'm listening now I think that even for you guys like never said people they watch y'all and you know, they love y'all You're like y'all fan bases crazy loyal.  So I started investing for my daughter when she was two, you know, I'm saying so now we done built that account up She fought to be five when I'm built that shit I sort of go from it to make a million before she 18 and I don't do number That's incremental investing start the custodial count start the UG and me account, you know I'm saying put that money in there every time you get paid So now when your kid get older you already give them that leverage in life and start to start behind the eight ball And start to have them up, you know, I'm saying get it out the mud and start to have the help mom Oh, you can be a kid, you know, I'm saying like put them up put them on game early This is the question I'm gonna ask all three y'all What would you tell a person right now with no money? I'm talking about zero. They start net nothing, right?  What would you tell them? Unified natural advisor. We're gonna pass this around. It starts with education Okay, before you even have money, you got to prepare to have money, right?  I didn't like to learn. I just didn't like how they was teaching me And Troy, he's a teacher. So, you know, we always go back and forth So now I think a couple weeks ago.  They're not asking for your college degree. They're not asking for your high school diploma They're not asking for none of that. They're asking for how much credit score how much you want So it's like when we start to learn the other side of the game We realized that everything that we really learned is really pointless like Orion's belt It ain't helping me get no money So what wait what what? Yeah, you missed that club. You missed that Nah, it's real though and what travel is samples like yo if he got it out the mud There's no reason his daughter should and so we gotta start thinking like that Right like well, you know, I'm saying if we look at our business and if we hire our children as employees That's another way to raise income for them, right? So the max that you can do is like 12600, right? So my kid is seven years old if I did 1260 max, which can't be taxed, right? If he's by the time he's 17, he already got 125,000 You see what I'm saying and that changes the trajectory of his life because I don't know anybody I doubt that we you know anybody that 16 had 120 to say like what do I want to do now, right college might not even be the option It might be like y'all want to start my own business, but to back to what you said like if they had nothing Shai said education. I say his mindset Like I I have letters that I wrote to my parents that I was going to be a millionaire my whole life I already thought it in my mind, right? I said, I heard somebody said like yo, I've been a millionaire My thing account just didn't match it Right ain't gonna have the money Because they think being broke is funny It's the mindset I'm sorry You gotta have a mindset like yo, I'm gonna get there I'm gonna get there. I'm gonna get there. And when you get there you've been preparing for your whole life You already knew that she was gonna be a point when the point is made Did you catch that? Yeah, yeah, you know what I'm saying? So it's like yo, I've always prepared for this moment I'm at this moment. What am I gonna do with this moment? You know what I mean?  Don't even know it No, no, no, no, no, I was Well, I already said that eight years old. I already said I was you know what I mean? So like I said first is the mindset but even with that we gotta look at like growing up We always look at like a million dollars like screwed from a duck like you got a million dollars You can just go swimming. You know, we don't need way more than a million Yeah exactly like you realize a million dollars not really a lot of money, but it was in coins too With gold coins, you should have bitcoin So much money he was running from it was like look when I get to that part like it's a Hurricane and he was running and the coin was trying to get him We need the duck tails drop right there. He used to jump in his money and go swimming every day Uncle screws give us a dollar.  He's top five. He was swimming in money. He had a whole vote Did you miss that part too?  Burns But when you brought up mr.  Burns. This nigga scrawny is here because he don't pick up none, but money Mr. Burns on a power plant.   Love. All right. Don't say we Well, we scared of money, let me tell you why not we you get an average person You get an average person six figures.  You got to that's why you need more than six It's why you need more than seven If you get a million dollars you spending that bitch that's why you need more so that's why So that's why I said if you got a million that ain't enough ain't enough But what if it's the other half? Like you What Been a million right you didn't expect that now you on your second half and you like I ain't That's cool Man, don't get that second right nigga.  I don't want to hear them old stories A lot of man, man Come on. That's why investing is important. Yeah, you get the mail. You make two more mail. Then you blow the mail Right. It's okay. It is okay. It's okay. I want you to have fun with it But don't you scare these people and the thinking that they can't spend this That's why even with me like I brought like when I brought this watch, right? What So you got the watch I had to make an example like we still this is our culture hip-hop like we grew up like But we got to do everything responsibly. So I find what I made that bitch on the camera, man Just flick it one time because you didn't buy it for nobody not to see it. So it's it's factory factory diamonds Yeah, I'm saying like we didn't that's how you're supposed to go in drill holes in it This watch appreciates my appreciate over the course of time rick flay had this watch 30 years ago That one That nigga didn't got so much money. He buying rick flay a watch I'll say it like that nigga's stunting on y'all It's an investment though. Yeah, it's an investment So it's like we got to show them like we got to relate to them The same way a rapper will relate to them not to actually make them feel bad about themselves and show off on them But let them know like this is what you aspire into. You can still have fun.  It's a gold watch, right? We know that gold appreciates over time, right? So he can pass that down to his kid when he's 30 his tongue can have that for years and pass it down And so don't give it to your son Because I'm saying that's just so cliche leave it to your grandson Right. So that's what I say make sure you secure two generations. That's my thing right now That's just been so I think if all that written there left us a Rolex and then that's the fact. What if he left you that same money in stocks? What if he left you anything? My friend there left us some bills in the pocket Making it normal to leave your kid something You know Making it normal to leave your grandkids some bills and there was a pocket knife on there That's why that's why what we doing is so important. Hey, what's up? You know that credit card the one you're scared to look at because you don't know the balancing You ain't really been keeping up with it. Check this out. It's this program called upstart You can go to and now put all your credit card balances in one place and you can just make one Payment you don't have to keep worried about multiple logins and trying to figure out what your password is You can just go to upstart.com For slash 85 south and use our code and get your account started So you could pay all your bills in one spot and then save yourself a whole bunch of time energy and money Things you don't have to remember You can get approved the same day and you can receive your funds as fast as one business day With a five minute online rate check, you can see your rate upfront Loan amounts will be determined based on your credit income and certain other information provided on your loan application That's upstart.com go fill out your application They got loans from $1,000 to $50,000. You are already in the game right now because you're watching this commercial So make sure you go to upstart.com For slash 85 south so so you can start rolling get the ball rolling, man I don't know why you wasting time doing it the other way. This is the future. That's upstart.com For slash 85 south because when they see wall street trapper They see his struggle. They know he's from new all-ins. He's been 10 years in jail when he was 16 years old So he speaks the lingo You know what i'm saying when they when they see us they they know that we didn't go to harvard We're not the most polished as far as our addiction is concerned That's not stopping us from investing. That's not stopping us from having intelligent conversations You don't have to compromise a lot of time growing up.   So if every Everybody's talking about something now.  It's not like it doesn't make you a nerd It doesn't make you corny So when they see us I think like not just us but our whole movement of financial literacy online They're like, oh, it's just regular people. They're like us like if we can do it Why why why can't you know say everybody do it? Yeah, we making no secret that we learning as we go and as we learn we teach That's that's just the role like we're gonna learn and we're gonna teach As obligations. So when you learn you do the same thing. Um, and so like if that cycle just continues Now you got a whole community of people that's educated and it challenges you, right?  Welcome to another episode of Yeah, this is the paid portion of the show, uh, broke people are not even allowed to see this part You mean your screen will be blacked out right now We know exactly what you have in your account if you can still see this that means you have some money Oh Man, what are some of some of the lessons that you learn just in life about money like from your family the big So, you know some good and bad things There's some shit that you grew up around that you know was the biggest lesson I learned just in my journey of understanding money is The more you chase money, the more it's gonna run from you And it's like holes ain't it similar Oh Yeah When you don't need it, that's when it does say like when you so so it's like even coming from working class environments Like you said that was crazy what you said anybody that works too job They never really have any you still never have any money So it's like yo you we work in 40 hours a week over time and all this And you still you're in a race to go nowhere because you don't still understand money when you understand money. It's like I'm on my phone 10 o'clock in the morning on the wake up And money's coming in like you know i'm saying like we've understand we started businesses We got systems in place so to me That's been the biggest life lesson is like Don't chase the money chase your passion chase knowledge chase information the money's a byproduct of that It's not a byproduct of work. You can't work to become rich. I'm just sitting back smiling It's like Like you said, but once you're on the other side and you don't see it that way You have to get a certain knowledge and a certain understanding of what what you're speaking on right now. So it's like Motherfuckers who got to go to work tomorrow? They might be sitting there like man. They just sitting there talking It's real. It's real. Like I my partners are entrepreneurs Like so they watching me go to work as we're even doing any of these like I'm going to work teaching And I'm sitting there watching my phone. I'm watching kids. I'm watching my phone You ain't watching them kids if you watch If you learn to yourself, exactly. So I'm like, yo, what am I doing here? I'm watching somebody in Nigeria say, yo that episode really changed my life And I'm teaching the kid how to to like Skip and hop see how you was like what and I'm like you quit your job. Nothing. He told me quit my job And I'm like, yo My purpose is bigger than this moment, right?  What was that moment where you knew you had to quit the job? It was that moment. I was like, yo, where is my biggest impact, right? Because like I was teaching phys ed. I'm like, yo, what's the ceiling for a phys ed teacher, right? Like you get to be the athletic director somewhere like the football coach the football coach, right?  He'd been telling me that for like five ten years Like, yo, bro, I'm gonna get you out of there. You can't you can't be teaching no more Like they waking up when they want to wake up. I'm at I'm up at five o'clock in the morning I'm lesson plan with a lesson plan lesson plan with the lesson plan killer carrier Are you using the teacher teaching that uh, what would you use to listen to on the ride to school in the morning?  I'm listening I'm listening to anything. I'm listening to uh, what was your teacher's shit?  It's chicken tender day You might just skip that That's part of it too. It's like I'm listening to wherever the kids are listening to So they keep you young and it's like yo do that I'm like, all right I can learn something from that music and when it's time to teach a lesson I'm gonna incorporate that and so it was like, yo, that's how you get financial literacy So if 21 Savage is talking something about money, I'm gonna know Uzi's talking about something that has to do with money I know and now when I go into a classroom Bet yo, you heard that new Uzi song?  You know what I'm saying?  That's a fact. That's a fact. That's a hard, there you go. That's a hard bar But like yo, if I don't listen to it, I'm listening to it exactly Shit That's a hard bar fact That's a hard bar Shit Like savage I'm thinking about that one.  I need to see that so we can accept that That's a fact You will never You'll be listening close enough. You be saying something Yeah, you be saying So what are the things for the love of shit?  I got no money for that.   Over yet because in two He did not only bring me the current Up-to-date number He let me know that 2016 Was the peak of the WIG market Then it made a 192 million dollars On WIGs just in the United States Man pay that man ALONE Pay that man man Shout out to the research department Shout out to the research team I just won two million a year Off-the-head products That's the fact Yeah That's another thing We interviewed somebody Multiple streams Job, job, the tube, Bernard He went to the head Capital of the world India India, yup Went to part of India I forgot He went out He's like Frank Lucas Now he's a guy from Brooklyn That was down on his luck He lost everything He said you know what What do I do? He went to India Got bundles Straight from the source Came back Out of their heads Like a water Heard them Yeah Basically that's what happened And he still had the number one Hair product in New York For like five years running The crazy part is like The way you're thinking about having a business Our community isn't We're just consumers of it You know what I'm saying?  Gas prices went up in old five Boy you should have never brought up 999 in 2000 One time there was so many whole Thick holes on the street Bitches had no limit Tanks tattooed Listen So I had came to Atlanta and now Your face was shaking bro You was in New York Y'all probably wasn't lit yet Y'all wasn't lit I came to Atlanta and now I said the work prize was out Ruff Ruff Ruff That was a cold sunk The cash money Ruff Ruff Ruff I just missed the talk Yeah I just missed it I went I went Tell them that shit was crazy You know I was crazy about the Ruff Ruff Ruff Cash Money So you know who opened up Before the lights came on I don't know I was in 50 cent 50 cent Before the lights came on 50 was out With 10 people watching Mmm What do you say? That's when he was uh What was it uh Ghetto Caron How to Ruff How to Ruff How to Ruff How to Ruff The shit they got in shock That wasn't that was That was 2000 How to Ruff He missed 2000 He was in the system I was in the system I'm not in the system Your birthday Yeah Nigga you missed Velua fat form suit Iceberg That's not a That's not a Iceberg Shawn Shawn Shawn Shawn Shawn Man I was getting pictures My father used to send me pictures From Mardi Gras to be mad What? You ain't even get to go in there By two prayer out before it's born No I missed a whole two major error You were you from Mississippi?   Throw money at you? Yeah they like your jokes That's different Like why are you up on stage?   Remember like that much?    Niggas See niggas get in the car What's that running up to the next light?     Really? You don't know my boy?  You won't crash Niggaz is tired What you about to go at?  First person to sign on to y'all right?


Good afternoon, everyone. Thanks for joining us today. My name is Joshua Locke. I'm a senior principal engineer in Verizon's open source program office. My upstream work is focused around software supply chain integrity, where I work in several CNCF and open SSF projects, but I'm here to talk to you today about the update framework. It's tough. In prior life, I worked on open source Linux distribution build tools, so I'm a big fan of rigor and determinism in software engineering. That's what brought me into this line of work. I'm here with my friend and colleague Lukas. Hi there. My name is Lukas. I'm a research engineer at the New York University Secure Systems Lab, where, oh, thanks, where I've been working on software supply chain security projects for the past couple of years. That includes in Toto and Tuff, both projects in the CNCF, and yeah. Back to Joshua. Thanks. Yeah, so today we're just going to take a look behind the scenes of the Tuff project, talk about the organization and some of the things we're doing, and some avenues for contribution, hoping to attract some new contributors to the project today. So this is our agenda. We're going to have a really high level overview of software supply chain security and how Tuff kind of fits into that model. We're going to look at what the Tuff project is kind of made up of, talk about some of the recent work we've been doing and how that's enabling Tuff to be used in more places and indicate some of the places that that work is happening effectively. So I'll hand back to Lukas to talk about the 101. Yeah, so Tuff, short for the Update Framework, is a software supply chain security project. We won't go into details about how it works, but still briefly talk about the software supply chain and how Tuff protects it just to get everyone on the same page. You'll hear many different definitions of the software supply chain. Also here at the event, one definition I like is that the software supply chain is the series of steps from inception of a software project to the delivery of the resulting product. It's a very generic definition. What the software supply chain also is, is an attractive target for attackers. For one simple reason, attackers can maximize their impact. A single compromise affects millions of end users or clients.  Modern software supply chain or modern software products have many, many dependencies and are really supply chains of supply chains. And one more reason why there have been so many software supply chain attacks recently is that, or for a long time, is that it has been the security of the supply chain has been neglected for a long time. But this is getting better. Tuff is located at the last mile of the supply chain, where the content ends up in a repository or in a container registry and is then fetched by a client for installation or deployment. So Tuff protects that process. More specifically, Tuff protects integrity, consistency and freshness of content. And it does so by using cryptographic signature. This is nothing special most tools that protect something use cryptographic signatures to do so. Tuff can do more than that. It allows you to delegate trust at scale. As I mentioned before, modern software is composed of many components owned by different entities. So you really want to be able to delegate trust at scale, so that a client who trusts the owner of food doesn't also have to trust the owner of bar and vice versa. And the separation of trust also allows you to reduce the impact of a compromise. So if the cryptographic keys for food have been stolen, bar may still be fine. Another feature that is very defining for Tuff is that it allows in-bend recovery. And it just works without the user having to know, having to look at revocation lists or anything. This works transparently. As promised, this was a very overview style primer on how Tuff works. And today, we want to focus more on what Tuff is, back to Joshua. Thank you. So Tuff is a community project. It's an open source project. It originated in some peer reviewed academic research, identifying flaws in popular Linux package managers. The core techniques were kind of developed in collaboration with Tor or the onion router to provide an application of data for that piece of software, which is focused on privacy and security is tantamount within that ecosystem. So that was some of the early work that led to Tuff. Tuff was effectively a generalization of the techniques developed for Tor so that any software system with a repository and clients could integrate this functionality. And over the years, it was enhanced with several research papers to adapt to community style content repositories. But the key point here is that this was really from the very early days like a collaboration between academia and practitioners with a very strong bias towards open source ecosystems with Tor and PPI being prominent examples. But Tuff and its concepts have been very widely adopted and adapted for multiple use cases. It's on automobiles via the uptime project. It's on IoT devices via the founders team smart devices through Google's future OS, cloud infrastructure through AWS bottle rocket, ecosystem package managers and so on and so on. And the core of the project is these three kind of symbiotic things that they're each distinct git repositories, but we have a specification which describes the processes and procedures for achieving this secure client repository update process. There's a particular focus on the detailed client workflow, which is very well defined. We have a kept or pep style augmentation process where we can propose and peer review possible additions to the specification. And then we have a reference implementation, which is an exemplary input implementation demonstrating how to implement Tuff and the primitives and procedures within the specification in practice. We're going to talk about that a little bit more later but these three projects have a very symbiotic relationship. They all feed into each other. There are other implementations of Tuff, the specification, several of which are open source, but not all of them have this same kind of interactive nature. And then the other thing that Tuff is is it's a small group of friendly, diverse, professional and considerate folks from academia and industry and very welcoming to new contributors. And so that's tough the community and I'm going to hand back over to Lukas to describe some of the things the community is working on. Thanks. So Trasva has shown us that Tuff is widely used and adopted, which suggests some maturity to some extent. Another data point for this is that Tuff became one of the first or became the first security project to reach the graduation status in the CNCF. So Tuff has been around for a long time and is in a good shape, but that doesn't mean that Tuff is done. So Tuff is a very much living project. There are plenty of avenues where Tuff continues to improve or in other words where you or interested people can help to improve Tuff. And yeah, I'm going to walk you through some of those areas. So one big part of Tuff is its specification and everyone who has had the pleasure to read the specification will agree with me that it is not immediately obvious what it, how everything works. So it's fairly complex. That means that clarifying the specification remains an ongoing effort for us. We're trying to revise the terminology, revise the routines. Yeah, we have, I have listed a couple of GitHub issues there where we are trying to make this easier to grasp. One reason why the Tuff specification is challenging is that it leaves many complex decisions up to the adopter. And this is actually a deliberate design decision and is what makes Tuff so versatile and useful for many setups that try to protect content. On our visual list is something like secondary literature with detailed deployment recommendations for different use cases and also where we can explain the rationale behind certain properties of Tuff in more detail. Other efforts include defining a mathematical model for the server and the client parts of Tuff and using formal methods to prove the security properties of Tuff. This is also something that no one has ever done but a lot of people would be interested in. And in addition to those general improvements are, is something that's called TAP development. Joshua already talked about this TAP process. This includes design, discussions, technical writing, implementing proof of concepts for the ideas in the TAPs, conducting security reviews, integrating it with the specification once the TAPs have been accepted and then adopting it in the Tuff implementations. Some ongoing efforts, some ongoing TAPs that we've been working on recently include signing with six store identities, optimizing metadata sizes in Tuff and using different mechanisms of key revocation, for instance. Next, so as I said, Tuff is not done yet. This includes the Tuff implementation. I'm talking about reference implementation mostly because that's what I maintain. We're constantly improving user experience, developer experience. We're trying to add new abstraction layers to make building Tuff applications easier. We're adding new features, providing new signing mechanisms and so on. We're adopting the TAPs that I talked about earlier. And adopting TAPs in the implementation also feeds back into the TAP process, into the designs. And then Joshua has already mentioned this, there are other implementations than the Python Tuff reference implementation. We have recently added a Tuff JS to our organization. There is a new Tuff implementation and they all have their own roadmaps where people can engage and help. Yeah, and having all those different implementations also calls for interoperability and conformance testing, which is something we could really need help with. So there are plenty of things everyone can do to help make Tuff implementations even stronger. And I haven't even talked about things that are built on top of those implementations. So the implementations or in my specific case, the reference implementation provide very strong foundations to build applications on top. And some of the applications that also people from the Tuff team have been working on are listed here. They all deal more with the repository side of Tuff. We will talk about that later. But first, yeah, we want to take a step back and see how we even got into a place where we can vary easily and with a lot of fun build applications on top of Tuff. Yeah, so I'm going to talk a bit now about Python Tuff, which is the thing you've heard us refer to as the reference implementation. Last year, we completed a significant overhaul of this reference implementation. And I think that effort was a really good example of the considerate and rigorous work that Tuff community engages in. We spent probably around 18 months from scratch to create a new architecture and implementation of that architecture for Tuff. And why would we do that?  We had long had a sense that the code needed a major overhaul. The API had several functions which were triggering like pilot warnings for the default number of arguments. The API was frankly very sprawling and unnecessarily branchy with like lots of deep call stacks. The repository library implementation we had required all of the metadata to be loaded to an in-memory database. So for large repositories, this was the significant slowdown. We were prototyping PIPI integration and seeing like tens of minutes for operations to complete. And then the decision to kind of sunset the legacy code was really reinforced when a security vulnerability was reported and it took us around three weeks, I think, to verify the issue and develop tests to have confidence in the fix that we had created. So the thing we did is we moved kind of slowly and considerably and we really tried to make things better. And we ended up with a really nice architecture. There was a lot of contemplation and collaboration. There was some heavy lifting done mostly by Yusie who's in the front here and Lucas on stage with me. And we ended up with this design that instead of taking the specification and mapping that directly to code, they came up with these neat abstractions. So instead of just mapping pros to code, they had modeled the implicit abstractions in the code as software classes. And they also did a bunch of old fashioned software engineering. So modernized the code to use. Modern Python with standard coding styles, standard test suites, static typing. And this made the code much nicer to maintain and work with. And then there's some neat tricks in there like the repository simulator, which enables much more dynamic testing. So we've moved away from having static test files living in the Git repository to some code that can simulate the different files. And we've got this quite nice to use, very ergonomic Python API. And a bunch of the folks working on this wrote some blog posts about the details and I can strongly recommend those for anyone who's remotely interested in. I always enjoy reading about good software engineering practices and there's some good software engineering practices in those posts. And I can say that without too much kind of bravado because I didn't write most of that code, so it's other people's work. And then we made this 1.0 release and we had this much leaner code base. We went from around 5,000 lines of code to less than 1,500 lines of code. And so that made us feel better. We could read about things much more, but we were all aware of the fact that this was brand new code that we were asking people to trust for a security project. And so the CNCF very generously funded a security audit through the open source technology improvement fund, Elstiff, which was executed by X41. And the results were really great. A significant confidence boost. There were four issues you can see on the slide that were kind of deemed security relevant and we quickly addressed those and kind of added most significantly like a parameter to a shared library we used that restricts the permissions on the files on this when they're written. And yeah, this was like, we were elated with this basically. We were expecting some really negative results and they couldn't find much. One of these issues I think is interesting because it's actually an issue in Python itself that they reported against our project. So that's, give us all a pat on the back I think. And we're continuing to do development taking a similarly considerate and rigorous approach to our ongoing work, both in the library itself and using that library as a building block. I'm going to hand back to Lucas to talk about that. Yeah, one of the key realizations during the redesign of the reference implementation was that it is quite impossible to design a universal tough application. And that's because tough is a building block. And when I say tough is a building block, I don't mean the client. The client has very clearly defined workflows in the specification, which look pretty much the same for any tough setup model or some minimal custom configuration. So as a consequence of the shelf, client implementations as included in Python tough and another tough implementation can be used pretty much anywhere. It's so easy to write a client that I'll show the snippet again that Joshua already showed. Yeah, those 20 codes lines of code do tough for you on the client side. They work with any, any repository setup. Yeah, because the repository on the other hand can vary a lot. The specification doesn't really define one repository setup instead it defines primitives, it defines roles responsible for different tasks and different content in a repository. It defines metadata formats that represent those roles. And then it defines how roles delegate trust about content to each other, how they interrelate. And only a very minimal set of those roles is mandatory in any tough setup. But beyond that, there can be arbitrarily complex delegation trees with many, many more roles. And tough can also vary a lot in regard to key requirements availability of cryptographic keys. For instance, in an environment where content changes rarely and always in a very controlled manner, it might be reasonable to sign the content or the related metadata with offline keys, like cubic keys, plugged into your computer, even with a quorum of those. But this is definitely not feasible in a setup in a community repository like like PyPI where new content gets uploaded every couple of seconds by many, many different acres. And regardless, both of these setups can use tough, can benefit from tough and and its security properties to varying degrees. So the nature of the specification that provides these building blocks only on the repository side makes it not trivial to implement a generic repository application. And at the same time, not providing a generic repository application is not sustainable because adopters really need expert knowledge in order to adopt tough in their setup. Also, the right setup definitely determines the security guarantees. So you can have a correct tough setup, but still not achieve all the security guarantees that you want. So there is definitely potential for human error. And acknowledging this fact that tough is a building block allowed us to shift the mindset from to kind of an application layering. So at the very bottom, we have this low level metadata API that is, for instance, provided by Python tough. It still requires expert tough knowledge to use it to set up a right tough repository, but it like the API makes makes it very ergonomic to do so. And then on top of that, we have a minimal repository abstraction, which is sort of the clue between the low level metadata API and an application. Its usage still requires expert knowledge to some extent, but it already encourages correct usage more and makes it even more ergonomic. And then on top of that, we like the bottom two layers have made it easier to quickly write new applications that represent one specific use case of tough, but are generic enough to be used by by multiple adopters that then don't need don't need to adopt the tough repository setup by themselves. And Joshua will talk a little bit about some of those applications. Thank you. Yeah, so we're going to talk about a few of the ways we've built on tough primitives and abstracted some of the repository designs we've seen in the wild to make it easier for folks to adopt tough without having to understand quite as much of tough as they may have had to in the past. So the first one I want to talk about briefly is we have this project called repository service for tough. And this started out several years ago, it was proposed to integrate tough into Pi PI to provide kind of repository signing. And this was went through a Python enhancement proposal proposal process pet 458. And there was a flurry of work and then it kind of faulted for various reasons. So after we had, well, actually, the one of the motivating factors for our Python tough rewrite was to support this integration. So when that refactor was completed, we began the work again in earnest. And one of the folks on the team Cairo had implemented the changes and he had submitted a PR and we were really struggling to get any kind of review on it. And we were realizing as we're looking at it that these are large and fairly invasive changes and they're really difficult to review without the tough expertise and asking any kind of overworked open source maintainer to learn a complex system in order to review changes to their project is I guess, fairly offensive. So we had a challenge, how do we make these changes easier to adopt? And the design came up with effectively abstracts over the complexities of the tough repository design, tries to simplify the integration and in this case through a rest API and consolidate some of the operationalization best practices for managing tough repositories at a large scale, as would be required by PI PI. And so the result is this repository service for tough application. And this is sprung up in a relatively short amount of time and was recently contributed to the open source security foundation or the open SSF by VMware. And it's operating under the securing software repositories working group, which brings together a lot of the people operating these repositories like PI PI Ruby Gems, MPM and so on. And so we're hoping to see more interest from the working group members. And we have some future plans to implement related tough repository styles to enable things like developer signing. So an arbitrary API maintainer can kind of sign their package before they upload it. And that makes it resilient to repository compromise as well as kind of on path attackers. And then another neat project is a little bit newer called tough on CI. And this has its origin story in the six star project. So if no one, if you haven't heard of the six star project, six star is relatively new. It's about one year old, I think effort to make it much easier for developers to do kind of software signing. And it uses existing identities like your email account or your GitHub account or whatever and issues short lived certificates. And it's a fairly complex, as you can see from the diagram, like software system and the root of some of these services are these keys, which all of the clients need a copy of in order to verify like the chain of security claims in a six star system. And of course, any client with a copy of these keys need to know that they've got the latest copy of the keys and that the keys are not tampered with and that they have a consistent ring of keys, which all starts to sound like some of the properties that tough provides. And the folks working on six or made that connection. And they started coming up with this neat orchestration mechanism using GitHub actions so that they could have people contributing to the six star project from around the world all do the kind of quorum or threshold signing that tough supports through GitHub pull requests and automation through GitHub actions. And this is really neat. But it's also very hard coded for the situation. And it turns out that people want to do things like privately deploy six star to their corporations and trying to replicate that setup for their own use is tricky. And so you see here in the front realize that this could be generalized much more and implemented in a much more templated way so that it could be used by other projects of different kinds and other instances of six star. And he started this tough on CI projects to provide the root signing mechanism of six star for more general use cases. Yeah, that's another neat instance of tough application. These two systems are very different in how they apply tough with the number of things they're trying to sign and the number of people doing the signing operations, which exemplifies the versatile nature of the tough specification. So having some high quality first party implementations of tough repository models is really helping the project understand and the users of the project understand where this thing can be used and how it can be put to use. Okay, and back to Lucas, do you conclude I guess? Yeah, this concludes our talk pretty much to recap. We heard about tough providing building blocks for securing the last mile of the software supply chain today. And what maintaining tough involves, that's combination of security engineering, collaboration, project management, technical writing, software engineering, all sorts of skills are required and are appreciated if donated to our group. Yeah, tough community is small but very passionate, very engaged and definitely welcoming. And I can say from my own experience that it's very rewarding working on those projects with very skilled people. I have learned a lot. I've learned a lot there. And yeah, I hope to see more people. We have a couple of coordinates here on the slide. Most activity happens on GitHub under the update framework umbrella. We have a home page, the update framework IO, where you'll find more information about the whole project. Communication mostly happens on our CNCF Slack channel, hash tough. And we have a fairly low volume email address where we also announce our monthly community meetings. We haven't uploaded the slides yet, but they will be available later. So yeah, hope to see you somewhere on these platforms or in our next community meeting. Thank you. And if you do have any questions, we've got like four minutes. Yeah, and we will also hang out here a little bit. So maybe we have more than four minutes. Thanks. Maybe I'll ask you a question. And anyone hearing about tough for the first time today? Yeah. Yeah. Yeah. So the first user of our stuff was effectively integrating it into their CLCV pipeline to make sure that the artifacts they were producing through that process were kind of securely delivered to the orchestration system. Pulling, when you're pulling in a bunch of the internet as well, it does get a little bit more complicated, but you could certainly, you could use like our stuff to effectively, once you pull the thing in, you have the, you get the protection that the thing isn't tampered with internally or in transit from your, an internal mirror effectively. Absolutely. Yeah. Sure. I mean, there's trade-offs there. But this is one of the reasons why we contributed this project to the OpenSSF. And we are talking to the folks that, so some of the people working on Maven, like folks from Sonotype who work on Maven Central, they are a part of this securing software repositories working group that is sponsoring this project at the OpenSSF. And that's certainly like our goal is to have groups like that either adopt this software or, you know, an implementation of it. If, you know, some people are quite particular about, I don't want to take a Python dependency from my Java ecosystem, for example. So, but that we hope, this project is very well documented and we hope that we have both an implementation that folks can use, but also kind of an architecture that folks can replicate if they don't want to take the software that they need. So it's, it's our goal to get this integrated into repositories like that. Well, yeah, we'll hang around if anyone does want to ask a question without the microphones would be just out there. But otherwise, yeah, thanks for attending.


Suspense, and the producer of radio's outstanding theatre of thrills, the master of mystery and adventure, William M. Robson. Faithful listeners, and who among you is not, will remember a strange and wonderful story we presented some time ago about a member of the Beat Generation called the Tennis Shoe. It was the first radio play by a young man of whom we have expected much, and we have not been disappointed. Here with another strange and wonderful story by 26-year-old George Bamber. In years to come we feel confident that we will be proud to recall that it was on suspense that this brilliant writer was first heard. Listen, listen then as Richard Beals stars in Return to Dust. And now, Return to Dust, starring Mr. Richard Beals, a tale well calculated to keep you in suspense. Testing, one, two, three. Testing, testing. Attention, Dr. Warren Bader, Department of Pathology, School of Medicine, State University. This is James Howard, Research Fellow in Pathology speaking. At the moment I am seated on the tape recorder that is recording this message to you. As a point of fact, by the yardstick on my desk, I stand exactly 12 inches, and I am steadily decreasing in size. I calculate if I continue to shrink at the present rate of speed, it is possible that I will become invisible to the human eye sometime before midnight. I have been trying to reach you by phone since 8 this morning, but you are not at home and have not yet arrived at your office.  That's the precaution of this recording. As you will have discovered by now, I have gone against your orders and pursued my theory of cancer cell growth by working in the lab at night after my regular duties. I have been trying to prove that the biochemical agent not only stops abnormal cell division, but reduces the existing cells in physical size until the neutralizer is induced. The fact that I have shrunk from five and one half feet to one foot should be proof beyond refutation, though my condition is the result of an accident. While trying to introduce a more powerful catalyst in the laboratory last night, I inadvertently created an uncontrolled reaction, which manifested itself as a white mist which filled the entire lab. The mist lasted no more than a few seconds, and as I observed no effects other than this, I continued working. When I got home, I descended into one of the deepest and blackest sleeps I have ever experienced. I woke this morning to discover myself literally lost in a sea of blankets. I had shrunk four feet eight inches during the night. Naturally, my first reaction was one of panic. But I soon realized that my only salvation was to remain calm until I contacted you. You'll find a more complete report of my theory and the experiments which I've conducted to prove it in the uncompleted thesis here on my desk.  As for myself, you'll find detailed instructions on how to reverse the action, which I've accidentally initiated. You'll find this on pages 79, 80, and 81. No matter how small I shall become, even microscopic, you will be able to reverse the process if you follow the instructions on those pages. I had better place another telephone call to your office, Dr. Bader, while I'm still big enough to dial a phone. It is just possible that your efficient secretary forgot to tell you that I called. The phone has grown almost half as tall as I am, a strange sensation. Who would think the tensor springs on these dials would be so strong? Who would think I would have to use both hands to dial a telephone? Ms. Prichard, has Dr. Bader come in yet? Whom shall I say is calling? This is James Howard, Ms. Prichard. It's urgent. It's me all right. Are you sure? Yes, I am. Now look, Ms. Prichard, don't pull that. Dr. Bader isn't in stuff to me. You tell Dr. Bader I have to talk to him. Look, this is a matter of life and death. There's nothing anyone can do but Dr. Bader. He's the only man in the world that can help me. Yes, you do that, Ms. Prichard. Why, Dr. Bader, why of all days did you have to pick today to change your routine?  Why did you have to pick this morning to change? Self-preservation is the most powerful instinct. It is now 3.30 in the afternoon and I have shrunk to the unbelievable height of 6 inches. And I'm continuing to shrink, yet I'm taking every precaution to guarantee that I stay alive. What have I got to live for? What am I? A 32-year-old old man that's losing his hair, walks with a stoop from years of hunching over microscopes. What have I got to show for it? A cheap, furnished room, a meager position as a research fellow which doesn't pay enough to live like other people. Not enough to have a wife or children with no dignity, certainly. All that I can call mine is in this room. A couple of suits, some socks with holes in them, piles of heavy books, a microscope on my desk, and a tape recorder to record my notes on. That's all that will be left of Mr. James Howard, research fellow. Oh, excuse me, Dr. Pasteur, and one green and gold parakeet with the name of Pasteur. To pose a hypothetical problem, Dr. Pasteur, who's going to change the water in your cage if I return to dust? Certainly not Dr. Bader. He might steal what little water you had, but he wouldn't change it. Well, if I don't contact the doctor, it may be a week before the landlady comes up here to clean. He'd starve to death. Got to open that cage and let him loose. But how? I can push the latch open with that? Yes. Yes, I can just reach it. There! You're free, Dr. Pasteur. You're free. The window is open across the room. There's a whole world. Just fly away and make a name for yourself. The whole world. I've got the whole world ahead of me, too, if I live. After I publish my thesis, I'll be famous. We'll have everything I ever dreamed of. But not unless Dr. Bader gets the instructions. So, we resume taping. But I can't reach the start button on the recorder. These books, they're like a grand staircase to the cake deck. Push it, recording again. You'll not receive your phone call, but I have not given up hope. I've made the necessary precautions for isolating myself in the event that you do not call before tomorrow morning. I have made a ramp or the roller to the stage of the microscope. Load to the microscope is a transparent glass petri dish. As soon as it becomes apparent that I'm in danger of being lost from view on the desk, I will make my way to the petri dish. But what if you haven't called by the time I could be lost in the petri dish? I could prepare a slide for myself. If I diminished to the size of a one-celled organism, I would have no difficulty in crawling under the cover glass and taking up a position directly under the lens. Perhaps I should prepare a slide now. Still something left. So I went ahead with the preparation for my survival thing, too. It's not yet half an inch tall, arranged. In the center of the petri dish on the microscope stage, is a prepared slide complete with slip cover and label. In danger of being lost in the petri dish, I will make my way to the exact center of the slide and take up a position there. Able to see me for some time to come because I focused the microscope. Dr. Bader is, look, a different place now. Pencils seem like telephone poles. They will look like if no one ever finds me. The microscope is labeled carefully. Of all the slides I've labeled in my lifetime, I hardly thought the last one might become my epitaph. You refuse to leave so long as the last monster you are from this perspective. Your feathers are like scales of armor. Infested with lice, I see. The Spence in which Richard Beals starred in William M. Robeson's production of Return to Dust, written by George Bamber. Supporting Richard Beals in Return to Dust were Paula Winslow and Lawrence Dobkin. Sound patterns by Bill James and Tom Hanley. Listen. Listen again next week when we return with Victor Jory in Death Notice. Another tale well calculated to keep you in suspense. For news analysis, which follows immediately on CBS Radio.


Thank you. So, committee, we are going to look at H207, the Montpelier Charter Change, and for some odd reason, I seem to have lost my folder, but I can mainly remember what we talked about. So, where are we here in terms of what we're thinking right now? And maybe, Tucker, would you join us for a moment here? And this might also want to involve Chris, I mean, Will, possibly this question. So, one of the questions that came up by some of our colleagues was, well, two questions. One was whenever a local vote is made, it impacts the rest of the state because of budgetary. For example, if you're doing, creating a TIF, it's going to affect the rest of the state. So, some response to that, and primarily for you, I guess, is the issue of, if we let non-citizens vote, why would we also not let non-residents vote? And we, in our area, we have a couple towns who have like 60% of the population is non-resident. They're second homeowners who spend a lot of time in Vermont and are affected by the tax rate and by the decisions of the voters of the town, but they're not allowed to vote. So, so, do you, what would be the issues around non-resident voting and then we'll ask Will also that. Are there, from your perspective? Sure. Good afternoon, talk for Anderson, and also the Legislative Council. Both of those sound like policy issues that would need to be debated and considered by you as legislators. I don't necessarily see any legal advice being particularly helpful for that discussion. The last time we were here, I felt framed the first issue that you brought up about local elections impacting the finances and duties of the state potentially with respect to TIF districts. So, to briefly outline that again, that is going to be the case for every municipality, whether or not that municipality allows non-citizens to vote. Local elections at some point may have an impact on statewide policies and issues. That's just a matter of fact. It is a policy consideration for all of you as to whether you want to allow this particular municipality to have non-citizens voting in some of those local ballot issues that have echoing ramifications that are greater than the municipality. There's no particular legal constitutional issue there for me to discuss. I'm not as concerned about the non-citizens because they're not residents. This is trying to focus residents who live here full-time who would like to have a voice in the community they live in. So, I'm not as concerned about the non-citizens, but Tacoma Park, which is our one municipality we can look at with experience. Actually, I want to interrupt just for a second because I've seen this testimony from Roberta Garland, local citizen, she said that San Francisco and Chicago allow non-citizens to vote in school council elections. 11 municipalities in Maryland allow non-citizens to vote in local affairs. Tacoma Park has allowed this in 1992. Chevy Chase started allowing this in 2018. I'm just saying, I didn't realize that, 11 towns in Maryland are doing it. Oh, it's not just to go on. I thought, I mean. No, no, that's good. So then, because my question is, how have they dealt with any local issue that might have state finance impact? To me, that's a red herring. I sort of view it as a red herring, but I'm just curious, have there been any issues that have arisen in those 11 towns in Maryland that have adopted this in terms of placing undue burden on the state finances? I have not researched that issue. I didn't hear any testimony about that particular issue when Tacoma Park testified that is a question that's best answered by them. Okay. So, if you remember the last time we talked about this, I said that Montpelier had a population of 16,700 and there were so many registered voters and stuff. And on the top of my notes for that, it said topo. And I couldn't figure, it was Tacoma Park. I finally figured out that those numbers related to Tacoma Park, even though I only had written down taco. Right. And I thought you were thinking about Paco, who had been involved with that district. So, we don't have, it looks like 13 municipalities if you include Chicago and San Francisco and Chevy Chase also. That was still the question I had. So 14, as far as we can identify, is that Roberta is right here, so we can ask her when she testifies. Any other questions? Yeah, I just, I mean, we've got over this before, but I just would like you to do it again if you can. Go back to the constitutional history that maybe Betsy shared with us about towns or creatures of the state if they have the ability to do certain things. You know what I'm trying to get at? Could you talk about that a little bit? Sure. And yes, that was Betsy and Rask, who may be very thorough in our articulate presentation. Yeah, I'm sorry for you to do it so fast. The briefest possible summary is that unless the constitution prohibits you, the legislature, from granting this power to new municipalities, then you may give it to them. And there is no particular restriction on qualifications for local elections. Therefore, you have the ability to delegate this to the city of Montpelier through this special law. That is the briefest, squarist summary that I can give you without going through the 20, no, 18-page document. That was good. I just needed to be reminded. Any more questions for Tucker? Thank you. Will, would you like to just join us and talk a little bit about the issue of non-citizen versus non-resident? And I know it, like Tucker said, it's policy decision, but it is a question that we have been asked. Sure. Well, sending director of elections for the record and Madame Chair wasn't prepared for any direct testimony. You know, this is pretty informal discussion, so. Do you have a specific question in that regard? Well, how, just when you establish residency, how do you establish residency as opposed to not being a resident? In Vermont? Yeah. For purposes of the election law? Yeah. Both of those things are important because there's multiple residency efforts, as you know. But this is for elections. Yeah. For voter registration purposes, it's, I often say it's a fairly subjective analysis which hinges primarily on whether you consider the place to be your principal dwelling place. And you have an attempt to return there temporarily absent, coupled with an act or acts consistent with that intent. That's basically the definition of it. It starts with a basic premise that you consider it your principal dwelling place. But that's not the tax definition. No, it's not. Nor the school tuition assessment. That's the principle for you. Consider it your dwelling place. Primary dwelling place. And how do you define primary dwelling place? Good question. Honestly, the place you spend the primary amount of your time, the most significant amount of your time. Is that 51%? No, not necessarily. So if you said, I'm, this is my primary dwelling. We had a, this was a huge issue in Grafton. As you remember. Overwind and people who wanted to vote but had their primary residence in someplace else. How would they have established their primary residence so that they would have been allowed to vote? Would they have to change where they paid their income? I mean, how do you, if it's different for tax purposes and different for Medicaid or whatever, how do you, how do you establish that? And how do you enforce that? In the courts, there's not a whole lot of case law and I've looked into it. Some kind of tax, as I was saying, the statute ends with an act or acts consistent with that attempt. The kind of stuff courts would look for, maintenance of a bank account, P.O. Box. Some set of indicia that show you still have some connection to the community. However, I would say that that's usually looked at in the context of somebody who has left and maintains that they're coming back. So it was there as the principal going place then left for some unanticipated reason.  You get challenged by the Board of Civil Authority in your town. You say no by intent to return there as soon as my mom passes away, which might be in a definite period of time. Then the court would say, well, what can you show me that tells me your plans to come back? You still have the house, you haven't sold it. You know, if you've sold the house that you once had before, that shows pretty well that you don't intend to come back. But the second homeowner show is a difficult one. Although in most cases, I think it's pretty clear whether or not it's the person's primary dwelling place. And then sort of the baseline that everyone operates from also is the one thing you don't want to do is be registered in two places. So at least if you're going to be playing in Vermont, it's your principal dwelling place. You're not also registered in Connecticut or Florida. It's highly subjective is where I stand. But it is illegal to be registered in two places to vote. Correct. Not necessarily. Not necessarily. Just discussing that with my election director colleagues across the country yesterday morning. But you're not able, or you're not supposed to vote in two places. Two different things is what you just said. So clearly you're not supposed to vote in two places. Right, so clearly. So it's illegal to vote in two places. To be registered. And you are encouraged to be registered in only one. Yeah, there's sort of tangential statutes that get to it for instance where statutes don't say if you move and register somewhere else, either that clerk or you are meant to call and remove yourself from the rolls. But there are not definitive statements to say it's against a lot of your registered in two places. And I think that's probably a historic way over time because it's so easy to make that error unknowingly. Well, end up registered in two places. It takes a while, yeah. So, if somebody, go ahead. The last point I would make in reference to this bill is that I don't necessarily see the relationship in this discussion with the bill before you. Right. Which is to say that citizenship, unlike residency, is not subjective at all and is very easy to prove or disprove. And so I don't think that this bill raises the same kind of questions that one, I'd raise if it proposed to have non-residents. It raises the question of their colleagues. That's where the question comes from. So if you were, since you're not supposed to vote in two places, if you had dual citizenship, you can't have dual citizenship in the United States, can you? Yes. With someplace else. So, could you vote in that someplace else and vote in Montpelier? You got a country, I suppose you could. Depends on their laws. They're on, depends on their laws. Yeah, you can't vote in England if you vote here. Okay. I haven't enough to know our laws. I think so. You don't know the election laws of the world? Working on it, working on it. You'll be a test next week. Okay. But as we heard from Roberta when she lived in Norway, she could vote in those local elections, not in the federal elections, but she could vote in the local elections and she could vote here. And send a presidential ballot back here? Any ballot.  Absentee ballots are good for every election. From our perspective, I don't know about Norway. Yeah. No, but from our... Yeah. Okay. I did have one more question, but my senior moment just... It'll pop. It'll pop up at some point. Kind of, not exactly. My impression is that amongst people who direct elections in the United States, there's sort of a mutual aid attitude, like you work with your colleagues around the country and sort of things out. Yes. Are you working in any way to sort out what's going on in Iowa? He's just grateful he's not at elections in Iowa, right? No, in the end of that, you guys give me the opportunity just so there's an audience here to make the important distinction. Hey, the ballots. Well, that, but more importantly, to your question, as to that election primary caucus last night was not administered by the state. Right. It was administered by the caucus. Democratic Party function. And so my election director, colleague in Iowa, had nothing to do with that process last night. There have been suggestions that we should do away with the state-run primary in Vermont and have it administered by the parties and we could save a bundle. Yeah. And look, I guess we aren't. I guess we are going to leave a lot of discussion about it. We are not going down the front any time soon. We necessarily, but there have been discussions as you well know. But it's interesting. Well, I think that some of the reason that some of these states like Iowa still have their caucuses is because the legislature won't fund a primary. The fact that you guys pay $400,000 to pay for all our primary ballots is a big investment. But this is like our public records discussion. What is the business? These are core functions. No, but democracy. No, but the... Determining a party's candidate. Party's candidate? In determining candidates, period. We happen to have a party's assistant. I don't want to get into it. It's too late. I was just going to ask. The projectaries aren't to determine the party's candidate. They are to determine who are candidates. Our party candidates are. I think it's a function of state government and I'm glad we fund it. It hasn't been for very long. It's certainly been for the benefits of funding in, having it done professionally by people who know how to do it. And it hasn't been a state party. It hasn't been a state function for very long in Vermont. I'm thrilled it's currently a state function. And we're more thrilled after last night's mass in Iowa. When did it start to be a state function? I think in 73. 76, I think. 76, because the 72 election, we still did caucuses. I think I thought it always was. April McCollum for the free press is working on the story about the free government. I remember going to the caucuses for the 72 election because we had just moved here. And I remember the day that it was 76, the first senator of the primary, the caucuses also were going on at the same time. Yeah, all right. So you called us for Nixon, then? I did. I did, I called yes. Thank you. Since 1976. So does anybody else have anything they'd like to weigh in on here with some new material or some new thoughts or hasn't had a chance so far? Thank you, Roberta, for setting your tone. Let's see first if there's anybody else who hasn't weighed in so far, but no? Okay. Well, thank you, Chair and members of the committee. So my wife, Micah Garland, would have liked to have been here, but she's in Norway with her 90-year-old mother at this point. So she has been living in Montpelier for 26 and a half years and we bought a house here, we raised a child, we were really kind of involved in the community. So what I did was I came up with some questions that I thought might be questions that get addressed and questions that I and others who circulated petitions in Montpelier faced. Would it make sense for me to read through these or not? What does anybody think? I think I just, so I'm all right, I don't, I mean, we kind of already read number seven about that. Well, maybe I can read, well, the first one, this is a question that we got a lot voting that's a privilege that should be reserved for citizens. You know, people felt very, there were quite a few people in the street who felt strongly about that and we had discussions with these folks and so. Did they all vote? Did they all vote in the? I mean, they talk about it as a privilege, but so our numbers of nine people actually voting are so low. I didn't know some of that, but voting? It's a privilege, that good point, exercise. So I will say that in about five minutes we're gonna do something else. Okay, okay, all right, so I'll just read that. Some people believe that citizenship and voting are tied together and for federal elections they are. However, federal law does not prohibit non-citizens from voting in state or local elections. If states and municipalities allow voting, also the Vermont Constitution and Vermont case law does not prohibit non-citizens from voting in local elections. Because Bill solely addresses voting in Montpelier affairs, the right to vote in federal and state elections will still be limited to U.S. citizens. So I just point out here that in Burlington they just withdrew theirs and the two people that voted against it, one of them was a new American citizen. Right, and some new Americans felt like well, we work very hard and this is the right that we've gained. The majority of people who I spoke to in Montpelier who are from other countries, citizens of other countries, they were really, or they're spelt it in. They didn't say that. I just found that. Yeah, yeah. So another question is, let me see. Would this put non-citizens at risk of committing a crime number nine, and there's nothing in federal law that prohibits non-citizens from voting in local elections. As part of the naturalization process, applicants are asked if they have voted in federal, state, or local elections and are asked to provide supplementary materials if they have done so. In this case, the supplementary material would be information from the city of Montpelier and the city clerk of Tacoma Park, she addressed this too. She said she gives them information that they can attach to their application. Another question that came up with, why can't people wait until they become citizens? That's number two. Yes. The answer to this is as complicated as the number of people who would be impacted by the passing of this bill. And again, some examples. Some people come from countries where dual citizenship is not allowed. They might have family and a strong connection to their original country of citizenship. They want to give up their original citizenship. Some people would like to become a US citizen or in the lengthy process of establishing enough time to do so. One has to be a permanent resident for five years or if married to a US citizen three years. Oh, I didn't work on it. Oops, I don't know if you have the newest version. I wrote that it can take up to 10 years or more to even become a permanent resident. So it can take a really long time to even get to that step where you can consider citizenship. And it costs $725 and the Trump administration has proposed an increase to 1170. And this does not include any potential lawyers' fees. So those can definitely be- Which are serious. They also, I think everybody got the statement from Gilberto. Yes? Yes, thank you for those, that was good. Okay, he was not able to be here because he's working. One of the most powerful things about this conversation for me is the fact that it passed a month earlier by 3,300 votes, 4,900 against, that's like 4 to 1. That's pretty strong vote. Yeah, it was a strong vote. People. Yeah, it was very interesting to go around and talk to people about it in the lengthy process and get so much support. Because I think one of the things that, in terms of the time I've spent on this committee, that we do a lot of charter changes, as you know, as you can imagine. And I always feel like, whether I totally agree with what local folks are trying to do or not, if local citizens pass a charter change, I start from this premise of who am I to tell them they can't do something that they democratically elected to. Right. Hey, what I found very interesting that the only time that the governor's budget address, here was a standing ovation, was when he talked about welcoming more immigrants into the state of Vermont. And so, if we're going to welcome more immigrants into the state of Vermont, this might be a good way of showing a welcome. Instead of just saying welcome, and also we're dealing in the OPR bill, we're dealing with credentialing and license transfers and things like that for people who are coming. So, if we're going to welcome more immigrants, we need to actually output our money where our mouth is for whatever that means. But, anyway. Right, the show value of welcoming and their proximity, absolutely. Instead of just having a welcome banner. Well, I think that I've talked to a number of people. I don't think we're ready to vote on this today. I was hoping we were, but I think they're. So, I'm going to try and put it on possibly for, and I do apologize to the people of Montpelier because I know you wanted this to go through so that you could set it up for town meeting this year. I just don't see that that's going to happen because it has to get through here and then the governor has to sign it. And he has, so if we voted on it, there's a possibility that we could vote on it on Thursday because it seems we have some local government. No, it's not this Thursday, that's the 13th. But we do have a Wednesday, Wednesday, that's tomorrow. We were supposed to hear the Vermont National Guard Sexual Assault Report with the House members. It turns out that the House members are going to have a really, really long session because they have a lot of contentious things to vote on tomorrow, plus the governor's override. So we have some time before 2.30, so I suggest that maybe we be prepared to vote on it then, does that make sense? Yes. Oh no, not tomorrow, all right, thank you. Thursday, we'll see if we can move something and vote it out on Thursday. So thank you Anthony. My pleasure. I think that's on track. It's always a good thing in this committee to have good vice chairs, both Anthony and Brian have acted as great vice chairs, keeping me on track. Okay, thank you. Good bye.


If you wanna travel in an RV but don't know how to make a living along the way, then this video is for you. You no longer have to be tethered to a location dependent job to make ends meet or get healthcare or save for retirement. Now there are hundreds and hundreds of opportunities out there so you can get out and live your life now and not wait for retirement and still make a living. Today I'm going to tell you about four jobs just like that and not one of them is work camping. Happy Sunday everybody, it's Robin with Creativity RV. I hope you're all doing well out there. I am excited today to bring you this video. I've been meaning to do this one for a few years. Now if you're new to my channel and just stumbled on this video because you were looking for remote jobs, let me tell you, I work and live full time from an RV and I have for several years and I'm the author of the book, Work From Home While You Roam, The Ultimate Guide to Jobs That Can Be Done From Anywhere. Today I'm going to tell you about four jobs that you can do from an RV and none of them are work camping. Now there's nothing wrong with work camping. I have a whole chapter dedicated to that and another one dedicated to seasonal workers. But when people think about remote work for RVers, that's really all they think about and then they stop. And I'm here to tell you that there are hundreds and hundreds of opportunities out there in all kinds of different fields, whether you want to make some quick cash or have a six figure salary job, there are opportunities out there for you. So out of all of those, I chose my top four, which was really tough, but just keep in mind it's just the tip of the iceberg. There's something out there for everybody. The first opportunity I want to tell you about is delivering RVs. Now that's not so tough, right? Because you already know how to drive an RV. RV transport drivers deliver RVs from the manufacturer to dealerships across the country. And here's what's really cool about it for us. This is a flexible job. So you can choose what you want to do with it. You can do it just in the peak season. You can do it part time or you can do it full time. And if you do, this can be a six figure job. Now you might be wondering if you have to have a CDL license to do this job. Not necessarily. Those companies do not require that you need one unless you're driving a rig that's over 40 feet long. And with a lot of these companies, you get to choose what kind of a rig you're delivering. So if you're comfortable with a 25 foot class C, for example, and not with a 40 foot class A, when you go in to choose your gig, you choose the one that you're comfortable with. The book has 13 different listings for transport companies and each one has a link to apply and tells you what that specific company is looking for in terms of qualifications and background and what they pay. As you can imagine, every company is a little bit different. So today, I just wanted to give you an overview of what the transport job is like and how you get paid. So when you go into these companies, you're generally going to see that there are two different types of jobs listed. One is for a tow away driver and the other is for a drive away driver. Tow away drivers use their own truck, so they have to supply the truck and all of the equipment to hitch up. But then since they have their truck, they have a way home. Drive away drivers, on the other hand, have to figure out how they're going to get home. So most of them deliver the all in one RV with a towed on the back, which is a little car that they pull behind them so that once the RV is delivered, they can just unhitch that car and drive home. Most transport companies have a minimum and maximum allowable age for their drivers, depending on the insurance requirements. A lot of them have a minimum age of about 25 and a maximum age of 75. They also require that you have a little bit of experience driving an RV before you can start delivering them, but for most of us, that's not a problem. Here's how it works. Once you apply with one of these companies and get approved, you generally go into something called a load board where drivers can see what's coming up for available gigs. Once you choose a gig, you usually get paid in one of two different ways, either by the mile or a flat fee. Either way, you usually get paid half of the money for that gig upfront when you pick up the RV because you have to pay for all the gas on the trip. The other half of the money is generally paid when you deliver the RV and finish the paperwork. Pretty cool, right? You could choose when and where you want to do this type of a gig or you could do it full time and make a really good living out it. The second opportunity I want to tell you about is being a reseller. So if in your travels, you have a really good eye for spotting things like high-end fashion items like handbags or textbooks or electronics, then this might be for you. I've got 13 different ones in the book and as you can imagine, they're all a little bit different, but like I said, if you really want to make money in this field, the good things to focus on are handbags, books, and electronics. Resellers that know how to spot these items at a low price can do very well. In fact, I know a nomad who makes six figures a year just being a reseller for designer handbags and shoes. So if you have an eye for something like that, check this out. The platforms are very cool. Let's say you're in a thrift store and you see some kind of a designer handbag. You can go right into many of these apps and ask it how much they will give you for that handbag and if you decide it's worth it, you can buy it, take it right out to the post office and ship it off to them without having to carry it around with you. The next job I want to tell you about is being a fully employed customer service representative or virtual assistant.  But a lot of people just do feel more comfortable working underneath a regular employee with all of the benefits and infrastructure that gives them. As I'm sure you guys know, the opportunity for remote work has absolutely skyrocketed in the last 20 years, especially after COVID. A lot of these opportunities seem to be in the field of customer service or being a virtual assistant. But really, you can find anything across the board for almost any kind of office work. Now you might say, hold up there Rob and I've searched for jobs like that and I can never find anything. Well that might be because doing a simple Google search for the words remote job brings back over 500,000 listings. Your dream job might be buried in there somewhere but who has time to find it? To make it worse, when you search for the word remote, that can mean a lot of different things to a lot of different employers. In the book I have a chapter called The Big Five and How to Use Them, which breaks down the big five employment marketplaces. What's important to know here is that some of these platforms are job boards and other ones are actually search engines. So to find the job that you want, you have to know how to search for it in the right way. Here's an example. Let's say you go into the employment marketplace indeed, which is really a search engine and you want to find remote jobs. It's not easy to find. You actually have to go into the location for the job and search for the word remote. But if you're searching on the employment marketplace dice, you actually have to go up into a little search bar and type in the word remote to find those jobs. But don't despair, the jobs are out there. When you go into these platforms, just keep in mind that you have to understand how that platform was built and how you have to drill down and find the remote work. Sometimes you just have to take about 10 or 15 minutes and figure that out. And then all of a sudden the floodgates open up and you will find listings for all kinds of remote work. But wait, you then have to figure out if the job listing you're finding is remote friendly or remote first. If a job is remote friendly, that just means that every once in a while they're okay if you go home and work from the couch. But it's not something that you can do all the time because the job doesn't support it or the infrastructure for the company doesn't support it. What you guys want is a remote first job, which means that the job is 100% remote. It was built that way and they have the infrastructure to support it. And finally, the fourth job I want to tell you about is the job you already have. It is absolutely possible to change your current job into a remote job. And remember, remote work has grown 159% since 2005 and 69% of companies already have remote workers. So you're actually going with the trend, not fighting against it. So I'm going to give you a few tips on how you can successfully turn your location dependent job into a 100% remote job. The first thing you have to think about, of course, is can your current job be a remote job? There are lots of jobs that have to be done in person.  But if you're working inside of an office, there's a good chance that you can. The next thing is to think about if remote work is trending in your industry or business. It is not uncommon now for companies to offer a telecommuting option to their employees. Are you seeing that? And have you seen your company make changes to their infrastructure to save money like going lean? Then making a pitch for remote work might be for you. If you think it is, you want to prepare a pitch and arm yourself with the data.  You want to go in with a fully formed plan that explains to them why it works for them if you become a remote worker.  Remote workers are more productive than their office counterparts. 79% of employees say that they are more loyal to their employer if that employer offers some kind of flexible remote work opportunities. 66% of workers surveyed said that they are more productive when they do their work outside of the office instead of inside. To that end, 76% of workers say that they're less distractions outside the office. 91% reported that they're more productive when they work from home. Remote employees are 43% less likely to experience burnout. And this is my favorite one, especially if you're going in with a pitch. According to Flex Jobs, employers save $22,000 on average per employee when they allow that employee to work remotely because of the savings in infrastructure cost. And definitely, when you prepare your pitch to change your job to a remote job, be confident and have a plan that explains to your boss exactly what the logistics are going to be and how this is going to work for them as well as you. So that's four out of hundreds and hundreds and hundreds of opportunities that are out there.  There is something out there for you where you can make money and get on the road. I hope that this has just piqued your interest and you guys start to search for the job that can help you live the life that you want to live right now. Please share this with your friends or anybody that can use this information. Subscribe if you haven't already and give the video a thumbs up. I'll see you guys next week with an all new video. Until then, everybody out there, have happy travels and be free.