Hey guys, it's Nate, aka The Foot Account, and welcome back to the channel. Happy Wednesday, new team of the week today, probably an updated loading screen for future stars as well. I wanna talk about that loading screen and some Thursday flip potential alongside of the actual Wayne Rooney end of an era SBC. We talked about it possibly coming yesterday, and it actually did come. In yesterday's video, we talked about it, and we got a little lucky, I guess. We kinda were thinking along the same lines as EA Sports were, and that SBC that they did release yesterday was a crazy one, right? We get one day out of team of the year and we have a massive SBC like this Wayne Rooney released every single year, but for the past three years now, we have had a Wayne Rooney SBC and it has been very popular and a lot of people have done it. Now this one this year is one of the best, if not the best Wayne Rooney card we have seen in FIFA, four star, four star, you got the upgraded skill moves, and a lot of people are doing this SBC. This is again just one of those cards that's coming out that people are having to go and get, and they're having to pay a premium for it because right now SBC fodder is inflated like crazy, 421,000 coins for this Rooney SBC, 13,000 upvotes. The card can literally play anywhere. He is really, really good in game from what I'm hearing and that four star, four star makes him a force to be reckoned with. So of course, just kinda like it was when we had the Dutch links with the Robin SBC that were very hyped up, we are seeing that the English links now are getting very hyped up, especially with some of those icons and some of those English out of pack special cards that went up today and possibly could be going up further after rewards on Thursday. Now of course, again, we just did look into the game as well and we saw that a future stars loading screen was released. Future stars is confirmed now for Friday. They're letting us know early and I don't know if you guys remember this, but FIFA 19, when they put out future stars, they promote it like crazy. They had loading screens really early. They give us little bits of information for this brand new promo on FIFA 19 and since they've already given us a loading screen on Tuesday, I feel like it's gonna be one of those weeks where they do a loading screen update every single day, especially today on Wednesday and tomorrow on Thursday where they might show the car design and then they also might start showing like some nations, some numbers, some teasers, I guess you could say in that loading screen. So that's more than out. I would expect that today and tomorrow on Thursday, but again, new team of the week today. I wanna talk about that and then what kind of stuff we could see happen on the market with stuff happening in FIFA with rewards, people maybe saving their packs now. Of course that we have future stars, but this is the foot bin team of the week prediction, Salah, Malikovic Savage going to a 90 would be a crazy looking card. That headliner, SBC, Lukaku, Callum Wilson looks like a pretty decent card. Delaney would be club 80 as a CDM. That'd be a pretty cracked out card as well. Cancelo possibly getting another in form. I feel like he's in team of the week predictions almost every single week. Sushek possibly getting another in form. Dava Duiz, Bamford is in here, Todich is in here. So, you know, kind of okay looking team of the week according to foot bin. If that is something that comes out today, the only card that I can see making waves on the market from this set is really Cancelo, right? If he got a right back in form, Cancelo of course links to so many people in this game with the Ronaldo right wing, with the Bruno Fernandez, with the Joao Felix. Portuguese nationality is so OP this year from what it has been in prior years. That would be an interesting card to watch. I think that would make the road to the final move and then it would make his right mid-inform move a little bit on the market as well but not a crazy team of the week. So, if we're looking at stuff that could be moving this week after rewards, let's just talk about rewards for a little bit as well. If you think of it this way, you know, I think less people played a weekend league this past weekend, especially in the part of the people in the game feel like they took the week off because they were not playing footchamps on the weekend. They were trying to open packs, trying to get a team of the year. So, a lot of people might not have footchamps rewards this week, like me, right? I did not play footchamps. People probably even haven't played division rivals. They might be playing some rivals this week to try to get that rank one, try to get those rewards, especially since people don't have anything in their clubs. That's probably something that people are doing this week to get those pack rewards. But honestly, if you know that future stars is coming on Friday, you're probably gonna be holding your packs for that promo that's coming on Friday as well. So, that puts us kind of in a dilemma for this week with rewards flipping and is it going to be possible? Now, the one thing I really do like, I really do think about is, again, this Rooney SBC because that narrows the market down in a sense where we feel like, obviously some of these icons have shot up in price, but some of them have kind of come back down a little bit from where they were as well. And some of the out of pack special cards have gone up and now they come back down and now some of them are back up again. This Ashley Cole baby icon card went from 400,000 coins up to about 600, didn't really sell much there, got listed all the way back down to 440 and is now back up to 500K. You have guys like Mid Gerrard who were somewhere around like the 700K range for this card and now he's above 800,000 coins. But again, just like we saw with the Robin and the Dutch icons earlier this year, some of the icons just went higher after this. Now, that's one area I would wanna look this week for Thursday flipping investments. Whatever comes out today on Wednesday in FIFA Ultimate Team, I would definitely keep an eye on some of this stuff. Even some of the other English special cards, right? Mr. Sancho 325 for this car right now. He was like 280, I believe, and now he's up to 330. He was initially went to 350 and then was sold back down to the 310,000 coin range. So if any of these cards drop today, now Sancho's an interesting one because if Delaney gets it informed today as well, that might make this card go up even further. And again, this card is very rare to begin with. So as you're looking at some of the English cards, I think that's the number one place that I'm gonna be interested in this week is the English out of pack special cards that will link to Rooney that people will be using to link him in their teams. Now, of course, a lot of people might be using the Sinclair objective card to link Wayne Rooney who was in the objectives. If he's actually pretty easy to get in the EFL championship squad foundations, all you have to do is play 15 matches in the managerial masterpiece with seven EFL championship players in your starting squad and boom, you get Sinclair, 82 rated left mid. People were comparing him to Kent from last year. He just kind of looks like an English left mid of Kent's stature. So that is one card that people might be using to link Rooney. But I feel like a lot of your English links are gonna be the way to look this week and might be somewhere where you might be able to make some profit, right? You might be able to make some profit off of those English links that drop back down, especially in the icon range and on some of those other out of pack special cards that are pretty meta. Now, the other places that I would look this week for flips would be, again, we know we have this Wayne Rooney SBC, but we also have this very popular Ronaldo that was out earlier this past week and now the like ratio is really close right here, which is kind of funny to watch. It's really funny to watch those, but I would still check in and keep an eye on some of your Serie A and Bundesliga special cards that went up a lot that were sold off a bit when Rooney came out, right? I use Fries Chiellini. I don't see him on the popular page here, but I use Fries Chiellini as an example all the time, right? This Chiellini card obviously gets the green link to Ronaldo, the Fries card. This guy was 350,000 coins at his peak, 360K when Ronaldo's SBC was very high. This guy was down to 320 today and has rebounded back to almost 350, right? If you see any little bit of panic selling on cards like this, a Serie A meta specials quadrado would be another one that I would keep my eye on. I believe I saw quadrado on foot bin just a bit ago. His inform was actually down from like 220,000 coins. He was down about 10K. Maybe that was just a foot bin undercut, but usually this card's chilling around 220, and if you see some of these guys, those links to Ronaldo, the Serie A stuff, DiBala links as well, if you see some of them dropping, that might be a very interesting scenario where you might be able to find some cards to possibly flip. So I kind of like looking into these. I have one of the Alejandro Gomez cards. He, I bought him at 207, I believe, and it looks like right now he's 215-217 with DiBala's SBC going out of the game, I believe really soon, if it's not out already, this is one of those cards that I like because he links to DiBala and he was just, he was 240K last weekend with the Serie A hype. So I like that as well. As well as some of the team of the years, honestly, especially this main man, Mr. Neuer, because a lot of people still have that Jerome Boateng SBC and their team. Now I'm trying to flip a Neuer right now. I got him for 519 earlier today. He really hasn't gone up that much. So I'm kind of watching this situation as well as the Inform because the Inform Neuer is a pretty interesting card to watch as well. People don't want to end up paying 500K for a goalkeeper, but they're fine paying 200K. So this guy was down to like 190 earlier today. He's back up a little bit. So this is what I would kind of do. I would look around on the market for those Bundesliga links or Kimmich, right? Bundesliga and Serie A links that were up that have now come down that are some of the most hyped up ones. Like this Kimmich team of the tournament card. He was like 280 this morning and right now he's 268. If I saw this card or if I could snag one of these on bid for the low 260s in the 250 reigns of the PS4, that would be a card I'd be very interested in for a Thursday flip. And again, the other thing to just keep in mind is this market is very rich right now. And my only cause, my only throwing caution in the wind would be, I feel like so many people have already purchased cards for their teams. That makes me wonder how much arrives are we really going to see after rewards? Because what is gonna be the incentive for people to be buying teams at that point rather than just waiting on the Friday promo and stuff like that? Now I think there's gonna be a lot of moves around the Friday promo with Future Stars because that's gonna bring some new cards on the market and it's gonna be very interesting to watch. But before we get to Friday, I'm just curious to see since it feels like people have already bought a lot of cards to their teams. Lozano is 219, that is down, he was 230 today. It looks like it's to be kind of an undercut there too. So, you know, this is the kind of stuff that I would look at. I wouldn't expect a huge market rise on Thursday after rewards, I really wouldn't. I think it's kind of foolish to expect something massive just because it feels like a lot of people have bought those teams. They might be readjusting for the Rooney. They might be readjusting with some English links throwing into their team, adding some of those cards. And I would still take a look at meta out-of-pack special cards like your Zaha 2nd Inform, your Sun Inform, Pogba's 1st Inform. The stuff that moves around every single week, I would still keep an eye on that, right? Donoruma 135, he goes from like 120 to 130 every single day almost. Keep an eye on cards like this to just your normal rare meta out-of-pack special cards. Road to the finals would be cards you wanna keep an eye on as well. This Kulabali was like 630 today on stream. He's now bounced back. Bebu 175, what's up with that? Yeah, that's a 10K undercut right there. I mean, this guy's been 190. You guys know, Road to the Finals have been flying sky high because people are investing in them and they're waiting for them to get upgraded as champions in games are literally two weeks away. And that's why you're seeing these guys' prices go super-duper high. But if you see panic selling on those as well, some people are gonna use those in their week in league teams. Like today, if Salah gets an Inform, watch out for this 92 Salah right wing live card. Might take a bit of a drop. Might be a place where you might be able to get a deal on that card and make some flip profit. Abominan was over a mill today. He's 940 right now, interesting. Very interesting. And then of course, take a look at your regular rare rule breaker cards. Quadrado I think was like 340 and now he's 320. So, you know, it's gonna be, you're gonna have to really pick and choose your spots for Thursday investments this week. And if all else fails, just remember that a lot of people have coins right now. They're willing to spend them. And these English links are gonna be probably reigning supreme. Now this baby Ferdinand was 132. And this middle reel was low 900s. And it looks like this reel now is near the higher 900s, which is crazy. Base Beckham 1.08. This guy is sitting at 1.2 on the market, which is crazy. Super-duper rare. Base Beckham, the only one that's not at right mid until maybe we see what the prime moments looks like. But a lot of these icons are gonna be very high. So if you find a spot where you think one of these icons could rise more, do your research, right? Look at some of the English icons, see how much they've risen up, if they're meta, if they're usable, and you'll be able to maybe make some flips on cards like that. I've been watching rule breakers, Harry Kane, because again, this is a card that's very rare too. English links, you know, you might find a deal at a 1.15. You'll be able to sell maybe close to 1.3. But, you know, that's kind of the stuff we're thinking for Thursday flips this week. I'm not super-duper confident about it, because again, I feel like so many people have bought, the market is so high. The one thing that I would look into is, even though there might not be a lot of people who open their packs on Thursday at rewards, I would keep an eye on SBC fodder, because yes, it's very inflated right now, but people might be waiting for their division rivals' rewards to get some untradables to finish an SBC, kind of like me. They're trying to finish this 88 Bruno Fernandez so that I can use him in the weekend league and have him in my team, right? So, I mean, or they're trying to finish Rooney or the mid-icon upgrade, which goes away, I think, on Friday as well. Three days remaining on this mid-icon upgrade. So, I feel like a lot of people post weekend league rewards timeframe if there are people that open their packs might drop the market a little bit in the fodder range.  That might be another potential where you're able to trade. One thing I might do this week is actually trade with the current team of the week. Whatever comes out today, I might be watching it during rewards. Usually that first to second hour or third hour of rewards, all the informs dip, then they bounce back because, of course, they get supplied with the team of the week packs, which, you know, people open those right away anyway because they can't save those and change what's in them, or I guess they can, but if it's a decent team of the week, most people just open them right away anyway. So, that's kind of what I would do for the market this week. Thursday flipping, I don't feel super duper confident about it, especially now that we have a loading screen for future stars, and there's a lot of expectation and a lot of, I guess, hype that I think we'll build for that, because future stars is a huge problem. You're already gonna start seeing people make concept squads on Twitter and cards, and a lot of hype is gonna get built into that. Even EA, and this actually, I gotta show you this, I gotta show you guys this because this was one of the weirdest things I've ever seen EA tweet today. They tweeted this out. Foot future stars are almost here. We're sending a foot future star talent scout out to help us identify the player for one of our future star SBCs to get started which player nationality should our scout focus their search on. And right now it's 40% England winning the vote. I voted for France, and of course you could sell here. I had my nice rhetorical comment asking if they could scout and try to find where their team of the year promo was because team of the year this year was just kind of an L, but yeah, this is interesting. And there's a lot of funny comments down here because I think right now there's some travel ban like requirements alongside of like England. And if someone were to come in the country they have to be like quarantined for 48 hours. And so we were kind of laughing on stream today about you better send that scout out pretty fast or he's not gonna be able to find anything before Friday. So that was good laughs on the stream today as well. If you are interested in the Twitch live stream check that link down below in the description. But that's the video for today boys. Kind of just like we're in this period where the market seems very high. A lot of people have bought and invested. We had this new SBC that has come out and we're all just kind of waiting for Fridays almost what it feels like. I'm not expecting big content today or tomorrow but we'll see what EA has up their sleeve if that is anything. But if you enjoyed this video make sure to smash a thumbs up on it. If you have questions, please drop them down below and of course subscribe if you're new. It's been Nathan Foot Accountant and I will catch you guys later. Peace out.


So Sam, that was the first time seasoning meat like that. Why don't you tell everybody where we're at? We're at Dogfish and Booleans and Eats, our original home of our brand, where we've been since 1995. Let's get it in the oven. Oh my gosh, you got it? Sort of. Next stop, Ovenville. There we go. 200 degrees, 12 hours. That smells so good. Whoa, my goodness. Sam, where'd you get this meat? This is from our buddies at Rosetta Farms in Maryland. It's called the Steamship Round. That's the cut. Look at that. You ready? I'm ready, everybody, if you are. That's scrumptious. That was a big day. It's been a blast. It's been a big day. It's been fun. You guys, we hope you enjoyed the video. Leave a like. Leave a comment. Hit that follow button. We'll see you next time. Keep sprinkling, my friends.


In September 2018, Typhoon Jebi smashed into the Japanese coast with gusts of nearly 200 kilometers an hour, flinging fuel tankers into bridges, inundating airports, and inflicting $12.6 billion of damage. Officials at the Taiwanese consulate in Osaka in the heart of the typhoon valiantly fought through the storm to evacuate stranded citizens. A few days later, a story claiming the Chinese embassy had dispatched buses to rescue Taiwanese went viral. A flood of criticism, much of it deeply personal, poured on Taiwan's representative in Osaka. Ten days after the typhoon, the representative had hanged himself. But there never were any buses from the Chinese embassy. The story, originating among probe-aging trolls in Taiwan and given life by the Communist Party-owned tabloid Global Times, was wholly invented. The story was one of hundreds of examples of disinformation targeted at the Taiwanese government in the past two years. In the lead-up to the 2020 presidential elections, Beijing would deploy a campaign to control Taiwanese narratives whether through outright deception like the Osaka consulate case, misrepresentation like in reporting on Hong Kong protests, or simply highlighting achievements of the Communist Party and stoking Pan-Chinese nationalism. Chinese influence in the Taiwanese elections serves as a case study in how authoritarians make use of digital media to accomplish their geopolitical goals. Over the next 30 minutes, we're going to go in-depth with the Taiwanese elections and the recent Polish elections as well to understand what this new version of information warfare looks like, how it succeeds, how it fails, and why. Taiwan, officially the Republic of China, has a history and present intricately entwined with that of China, officially the People's Republic of China, since both governments in Beijing and Taipei claim to represent all of China. Beijing caused Taiwan a province, and Taipei refers to the territory it administers as free area of China, free area of the Republic of China in contrast to the mainland. China is largely large in each of Taiwan's election, and much of each campaign focuses on competing views of one day uniting with China or forging an independent Taiwanese culture and one day an independent state. Having a vision of pan-Chinese unity is the Chinese Nationalist Party, or KMT, from its Chinese initials. They ran Taiwan as a dictatorship for nearly half a century before transitioning to democracy in the 90s. In 2000, they lost an election to the more independence-minded Democratic Progressive Party, or DPP. The KMT, or Chinese Nationalists to this day, maintains close relations with Beijing and pushes an agenda of greater cooperation and economic ties with the mainland. The DPP, or more independence-leaning party, has a base that comes from the non-mandering speaking majority of Taiwan and favors the cultivation of a unique Taiwanese identity and is the only party besides the KMT to have held the presidency. In 2016, Tsai Ing-wen, who helped to draft DPP's foreign policy, which emphasized separation from China, defeated the KMT in the presidential elections by 25 points. In response, China suspended official communication with Taiwan and began an economic pressure campaign. Following guidance from Beijing's National Tourism Administration, Chinese tours to Taiwan dropped by 40%, ravaging an industry that's responsible for 8% of Taiwan's economy. China also released a slew of incentives to peel away Taiwan's best and brightest. Size popularity began to sank, aided by resurgent Chinese information operations. China was pretty late to the game for information operations, especially when compared to Russia, but by 2018, they had established a massive online empire. According to the CCP's Propaganda Department, quote, information is a battleground, and quote, competition for news and public opinion is a contest over discourse power. CCP outlets witnessed an astronomical rise in popularity, especially on Facebook, which is banned in China, and now Chinese-owned outlets account for seven of the nine most followed news pages anywhere in the world. Chinese state TV took to YouTube as well and has since amassed billions of views becoming the leading source of news in Mandarin anywhere. Traditional media came under the Party's thumb as well. The Chinese Communist Party bought a $37 million stake in Wanwan, a food conglomerate which, over the next decade, added to its portfolio to leading Taiwanese television channels, CCTV and CCITV, which soon became vehemently pro-KMT. The frequency of articles after this takeover, criticizing Beijing, dropped by 70%, and the Financial Times uncovered in a report that the Taiwan Affairs Office and arm of Beijing's government had to say in every single headline and report. Throughout 2018, much of what Beijing was demanding attention on was the astronomical rise of Han Ku Yu. A longtime member of parliament, Han took on the unlikely task of unseating the dominant DPP from Kaohsiung, Taiwan's second city and a base of DPP support. With a populist campaign promising economic rejuvenation and with extensive use of social media, Han's popularity soared. Unlike other populist social media politicians, Han was unwaveringly cordial, refusing to speak negatively of rivals or even their platforms. A Facebook pam page of Hans soon became one of Taiwan's largest and coordinated rallies with hundreds of thousands of followers. Taiwanese media from all parties spoke of a quote, Han wave. CCTV and CCITV, the two television channels that take orders from Beijing, gushed over Han and the KMT. According to a Taiwanese security official, China mobilized 300,000 cyberoperatives, twice the size of Taiwan's army, to sway opinion in Taiwanese social media. Using tactics from Russia's troll farms, the operatives blasted Tsai. Disinformation abounded like a rumor the president intended to sell part of Taiwan to the United States. A 2018 survey by the VDEM Institute at the University of Goetheberg in Sweden found that only Latvia and the United States were targeted for more disinformation in 2018 than Taiwan. The KMT swept local elections. Not only did Han win the mayoralty in Kaohsiung, but the KMT, having lost the national election by 25 points just two years earlier, won local elections nationally by 9%. Size quote, separatist stance has lost her the support of the people on the island, Crow China Daily, the CCPO newspaper. As the role of China in the 2018 elections became clear, DPP supporters grew enraged. In 2019, tens of thousands rallied in Taipei against Chinese controlled media. The proximate cause was the start of protests in Hong Kong against the Chinese extradition bill, inspired by events in Taiwan. As well as the 30th anniversary of the Tiananmen Square Massacre, both of which were downplayed by KMT-allied media. Taiwan began to lean heavily on the platforms that had long been engines of Chinese disinformation, forging partnerships with Twitter and Facebook. DPP against accusations that the KMT was using it to muzzle dissent past legislation aimed at discouraging meddling from China. In the week leading up to the presidential election on January 11th, 2020, according to our research, CCPO and media planted 178 stories about Han and the KMT in traditional Chinese, the script used in Hong Kong and Taiwan, but not on the mainland. In addition to 25 videos in Mandarin, the overall sentiment of this content when referring to Han was plus 0.6 on a scale where negative 1 is most negative and plus 1 is most positive and 80% of scores are between 0.1 and negative 0.1. Those commenting or replying on videos responded in exceptionally positive manner as well with those writing in traditional Chinese suggesting they're either Hong Kongers or Taiwanese expressing a sentiment towards Han of plus 0.42. By contrast, China's 142 stories on Tsai in traditional Chinese and 21 Mandarin videos expressed an average sentiment of negative 0.32, with traditional Chinese commenters responding with an average sentiment of negative 0.2. With these story counts as well as engagement counts were fairly low by Chinese state media standards. The Taiwanese election occurred the week after COVID-19 was first described, which quickly dominated the focus of CCP outlets. With two leading nominally private Taiwanese broadcasters taking orders from Beijing as well, local proxies could fill in the role that otherwise would have been played by the CCP. For covert operations however proliferated, Twitter later detected 170,000 bots spreading Chinese influence. The intelligence service, the NSV, found that the Facebook page that helped to coordinate Han's early election was created by the Communist Party and working with Facebook, they removed that page along with 260 others created by the Communist Party but masquerading as local Taiwanese. Of half a dozen viral disinformation claims that we tracked linked to these pages, none wound up receiving more than 7,000 shares. On January 11, 2020, voters in Taiwan overwhelmingly opted for Tsai, who received 57% of the vote to Han's 39%. In the end, Taiwan successfully fought back against interference from a larger and more powerful adversary with little outside influence on the election detected. But in doing so, they gave sweeping power to the state to find the limits of reasonable dissent, possibly silencing good faith debates on the extent of cooperation with China, one of the most important issues in every Taiwanese election. China despite its massive advantage in terms of manpower and funding launched a sloppy and ineffectual campaign online, distracted by the looming threat of COVID, unable to create viral content and unable to stay ahead of Twitter's bot detection system. Taiwan's victory over disinformation, though, could very well be a losery. With Han already trailing by 20 points 100 days before the election and anti-Chinese sentiment running high following the Hong Kong protests, China's digital army may have simply counted its losses and refocused on higher priorities. Four months later, and halfway around the world, in the brick medieval town of Krakow, the archbishop whose predecessors include John Paul II, delivered a homily marking the 75th anniversary of the Warsaw uprising. Quote, we also know that our land is thankfully not affected by the red plague, he intoned, referring to communist rule. But that does not mean there is no one that wants to control our souls, our hearts and our minds. This new plague is not Marxist Bolshevik, but born out of the same sphere of neo-Marxism. Not red, but rainbow. Both the content of the archbishop's homily, the supposed threat of social liberalism, and the symbolism commemorating Poland's fight against fascism, foreshadowed the political axes in the country's 2020 election, one that inflamed internal intentions to a level not seen since the fall of communism. With both sides staking out staunchly anti-Russian positions, Moscow launched a massive campaign to engender outrage from each side against each other. In thousands of stories, Russian media warned polls of the coming end of traditional values or the rise of fascism. The election proved a case study in information operations towards destructive as opposed to constructive ends, not supporting a party, but stirring unrest throughout the country. The response of the ruling that law and justice party PIS, dousing dissent and muscling independent media, reveals how combating disinformation, like combating terrorism a decade before, can be a pretext to support authoritarian goals. PIS began in 2001 as a standard center-right party allied with Christian Democrats in the EU and won the presidency for the first time in 2005. But disaster struck in 2010 when much of PIS leadership died in a plane crash on its way to a memorial service in Smolensk, Russia, and the party's surviving leaders afterwards adopted an increasingly conspiratorial and nationalistic tone. Though vehemently anti-Russian, PIS's strident defense of traditionalism fit perfectly with Moscow's new self-betrayal as a bulwark against the EU and its, quote, homosexual propaganda. With Russian outlets dominating YouTube and Russian bots dominating Twitter and Facebook, similar far-right populist movements gained traction throughout Europe. In this wave, PIS leader Andrzej Duda captured the presidency in 2015, beating the center-left civic platform, or PO, coalition. Duda's first term in office was marked by a series of moves to bring independent institutions under the rule of PIS. The newly PIS-dominated legislature refused to seat duly appointed judges from the previous administration, instead filling the highest courts with partisan loyalists. Duda's long threats of foreign influence due to ousted the head of the state broadcaster Tel Aviv Zyopolska and editors of public media organizations, such as Gaziette Vaborstia and Politikia, in favor of PIS loyalists. A bipartisan report showing that this Smolensk disaster was a result of pilot error was discarded and conspiracies about foreign agents' involvement became state canon. As Duda and PIS increasingly sought to merge party and state, the center-left PO began to portray the PIS as threatening to establish an authoritarian regime. PIS's ultranationalistic language lent itself to charges of fascism, as did new laws curbing free speech, such as one criminalizing any implication of Polish involvement in the Holocaust. Following the ousted of a pro-Russian president in Ukraine in 2014, Russia began a massive multi-year, multi-language campaign to portray the NATO-friendly nationalists in the Old Eastern Bloc as fascists and heirs to those who fought alongside Nazis against the Soviet Union. Nearly 60% of all instances of disinformation from Russia in Polish portrayed Duda's PIS party as fascist or fascist sympathizers. In February 2019, PO's rising star Warsaw Mayor Rafał Czyskowski signed a bill that would include same-sex education in school curriculums. With a dominant grasp on state media, PIS whipped up homophobic hysteria. The next month, a small town in the country's conservative southeast declared itself a quote LGBT ideology free zone. By August, 30 towns and four of Poland's 16 provinces declared the same. The backdrop made the 2019 parliamentary election among the most divisive in Polish history. With both the PO and PIS taking strident anti-Russian stances, Moscow turned towards inflaming sentiment on both sides. Sputnik Poland published 399 pieces supportive of the LGBT free zones and 265 pieces accusing the government of cozying up with bashes. Journalist Marcin Ray uncovered dozens of links between the Kremlin and nationalists on the rightmost edges of PIS's coalition. While a report from the Oxford Institute on computational propaganda confirmed that bots were acting to further polarize the electorate. But with near total control over state media, PIS was able to expand its popular vote majority in the parliamentary elections. With the success of the 2019 rainbow plague campaign, PIS doubled down in the 2020 presidential elections, which pitted Duda against Warsaw mayor and PO candidate Czeskowski. Czeskowski sought to make the election a choice between democracy and authoritarianism. Duda aimed to cast the vote as one between foreign-imported gay rights and Polish tradition. The election was characterized by widespread disinformation, the most prominent case coming when Russia hacked the Polish War Studies Academy website on April 23rd, allowing the hackers to publish forged letters by a Polish general calling for soldiers to fight, quote, the American occupation. Over 57 public Facebook groups reposted links to the letters and average Facebook users followed suit in proliferating false stories. Like Russia's IO campaigns overall in Poland, the purpose was not to support anyone candidate, but to create a sense of chaos and imminent violence. Other post-paradid Polish political leaflets, warning of scandals and poverty if Czeskowski was elected over Duda, other content claimed LGBT activists had Polish flags on fire associating the anarchic behavior with Czeskowski. On the other side, post-mentioning Duda characterized the current European environment under his leadership as a chaotic storm. Duda was also accused of brutalizing public life of Poles, a dry run for a fascist takeover. In the two weeks leading up to the second round of the presidential election, Polish language media from Russian outlets saw a large spike in incendiary terms. References to fascism, excluding references to Russia's Victory Day parade, which was held during this period, saw a 20% spike with an average sentiment of negative 0.76 and audiences responded similarly negative with point negative 0.52. References to LGBT and related key terms increased by 11% in the same period with an average sentiment expressed of negative 0.22 and audience response of negative 0.17. Russian outlets portrayed both candidates Duda, negative 0.17, Czeskowski, negative 0.15, and both coalitions, PIS, negative 0.26, PO, negative 0.21 in negative terms. On July 12, 2020, voters in Poland re-elected Andrzej Duda for a second presidential term with 51% of the vote to Rafael Czeskowski's 49%. Matsia Czeslowski, a professor at the Central European University, called the election quote, a death blow to Poland's liberal democracy. With anti-Russian sentiment high throughout Poland, especially as Moscow began a campaign to blame the Second World War and probably on Poland, Russia instead turned to destructive information operations, amplifying the vice of voices, sowing distrust among the population and undermining institutions. The Russia plays large in Duda's conspiracies. Duda was happy to oblige, parroting Russian talking points and tactics on the EU and gay rights. Even among anti-Russian audiences, Russian I.O. was able to further Russian narratives. Despite Duda's own dalliances with this information, he was able to deploy fear of disinformation to win closer NATO support and to silence dissent at home, much as autocrats had done with the fight against terrorism throughout the early 2000s. We approached the 2020 U.S. presidential election. Russia and China command dominant positions on social media. The top YouTube publisher is the Kremlin, which owns the platform's most watched news network even in English, and seven of the nine most followed news pages on Facebook, all of them in English, belong to the Communist Party of China. In Taiwan, we saw how the Communist Party wove itself into the workings of an opposition party, but facing massive public backlash and the growing unpopularity of the opposition retreated as the presidential election approached. Efforts to stem disinformation notched up significant victories through partnerships with social media companies, but legislation failed to win bipartisan support and thus shake off the appearance of censorship. In Poland, we saw how Russia adapted to an environment without support on either side by amplifying dissent. Fellow travelers against gay rights and for wild conspiracies helped to ensure civil strife, anti-EU sentiment, and strain all Western European alliances in Russia's near abroad. Successful information warfare is adaptable and with so much social media power and advanced targeting techniques, anti-democratic forces can easily toggle between constructive campaigns to support a party and destructive campaigns to sow chaos, only through coordination between apolitical institutions and the social media platforms. We find true progress against information warfare while maintaining our democratic values.


Hey everybody, I'm Wes Todd. I'm a senior software engineer at Netflix working on the Node.js platform team Hi everyone, my name is Darcy Clark. I'm the senior engineering manager on the MPM Cli team here at GitHub And we're here today to talk about the first-ever open JS collaboration space Which we will be focusing on the package vulnerability management and reporting Take it away Darcy Yeah, so we were hoping to kick off things off by talking a little bit about the state of the ecosystem and why this all sort of came out of And sort of spun out of the package maintenance working group actually So there's been some recent data come out about sort of the state of the ecosystem in 2020 What we continue to see in the JavaScript ecosystem is exponential growth There's one point over 1.6 million packages on the MPM public registry, which is incredible Our community continues to publish new and exciting packages and we see over a hundred and twenty-three billion downloads a month on the public registry, which is just amazing recently It was MPMs 11th birthday back in October and we hit the hundred billion milestone for package downloads monthly package downloads So there's a lot a lot of downloads a lot of folks using JavaScript in the wild And we see that also with the data that we get from GitHub That JavaScript is still the number one language on the platform today and coming up Real quick is also TypeScript. TypeScript has recently jumped a few spots in terms of a top language that we are seeing in the repositories that live on GitHub and this just tells you how important our Ecosystem is and these languages are to programmers As a part of this data and part of this Sort of discovery work we notice that there's over 94% of the pause stories that are you know utilizing JavaScript they rely on open source and our job as a very Healthy community we tend to want to consume lots and lots of JavaScript as well and we see that packages and projects In within our ecosystem specifically within JavaScript we have roughly 683 transitive dependencies PHP comes in around 70 and Ruby comes in around 68 transitive dependencies The depth of our dependency trees and the scale of this issue definitely put JavaScript in a unique place But I think Julia said it best Vulnerabilities in software they occur like regardless of language and framework and ecosystem Getting them fixed is really where I focus on From like the security side. So getting things fixed kind of in any ecosystem is really difficult I think they call it dependency hell everywhere for a reason Knowing that these problems exist and are difficult to solve in all language ecosystems We think that the JavaScript ecosystem presents a really unique opportunity for us to set a precedent and to try out New ideas for how to make managing reporting and dealing with these security issues better across the board We'll hear more from Julia later So there's a huge surface area here in terms of projects You know potential for you know Vulnerabilities but also potential for for growth. This is you know, our strength here is also in how we use open source within our ecosystem So we also want to take some time to look at the state of the advisories that get flagged within our ecosystem as well and Utilize some not same data that we found within the October's report from 2020 First off, we just want to take note that it's since you know, October of 2015 the MPM advisory DB has filed all over 1600 Ivory the advisories which is pretty amazing in terms of, you know, the folks flagging issues that are coming up within the software that we're consuming And another really interesting fact is that 59% or there's a 50 my percent chance of You being flagged or they're a CVE being filed against while your dependencies Based on, you know, those numbers that we were seeing before with how many transitive dependencies we have It's pretty that's a pretty large number And and if you're working in JavaScript, you know that for JavaScript projects, that's really 100% of projects will be flagged in the next week That's definitely right. There's probably a lot of projects that get flagged a lot higher This is definitely a rounded average number for sure and Looking at also the breakdown of what is contained in those advisories We've seen that at least from, you know, GitHub side that there was only 70% of those that were sort of actively malicious that those CVs were, you know Potential worms or malware. Whereas there were the other 83% of those seem to be results of mistakes potential, you know errors and Vulnerabilities within our code that were being caught by researchers and and folks that were flagging these things to To maintainers and to the ecosystem So those are really interesting numbers and and really show you the scale and scope of the problems that were for challenge with today One of the best parts about working in such a large ecosystem is all the amazing people We thought that to kick off the collaboration space it would be great if we could hear from some of them and how CVE reporting and remediation affects their work Great, thanks Wes. So I'm Nick O'Leary. I'm the project lead co-creator of Node-RED one of the other projects of the OpenJS foundation which is a low-code programming tool written in Node.js and I think what's a bit different about some of Node-RED's interests is our users aren't necessarily node developers or JavaScript developers We use NPM and we use node to Ship Node-RED so users run NPM to install it But they aren't necessarily node developers themselves We often focus so much on the developers of libraries the developers of applications But I think we really miss out on the perspective of the end users who often are just seeing reports in their CLI And they don't really know, you know, what that means. Yeah Does that does that play a big role in in your users and the reports that you get? Absolutely You know, suddenly for users who aren't familiar with NPM, you know, we document the commands they should run We don't go overboard on all the flags You can give NPM to quieten down the warnings because you know, you don't want to suppress genuine warnings that users kind of should know about But there's always going to be stuff in there that We know don't doesn't matter But some users lots of users ignore it But some users do get concerned by having even Moderate severity audit warnings or whatever it might be and again The nature of node-RED is there's quite a large dependency chain of modules because it's a programming platform It can pull in all sorts of different modules depending what else you install into it to supplement it so You know the scope of what warnings you might get is pretty pretty large depending on the modules being being installed Now that we've heard from Nick about how these things affect end users and authors of open source libraries and platforms like node-RED Let's bring back Julia and hear a little bit about how larger companies deal with these kind of things and how engineers and security teams can better work together Sure, my name is Julia connect. I'm on the Netflix application security team I'm a security partner to some of our developer productivity teams at Netflix in my my pretty strong opinion is that Developers shouldn't have to be security experts and I think it's security experts jobs to help developers get their job done and to Help make you know kind of the right decision. We have this Concept at Netflix of freedom and responsibility and context not control and I really see that as The security person like our job We're employed to be these these security experts and to really help people understand but not to like Go put a ton more context in your head and say also become a security expert and interpret this how I would interpret this, right? It's it's given all these inputs given my background given My security expertise This is what I think is you know kind of the most correct or the safest path forward And let's you know work together on ways to address any Productivity issues or can we can we join those things right like can we say productivity and security? Get to hold hands and cross a finish line together, right? One of the best ways to tie together Productivity and security concerns is through tooling. We've got a lot of great engineers in the tooling space in the JavaScript ecosystem One of those is Bishak or as he often introduces himself to us English speakers as Zeebe He has been instrumental in helping kick this group off and he also wrote a tool called npm audit resolver on the web, I'm known as an actor but my real name is Bishak if anyone wants to try to pronounce it and I've been I've been playing around with Node.js since version 0.8 and I've been Growing a team of Node.js developers for the last 70 years at Ignite meanwhile, I'm also doing some open source and Trying to work around Node.js diagnostics working group and some other places and a bit of security. So, yeah, so it all started when we had around 20 apps and No security was important but we discovered That we can monitor dependencies for security a Bit late in my opinion well npm audit didn't exist yet, but node security project was already there So I installed the nsp command and run nsp check and thought well This is awesome It checks my dependencies and says I'm okay because that's mostly what it did at the time There were not a lot of vulnerabilities reported yet. So I Obviously took it and put it as a step in our CI so that the CI would get read when we get a vulnerability and then Adam Baldwin started working on finding more and more vulnerabilities So one day like two or three weeks after I put it in CI Everything literally everything that read because there were like 10 or 20 different dependencies That got us The bad status. So first thing we did it was spotting that most of those are dev dependencies and most of Vulnerabilities are regular expression denial of service So, yeah, the one that everyone loves So NSP check at the time would only allow Ignoring by The vulnerability advisory number. So we ignored regular expression denial of service and Fixed everything else and moved on but that didn't last long because then he started finding and I literally mean Adam Baldwin He did find most of these Early on so we had to switch off the CI step and then npm audit came out so we switched to npm audit, but it was still too much and That was the decision So I have to choose between not running this as a CI step Which I still consider a good thing to run it in CI to build the The culture of caring for security on any team and so the other choice was to make it Reasonable to run npm audit as a CI step and that's where npm audit resolver came in One thing you said which I think is really interesting is building a culture of caring I was wondering if you could talk a little bit more about how you can do that on a team for a team of software developers security is Going to be like initially is going to be the thing that gets in the way Unless you build the right mindset so my goal as a leader of a team in terms of security is Not to make sure that everything we build is perfectly secure Instead is making people care about security and not consider it an annoyance. So I want to Everyone to fill the mission to Build something secure I want people to think about it every now and then And if you get a tool that tells you now this is insecure every single time you commit something That's not gonna build this culture because people are gonna treat it as an annoyance. So you need a tool That lets you make decisions Hopefully informed decisions on what to ignore because only when you can ignore Some vulnerabilities you're gonna be able to really care about the ones that are important Where can we take decisions? Maybe away or abstract them away, but put in the safety faults, right? I think I think safety faults with the option to undo with the understanding that like that's an action that developers Taking so that they have to you know kind of understand what they're undoing rather than Going in with the expectation that something secure because why would they give me something insecure to start with? And I have to go like do all of the work to pop security onto it Yeah, I really like the idea of like Security people and productivity folks like working together towards a common goal and saying like how can we make the? Right choice the securist choice also the easiest choice and also like the most correct choice Making informed decisions is super important at Netflix We call it context not control the reason we say that is because we want to give our Engineers and our teammates as much context as we can so that they can make the right decisions when it's necessary Often times the information that is gathered on one end of the life cycle is not Propagated all the way through to the other end. I think in the case of CVE remediation. This is especially true To help understand this better. I asked each of our interviewees a little bit about how they think we can improve this situation I Suddenly see I think it's two-fold one is certainly on the tooling side So I think Having some way for our module. I mean don't get wrong. It is good that That security vulnerabilities get floated up and we get notified You are depending on something that has a vulnerability that that is good and that is important to the ecosystem The bit that I feel is missing is a way for us to then say You know in a in some metadata somewhere in the module saying You know this This vulnerability we have evaluated and Please you know suppress this from when you install when a end user installs us because You know, we have done the technical work to validate that that vulnerability does not apply to us and You know, please don't bother our users with that now I'm also well aware. There's a lot of good will in a mechanism like that and It would be right for abuse for people to Not do the technical work to do that validation and just you know do whatever it takes to shut the warnings up, but You know, I think there's going to be a trade-off between the user developer experience for End users of modules and maintainers of modules and I do think there's got to be a better balance to what we have today The security game when you're not attacking when you're defending is about prioritizing So we always need to be able to say, okay, this is the last day of the sprint And I need my build green Even if it means there's gonna be some vulnerable dependencies that I didn't have time to review what now So I literally build a feature for that which Let's you quickly ignore a Failed dependency scan for 24 hours. This is enough for the sprint review And then your build is read on the next day again You're you're back to fixing it, but you didn't have to break everything. You didn't have to fail a sprint Because there's a tool so it's no longer an annoyance. It's something that helps you and it builds the culture in the team to well, try to stay on the ball with Making your dependencies secure and I think just to just to like dig into that a little bit more. I do think that That there's been a historical disconnect I've seen it getting better in the industry where like security people would just come in and say just update no matter what which is probably why npm audit says just update and Right like it's kind of like this this mandate rather than in nuance like Update if you use this library in this way, right? Like it's vulnerable for these reasons But when I've actually talked to developers like everyone wants to like understand what's going on I just think it's also like it kind of is competing for resources, right? So if it's like tell me tell me the right path to get rid of this thing to answer your actual question that you asked I do see that there's opportunities to kind of pass through that guidance and I like I wonder also if that's a just a way of Standardizing how that stuff kind of comes in doing these interviews was a great way to validate that there's room for improvement in CVE reporting and remediation But at this point, I am sure you're asking yourself. Well, what is a collaboration space? Why not talk about these things in some existing groups like the package maintenance working group or with folks directly at npm Or sneak or one of the other parties involved since this is the very first one I you know, we want to make sure that people understand what what we're doing here so the collab space is a New program set up by the open jest foundation It gives us a neutral ground to bring together parties from from different parts of this ecosystem different parts of the CVE's Lifecycle and and gives us a nice space with support from the foundation To to discuss these ideas and come out of it with You know solutions So so our goal in this group is to bring together folks from different parts of the CVE Lifecycle and and hear from them and really understand the problem space Because we don't think we have all the solutions And we think that the best end solution is going to be one where we hear from all the voices across the SPLC And we bring together something that's really going to work for everyone involved And so, you know examples of some successful outcomes that we see from the collaboration space It would be like even just defining better domains of control over the different parts of the STLC Something like improving communication lines between main or maintainers of open source libraries and users and then also the other direction maintainers open source libraries and The folks the security folks who file CVE's And then there's the obvious Space where we sit in the middle, which is tooling We have a lot of tooling in the ecosystem, but you know the the context that the security folks have It's not always reaching that that folks who have the control in the end the application developers the open source library authors So, you know finding the ways that we can better tool around these so that the People who are most impacted by these security incidents have the context they need to be able to Remediate or ignore because we always know sometimes ignoring is the right answer when that particular CVE doesn't apply to your project So the next obvious question is how can you get involved with this.  We'll be scheduling them on the GitHub repo. Our hope is to start next week. So hopefully y'all can can hop over on to the GitHub repo and and and join us for the meeting and we'll discuss So thanks everybody and we hope to see you in the GitHub and the special thanks to our interviewees Julia, Nick and Zeeby We couldn't have done this without them and thank you so much for the Conference organizers and for Robin again for reaching out and making sure that we had this session This was great conference and we appreciated being a part of it. Thanks everybody for your time We hope that you're as excited about this collaboration space as we are and we hope to see you in our upcoming meetings We're gonna send you out with a couple more clips from them that we thought were really great You know, it's the open-source ecosystem. So everything you see in the open-source ecosystem is More free information So every time I get an audit to me, it's just free information These are things that I could have spent a lot of time figuring out for myself But I'm getting this for free and it's literally the same attitude When it's code and when it's information about the vulnerabilities. So that's my point of view So this is free information and I decide what to do with it. No, the side is not the right word I'm responsible for Figuring out what to do with it. So if I pull in some code from NPM, that's my responsibility now If I pull in information about vulnerabilities, it's also my responsibility. I can decide to ignore it I can decide to trust it. I can decide to postpone a release because This thing looks scary and I'm gonna look into it like do you feel like that response? Has built trust in those users like do they do they respond in a way that Seems like they still trust Either node red as a project or the node ecosystem more generally or do you feel like that erodes their their trust in the system? That's a good question. I don't think I necessarily get a good sense on that certainly when it is someone who is Is emailing us rather than asking, you know, when it's someone who's following our security policy to report this kind of security issue You kind of immediately understand that this is someone who is perhaps a bit more switched on to these problems so and in general, you know the response when we explain the situation the response we get back is Oh, no problem then, you know, you know, thanks for explaining it and You know, it's a There's there's an understanding and appreciation that the fact that we've taken the time to respond and that we are able to explain it but you know having some way that NPM audit could say, you know Yes, there's a vulnerability, but here's what the node red project says about it And put that up front would just again put that Put more confidence it would remove that period of doubt when someone has felt the need to report a security vulnerability To the time when they get a response from us, you know, if the tooling could at least give Give our assessment to that vulnerability up front, even if you rather than hide it, you know, just say You know, and here's what no dread says about this Which could be Thank you, we're aware fix coming in in a week's time in our next mentioned police or You know judged as not relevant to the node reduce case whatever it might be I think that would just remove that period of doubt between someone seeing a vulnerability and then Going through the process of getting a response from us. Yeah, that's great Do you feel like you your team and other engineers in your sphere are getting enough context around the vulnerabilities to Understand what they need and and do the right responsible actions Well, I want to say yes because theoretically There is a link to a write-up with a POC often, but Not really. So I've seen it way too many times that That conversation on the team We're we're building a feature. There's a there's a merge request It's getting reviewed meanwhile The build is read because of audits. So hey, what's happening? Oh, I gotta fix the audit. Okay Ten minutes later. What did you do? Oh? I I ignored a bunch of things And it took ten minutes, okay, I I think I I think I can trust most situations That these were really things that you just look at them and decide. Yeah, this doesn't affect us But at the same time It's a denial of service in the Mongo client Well, that's looks serious. Okay, let's let's have a larger Debate so we pull in more people and Try to figure out what to do with it Like frankly the way that we're doing it in Everywhere I've ever been has been like the only way that security feels like in scale is just say update Right, like we can't possibly triage all this stuff someone on your app set team can't write tests for everything Honestly, I think one of the most Underappreciated items in the npm audit Output is exploitability So I did take that into account a few times When deciding Okay, exploitability is very low. So this looks serious, but it's very unlikely to be exploited I can spare some time to research it now, but we can Move forward with the feature or exploitability is very high. Okay, let's stop the work and look into it So that seems to be Like a very valuable thing, but this is just a number and I don't know where it's coming from so I might just Be very naive about it okay, so So the particular scenario with no dread was the fact we use bcrypt that's to In two places one for the user to encrypt their password to put into their settings file and Then equally to decrypt when as part of the login to the tool to to compare well, not to decrypt to Encrypt the password that's been submitted to be able to do the comparison with what's in the settings file and For a variety of reasons we depend on both bcrypt and bcrypt.js. So bcrypt.js is a pure JavaScript version bcrypt is a binary module and the reason we do that is a bcrypt Historically hasn't always compiled cleanly on all the platforms that we need to run on and As a strategy to like on the low-powered Raspberry Pis where a lot of people run no dread They wouldn't necessarily have the right build tools so we actually have bcrypt as an optional dependency and bcrypt.js as a main dependency So that if for whatever reason bcrypt fails to install we can fall back to the JavaScript version that's slightly slower But as it's only when you log in we can afford for it to take slightly longer. So So we were actually in this position where we had bcrypt marked as an optional dependency and now That's another interesting factor because tools like npm outdated ignore optional dependencies So there there was a period of time when our checks, you know, are there updates available for modules? We just completely overlooked bcrypt for for a time because again the tooling just didn't pay attention to it because it was marked as optional which is a separate issue But then along came a an issue that someone pointed out that the bcrypt we had installed was had a CVE That the the encryption it did in certain scenarios was not strong enough. You know, it had had vulnerabilities in its encryption Now Because bcrypt is a bind well as from my understanding of it Because bcrypt has a binary component They have been quite they have a compatibility table of if you're using these versions of node this is the version of bcrypt and It's actually quite a You've got to try and get that right and thankfully that it's always the case their latest version supports Yeah, everything and higher. So it as long as long as you're on the latest version, you should be golden however Just through through the timing of this at the time the CV came in the fix Was on a version bcrypt that no longer supported node 8. I believe Whereas within node red we still supported node 8 and node 10 Again reason being we know there are users running on embedded devices that can't change their runtime So, you know, we were we had made a statement a couple years ago that we will keep supporting node 8 up until No dread 2.0, which is due now To coincide with node 10 going out the window at which point we drop support for node 8 and no 10 But it does mean since this one of we got reported we have been simply unable to upgrade bcrypt Because that would force us to drop support for node 8 and that would break our commitment to our user community So when we looked at the actual details of the vulnerability Again, I Can't remember this the specific parts of the internals the module But our analysis of it showed the the very limited way we used group bcrypt purely just to encrypt the password Which is stored on disk. It's never transmitted anywhere And then to do the comparison of the password that's received That didn't go near the The vulnerable code so we were We were satisfied that the the risk was not present for for no dread users. I think Yeah, we fight this Frequently, right? I think everywhere I've been just software supply chain is is hard And so a lot of times like the only way to scale it has been, you know, let's let's have people update their libraries even if it's not Necessarily vulnerable, but we but it has a vulnerability, right? Like the easiest answer like the answer that gets to us is Updating that thing and so I think there I think if we can make consistent the way that these vulnerabilities come in and Have some requirements or even if we can if the security people maybe don't write the test themselves but you know, they can turn in their their vulnerability and and their CDE and You know, if there's library maintainers or people like this who can help You know understand the vulnerability itself write the tests and then so then npm audit becomes a thing That's that's more customized to your code and your use cases rather than just we've we found a match for this library You know kind of somewhere in your dependencies, okay, right so one last thing is the thing you care about the most in this topic and it's how it affects The the people who build the packages so from my point of view The other way around To me being the consumer of npm in this role I'm installing dependencies. I'm checking the audit What What I would find useful is Information in the audit or elsewhere About Other people's choices, so there is Thousands of people like me Checking the audit looking at it deciding like this regular expression denial of service in a fourth level dependency of express Doesn't seem like it's affecting anything, but what do I know? So the question is are there any people who already researched it and made a informed choice That's probably much better than my educated guess And if so, I want to know what they did so One thing to look into one thing I'm hoping for the future is a system where The the file with decisions that I produce is something that I could potentially Share with others and being in a position of someone who's informed to make those decisions I could be Okay, I'm a troll. I'm gonna say influencer in this area so what I publish is gonna be a An informal guideline for some other teams for example if if I'm involved in a certain project I Can publish information about what I consider safe to ignore and people could use that information as a Factor not one by one. So not importing my decisions, but just Reading up on them treating them as a suggestion where when making their own choice