It is five o'clock. I will call this meeting of the finance and personnel committee to order We will begin with the role. Oh, they're Ackley Oh, they're Perala. Oh, they're Feldy Yeah And all their flicky Paneski is excused Will you all please join me and stand for the blotch All right barring any objections will jump over for for introducing committee members and staff and Move on to item number five, which is approval of the minutes from the July 24th 2023 meeting Do we have any discussion on the minutes from the last meeting? If not, we'd be looking for a motion to approve I move to approve second right we have a motion in a second on the minutes from the July 24th meeting seeing no further discussion all in favor I All opposed Chair votes. I the eyes have it in the motion passes With that we will move on to item number six, which is arrow number two of 23 24 Submitting a claim from Turkey coffee company incorporated for alleged damages to a vehicle when it was hit by a city garbage truck So this is here in front of you for filing, but just to report. We this was a claim that we did pay Questions or comments on this one Not we would be looking for a motion to file We have motion a second then seeing no further discussion all in favor All opposed chair votes. I the eyes have it in the motion passes that one is filed Next up is item number seven, which is arrow number 129 of 22 23 Submitting a claim from yang pao chang for alleged damages to the driveway and sidewalk due to a broken water main Similarly, this one is in front of your filing. This is one where we denied Questions comments on this one. Oh, they're parrilla. Yes, would you please explain why it was denied? there was no Liability on the part of the city for this so there was no negligence or anything like that that would allow for payment That's because there was no evidence that what they reported was Reflective of the truth of what happened. Yeah, basically, I'm gonna have to think back because this is a fairly old one but they were Alleging that there was sort of a piece of metal that was that was sticking up out of the roadway But it was there were a couple of issues one there was there was insufficient evidence that that Was handled improperly because it's in the street right-of-way and so under the statute Damage in the street right-of-way is only payable if we're grossly negligent and gross negligent means that We were aware that there was a problem and we chose to do nothing about it the fact that Something might as a result of wear and tear might suddenly start appearing out of there That's not that's not something we would pay a claim on until such time as we ignored it So it's similar to a pothole type of claim additionally in this case the the claim actually didn't Entirely represent what had actually occurred there It was actually not it was in the right-of-way. It was not on the person's property Okay, and finally how come it took so long to take care of this one. This is I think October 22 do Yeah, the the letter has been out for a while. I'm not sure why it took till now to get to you But the the denial is has happened that happened quite some time ago Thank you Any other discussion on this one if not we would be looking for a motion to file So moved Do we have a second second all right, we have a motion a second then seeing no further discussion All in favor All opposed chair votes aye the eyes have it the motion passes Next up we have item number eight, which is resolution number 33 of 23 24 Resolution authorizing the city attorney's office to settle the matter of Christie Murray versus city of Sheboygan and Mark a pollock So this is a settlement that I've worked out excuse me with Her attorney mrs. Murray's attorney normally we wouldn't have to come in front of you the administrator would have the authority To but because we don't have that authority because you didn't pass that Resolution I have to come to you to get your permission to settle it Basically, this is a claim was filed the claim was incomplete. We could not pay the claim based on the information that was provided So we had to deny the claim to avoid the problems with timing because if you don't deny a claim within X period of time It extends out the time for them to sue us to two years or three years Rather than the shorter period of time. So we had to deny it Then when she hired a lawyer to sue us in small claims I just simply asked the lawyer for the same information that we had asked for as part of the claim they provided it And nine hundred dollars is a good settlement on this one So so we're just requesting your authority to to settle it in that amount Questions comments on this one if not we would be looking for a motion to approve So moved second All right, we have a motion in a second then seeing no discussion All in favor hi Hi All opposed chair both side the eyes have it the motion passes. Thank you. Thank you That brings us to item number nine, which is resolution number 34 of 23 24 Resolution authorizing the appropriate city officials to execute an agreement with Hague of incorporated To implement forms licenses and applications software for the Department of Public Works and city clerk All right. Thank you Just a brief update on this this application will take care of the park rentals for DPW as well as the clerk's Business licenses both of those Applications are just in legacy applications on the AS 400 or IBM. I was you're trying to get rid of so this is a great step forward and continuing to reduce or Replace legacy applications Holder flaky Panasky. Thank you Am I understanding that this is yet another application that we're Putting on top of the stuff that we already have It will be replacing The applications the legacy applications that exist on the AS 400. This will be a cloud-based solution So it's sass or software as a service It'll be there's a one-time set up fee of $5,000 and then a reoccurring annual expense of $15,000 So I'm so used to hearing about mu-ness does mu-ness not have an application on its platform that would Suffice they they do they have a parks and recs module which we Did own the issue we ran into at the park and recs ma module is the it was very heavily Written for the recreational side which the School system has the parks and recs if you will we were just using a very small piece of That soft words was the rental side and it It Didn't fit DPW's needs to fulfill the rentals in a manner in which they wanted to we looked at a number of software solutions after that and It's not it who directs which applications Departments are going to use, you know, we will support their decisions As they Analyze the applications to meet their business needs and this is the solution they chose So I'm hearing that every department gets to pick their own application Ultimately, I will say yes, but we provide guidance and when looking at this Solutions more more particularly for the clerks. We looked at applications from To say five or six thousand dollars up to eighty five thousand dollars a year So there was a wide range there and obviously They did like some of the features that were in the much more expensive applications, but We as it came back and said that's not affordable for us So ultimately they yes, they they pick their applications because at the end of the day They're the ones that have to use them day in and day out. We will you know if they come back and say we want to run an application on some platform that we don't support or Some technology that we won't support we will say we that will not be supported by us and typically we would say no in that case So the the dollar this is the one where The transfer for the dollars for this came out of six or seven different categories. No, that'll be the next one Okay, I believe I believe that is correct. This one was coming out of the IT software budget. Yes. Okay. All right. This is coming. Yes, we have Each year in our capital plan we set aside 25 or 35 thousand dollars of money to Replace legacy application so that's where this money is coming out of for this year We'll be out of that fund to replace legacy applications Okay. All right. Thank you. You're welcome. Oh there Perala Yeah, I was wondering So it because in the in the documentation it said For applications Licenses, so it's what is that is going to be used for exactly for by DPW the Rentals of the parks and what else other things other uses to We're starting with the park rentals After that we are going to look at the boat slip rentals Which rentals again boat? Oh Both slips, okay, and then after that they do issue some permits from DPW, I believe like dumpster permits and those types of permits and We are also going to consider potentially moving those permits over to this solution as well Which means that the public can apply? Online for this when you say replacing legacy Applications you mean the for legacy application you mean the paper application What is the up the legacy application the legacy applications are? applications that were developed internally by the city IT department back in the 80s probably written in a language called cool ball They're just the green screen applications this new application. Yes is a very you know, it's a web-based I Smartphone-based application it will allow the residents from a park rental perspective to go out there Severe nice imagery of the parks as well as See what dates are available For the park rentals as well as pay via credit card all online But today they typically call up the parks. I'm sorry DPW and talk to them on the phone So it's a huge, you know time-saving as well as I think a significant convenience for the citizens and and the The fees then for future years would be 15,000 Yes This is right now. We're going year by year. I believe after This year if the application is meeting our needs, which we anticipate will we'll probably look at engaging in To like a three-year contract and at that point we'd see you know Some savings whether that's 10 or 12 percent of the savings. Okay? All right. Thank you. You're welcome Oh, they're flaky panacea. Thank you. I Think the biggest benefit is that it allows payment online The police department has an application to do that. Do they not right? We implemented parking ticket payment online parking ticket payments beginning of January this year and that has been a significant success. I Don't have the numbers in front of me, but I know like after four months out 85 90 percent of all tickets were then being paid via online payments So what I'm looking at is Would that application accommodate park applications? I'm looking at the duplication and numbers The the credit card payment is a basically a separate piece the credit card application we're using for the parking tickets Was written by Tyler or Munis so that integrates well with that that solution each We are also looking at taking payments for the Building inspection licenses and those type of things through the Munis credit card payment system But this other will be a it's a different credit card payment system that interfaces with Hague of So why if I can yes, thank you jump in quick I guess I'll stay off of the IT side of the question for the most part, but would you qualify the greatest advantage of moving to the system being that Residents who want to fill out these applications for their licenses permits and so on they're able to do that online Instead of coming in and having it on paper and I'm assuming if it was cobalt, it's being entered by hand after those paper applications are filled out Yes, I mean everything is yes, it would be entered by hand You know when you say what is the biggest benefit? I assume a couple a couple different perspectives I think from the citizens perspective. There's two one is it gives them very improved visibility to what shelter is available to rent Also gives them very good imagery or pictures of the shelters And then the other big benefit is they can pay online with a credit card where today they they need to come into The municipal service building and pay cash or check. I'm sorry. They don't take cash Or I think that they credit cards, but yes, so from DP DPW's Internal processing perspective, you know, they're not gonna have to take All those phone calls that come in and try to help people Find shelters this should make it much more of a self a citizen self-service portal for them Additionally, we get the clerk side of this which today all the clerks once again is a very paper-based Licensing process and this is now going to move that from a paper-based processing system to a online type system Once again supporting the payment of the license fees via credit card Thank you Other flick been asking thank you So This particular application will be used in the clerks department too. Yes, it's gonna fulfill the clerk's licensing needs as well as DPW's needs for Park rentals and potentially both slips and some of their licensing requirements Okay, the clerks use munis for a whole bunch of other stuff Um The clerks don't use very much of munis today their main application that they're using would be the legacy Permit legacy as for a hundred business licensing application for permitting for permitting, right? That's legacy application So the clerks really don't use munis for very much at all a lot of their Also from the election side, that's all state provided a software from the you know the duties they do for elections We get all our documents through munis. So My observation is they use it a lot You mean like mini code, yeah, they're different. That's not munis. That is a separate application again Any other discussion on this one if not we would be looking for a motion to approve I move to approve We have a motion. Do we have a second second? All right, we have motion a second then I guess Just a little bit more discussion from my end. I this seems incredibly worthwhile. I Anything that is a cobalt system is a screen of text There is no external facing Part of that application that is going to help Improve the customer experience that Is going to be internal? So I'm assuming it's paper applications that are then being retyped into this It seems like this would be moving the entire process forward pretty far Being able to have people actually fill out forms online and have it go right into that new system Additionally as you mentioned the cobalt cobalt side of things our analyst that supports that today is is nearing retirement age so We're going to lose at some point our Capability to support that system without Additional expenses of probably going on finding a consultant to support that Thank you All right, if we have no further discussion on this one, we have a motion to approve and a second All those in favor, please indicate by saying aye All opposed Chair votes aye the ayes have it the motion passes Next up is item number 10, which is resolution number 39 of 23 24 Resolution transferring budgeted funds so as to pay for additional cybersecurity products provided by ACP creative ID LLC doing business as camera corner connecting point and Obligating American Rescue Plan Act funds to pay for the associated cost Okay, thank you. Once again, this is requesting ARPA funds ARPA some of the purposes of ARPA was to help Organizations tighten their cyber security. This is a request to use ARPA funds to to once again continue on our journey of Strengthening our cyber security Oh, they're proud. Thank you chair Where is that? So these are cameras, right? I'm sorry these the system you are referring to is cameras installation of cameras What is the safety measure that will this Resolution will enhance it will and in this particular case. This is going to enhance our email security so it will Allow us to Take I guess much more detailed look at emails and continue to improve I guess what we'll say is the false positives So we're already struggling that we're you know We we could hold every email and nothing could get through or we cannot not hold everything and all the bad stuff gets through This is trying to find that balance between not holding too many emails But holding the appropriate emails and this allows us to get into the granular detail of the emails In in-house additionally One of the processes we have today is is what we call sandboxing and that's when an email comes it up puts it in the sandbox and then Analyzes the links and attachments and whatnot that actually Currently goes outside to the cloud and then comes back and that can take up to 30 minutes to process This by bringing this part of the solution is we're going to bring that process internally and it should Make our email turn around time a couple of minutes versus that potentially 30 minutes Very good. Thank you. I think I was Sightracked by the cccp The camera connecting point of the name here. Yeah The company yeah, I it's not the company's name is I think it's Well, it is the company name. You're right. It's dba camera connecting point cccp cccp is the vendor that will be selling us the products And the products are from for the for the net and just one more thing. This is all our performance, right? Yes, okay. Yes. Yes. Thank you Any other discussion on this one if not just my two quick sense that it seems like with an it you're always fighting between user convenience and security Getting this product in house is going to be a pretty strong way to bring those two closer together when it comes to the email system without sacrificing any of the security that we have agreed If there is no further discussion We would be looking for a motion to approve So moved second All right, we have a motion a second then seeing no further discussion All in favor All opposed chair votes. I the eyes have it the motion passes. Thank you. Thank you Next up we have item number 11, which was a direct referral of resolution number 41 of 23 24 uh By all the persons michael and flicky panoski to appoint kasey bradley as the new city administrator effective act over 23 2023 And authorizing appropriate city officials to enter into an employment agreement with kasey bradley Thank you chair. Uh, so in front of you you have both a resolution and a contract I just want to make a few comments before I entertain any questions First this appointment is a little bit different than what you typically see because this appointment is a council appointment As opposed to a mayoral appointment, which has to be held over to give the council the opportunity to Review and vet those candidates that the mayor is putting forward because the council has already had the opportunity to review and vet the candidates The council appointment doesn't go through the same process that a mayoral appointment does For example, when the last city administrator was hired The interview and the hiring all happened in one meeting So there was no two readings. There wasn't even two meetings. It just happened all in the same meeting The reason this is coming forward here today is twofold. Um, one we feel like it is appropriate For it to have a first review before it goes to council For any questions to be answered Additionally, I will not be at the council meeting next week. So I wanted to make sure that I was able to provide The details of the contract to all of you secondly the contract Follows the terms that were discussed in closed session after the interviews when council indicated Who they wanted a leave from gov hr and myself to move forward with and the terms by which that contract should be Written that's the terms here in this contract. So I'm happy to go through any of the terms that you have questions on Or answer any of the questions that you may have regarding this contract Questions Other flaky panasky, um, I recognize that The salary was at the upper end of the scale And then in addition there were moving expenses This was all negotiated out as we had Determined in closed session. I'm assuming Yeah, so in the closed session Council directed what the salary range could be that we could negotiate up to And then the same thing with moving expenses council indicated the threshold For moving expenses. So both of those specifically were Directly directed by council. I will say the two items in here That were loosely directed by council Would be the term of the agreement. So as you will see in this contract, there is no term The contract the contract is ongoing. So it's not like a three-year contract So that was one thing and then the other thing was the severance package Which in this contract It is one Month salary for every year completed. So if in six months the council decides to part ways There would be there no severance or one month severance that would get into later You would have to we'd have to have that conversation But if it was five years in there would be five months of severance The most it could possibly be is six months, which is in line with what The past two city administrator contracts for the city had. So again, those were loosely Formed by council, but not directly spoken about in closed session Any other discussion on this one? Also, just so you know, mr. Bradley is planning on attending The council meeting next monday. Um, so he will be here if you want to We'll look forward to seeing him Farb, did you have a question? No Okay Looking at you, but I'm reading the name Oh, they're parella Yeah, so I wasn't at the meeting unfortunately. Um, how does this salary compare with comparable cities So, uh, we unfortunately have two Cities that recently Settled contracts or not settled agreed to contracts that significantly higher than this This is in line with what mr. Bradley was requesting on his application And is in line With what we would have expected to have I will tell you we are lower than Other municipalities that are of a similar size. It's it's kind of difficult because there aren't too many Municipalities that are that 50,000 range, but when we look at like we're seeing Jamesville Those types of communities We are lower than that So you did compare with some comparable cities correct and you concluded that this is lower correct and this is This is midpoint of the pay reign the salary schedule that council approved last year which is Typically what people are being brought in at at every level now if you're coming in with significant experience midpoint which is the control point is Is generally where people are being brought in for for any position And mr. Bradley has significant experience in this role So it it was not surprising at all to come in At midpoint Thank you. Yeah Any other questions comments If not, we'd be looking for a motion to approve So moved second Second time that I've been beat on the chair seconds today But all right, we have a motion and a second time this one then Seeing no further discussion All in favor All opposed chair votes aye the ayes have it the motion passes Our next meeting date will be August 28th And with that we have exhausted our agenda and are looking for a motion to adjourn Second we have a motion and a second. There's still no discussion on adjournment all in favor All opposed chair votes aye the ayes have it and the motion passes. We are adjourned. Thank you. Thank you everybody


Hello, everyone. Welcome. My name is Jossi Kokkonen. I'm here today with this impressively vague talk title. And I promise the title's brought by the talk really isn't. I'm going to talk about a specific security feature and implementation of the update framework for a specific package repository, the Python package index. And we'll see how much we'll learn from that example. And I believe that there are generic takeaways from this specific example. I'm probably not going to try to unwrap them too much in this short talk. I'll just tell this short story about this one security feature and how it has succeeded and maybe more interestingly how it hasn't succeeded in improving package repository security. Basically, what we can learn and what approaches we could take in the future. So the package repositories that I mean in the title are specifically community maintained language ecosystem repositories. The example is PyPI, but I think the lessons that we might be able to learn are applicable to any of the others that kind of fit that description. And I would be cautious about generalizing to other things like let's say Linux distro repositories because they look similar but they have these small but kind of important differences at least for this specific case. My background is that I worked on open source and supply chain related things for a while now and I'm one of the maintainers of Python Tough which forms a part of this security feature that I'm going to cover. My plan is to explain the problem that's being solved or that we're trying to solve and show you the potential solution and then document or analyze how this solution has been applied to PyPI, the Python ecosystem repo, and after that kind of continue on looking at what worked and what didn't and those lessons that could be useful. So I should start by defining the problem that we or people before me started to try to solve. On the very high level it's just that community package repositories like this are not safe. PyPI and other repositories like that were designed in a more innocent time when supply chain security wasn't really a thing people even talked about, not in this context. And you could say that these repositories are successful partially because of that insecurity. Part of the appeal is that the repository is a sandbox where anyone can publish anything and there is no expensive publishing processes involved or something like that. And the specific issue that this story is about is that the repository itself, the service, is a massive single point of failure. So what I mean is that the repository infrastructure, like if PyPI.org website is compromised then any clients like PIP that download anything will be compromised. And then there is a separate issue that I think is very much linked is that even if developers of those original packages try to do better and let's say they sign their packages no one later in the supply chain does anything with those signatures. And now you might think that this is a fairly simple problem we just use more signatures. Make download or clients verify signatures that are signed by either the repository or developers or both. And yeah, that is kind of true. Cryptographic signatures are the obvious solution to problems like this. They provide resilience against infrastructure attacks and are proven to work. Distros and like Dubian have this working and so do many other software delivery mechanisms. But there are differences between those systems and these language ecosystem repositories that kind of mean that the language repositories can't easily copy the solutions from those other systems at least not without radically changing the nature of the repository that I mentioned that it is a free-for-all. And there's a couple of things that you need to make signing viable, signing useful. You need to somehow be able to delegate trust. You need to define who is trusted to do what, which kind of keys are allowed to do what. And then you need some sort of key management and I don't just mean how private keys are protected but how the public keys are propagated. How do the downloaders know which keys to trust at a given time? And these issues have to be solved even for repository signatures like if the repository is signing things on its own but they really become a major pain point if you're having the developers sign things. And what makes repositories like PIPI uniquely tricky in that is just the scale and velocity of things. So if you think about the number of maintainers, number of signers that would exist in this hypothetical PIPI where developers signed, that is an amazing amount of keys and identities to keep track of and just easily becomes a key management and key propagation nightmare. And if we think about other methods that other systems like this are using, maintainer, identity verification, trying to keep track of who people really are, can we trust them. It's also practically impossible if you have hundreds of thousands of signers. And then the frequency of releases is another thing because if you think about the repository signing things whenever things are made public, you could do that fairly securely if you make releases once a week or something like that or how a stable Linux distribution might work. But when your releases happen every few seconds then it means that the signing key has to be online and kind of available to processes that can be compromised. So it's not the easiest case. But we do have a potential solution to at least some of these issues. And that is tough, the update framework. It's a secure content delivery framework. This is what I've been working on for the past two years or a bit more. It was originally developed in 2009, University of Washington that was Justin Samuel, Justin Kappos wrote a paper with a couple of Tor developers. Survivable key compromise in software update systems that led to a specification and a reference implementation. And tough provides a solution to trust delegation and public key propagation to downloaders. You can think of it as a clever way of allowing quite a bit of complexity in delegating trust and doing key changes without making any of that a user problem or even a downloader client problem. And when it does that, it also provides this interesting feature of making the repository fairly compromise resilient. You cannot as easily compromise the downloader clients by compromising the repository if you're using this. And I'll need to explain a bit about how it works. Sorry about that. I promise to get back to the package repositories in just a moment. So in a tough implementation, it typically means a client library used by a client application that wants to download something and then some sort of repository software that maintains metadata that the client uses to verify any content found in the repository. So for clients, this is pretty easy. They use a tough library like an HTTP library. You just tell it which artifact you would like to download, a tough client downloads it, make sure the content is correct, and it does this by first downloading some tough metadata, which is JSON files that the repository makes available, and those metadata files contain essentially a chain of signatures that proves the artifact is not compromised. And the repository then maintains that metadata. And the metadata is essentially JSON files that each define what's called a role. There's quite a bit more complexity in the format. The main point is that each role can do two things. It can list artifacts it knows about. So this is the info that the clients are actually looking for. And what I mean by artifact is just a download URL and a content hash for that URL so that you can download it and know that it's correct. But the other thing it can do is delegate trust further to other roles. And this delegation can be kind of focused. We might delegate some artifacts and not others, and then delegate maybe other artifacts to some other role. So here's a simple example repository. There is a diagram of delegation starting from the root role that delegates to targets role that delegates to two more roles that then actually list one artifact each. The actual tough architecture contains a few more mandatory roles, but I think these are relevant to understanding the trust delegation and key propagation stuff. So the delegating role decides both whether it delegates trust onwards and the keys that the delegated role must be signed with. So what this means is that the root role essentially operates as a source of trust that then propagates onwards. And what that means is that your client can be bootstrapped with just the root keys and that's it. Then you can get all of that, the rest of the trust tree dynamically when you need it. So root and targets and a few other roles that are not drawn here are hard-coded in the spec. But everything to the right of targets here is up to the specific repository and it can change dynamically as needed. So new metadata versions might add new artifacts, remove artifacts, but could also add new delegations and new delegation trees. So to maybe make that example a bit more concrete, if we have this repository and a downloader client wants to download x.zip, then there's a defined process where the tough client library makes sure that the top-level roles, root targets and a few others are not drawn. These are up to date and signed. Then the tough client sees that targets delegate forward to project x. Then it goes ahead and downloads project x metadata and verifies that it's signed by keys defined in the previous delegating role. And then further finds that there is a matching artifact that has a hash and it can download the artifact and check that the hash is correct. So to compromise this download process, the attacker needs access to either root, targets or project x keys. So getting control of just the hosting infrastructure for x.zip or the metadata is not enough. If you want to compromise clients, you need access to keys. Yeah, that was a quick primer on tough. I hope that's enough about that and we can move on to the actual content. So I'd like to talk about the plans, how you would integrate this into the Python ecosystem. We've got two PEPs. PEP is short for Python enhancement proposal. And this one, PEP 458, sorry, was written in 2013 and it defines a repository signing model. That means the maintainers of the projects do not sign things, but instead every time a new artifact is uploaded by a maintainer, the PIPI software adds those release artifacts to the relevant metadata and then signs it. And this kind of system protects against file hosting compromise. So the metadata or the Python index files that would be the content here. But it wouldn't protect again against compromise of the signing component, of course, because as we discussed, you need the key available all the time because there are new releases all the time. So the key is online. So it is compromise resilient to a point and also handles the key propagation and enables compromise recovery. If keys are compromised, then they're easy to replace with the system. There is another proposal that's a bit more interesting. Just a year later, so 2014, PEP 480 was written and it defines developer signing. Each project potentially signing their own releases. And it does contain some major workflow changes for maintainers and administrators, like maintainers of Python projects and administrators of PIPI. But it does protect against all infrastructure compromise and creates a secure supply chain from developer all the way to user. And what I mean is that if you remember the diagram of roles, imagine that a bit more complex, a bit more deep, and the whole chain of keys from root to targets to some midway delegated roles to the final project role, the whole chain can be offline keys. They could even be hardware keys in someone's drawer. And what that means that it is not possible to compromise any downloader clients without access to at least one of those keys. And none of those keys are on the server. And I don't know about you, but I think this is just a very cool idea and it would make the whole supply chain resilient to PIPI compromise. Period. I was not involved in the project at this time, but I would assume that the thinking was that there is now a simple two-step process. We implement PEP 450, then we implement PEP 480, and the result is like a Fort Knox of package repositories. But before we get to what has actually happened in this space, I just want to quickly mention how tough and general progress from that point, like 2014 or so, to today. I think it's fair to say that the specification has stood the test of time. It's improved, but in general, it gets proven to be useful in practice and secure. There are many more implementations now. It's in use in several operating systems as an update system and in other places as well. Practically useful and clearly implementable. What about the PIPI case that I was talking about? We didn't get a Fort Knox. We maybe got the Sagrada Familia instead. About nine years has passed since the first proposal and we don't have anything running list publicly at this point. This is what I want to spend the rest of the talk on. Why was this much harder than was expected and what could we learn from this? I don't want to make it seem like there is no success at all. The PEPs have resulted in a lot of flow-level work in the spec and in the tough Python implementation, which is a far better software project now than it used to be. PEP458, the first one, has had considerable progress and very smart people are working on it right now and I trust that that one will happen hopefully soon. But the reason I wanted to talk about this is that nine, ten years from making the proposal to maybe getting it into production, it's a long time and that's the simpler proposal of those two. Much, much simpler. If you ask me as something of a subject matter expert, I would say that with this same trajectory, PEP480 is not going to happen. It's just a far more difficult problem. So I would like to see if there are other trajectories available to us. Right, so what can we learn? I have some suggestions. There's a couple just kind of very specifically about tough and how the spec works and how the software is developed. And then some comments on the enhancement proposals themselves and then some sort of more general suggestions what we could do in practice to get things like this moving. So one clear issue has been that while implementing simple repositories with tough is not too bad. This turned out to be far more difficult for complex and highly automated cases. And I think there is a clear underlying reason for that and that is that the spec only defines what the client does. The repository isn't simpler to implement but the complexity isn't obvious to the spec reader because the spec only talks about the client. And maybe this sounds obvious now that if you see a spec that only talks about the client you'd notice that that's not the whole story.  It took me an embarrassingly long time to figure this out. So maybe that should have been said. And if you're wondering why that is a core decision in the tough spec it's that the spec is supposed to be generic. It's not like a specific update system. It's a framework for building update systems and that works great for the client because the client is essentially the same for everything and it kind of works. You can build wildly different repositories with Tough. As an example you could have a repo maintained by a single person with no server software running at all just something you run on your local machine and publish the files out every few weeks or months. Or you could have a repo with thousands of maintainers and a lot of automation on the server side. And the same workflows aren't going to work for both. So I can see why the spec doesn't define any repository workflows but something really should. Because the result of this specifications hyper-focused on the client has been that we simple implementation developers spend a lot of time very very carefully implementing the client spec to the finest detail. And then when it comes to the repository tools we throw something on the wall and we don't carefully define those repository operations either and it probably doesn't come out very well. And we probably should have chosen a specific or maybe multiple types of repositories and provided good support for those specific use cases. But that's not how most or almost all tough repositories or tough implementations that I know of operate. So yeah, that was about tough. Let's look about the PEPs. What could the PEPs have done better? So these are the enhancement proposals for the Python ecosystem. While attacks and protections and tough mechanisms are important, they maybe didn't make the best possible enhancement proposal for the Python ecosystem. Because they don't talk so much about PyPI workflows and processes and how this affects the clients or the developer tooling and so on. And the PyPI developers themselves have not been super involved in this process. And I can understand that. Spending time on a proposal that mostly doesn't talk about the things that you're interested in, maybe that doesn't sound very appealing. And while the PEPs have a lot of focus on tough mechanisms and they're talked about in great detail, they don't actually include a software design or prototypes. And I don't mean PyPI prototypes. That's a lot to ask. But I mean tough repository prototypes that would validate the design that is being proposed. Because something like PEP480 has not been implemented anywhere. And PEP480 is a very ambitious design. It will require prototyping somewhere. And now if you think about PyPI, that is a very conservative project for good reasons. It's the backbone of a massive number of supply chains and prototyping there does not seem like a good idea. Finally, especially the developer signing, so that's PEP480, but absolutely disrupt PyPI workflows at many levels. This disruption really needs to be well-defined before a proposal like this is credible. And it probably shouldn't go into too much details, but if you're wondering what workflow changes I might mean, you could think about identity or key changes.  And that's pretty much it. But if all of that... and that's the trust delegation currently. So if all of that is in locally signed information, then you have to start by maybe the new developer needs to sign a message that contains his or her public key. And that has to be made available to the original developer who can then do the trust delegation change so that it includes that public key and that has to be made part of the repository. And now we're talking about multiple local tools that are required in this workflow that used to be a single click almost on a website. So that's a big change, a changing user experience like that for tens of thousands or hundreds of thousands of people. It's a pretty big thing. And I think that currently, we don't have a reliable view of the required level of disruption. That was just an example. And in my opinion, that means we can't really tell if PEP480 is a viable solution for PIPI. And I think we really should be able to tell if we have an enhancement proposal for it. That sounds a bit harsh and I want to stress that I think I still think this is a very, very cool idea and worth investment and work. But we do need some kind of a different approach if we want to figure this out. Okay, so finally, looking at the sort of wider ecosystem and stepping back maybe to the original problem statement that the original design of community repositories is from a more innocent time and then add to that the evidence that we've seen that some solutions just need more experimentation and also maybe more resources than individual projects like PIPI are willing or can expand. Then it may not be sustainable for each repository and ecosystem to experiment and develop all of these solutions on their own. But the repositories are more like than they are different. A lot of the problems are shared. In the case that I've described as a good example, it's an issue and what I've talked about as a potential solution is a potential solution for a lot of different repositories. So it would make sense to combine four C's somehow and the number one forum, I think, currently seems to be the securing software repositories working group. There seems to be real momentum there. So if anyone has ideas about in this sort of space, I would suggest that as the place to do it. And then there's a more specific specific place to experiment. I've got a project that I'd like to continue that basically is about prototyping exactly this developer signing for repositories like the ones we've talked about. Because the fact that community repositories are conservative and lack resources means we need places where we can experiment with specific designs. And it probably doesn't make sense to do that in those repositories themselves. And for the PIP480 use case, and I'm using that to just describe this general design of developer signing, my plan is to use repository playground, the link's there for this. And if you're interested, please have a look and get in touch. It's still in fairly early stages, but the plan is to develop some tough repository workflows and processes for this community package repository use case, actually try what works and what does not. And the goals are basically to find out if tough is a viable solution and then produce an implementation and documentation that allows repository projects like PyPI to evaluate the idea and see if it can work for them. Can they take the design and use it in their own systems? Yeah, that. That is what I have. I think we should have some time for questions or comments. And I think I should put this on if there are any. All right, go ahead. It's a quite interesting problem, right? I was wondering, because you talked a bit about tough and the PEP and PyPI and the working group in MSSF and so on, it's all kind of different parties who are maybe not collaborating enough. Is that impression true? Because I would think that the security of the PyPI repository would be one of the prime concerns of the people who are running PyPI and developing it, so is there some gap there or can you share some thoughts on that? Yeah, I suppose that's a really common problem in open source, right? And I don't have any fantastic solutions for it, but it's really understandable. Projects like PyPI aren't exactly the sort of sexist objects that get a lot of new developers all the time, and also they can't just take anyone to just do changes into PyPI source code just like that. Then you have to be careful about it. So there isn't like a huge amount of resources available to just start looking at experimental projects and I'm not involved in developing PyPI itself, but I can certainly understand that seeing far-reaching proposals for it, you might look at that and then decide that, well, I've got these much more pressing concerns to work on right now. It's a tricky problem, but definitely working together probably is part of the solution. Sorry. With so many developers and so many keys that are going to be compromises somewhere, is there a revocation mechanism built into the framework? Yeah, yeah. It's not even revocation in a sense, but basically when you do try to download something, the whole trust chain is updated, if that makes sense. So you always have the newest keys that are valid for that artifact. So yes, that is something tough-handled. Hi, my name is Nick. I was wondering, since you mentioned that the PyPI repository system was designed in the times when security was not really big of a concern, so it might have some security issues and it had it at the time you did the proposal for the PEPs, right? I'm wondering, since none of those PEPs have been implemented, what are the security measures that are taking like today and that were taken during those nine years apart from your PEPs that enhance the security, of course, and the second part of the question is if it worked for nine years, I hope successfully, why it couldn't be used anymore? So on the generic question of PyPI security, they've definitely worked on various aspects of it, but like I said, I'm not a PyPI developer, so I'll not go into details, but they've definitely done that and I think there is things like two-factor authentication and so on in use. And the second part, like no, this tough has been implemented during these years in several places, yes, but these are specific implementations and the implementation for PyPI in any form hasn't been in operation yet, so that's the status. Anything else? Yeah, could you comment on what the difference might be between tough, the generic implementation and sigstore in general, because that seems to be the going topic within the securing of the software supply chain repos working group that you mentioned earlier. So just generically, what kind of the differences and overlaps might be there. Right, yeah, it gets a bit complex. So sigstore and tough are kind of very related, but I don't think they overlap really. So just to give two examples, you could use, this is not right now possible, but with small changes to the tough key system, you could use sigstore keys within tough, so you could do signing using sigstore keys so developers would need actual long-living private keys, you'd use sigstore, and then use those within the tough system. Then another sort of commonality is that sigstore actually uses tough to deliver some of their sources of trust to their clients. What else? Yeah, so I don't think that they necessarily overlap as in they solve slightly different problems in this space, and of course you can choose which you prioritize and also which seems more achievable in the time frame that you have, but both make sense to me. All right, I think we're done. Thank you, everyone.


Yeah, I didn't know what to do there. Oh, am I dead? I think so. You are Goku, a con artist. How's it going, everybody? Dato and I here back with another UI Goku video for you all today. And this one is going to be pretty exciting because what happens when you take two UI Goku players that are both in the UI Goku rank in Dragonball Fighters and put them up against each other. I am, of course, talking about Lotus Asakura, who has joined me here today in the ring match. Say what's up, dude. How y'all doing, boys and girls? I already seem to get beat up. Actually, you know what? I'm not here to get beat up today. I mean, I'm here to do cool stuff with Ultra Instinct Goku. I'm here to use counters. I'm here to stuff Dr. Doi's little curling face into the dirt. That's what we're here to do today. Yeah, so if you didn't already know, this is actually part two of a set we already did over on Lotus's channel. You can go check that out. The link will be down below in a pinned comment. But yeah, we're just going to be talking and playing some UI Goku today. Just doing what we do. He might have my favorite intro in the game now. Because I always love the intros where you can see the other two characters on your team, not to mention that he just looks sick, so. Yeah, that's really underrated. I feel like people don't talk about that enough. Intros where you can see the whole team are underrated. Yeah, like right here, look at this. It's the only time when Krillin has an intro where he looks cool. Great Krillin's own intro, maybe not the best look for him. But falling over and everything. His teammates intros, those are sick. Janemba is one of them that I thought was really good. Are you not overdoing this already? Yeah, that move. Oh, Reds. I don't know why I put myself in the corner. We blocked those. We blocked those. I tried to 2-H at that time. I wasn't fast enough. Oh, can I actually hit this? Oh, we got we got Korda combos? Yes, Korda combos. Yes, I do. Hey, I think we got a couple things. I don't know what part I did wrong. I might have just not done it fast enough. But yeah, that was actually so far the optimal. Oh, another drop. Man, I am just a good player. My ex move might be a little bit faster than yours. Yeah, that was just the kindest. Oh, you know what? Quick tags. Don't have to image me. I'm afraid. Oh, the beam. I always just that's that's my new fear tactic is I just hold the beam and see what they do. Oh, my goodness. No, I let it slide. Yeah, I'm the king of doing that lately. Yamp just is just kind of rocking out with it. Renaissance for me. No, OK. No, you don't. Oh, no. Oh, what am I doing? I'll take that. I'm just I'm just I'm just losing it with you. I go to right now. Any button I can press is getting pressed.  I go because this is what Bartok it. I should have gone for it anyway. But I just thank you. Yeah, I just I risk Yamp's life trying to save you. I go to East East. You I go who is that cool of a character that I got. I got to do it. I got to save the boy. Oh, I actually got it. I should have gone for the first time. I was clean. Yeah, it would have been clean if I actually killed Yonka there for that foot. You know what? I'll take it. This is a ton of damage, though. Yeah, this level three, apart from the bad wake up, is I really like the look of it scared again. That command throw just puts fear in my heart. I'm just going to a level up. Oh, all right. I felt that. I was going to have to spend the bar to vanish anyway. I was like, why does well little one here? Oh, toss up the job just a little too soon. All right, I'm going to I'm going to go for a level three here and just hope that the mix is enough. All right, we take this. We lied to me. You lied to me. You didn't try to make me. I didn't try to mix it all. I was just going for it. It was an audible mix up. He knew what I could resist. I'm a master of audible mix-ups.  Everyone thinks Dr. Dwayne is just so innocent.  I'm just a con artist. I am just a con artist in these streets.  That after image is definitely a con. That is that is true.  Yeah, I like Krillin is my favorite in the show, but also after image. So we take those. See me and Naruto fighters. I'm a shadow clone, man. You don't listen. Don't even get started on that because you don't want that problem. If they ever, I will listen. I love Dragon Ball. I love Dragon Ball fighters. But if they ever drop a Naruto fighters, I will devote my life to that game. I think I played this game like crazy. I love Naruto way more than Dragon Ball. Yeah, we're in the same boat. I actually would say I'm more of a fan of Dragon Ball than Naruto, but my thing is I like them both. Oh, let's go. I like them both a lot, but I just feel like Naruto has a more interesting side cast. Like DLC for Naruto would get me excited. I don't think I've ever talked about this on my channel, but if you are a viewer and didn't know, I wouldn't. If a Naruto fighters drop, you see in videos on that for me. Oh, facts, like, I'll be there. Y'all think I'm a Dragon Ball fighters YouTuber. I mean, yeah, I do a lot of that, but you see an awful lot more Naruto on the channel if that game ever comes out. Oh my good. I might be kind of nasty. I might be a trunkster. That was so fast that I didn't even have time to feel fear. I just died. All right, now I gotta worry about getting countered. I forgot all about that. Yeah, that move is definitely good. He's got so many tools. I definitely did it twice when we moved. I'm alive though. Yeah, I didn't know what to do there. Am I dead? I think so. You are Goku. I'm Pawn Artist. The worst part is, if I had done that, you'd have baited me and not have lost, but you did it and I lost to me. Dammit. Oh my goodness, this character. He might be my favorite. In terms of fun, I think he's the best character they've put out. DBS Broly would probably be second to me just because I love grapplers, but counters might be my favorite. That's the exact opposite. Command grab. Sick. I was sick. I could convert all that. Back up. Oh, the jab. We talked a lot about that. I'll notice this part, but don't sleep on UI Goku's jab. I got caught by the yamcha, the command grab whiff, but I just ran into the yamcha. What's funny is I actually was able to recover from whiffing that and then go into the combo. DP. You know what? I actually don't use just the DP enough when I play. I really don't either. That's mostly just because I mess up the input a lot. Down, down input for the DP. It's just really weird. Like I'm used to using it for like 18s barrier, but the situation where I use that barrier is like really different. And that's not enough. Are we living this? Oh, gotta gotta play defense. Audible mix. Oh. The J's got counter hit and he gets to tag out all that blue life. We're trying to escape with that blue life. Actually, you know what? Man, forget offense. We're just going to heal that blue life. I'm so scared. Oh, I got hit. I need this character. I'm nothing without my sword, boy. You know what? I don't even care.  I just wish I could actually hit that combo.  I am a freak. You want to air twitch? I definitely got to work on that combo some more in trading mode. I practiced that right before going to EVO and then ended up not playing Krillin at EVO. So it was a real waste of time. And my trunks is dead. Well, we know who's winning this batch. Solo anchor Bardock. I don't have I ever pulled off a Bardock comeback before? I think I have, but like it almost never. It probably has happened, but it's just there's been so many trunks ones that it's hard to remember the cool. And the best part about this is you can actually, that's my favorite part about that is you actually get to do some of it. I usually try to 5S into a beam assist is what I usually do. But I didn't I don't think I knew that you could roll to like off the. Yeah, that's just what I've been doing because I feel like I don't know. It gives me the most consistent, I don't know, like things I can do off of it. Bro, that JM catches me in the air every time. I don't think I've tried the beam. Not that you mentioned it. I don't think I've ever tried the beam. The day I get comfortable with that assist is the day I can finally proudly play this. Come here, you. I am just going to start bar docking. I'm just going to start bar docking. Help. Oh my God. You want to go to a bar docked? Oh, the bar dock betrayed me. The bar dock betrayed me. The end of bar dock saga. Who did I throw that to? Really just wasting food out here. That was quite the quite the two that he styled on me with ultimate change into the. Yeah, I just. Wow, that was that was a watch.  That was that was that was just friendly banter. You know, yeah, yeah, yeah, I was just, you know, sometimes I got to fight side by side. Right back. Yeah, rematch. What is it? One one now. That's to own your favor. Is it? Wait, the first game. Did it?   So bad. He don't even remember. Oh, my. Your job is that powerful. Oh, my goodness. There I thought you'd be afraid of the counter this time. He wasn't. I was trying to make up a mash. Oh, my goodness. Lotus can I for some reason, I felt like my 2 3 6 L got me out of the corner. It does not. I did it thinking I was bar dock or something. Oh, I definitely he completely avoided the beam. That's insane. Oh, no.  And we just ran it. Oh, I thought that was a second version on the ground. Don't accidentally punch. Wow. I'm pretty sure I said this another year. I know I said this to you, but I don't know if I've said this in the other videos, but man, I did not know I used to tech with Dragon Rush until this character dropped. And I just kept doing that tech accident 6 in. Take those as well. They had the two-way stuff, but the object kept me jailed. Well, this is going to be a really, really fast video. The fastest first of three between us ever. Maybe. Hey, Lotus, how come you let Dr. Doya win whenever you all play? He just better than me. I don't know what to tell you. He's really downloaded the Lotus All Support matchup. I forgot to tell you other than that. Made by you, I'd go because we've been getting Dragon Rushed all day. Am I getting? Yep. OK. Let's see if we can make anything happen here with this character. The moon jump, Oki. Right, that can also be a thing. You know what, Smarter Man would have seen that coming. Oh, I like that.  Herb it down, got those? I tried to walk through it, and I guess I was in the air. I don't know. Maybe that. All I know is I'm sad. To be honest, I would have been shocked when you hit that. All I know is I'm really sad and you ever just lose all hope in a match? You ever just completely give up knowing you have no chance? You are playing trunks with level three sparking, so this could be the case. But I've already popped it, so it's not going to last very long and your guard cancelling my mix. And I'm getting hit by Key Blast. It's just over. I vanished too. Got that early. It's so active. Oh, I got put, right? You can't do that every time. Stopped. I definitely thought I was getting punched in the face like last time.  You might go because counter is not a wind tool.   No. You were able to still block there.  I'm not even exaggerating. That was brutal. I haven't been 3-0 in this game in a very long time. I need you to know this. Do we want a run back or are we calling it the? I don't know if my heart's ready for a run back. That was brutal. That was very brutal. Well, thank you guys so much. No, no, no, no, no, no. That's salty, salty. I'll run it, run it back. The confidence back. I can't go out like this, man. There was something bubbling under the surface. And as a friend, I thought I'd push it a little. We're back. I could. Yeah, this is off the great start. That move is powerful. He just got the answer to everything. He's just like the Ultra Instinct. It's too powerful. This man hit Ultra Instinct's sign rank and never looked back. That move is. Wait, what? How did I? I guess I might have actually timed that right. Yo, Goku, I'm sorry, dawg. You got doffed. I messed up. I'm just going to drive a brush. I'll exit stage left over here. I'm good. It's looking like it might be. It even has a beam. Yeah, that beam is. I'm surprised that people have been finding so many good uses for that beam. Like in mix ups, the roll, being able to EX roll into it, stuff like that. That's wild tech. That's definitely going to be the next stuff. It's too west. You blocked it? Not used to people blocking that, honestly. Oh, the rea. Not this time. He's got like. Am I, though? That is definitely gone. Like, hey, when I go sailing past it, those are the worst because I've reached the high. I just didn't have the movement. No, you don't want to take the bait. All right, that was. I just want to look cool, man. Oh, no, I dropped it again. I'm going to use that more to myself, to be honest. Too afraid. Actually, I was going to say, what do you get off that in the corner? I would say in the corner, I wonder if you can dash just a tiny bit and get his. Yeah, maybe a 5-0. You probably can. I didn't think about that until you just hit that there. I'm just going to waste the ball. I was just thinking that there myself.  This is interesting. I was like, does this work? What a scenario. Did you go for a counter or just a jump? Yes, I went for a counter. And the curse of UI Goku is. Oh, like he's staggering. So maybe I can slip one in here. His was not the case. Max range, solar flare. Not even a UI Goku feature. We're just talking about how max range that was. Drunks, please stop. Not like this, man. Come on, man. I'm just a boy, man. I tried to rotate. Nice. I've had enough of this oppression. I'm not going to go out like this. I'm swigging back. What is this, a level one, level one? Yeah, that's going to do it. On our way out. My heart hurts. I got to let a, I got to get trunks out of here if I can. Stop this. If I can, if I could just get trunks out of here. I'm not confident in my limit break Goku. Oh my goodness. That was an interesting one. I could probably count on one hand so many times I've seen that. Wow, I ain't taking a lot of damage. This might have to be a limit break Goku. I can't tell you how much I. You're just going to spark and save the yacht. I might have to check the blue life if we can real quick. We're doing it. Oh, I dropped it. No. OK, I'll take that. You know, I should have known better. I still went for it again. And he actually got the conversion this time because, of course, he did. We're sparking. OK. Through with this. I didn't have meter. And now I'm dead. OK, we still have the bar. Bring it on. Sparking. Bring it home. Come on, sparking. Yes. This is so close. Oh, I should have gone for a faster button. Oh, wow. That is the offshoot. OK. Oh, and he's saving the assist. Oh, you know the vibes. You know what energy we all. OK, it is Trunks' beam assist, so we. Come on, bro. I can't go out on a 4-0. Not like this. What am I subscribed? First thing. Risk it for the bit. I tried to roll a level three here. You cannot roll a level three that apparently. No. Wait. If you could drop it, I'd appreciate it. Four bars, that's a lot. I'm not going to hold you. No. You know what?  I did the right jab too early, and I feel like if I angled it downward, it was going to go straight to the pavement, and I was at level three. I thought I was like, is that angle going to hit? And then you've called out Trunks. I was like, I guess it doesn't matter. No, I panicked immediately. As soon as I saw that I did it in the air, I was like, no, we're not even risking trying to angle it. We're bringing in Trunks. I pray that he doesn't whiff. I'll be honest. I definitely was holding down the punch tech, so I was coming flying back. I would have ran into it too. I got wood. You know, we got three wood. That's a good place to call. I feel like that was a pretty sick game. So if you want to go down and check out the first part, definitely go down there as well. Let me know your favorite moment from the video. Ed, while you're down there, hit the Like button and stick around. Subscribe if you want to watch even more UI Goku content. That's sure to come out at some point. Other than that, I have been Dr. Dewey. Thanks for watching all the way to the end of the video, and I will see you all in the next video.


What's up guys? Welcome back. So today I want to talk about something very very very exciting. Ticketmaster Verified Fan Pre-sales. Let's get into it. So we got to go over the basics. So what are they? How do they work? How do you sign up? And then any kind of tips to make sure you maximize your chances of actually getting those tickets. So let's start from the top. What is a Ticketmaster Verified Fan Pre-sale? Basically it's Ticketmaster's version of being able to create a pre-sale so that they can really kind of filter out any of the bots and brokers who are trying to buy tickets for different events. Obviously no system is perfect, but what Ticketmaster does is they actually have an algorithm where they'll take everyone's kind of information. It'll then kind of take it all back, put it through their magical algorithm machine. So what it'll do is it'll spit out an option saying hey you're eligible for the pre-sale or no unfortunately you're put on the wait list. You may or may not get tickets in the future, but most likely once you've been hit on that wait list or not been verified essentially, odds are you won't be getting any tickets. That's the basic gist of it. Ticketmaster kind of introduced it a couple of years ago. They started with just, you know, a couple of events here and there, then it's kind of now taken off as people have got a bit more used to it and they've kind of fine tuned it. So at the beginning it was you would sign up for a pre-sale and you could just kind of sign up as many times as you wanted with one phone number and basically you just get tons of codes to be able to buy lots of tickets. Ticketmaster has then kind of refined it so that now if you kind of use an account that has been flagged, generally speaking you won't be getting any more tickets on that account for the pre-sale. So that's kind of what it is. In terms of how it works it's relatively straightforward and by that I mean not straightforward at all. So let's kind of dive into that. So first off you actually have to know when this pre-sale is happening or when the sign up period is open.  Unfortunately many of them will not. And so one, you just know when the registration period is opened and with that you then also need to register. Just knowing unfortunately is not enough. So actually registering is a relatively, I would say it's actually a very straightforward and very easy process. The only, there's a couple things there though that you should know. Once you've actually gone and registered you'll get a confirmation email and it will basically tell you when you'll find out if you've been selected or not. And then it will also give you the information on when the tickets will actually go on sale for that pre-sale. Usually the night before, two days before you'll get an email or confirmation saying hey congratulations, you've been verified, hooray, success. Or you'll be on the other end of the spectrum where it says unfortunately due to high demand you've been placed on the wait list. Now being placed on the wait list can be one of two things basically. One, it means there are just two people who signed up so unfortunately they couldn't give everybody a code which is why they kind of do this process. And then two, the other option when you're put on that wait list, it means that you unfortunately have been flagged. Now they're not going to explicitly state this but what it means is that if you have been flagged your account will never be able to successfully get a code ever again for a Ticketmaster verified fan pre-sale. Reason behind that is again like I said with the algorithm what they're trying to do is weed out rogues and bots. And so what Ticketmaster has done is basically flag that account to say hey we're always going to put whoever signs up with this account and this email address and this phone number. We're going to put them in this other bucket so that they never get tickets again because we don't like you. You don't know which bucket you've been put in so obviously the first time it happens you go on the wait list I would not be too worried or too concerned. But if you find that you've signed up for you know five, six, seven events down the road and every single time you're being put on that wait list that's kind of the time to get worried. The actual ticket buying process is a bit easier but at the same time there are a lot of kind of things that can trip you up. So when you actually are going to buy the tickets you have to one get into the wait room in time. So make sure that you are there you know about 10, 15 minutes where the presale opens. Reason behind that is that you actually have to go to the wait room you have to usually not always but sometimes you have to do another level of authentication. And then once you've kind of passed through all of that and the wait room opens and you know the tickets are going on sale you're put into a waiting room line. So once you're in that line it kind of depends where you are if you're in the first 2000 you'll have an actual slot or number that you'll see that pops up on your screen. If unfortunately you are you know 2000 or more you're just going to say 2000 plus please wait blah blah blah you'll see a little walking man there. Sometimes you'll think he kind of like tore his ACL because he's just not moving he's having a really tough time. But not a whole lot we can do there. Once you're kind of placed in that line it's just a matter of waiting for the ticket for you to get to the front. Once you're there go ahead buy the tickets congratulations you made it. You made it you did it congrats you are the best. That's kind of the jumpers of how the Ticketmaster verified fan presale works in terms of actually signing up very very straightforward though. We'll just jump into it right now. Take a look here. So all you need to do is there's a couple ways of doing it. One you can go to the band's website and then just click through the links there to get to the verified fan sign up page.  Once here just take a quick look at all the information. Just tells everyone on tour. Stay tuned. Sign in buttons here. We'll click that in a moment. What you'll see here is the deadline to register. So in this case closes Sunday October 20th 10 p.m. So what we'll do is just a matter of clicking the button. Sign in put your login information. You'll get to the bottom where it'll ask you to select which show or shows you're interested in. If it's just one show that you're able to register for you'll just see the one line. If there's multiple options generally we'll say your first second third preference however many options they give you. So all you do is kind of go to a drop down list and just pick one. The one that you want to go to obviously don't just pick any random one because we're not crazy. Anyway then last couple things there are these two checkboxes here. You can set to join the mailing list and then do you want to be notified of other verified fan programs with similar artists. I don't check these off just because I don't need any more spam than I already get. So you can leave those blank. But if you do want to be notified or you want to get more information things like that you can go ahead and select these. But I will be leaving them blank at this time. Then the last step is here once hit submit. You're actually going to go through a two step verification process. All you need to do is click the option that you desire so either text or call. And then what will happen is you'll get a six digit confirmation number that you'll need to enter in once it is ready. Alright so once your code comes in type that into your box hit confirm. And then congratulations registration is complete. Congratulations you did it.  So what you'll see on the registration page is a bit more information. Again this one here is important. It does not guarantee that everybody will get a ticket. So just keep that in mind. Even if you do register it doesn't mean that you'll get a code. If you do get a code doesn't mean you'll get a ticket. Last few things when you hear from us again.  You get an email basically saying hey congratulations you made it. Or unfortunately you can put on the wait list. So again you do need to have your mobile device available. Generally speaking the codes will be sent a few hours before the event goes on sale. Sometimes we get it the night before. But generally speaking it will just be a couple of hours in the morning of the event going on sale. Down here tells you when the presale will happen. So Tuesday October 22nd at 4 p.m. local time. And then they tell you the limit so in this case 4 tickets per code. Easy right? So yeah so that's basically how you sign up. Like I said it takes only a couple of minutes not even. The hardest part is really kind of picking out which show or shows you're trying to sign up for. But yeah that's kind of basically all you need to know on the sign up process. There's a couple of things that you can do to kind of help make your odds a bit better. So number one if you're buying an event that is local. Like so for example if the event is happening in New York and you're from New York. It's not guaranteed but for the most part if you're buying an event in your own location. It's likely that you are going to have a better chance of getting tickets for that event. Why is that? You're in a city where the event is happening. The odds are you're someone who actually wants to go attend that event. So if that's the case you know take a master when it goes through their magical algorithm. They'll say hey this person likes to go to events in New York. And this event's happening in New York. And I think we're going to let them in. So bam checkmark verify you are good to go. Now if you're buying for an event out in LA and you live in you know Toronto. It doesn't mean you won't get them but the chances of you getting selected to be verified are a bit lower than someone who again like I said is local. So if you happen to have a friend who's in the city of where the event's going to happen. You can sign up for sure but also I would recommend you just go talk to your buddy. Tell your friend hey can you also sign up for this verified fan presale because you might have a better chance of getting tickets. You know kind of just working together so that you can all have the best chance to get those tickets. Another thing you should not do is try and sign up multiple times. So if you sign up more than once ticker master will only take your final selection as your option.  If you want to go to the New York show but you ended up doing Minnesota as your last submission that's the one that's going to get selected for the verified fan presale selection process. It might say hey you've been verified for Minnesota not for New York. Sorry buddy. Unfortunately that's kind of just the way their system works. So you have to make sure that you're very careful with the shows you're picking. Also so if you sign up many times for the same show or for different shows this could potentially be a flag against you. So you want to make sure that you're not signing up for the same thing more than once and if you are you're trying to keep everything in moderation. Don't be so happy to sign up multiple times with the same account with the same information. Reason behind that is just because if you do this this might be you know seen as bought activity or broker activity. So again just want to be very careful with how you're actually signing up. So when you actually went through the weight room and you know ticket buying process you've been verified make sure that you only have one tab open for the event. Reason behind this is that if you have multiple sessions going at the same time Ticketmaster one again might flag you as a broker and then just place your weight room number back into the back of the line. So that's always a bummer because then you have less chance of getting those great tickets and then two if you have multiple sessions open a lot of the time it's going to happen is Ticketmaster is going to run it into error. So if it says hey you're logging into this device then you're logged into this device Ticketmaster doesn't like that they're going to say hey this device over here no longer any good we're going to kick you out of this weight room and then oh by the way this one too we're just not going to let you in. It's very important that if you're trying to have the your best odds you only want to have one session going at a time. Lastly once you've gone and got through all this process got your code got through the weight room you're into the place to buy your tickets you're on ticketmaster you're ready to go you see the map it's all full of blue dots don't click on the seat selection map. I would highly recommend against it. Only reason behind it is because there are many people all trying to buy tickets at the exact same time. So what's going to happen is you're going to see that map and it's going to show all these blue dots and all these great locations but because there's so many people buying at the same time by the time you actually go and click on the map and click on those you know four blue dots you want to get tickets are generally speaking going to be gone already. It's a problem the map can't update as fast as people are clicking and buying and checking out so it's very important that you try not to use the map as much as possible. If you feel like you want to use the map basically have an idea of what section you're looking at and then what I would actually recommend you do is hit control F and then search basically for that section. So if you're looking for section 221 just you know command F control F search for that and just start searching on the sidebar and just kind of scroll through and see what your options are from there. So what's going to happen is the sidebar will just show kind of the first main options you'll have option for top seats or just look whatever is like the cheapest available. So if you're looking for a specific section all you need to do is just kind of do that control F do a search for that section number. Other option if it can't find it just scroll down on the sidebar and what it'll do is kind of load up more options for you. So as you kind of skip scrolling it might open up different sections for you so then you'll be able to kind of jump in and find it from there. If you feel the need to go through the map regardless though make sure that when you do don't click on the best rows in that section available because many people have the same idea and they all want to buy those tickets what you should do is jump back a few rows so if you see you know row 10 and then row 12 and 15 you might be you know the experience level between row 10 and 15 if they're the same price you might have a better option of actually being able to check out with those row 15 ones. So if you want to kind of give yourself the best chances of actually checking out and getting good tickets kind of just jump back a few rows to give yourself better odds of being able to use the map to get the tickets you want. I think that kind of covers everything for Ticketmaster Verified Fan Pre-Sales. Like I said there's kind of a whole you know process and thing behind it and then obviously Ticketmaster has their own you know algorithm side of things as well and then on top of that there's just you know odds, odds, odds, odds, odds you never know what's gonna happen. So hopefully you guys are able to get successfully through this process every time you sign up. If you have let me know in the comments below if there's been any you know successes or failures or questions. If you like this video definitely hit that like button. I always, always, always am very happy when that happens. If you want to see more great content be sure to subscribe because I'm going to be starting to post every couple of weeks going forward and I'll see you guys next time.