Hello, everyone, and welcome to hacking and defending Kubernetes clusters. We'll do it live. You've got myself, James Cleveley-Prance. I am a security engineer at Control Plane. I lead our penetration testing services, purple teaming, deliver training workshops, and facilitate CTF events and scenarios such as one we run at KubeCon events like this one. Hi, I'm Fabian. I'm a security architect also with Control Plane, and I'm passionate about all things automation and security, especially supply chain security in the last year. I spoke at 6.com and some community days and meetups in around Berlin, where I'm also located. So, what are we going to talk about today? We'll do a high-level overview of what threat modelling is and why it might be important to you, and then we'll go through six exploit scenarios at pace. In each of those individual scenarios, we'll have a little bit of a look at the impact of the attack, and then we will map through to controls that we would use to prevent against some of the techniques that we demonstrate. And have a little bit of a discussion about those mitigation strategies. Then at the end, we'll summarise and have a look at what we've learnt in the session. All right. As James mentioned, let's first define the term threat model, or the exercise of threat modelling. So, what is this? In a threat model session, you should really define and also address the risks of your system, right? Why would you want to do this? Of course, you want to find security issues before someone else does. Hopefully, before it goes into production. So, to prevent this, we want to do this as soon as possible. So, if you have a new system, for example, do a threat model session as soon as an architecture is available, or even an architecture draft can be used as input here. If you have a system that is to be extended, this is usually done with the means of a user story or something similar. So, you can use that piece to think about new risks being introduced into the system and how to mitigate them. So, who should join these threat model sessions? This is a group exercise, so you should really bring everyone to the table, your developers, your SREs who know how to run this stuff in production, bring your security folks and everyone with domain knowledge or special knowledge about the system. Everyone can bring insights to the table and you find more risks together, and you find more appropriate mitigations together as well. Really, this is just a quick overview. If you want to learn more on how to do threat modelling, Rowan gave a great talk at the previous QubeCon. So, check out his talk for an in-depth discussion of the topic. So, there are great many resources out there to assist you in your threat model session. We will be using today the Microsoft threat matrix for Kubernetes. It presents you with a lot of tactics or entry points an attacker could use to gain access to your system, but it also presents you with the mitigations to take to prevent this from ever happening to your cluster. All of our six scenarios are based on the threat matrix, and we will reference the same mitigations they do as well. Of course, there are more resources out there specialized, for example, a container matrix, or the CNCF financial group, for example, worked on a set of attack trees, which are really helpful to think about or get in the mindset of an attacker, because usually it needs more than one vulnerability to really take over your system or access your database. So, you need to follow a whole path of attacks, and these attack trees visualize them very nicely. So, scenario one will be about discovery and initial access, same steps an attacker would also take. But before we dive into the scenario, let me set the stage briefly. So, we will run all the scenarios on a QubeADM-based cluster, but all the steps will work on any type of Kubernetes distribution. So, you can run it on a cloud provider managed Kubernetes, such as a GKE, for example, or you can run it on your developer laptop with micro Kubernetes. I really encourage you to take the same steps. It's very powerful to see how an attack plays out. You can watch your system and see which parts are affected. We've done this before, so that's fine. So, first, nothing up my sleeve, right? So, if we look at our cluster, there's nothing deployed with Helm. If we look at the namespaces and the pods, we can see, as I said, this is a QubeADM-based cluster. I deployed the WeaveNet-CNI for the networking component, and now I, as an administrator, am tasked to deploy Jupyter Hub. For those who don't know, Jupyter Hub is an application. Sorry, it's fixed size. The next ones will be better. Jupyter Hub is an application to run Python programs in an interactive manner, so it's very popular with scientists, data science, NLP, and so on. I, as an admin, just follow the docs of Jupyter Hub, I deploy the Helm chart, and have it running in no time. So, now we step into the shoes of the attacker. Attackers continuously monitor all the routable IP addresses of the internet, and they do something called port scanning, right? So, you can do this on your own with a tool like Nmap, and here we scan the ports 30K and up, so these are the node ports, and we can see that every external participant in the network can discover the open port, 31903, and if we check, this is exactly the port that is advertised or used by the public proxy of the Jupyter deployment. So, if we use the same information, the IP and the port, we can go to a web browser, browse there, and because it's a new application or freshly deployed application, default credentials of course work. So, Jupyter Hub is a very powerful application, and it makes it super easy for both the devs, but also attackers to directly launch a terminal from your browser and get execution in the port. So, getting initial access to a system is quite easy, as you can see with just a few misconfiguration steps. Maybe let's recap briefly. So, the admin deployed as per Jupyter Hub the Helm chart, they enabled the node port service, let's face it, setting up a load balancer is kind of pain in the butt. They of course didn't change the user and default password, and they were asked to deploy a really powerful application with lots of permissions. So, mitigations for this, right? You should restrict your traffic via network segmentation. Kubernetes uses a lot of ports, not just node ports, to basically manage the control plane or the backend of Kubernetes, and you should really lock those down, only make them accessible to those components or user, users who really need the access. And secondly, as with every application, you should use strong authentication, delete default passwords and users, this is not specific to Kubernetes, and even better use two-factor authentication. If you for example use this load balancer, you can do this in a single point and even set up things like IP allow lists and so on to make your system even harder against the text. Now James will talk about persistence. So, once our attacker has that initial access, it may be found a vulnerability or something exposed it shouldn't be, they're going to want to look, see what they can do and enumerate their environment. So for, I hope I can spell, there we go. How's that size at the back? I know I have no brightness control, I don't know if any of the tech guys can dim the lights maybe at the front. Thank you. Thank you very much. Hopefully that's a bit better. So for this scenario, we're getting our initial access through a leaked secret. So something by the sound of it that you're familiar with, but this is in this example, leaked through a Git repository. We can see a Git commit here. This could be in a public GitHub repo, maybe even a file in an S3 bucket. I'll leave you your imagination. But from the context, the attacker can see that the key in the config file is called token, gives us a little bit of a hint. And through previous enumeration, the attacker knows that this environment has Kubernetes clusters running. So the attacker makes an educated guess and here we set up the kubectl binary to use the token against the API server of the Kubernetes cluster that we have previously enumerated in the environment. So we can see tokens being used by the CLI arg down here. We're using the server IP address of the API server that previously enumerated and ignoring the CA certificate for now. So we'll set this up as an alias just to make the next commands a little easier and issue a version command just to check basic connectivity. And we can see with the server version returned to us, that gives us initial indication that at least our basic connectivity is working. And then the attacker will go ahead and will likely enumerate what permissions they have. So I'll have to shrink this down a little bit to make sense. Hopefully you can still read the gist of that at the back. But here we can see the permissions associated with this token which are largely default. So these top lines are default permissions that are available to tokens for querying what they can do just as we're doing now. And these non-resource URLs are default as well which is kind of just discovery based. The interest are the pod permissions, deployment permissions and namespace permissions which are definitely not default and have been added to this token. So the attacker is then going to use these credentials to start enumerating cluster at which point and start trying to make the most of those privileges. So here the attacker is running a benign command, ID in a container, check in the output just to check that command run successfully. And then after that the attacker may look to create persistence at the Kubernetes level. So here using a slightly different resource type of deployment which affords them a level of persistence you could say just as the workload is more likely to be recreated if for any reason it was killed off. So you can see here the creation of the deployment using our benign ID command. We'll check that the workload is creating and that the command has run successfully. And then demonstrate if for whatever reason the pod was killed it's recreated in the API service giving us a slightly better chance of persisting in that cluster long term. So what have we witnessed here? Our attacker has found some credential externally, not in our infrastructure or in a public facing part of our infrastructure has managed to execute commands and got a foothold in our infrastructure so this may allow them to do further enumeration and maybe exploit other things in our infra. How do we mitigate against this? So the first option here is restricting access to the API server on a network level. At the very least we can implement an IP allow list restricting access to the API server. Even better would be putting it in a private network that only we had access to. Further to that we can restrict what sort of things attackers are able to run in our clusters through gating images through a policy framework such as OPA Coverno or if we're using private networking it might just not have external access. And then in addition to that we want to restrict people from running workloads with any additional privileges and potentially escalating escalating their privilege to something that is undesirable so we can again use one of those policy frameworks or something like POD Security Standards to restrict these. So talking of privilege escalation we're looking at that in a little bit more detail in this next scenario. So in this demo the attacker has landed in a privileged container so this is either the attacker has managed to create a privileged container and exec into it or they landed in one through a vulnerability in a workload. And here they're enumerating and the attacker has found that there are unmasked devices in the container and is enumerating through those devices to see what they are. So here the attacker has found that the one of the devices looks like a primary file system for a VM and so they're mounting that file system into the container and verifying the contents of the device. And here we can see it looks like a root file system and is a good chance that it will be the host OS. So at this point attacker may look to jump directly into the host which could be achieved in a number of methods. Maybe a malicious cron job back during bash RC but in this instance we're going to drop a malicious or a key SSH key under our control into the authorised key file of the root user. From here the attacker would be able to SSH into the VM host and completely bypass containerisation. So what have we seen here? The attacker has started off in that initial foothold and has privilege escalated onto the VM which may allow them further escalation or access to further resources for abuse. What can we do to prevent some of this some of these types of attacks? So really there's only a few limited use cases for use of the privilege container. They should absolutely not be used in day-to-day workloads. So auditing our clusters to make sure we're not using these kind of privileges as much as possible is really important. The recently introduced pod security standard is an excellent way to prevent these kind of breakouts. Just because the baseline default prevents a lot of mischief and as it's built directly into Kubernetes is quite easy to use. I'll hand back to Fabian for the next scenario. Thank you James. So next scenario will be about authorised or in this case unauthorised access. It's not a feature. That's definitely a bug. So in this scenario we're deploying just a plain old pod into the Kubernetes cluster. As you can see here, there's no magic in the spec. It's just a container image getting deployed. We're using an image with kubectl in it to interact with the Kubernetes API. You can exchange this for any other tool that can do a network request like curl or roll your own. So once we have the pod scheduled to be deployed we can extract into it and as we can see without having any additional things in our pod spec there's a secret available in the pod at VAR Run Secrets Kubernetes IO and that's the service account. So each pod in Kubernetes gets the service account to talk to the Kubernetes API and as we did in a previous scenario we can now use the CANI command to basically list all the permissions we have with that token. We can see it gives us a lot of permissions to query additional information about the environment so an attacker could use this to for example query all the API resources we have in the cluster and we can see on the bottom right-hand side for example the tecton, the CRDs for tecton are available in the cluster so this would give an attacker an idea to look for further vulnerabilities look at known vulnerabilities in tecton and leverage those to continue their journey through our cluster. It's the same for the API versions we can also query those with the token we are not allowed to query pods or secrets not even in the same namespace so it's somewhat limited but still has some value to an attacker. So what can we do about this? There is an additional flag in the pod spec we can set which is called AutoMount service account token which by default is true so we get the service account token or we should definitely set this to false for every pod that does not need to talk to the Kubernetes API as we can see when we exit again into the container there is no more service account for us to use and therefore we don't have access to these additional information so other way around now we have an application that actually needs to talk to the Kubernetes API and instead of using that default service account or extending it we should really create our own service account so to do that we create the resource of the service account for our machine user we create a role that is allowed to get and list secrets in the default namespace and we attach those two resources together with a role binding and in the pod spec now we can specify the service account name and this service account will now be made available inside our pod again we exit into the pod and with kubectl for example we can see that we can now query the secret but we can also list all the other secrets in the namespace which may or may not have been intended but we see here that for example credential available in the same namespace which we can now read out so let's recap briefly so every pod has this default service account and we should really disable this via the shown config field and we again should use least privilege principle so even when we define custom roles for our services to use make sure to really lock them down as much as possible you cannot only list limited to the namespace but you can also limit it to specific resources, the verbs so pay attention to all those things to only give the required amount of permissions so next scenario is about poisoned image in the container registry and for that scenario you do like the gifts a lot more nice to see in demo 5 we can now use the docker credentials we discovered in the previous scenario to attack the container registry of our Kubernetes cluster so we can see here for example we have a deployment in our Kubernetes cluster which is called awesome cats which is hosting some cat pictures seems like the perfect target for me we can configure the docker credentials we found in the previous step and use a tool such as crane which is very powerful to do weird operations on container registries you can standard scenario list at least the versions of an image and we can also fetch the digest so we can see here there are four versions of this container image available in the registry and latest is always a nice target for an attacker to see and we will see in a second why so we will grab the digest of that latest image which is like the fingerprint behind that image and we can use another docker file to basically now extend the image we have discovered so we start from the image but then we eject whatever code we want we hide it in it as H and we extend the entry point to execute our script before like the previous entry point is called again so we are not raising any suspicion by breaking their service so after building and pushing that image we can refetch the digest and we can see that this has really changed so this was 8.8 before now it is 3.0 and we have a different image behind that latest tag we just overroated so what you could expect is that our code is now running on Kubernetes but that's not the case because we have a command executed this is because Kubernetes is not like watching the tags in the registry it is only downloading the image if necessary so we as an attacker need to force the pod to get redeployed usually you find a lot of vulnerabilities for web servers where you just crash them so the pod dies, gets rescheduled and the image gets downloaded again I will simulate this by just scaling down but you can find those malicious payloads easily to crash a lot of web servers so once the rollout was successful and the pod is rescheduled we can query the service again we can see the service works fine no one is checking or double checking but we can see that now our code is executed and we can do whatever we want in the system alright so what have we witnessed is the leaked container credentials and the lessons learned here is really we need to protect also the external cluster dependencies right usually you have container registries but also config repositories if you're doing GitOps we have deployment pipelines and secret managers and all of these have power over our cluster they can be abused by an attacker to gain some sort of control of what is happening inside our cluster so specific mitigations for this attack is really to pin by hash so any kind of attack that can be overwritten by an attacker is a nice target if an attacker adds code to your container image the hash will change so now if you pin by hash the attacker has two problems they need to attack the image but they also need to attack the deployment file and change the reference in there to get them malicious code deployed which makes it even harder for them going one step further we can also use container signing so only deploy images that are signed by us if we do that the attacker now also needs to gain access to the private key and sign the image before it can get even scheduled in Kubernetes and lastly we should really use short lift secrets we heard this a lot but if the credential for the Docker registry is long lived the attacker also controls this attack vector for a very very very long time if we make those short lift the attacker really is is on the timer to get that attack out there and maybe we can lock them out before they can get to the next step all right scenario 6 is about evasion and James will speak about that so once we've gone or the attacker has gone to all this effort to get access to our clusters maintain the existence there they may want to avoid being detected by the administrators so we'll have a look at that in this scenario so at the Kubernetes level one thing that we're given is a resource called events which is the same as any other resource but it is kind of a meta resource implemented by Kubernetes to give us information about what's happening in the in the control plane and in the cluster so we can see normally this has a whole load of information about what's happening so for example we're looking here at fairly vanilla cluster but even then there's a lot of information we can see information about cube proxy some control plane components here as I said we're in a cube ADM based cluster there's some calico stuff here that's the CNI we're using there's a whole lot of information and if we're a malicious actor there'll be some information in here about the workloads that we've been creating and what we've been doing to the cluster which is potentially undesirable so what we can do is just delete the information and as shown it's all gone easiest that so this is a little bit suspicious I don't know about you but if I came to my cluster tomorrow and saw no events whatsoever I think something very fishy would have happened so a more skilled attacker sorry may go through and selectively delete events but on the Kubernetes level this would be a great way to start avoiding some detection by administrative and security teams so one of the issues here is that this attack is a little distribution dependent so if you're running in a cloud provider it's more than likely that your events will be shipped off to the cloud provider's logging solution so therefore deleting event logs in the cluster won't delete them in the logging solution so it's not quite as useful in that scenario but it's definitely worth checking because it'll depend on the setup if you're in a provider that manages the control plane for you they'll have made a decision about how they handle logs so it's dependent on which provider or distribution you use as to what they're doing there as to how effective this would be again looking at the level of privilege an attacker needs to do this there's very few scenarios in which a user needs delete events they should really only be restricted to be like cluster admin I'm really struggling to think of any legitimate use cases for this and so yeah reviewing these permissions to make sure they're not unnecessarily distributed as key so looking back at all these scenarios what have we understood today so hopefully some of these scenarios have helped you understand why some of the best security best practice exists and what the impact of some of these exploits is hopefully you'll be able to take some of the resources we've linked to today away from this session and that will help you some of your threat modelling exercises going forward and hopefully we've communicated some of the importance of threat modelling to you to help you contextualise and prioritise some of the risks you or your org may encounter so we realise this is quite a rapid run through a lot of the topics we've talked about today if you have any questions about threat modelling or any of the exploits or scenarios you've run through please feel free to ask a question or drop by at the end of the session and ask us more and we're more than happy to chat about any of it to you thank you we're running there's a couple of sessions of our threat modelling available to those that are interested where we're running 20 minute sessions as a company you're more than welcome if you've got any organisational problems although there's I think a couple left this afternoon so yeah come and chat afterwards also if you're interested we have a booth in hall 5 and jobs available thank you


I'm in India. I am officially getting in my lift to get to the airport, to Meesebrick, to fly to you. Let's get this going. Just got to LAX at the International Airport. Gotta go to customs. But first I need to find that decrepit old man. Let's see if we can find him. Your mom. So we are here at the LAX International. We haven't gone to customs yet. We're at the currency exchange. They're apparently on lunch, lazy people. Yeah, exactly. So we have to hurry up and wait. I have to get my rupees. Gotta get your rupee on. Gotta get my rupees. Gotta get your rupee on. Oh, yeah. I got my stylish mask here that I bought specifically for this. Ah! Oh! That's not gonna work. How's that? That's perfect. How's that? That'll protect you from everything. The corona virus, the Budweiser virus, the... You know what the CDC... Kingfisher virus. You know what they said? The CDC said in order to be fully effective, you need to shave your beard. Wow, that's not happening.  You probably don't even need that. Just put your hairs over your nostrils.  I think I look awesome. I think you do too. So I just touched my first Indian rupee for the first time. You did. I did. So now I got all my quiche for all my food. He's got all his roots. I'm gonna say hi, Indrani. I call it mango money. It's all my mango money. So, checked in our bags. Now it's time to go through some customs. Yeah, we gotta be sniffed by dogs. I hope go straight up into the bearded bastard's crotch. I'm hoping they don't know that I'm carrying a monkey with me. Or a hoverboard that your monkey uses because apparently... You're not allowed to take those. They've actually had a sign at the desk. No monkeys? No hoverboards. Well, our monkey rides a hoverboard. I think I should talk like Bane for the rest of the time. And I also love... He has a sleeping pillow, but he can't sleep on planes, so... But gotta try. I gotta try. Rick's bag got flagged. Let's check in. Always. What are you doing? I'm special, man. They always, for some reason, think there's something sketch in my bag. It's probably your face. Probably. Yeah. You know what it is? You know what I packed? You don't have a trusting face. No coronavirus for me. Well, we made it through security. Don't know why. Yeah. They apparently didn't find our weapons.  That's true. I hid that in my butt. So now the bearded bastard is looking for some food and some alcohol. Right here. So... Oh, you know what you really want to get? What? Is the caviar and champagne bar, my friend. Oh, yes. And two, three hundred dollars for a little taste of caviar. Caviar?  That's good stuff. It's a caviar and champagne bar. So if you want, like, say, 30 grams of the imperial one, it's 231 dollars for that 30 grams. So, we are headed to our gate. We just had some lunch and an alcoholic beverage. Alcohol is injurious to your health. I have to do that or they'll demonetize us. It was not an old monk. No, because we're still in Los Angeles. Yeah. I had some Jameson. But they just called and said our flight is boarding. Which is weird. It was like an hour before, but, you know, we don't want to miss it. So here we go. Bye. Hey, Rick. Hey. What? How's the Josh? No, not very well. Man. So we are boarded on our first leg to Amsterdam. Just found out they don't have Wi-Fi on this plane because apparently we're stuck in the Middle Evil ages. Yeah. And there's no charging ports. No charging ports. So, I don't know what year we're in, but apparently we're in the 20s. Anyways, we will update you when we land. When we land. Because you ain't going to hear from us in the air. Yeah. Well, maybe I'll film something when Rick falls asleep five minutes into the flight.  I'm already prepared. Unfortunately, I can't post them while we're in the air. You have to take pictures of me sleeping. It's kind of a weird obsession of his. Here we go. Got our first meal. I got some second drink of the day. Let's see what we got here. What is this? Coleslaw? And this looks like a brownie. Kind of brownie. And you got the... I got the pasta. Vegetarian pasta. Vegetarian pasta. Same things as you. Oh, good. We just landed in Amsterdam. Watch your language. I know. We have about a three and a half hour flight. I mean, a layover. And then an eight hour flight. I wish it was a three and a half hour flight. Another eight hour flight. I got my Starbucks. And apparently a new Oxay trailer just dropped. And we are trying to figure out how we can film that without getting kicked out of the airport. Yeah. And the tripod is in the suitcase, but that doesn't matter. Yeah. So we're going to try and figure it out. You'll know before this is up if that trailer reaction was able to be up or not. So we'll see. I just ended in the Oxay trailer and uploaded it. It took forever, only like forever. And now we are with some delicious cheese. Dutch cheese. All right, India. We are now boarding our flight to New Delhi to you. So in eight hours we will be inside you. Sounds disturbing. All dressing crackers. What did you say? It sounded a little good on this flight. They would say that is incorrect. Rick is still waiting on his. It's because he's a sketchy looking fella. I tried to tell you. You know what it's from? All the wine on my pants. I spilled wine on his pants on the plane. Not on purpose, but it's fine. We got our bags and are now about two step foot. Well, me, except put in India for the first time. Both of us have put in New Delhi for the first time. Well, I've been in this airport once before. Oh yeah, I have. Well, you haven't stepped out of the airport. Correct. So point still stands. It's true. There's all these poor stray puppies. So is he at. So we're waiting on Andrani right now to meet up with us. I've never met her. Oh. Kissy kissy. Moosh moosh. Kissy kissy. Moosh moosh. So we are currently trying to find a ride.  So I found one red car. I don't know if that's them. Apparently we found them. It's a red car. They're just getting out of the car. Explain to me rules of the road here. There's no rules. You don't have to. These are mostly suggestions. The lines are just suggestions. These are mainly suggestions to let you know where the road is heading and where you shouldn't go. So basically the lines. So you didn't have to stay in the line? Yeah. Since it's self-driving until they have a whole chip thing. Yeah. That's how it should be. Start in the very old GPS. I don't need them from. Continue along the lines. They're running into each other. If you don't know. It's like they aren't the total man. India. And before I sign off, let me show you our wonderful view. This is our fantastic. What a view, no? Yeah. It's our great view from our Airbnb. Well, we have an early morning, tomorrow morning. And we are getting right going. We're going to eat some breakfast. We're going to see some stuff. Then we have a meet up. So we're going to be going nonstop. And we're going to be exhausted. I'm running on no sleep for more than 24 hours. So I'm going to go to bed. But we're in India.


Don't use Aliexpress until you watch this video. Hey, are you considering using Aliexpress for a drop shipping business? Ooh, it can be really dangerous, or it can be awesome. And in this video, I'll explain to you exactly what you need to do to use Aliexpress for your drop shipping business. And we're starting right now. Hey, I'm JR Fisher. Welcome to my channel. I appreciate you being here. It means so much to me. And if you would do me a favor, hit that subscribe button down there. Next to it, there's a bell. The bell sounds like this. And I swear, I swear really, if you hit that bell, it's gonna sound just like that. Try it out, you'll see. And then turn on all notifications, every single one of them. That way, I can notify you every time I do a video. Every time I go live, you will be told about it because you're part of my family, the Fisher family, the VIP group that gets notified before anybody else. Now, I've been selling online since 2009. 2009 was a lot different. But now things have changed. It's a lot easier now. No, it's not harder, it's easier now. I sold millions of dollars of both digital and physical products. And I didn't have access to things like Aliexpress. I mean, it's a pretty cool thing. Drop shipping has become a huge business. People don't mind it, okay? Some of the biggest drop shippers in the world are places like Home Depot, okay? Amazon is a drop shipper. So there's some huge drop shipping companies out there and you could make a lot of money doing this. But you gotta be careful and that's what I'm gonna show you in this video. First off, we're talking about Aliexpress. So what is Aliexpress actually? Aliexpress started in 1999. And they were a result of people not being able to find the products they wanted easily online. So Aliexpress is really a group of manufacturers and distributors of Chinese products. The way Aliexpress works is that you can put in an order there and you can put in another address to have it shipped to. Now these products are extremely low cost. Some of them are low quality. Some of them are really good quality. But the point is you can drop ship there because I can buy a product and not send it to myself but send it to somebody else. Which means I can go out and sell a product prior to actually buying it, collect the money, give it to Aliexpress and then they ship it out. I don't ever have to touch the product. I don't ever have to package anything. Pretty cool system. Now I will tell you, if you're thinking about selling on Aliexpress, there are shipping costs, but you wanna always look for the one that says E-Packet. Don't use anything other than E-Packet. Do not use anything other than E-Packet. I'm telling you, it will burn you every time if you don't use E-Packet. So you must, must, must do that. Just take my word for this. So here's a screenshot right here from Aliexpress. And as you can see, drop shipping simply means when your customer makes a purchase from your site, you order the item from your Chinese supplier and they ship it to your customer. You don't need to hold any inventory or worry about packaging and shipping. Drop shipping from Aliexpress requires you to first set up a store or have a place to sell your goods. You can do it through Amazon. You can do it through eBay. You can make your sales pages in Cartra. I highly recommend Cartra. I will put a link to Cartra below. Cartra is a wonderful marketing tool if you're selling anything online, you need it. It does email lists. It does sales pages, videos, does it all? Just check it out. There's a free video down there you can watch. And if you like it, you can get a trial for $1. It's true that there are pros and cons to drop shipping. So let's hit those real quick. The first pro I guess is that Aliexpress has a database of hundreds of millions of products. So there's gonna be something that you can sell there. That's just a guarantee. Starting drop shipping with Aliexpress is absolutely free. It doesn't cost you a dime to do so. Getting started, there's no barrier whatsoever as far as finances go.  You don't have to worry about that. You know exactly what it's gonna cost you. You know exactly what you can sell it for. And the other cool thing is product trends pop up on Aliexpress overnight. Things like fidget spinners. As soon as that hit, there were tons of people that had them, tons of suppliers that would send them to your customers. And a lot of people made a lot of money on that trend. Now there's cons to it too, of course. You have to check out the seller. You have to find out if this distributor or this manufacturer is reputable. Fortunately on Aliexpress, they do have reviews in there and you can go in and read the reviews. The other thing is shipping takes a long time. I mean it's coming from China, so it's gonna take a long time. As long as you prepare your customer, you say hey, this is a high demand product. It's gonna take 15 to 21 days or whatever it is. And I always like to tack a little bit of time onto that because it could take longer than what you think. But the other problem with Aliexpress is you can't really bundle items, okay? If they buy three different items and they're coming from different distributors, you can't have them all arrive at the same time. So you have to let them know that you are drop shipping, that you're getting these products from several different suppliers and they're gonna arrive at different times. As long as you tell people up front, you don't have the problem. Where people really have problems is where they don't tell them how long it's gonna take to ship. They don't tell them that their items are gonna arrive at different times and then the people get upset. And then you're dealing with customers going back and forth, asking you questions and wanting refunds. So if you just tell them up front, they can make the decision whether they wanna buy or not. Now the next thing I hear is Aliexpress safe and reliable? And the answer, in short, yes, yes it is. Aliexpress is safe as long as you use it in a safe manner. The great benefit of working with Aliexpress is that it offers a lot of protection for buyers during ordering, shipping, and in case of returns. The site's functions have been designed to keep the buyer in mind through every phase of the stage there. You can actually look people up on there. You can look at the reviews. You can look at how many units they sold. You can look at if people are happy with the ones they receive. So it's a pretty safe place. I would say in the beginning it was less so, but now it's gotten really pretty safe. Now in the beginning of this, I told you to always use ePacket.  That's true, but it may never show up. It may get lost, okay? ePacket is the safest way to get it to you. It's coupled with the safest and the fastest way to get it to you. So choosing any other way of getting it to you is either gonna be more expensive, slower, or you may not get it at all. So don't do anything other than ePacket. Now keep in mind, there are some limitations to ePacket and it won't apply to all your products, but as long as you fall into these guidelines, you'll be fine. ePacket delivery is available for goods up to two kilograms, which is 4.4 pounds and they have to have less value than 400 bucks. So I would recommend anyhow, if you're doing drop shipping, I would fall into that anyhow. You don't wanna be selling heavy, bulky items. Now we do, we own Survival Cave Food, which is a large survival food company. We have cases of meat that are 56 pounds but we actually ship those out ourselves. We have a warehouse and all that. When you're having somebody else ship it out, this is the way to go. You have a lightweight item, low cost item. Now if you're watching this and you're in the US, ePacket is available to you. However, they're now expanding it to over 30 different countries.  Now the next thing is, you need to find a product to sell on AliExpress. Yeah, it's simple enough to sell products but you gotta find a great product. You gotta find a product that has enough profit margin. You've gotta find a good distributor for it, a good manufacturer for it. So you're gonna have to do some research. It's not hard to do but that's where you should spend the majority of your time is researching products. Try to find something unique, something that's not ordinary. Something that they can't just run down that's to where you get. You want a unique product and you want a good manufacturer or distributor who's gonna sell it to you. Now if you're using something like Shopify, I'm gonna recommend Oberlo because Oberlo will actually add the product to your store automatically. All you have to do is click on it, add it to your store. It's really that simple. Now, when you're doing that, you've got to be aware that a lot of the descriptions, a lot of the text is written by somebody who is not a native English speaker. If you're selling in the US, Australia, the UK, Canada, you've gotta understand that those descriptions were not written by somebody who speaks English so sometimes they don't make sense. You've gotta go back through and make the corrections in the spelling in there because if the spelling is wrong, they get a distrust for your company right off the bat and they may not buy from you. You've also gotta remember to mark up that item enough to where you're gonna make money, okay? So I'm recommending anywhere from 100 to 200%. And if that makes the product too expensive, then move on to the next product because there'll be another product there. There's millions of products. You don't have to worry about that. Now the most common way to set up your account on AliExpress is using a credit card, American Express, Visa, MasterCard, whatever you've got, they probably take it on AliExpress. They also have money transfers, wire transfer, all kinds of other ways of doing that. You can go to AliExpress and check all that out. But pretty much they take everything, they take it all. Now they do have a refund policy on AliExpress and they really do try to protect the buyers on AliExpress so you shouldn't have a problem there. But if you see a manufacturer distributor that's on AliExpress and they don't give refunds, beware, beware, beware, beware, okay? Because those are the ones you're gonna run into a problem with. You wanna make sure that they do accept refunds because sometimes stuff gets lost, it won't get delivered or whatever and you don't wanna be out that money and then have to refund it to your customer. Now a few extra tips I wanna give you so that you don't run into any problems. You don't really want the customer to know it came from a drop shipper. So you could do things like ask the supplier to not put any packing slip, invoices, prices, samples, anything inside the package. You can ask them to do that. And I would recommend you doing that. Number two, it is not regulated when AliExpress the way it is in the United States or maybe Canada or the UK or any of these places on infringement of copyright. So if you see an item on there that says Disney on it or you see an item that says NFL or the NBA or National Hockey League, don't sell it. You will get in trouble in the U.S. Even though, yes, even though it was available and they said it was real on AliExpress, I promise you it's not real, it's a knockoff and you're gonna get in trouble. So in a nutshell, that's how it works. AliExpress is a great way to get your business started without having to buy inventory, without having to worry about shipping stuff out, without having to have piles of boxes of tape and all those things in your house. So AliExpress is a great way to go and it is safe as long as you follow these guidelines. I hope you enjoyed this video. I do have a course below, it's a $97 course. You can get it absolutely free by just clicking in the link below and you don't need a credit card, which is really nice. If you haven't subscribed already, please do so, hit the subscribe button down below and turn on the bell notification, ring the bell, turn on all notifications, you'll be part of the Fisher family, the VIP group that gets notified every time I do one of these videos. I also want your comments. Don't forget to comment below. Let me know what you think of this video. Give me a thumbs up, thumbs down, something, some type of reaction. If you've had experience with AliExpress or drop shipping, tell me about it in the comments below. Thank you so much for watching this video and I'll see you in the next one. Hey, thanks for watching my video. Don't forget to subscribe to my channel and click that little bell right there so you can be notified every time I do a new video. Also, click on one of those videos there, keep watching on my channel.


Nothing beats being on campus. We're on the quad. Everybody's out here. The grills are going, the music. We're ready for some on-campus football. Football's back. It's great. Denny Choms is rocking. So we're just out here having a good time. Good afternoon, everybody. Welcome back to Bryant Denny Stadium here in Tuscaloosa. It's the Alabama Crimson Time. And the Aggies of New Mexico State. Here's Tua. Stands in, looks towards the right side. Jerry Judy, touchdown Alabama. 21 yards to a tongue of a law. To Jerry Judy. I believe I've said that combination a few times. Gets the snap, chest high. Looks and then takes off, running for the 20. He's the 15, he's the 10. He's going to go wide open. Touchdown. Reaction is Matt Throws. Judy Stutterstep makes the grab, breaks the tackle, and carries a man in for the touchdown. Bama will win it by a final of 62 to 10.


What do you think of when you hear Christmas? Personally, I think of spending time with loved ones, good food, Santa Claus, the art of giving gifts, and then I think of warmth, and food once again. And finally, I think of Christmas specials, a Jetsons Christmas, a Flintstone Christmas, the Polar Express, and my all-time favorite, a Charlie Brown Christmas. Today I want to look at what this timeless classic represents for the upcoming holidays. A Charlie Brown Christmas was created in 1965 and with it a unique inception. As stated in Charles Schultz's book, A Charlie Brown Christmas, The Making of a Tradition, producer Lee Mendelson initially approached Schultz with the idea to create a documentary about his popular Peanuts comic strip, specifically creating a pitch about Charlie Brown and baseball. Though the documentary was never picked up, Coca-Cola was interested in the idea of a Peanuts Christmas special. And with six months to make it, Charles Schultz wrote the special alongside Bill Melendez as the animator, Lee Mendelson in charge of the cast, who were comprised of mostly kids without acting backgrounds, and finally, Vince Garaldi and his team, the Vince Garaldi trio who provided a warm, playful, and a true Christmas soundtrack that later went on to be voted into the Grammy Hall of Fame in 2007. Though Schultz himself believed that his comics were not art and that they were not timeless, the Peanut creator was sorely mistaken. The special would be aired on December 9th, 1965, and on that day, a Charlie Brown Christmas would be immortalized, being the longest running holiday special on television, with its themes still relevant today. Although these holidays are associated with love, happiness, and laughter, we often overlook the other side, a time where some experience depression, anxiety, and stress over many different things over this holiday season. And Charlie Brown himself is no different, he too is feeling the holiday blues, as he constantly reiterates his distaste for Christmas. It has become a time where some students have anxiety or become depressed over finals, simply because of the season, or other things. People stress over that feeling that they are forced to buy gifts for others and spend copious amounts of money that they may not have, and some people don't have loved ones to celebrate the season with them, which again creates those holiday blues. And Charlie Brown is no different, his self-worth is fading because he doesn't receive the attention or the love that he feels the other children are receiving, and the fact that it's the holiday season simply accents his feelings. As the special continues, Charlie Brown searches for the meaning of Christmas, and he later finds it in that little tree that he buys. The other kids heckle Charlie Brown because it's not a big fancy tree like the others, but nonetheless he bought it, and while stating that the tree needs him, I think Charlie Brown needed the tree to strive him away from the commercialism of Christmas. A theme that is so relevant today, and though he believes he ruined their tree in his holiday, Charlie Brown's friends decorating the tree steer him to the true meaning of Christmas. Charlie Brown chose the tree for what it was, a Christmas tree that he loved, and that it was never about the tree, but it was about the fact that the kids were together. Appreciating each other's company and joy. This special doesn't have breathtaking animation, nor does it have incredibly deep philosophical meanings, but that's not what it's there for. A Charlie Brown Christmas has simplicity, vulnerability, innocence, and it is humble. It is there to remind you that your feelings are valid and you are not alone. And it's also meant to teach us that the holiday season is not a time to commemorate materialistic possessions, but a time to spend it with the people that you care about, and the people that you love, and if you don't have anyone to spend it with, it is a time to remove yourself from the dramatics and the pressure of everyday life, a time to relax and a time to be thankful for what you have, and for others a time to be thankful for who you have. So this holiday season, try and make it a time to be in good spirits, spread the love and joy. A Charlie Brown Christmas has been airing for 52 years because of its message of positivity and hope to everyone. And with that, happy holidays.


the bless of a drama queen, Van Derra. Like, you're basically a serial killer. Like, that's your John Sunshine and Rose's Disney princess. No one is necessarily gonna jump to that conclusion. These books are not like other Y8 books. Okay, I kid, I kid, but also I don't kid. That obviously the title of this video and the idea for this video is a little bit tongue in cheek, or at least I hope that's obvious. That being said, any genre, subgenre, any sort of area of anything. Movies, music, TV, books, whatever it is, can often just sort of become known for or is often lambasted based on its most cliche tropes or themes or recurring trends in it. And so it's easy for people who are not familiar with those genres, subgenres, et cetera. Again, of music, of TV, of books, to sort of write it off based on, I wanna say it's worst, but also not just it's worst, but it just, it's sort of like most typical, if that makes sense. And that there is, well, to some degree that's fair, because there is a reason, a genre, or a lot of something becomes known for a certain type of thing. One, there's often things that just do those things very, very well, better than you would expect. And also there's plenty of things within that space that defy those stereotypes, that defy those themes and those tropes. So while there is truth to there being those kind of tropes in that space, it's not true of every single thing that is in that space.  Like people who love romance, it is known that romance can often have a sort of formula to it. And this is not a bad thing to the people that enjoy it because it's a formula that is there for a reason and this is what people seek out. Like this is what they are wanting. But again, there are things that step out of that formula that defy that formula, et cetera, et cetera. Anyway, all of that to say, this video is meant to be tongue in cheek. But I wanted to kind of talk about some YA books that, well, there's nothing wrong with the types of tropes that you find in YA unless that's not a thing that specifically appeals to you. But so if you're writing off anything that's shelved in YA because you're like, all of it is just gonna have these tropes in it, that simply isn't true. So I have a list here or a stack here of books that in my humble opinion, these books are sort of transcend or subvert or diverge from the typical YA cliche tropes formula, et cetera. And so for anybody that avoids YA because they are avoiding what are more standard tropes and plot types and this sort of thing, these are some YA books that you might wanna check out because these YA books are not like other YA books. Top of my stack, I have The Diabolic by S.J. Kincaid. This is a book that I take every opportunity to sing the praises of and I'm always picking it. I wanna have the opportunity to choose a book for someone to read because it is so overlooked and underloved and it's so, so, so, so good. So this is YA book as they all are, but I'll probably say that about all of them. Just people don't get on me, I will say. This is YA, like I know we know, but whatever. This was originally published as a standalone and can be read as one, though there are two more books, it is now a trilogy, but it absolutely works as a standalone and there isn't sort of open-endedness to the ending that doesn't feel like, well, but they wanted a sequel. It feels like an open-ended story that's meant to be left open-ended. That said, I did have read the second book and I really liked it, I need to read the third one. But anyway, all I have to say, The Diabolic by S.J. Kincaid is YA sci-fi and it follows a character named Nemesis and Nemesis is a diabolic and in this far future where we have sort of left earth and we're off in the stars, there was some kind of like cataclysmic event that has made society distrust technology. So they use a lot of tech that already exists, but they don't know how to fix it or how to use it and it's like forbidden to study that. And what they do how are diabolics, which are these sort of genetically engineered super humans that are sort of bred to be bodyguards for the nobles and the elite and the rich. And so what happens to diabolics is again, they are bred to be, they are physically much stronger than a normal person and more agile, et cetera. But when they are purchased by a noble family, they go undergo a sort of brainwashing to make them love above all the person they are purchased for so that their raison d'etre becomes the life of this person that has purchased them so that their life is meaningless if this person anything happens to them. So they will lay their body on the line to protect this individual. So Nemesis is purchased by a rich family to be the bodyguard of their young daughter, Donia. And so they kind of grow up together. They kind of have almost sort of like sisterly bond, but Nemesis is a diabolic. And so meeting from her perspective, she doesn't really quite think the way a normal person would. She's been brainwashed to love this person, to protect them. And the way she's treated by the family, it's kind like they, she has a place in the home, but her purpose is to be a bodyguard. It's understood that like your body is, the purpose of your existing is to potentially die for this person. But so the main plot of the book unfolds when the government, the people in charge decide that diabolics are too dangerous to have around because other noble houses that rich people have been using diabolics as assassins to kill people. So they decide it's too dangerous having diabolics. We're getting rid of diabolics altogether.  We're getting rid of them.  And then, because Donia's family is in trouble politically, they want to have Donia sent to them, basically like as a noble guest, but everyone understands this is going to be like a noble hostage, kind of like back in the day. But so instead of sending Donia, they disguise Nemesis as, and has sent Nemesis in her place. This is a way to protect Donia, to take her place. So Nemesis kind of like Eliza do little, has to sort of learn now, unlearn being a diabolic and try to appear to be a weak vulnerable young girl in order to pass. And so she goes to the center of power where she is now going to be impersonating Donia. And there are a lot of sort of political things going on that she has to navigate. She has to navigate emulating being a human, while also navigating this like tricky political situation which Donia would have been thrust in the middle of. And the story goes from there. It is an amazingly well-executed book, like the way that it examines what it means to be human through Nemesis. Nemesis is an amazing character to follow. I love her as a protagonist. There are other, I don't wanna say too much kind of about what goes on, because some of it is spoilery, which is a lot of it is spoilery. Even telling you what inspired this book, like what story S.J. Kincaid was inspired by, is spoilery if you know about what is in that story. Most people don't. It's not a super widely known or read story. Actually it is a, no, I don't wanna say too much. Anyway, point being, if you know what it's based on, you'll know immediately what's going on. And that's what I wanna say. But it's just so good. It's good as sci-fi. It's good as an exploration of humanity. It's just a good character story. I love following Nemesis as a protagonist. The concept of diabolics is fascinating. And the whole thing is so well-executed by S.J. Kincaid. I've read this several times. I intend to read it again. I mean, I kind of need to read it again so that I can get to the third book because there was quite some time to pass between me reading the first two and the third one coming out. But anyway, I cannot recommend this highly enough. It is so good. I made Alan read it and he quite liked it. So if you don't trust me, trust Alan. And this one, this is a good one. Next up I have a book that I have talked about a few times in different sort of list-type videos. And that is And I Darken by Kristen White. This is the first book in the Conqueror Saga and the conceit of the Conqueror Saga is the retelling the life of Vlad the Impaler but reimagining Vlad as a woman. So what if Vlad the Impaler had in fact been Lara, a female? And so this is historical fiction. It is fantasy only in so far as Vlad was Vlad, not Lara. So it is an alternate history, not fantasy in that sense but there's no magic in it. There's no vampires in it. It's just alternate history. It's told from both the perspective of Lara who is our Vlad as well as her brother, Roddy and we follow pretty much from birth to death. So there's three books, it's a trilogy and I Darken, Now I Rise and Bright We Burn. And I think this is one of those rare instances where it truly stuck to the landing. The ending of this trilogy is immaculate, well done but the entire series is really, really incredible. The way that making her a woman kind of changes some of the way that you sort of interpret what Vlad felt was necessary to do is kind of brilliant. The way that the characters are portrait, these are historical figures so there's only so much kind of license you can take with that but the way that she paints the portraits of these characters, they are so fully fleshed out, so flawed, so human but it's an epic tale there's obviously like political movers and shakers, cities are rising and falling. I mean, there's a lot to this history so there's obviously a lot to this trilogy and I just think it's absolutely brilliant and complex and layered and very dark and Lara as a character is very, I mean, she's Vlad the Impaler so like obviously she's not gonna be a sunshine and Rose is Disney princess but she is compellingly written. I guess it's the best way to say it. And again, her being a woman kind of shines new light on some of again, Vlad the Impaler's choices because she is a woman living in a man's world and so in order to be taken seriously as a leader you kind of don't have the luxury of choosing mercy because they already think you're a weak woman so in order to be taken seriously you have to choose the most barbaric option well, or at least a lot of feels that she must choose the most barbaric option she cannot afford the luxury of softness. It's just, it's so, so good. Cannot recommend highly enough. I didn't mean to stack these back to back but my next one is also by Christina White and that is The Dark Descent of Elizabeth Frankenstein. This is a retelling of Frankenstein by Mary Shelley but it's all told from the perspective of Elizabeth Labenza and that choice would never have occurred to me but it is brilliant. This book I already, I love Frankenstein, Mary Shelley's Frankenstein so messing with a story that I think is classic for a reason and near perfection I'm gonna be a tough audience to please and she nailed it. It does an amazing job both paying respect and homage to the original source material but also taking some liberties and changing the original story where it needs to but in a way that doesn't, it is in no way disrespectful to the original because the original itself, our Victor Frankenstein is arguably an unreliable narrator and so this book takes advantage of that. Takes advantage of the fact that there is kind of no certainty with the original Frankenstein. You only have Victor's word for the fact that things went down the way that they went down and so we're getting to see events from Elizabeth's perspective. So things are going down the way that she says they are going down. I guess neither is necessarily to be trusted but this is why it's sort of possible to change kind of things and it's not a situation where it just like pretends like this is just how it happened instead. It kind of, the way that things go down it becomes very clear why Victor might not have explained it this way and it's just Elizabeth herself is a fascinating care she goes from being this sort of like milk toast kind of just female that is just there to be like a damsel in the original Frankenstein. Sorry, Mary Shelley, but she is and becomes a fully fleshed out and layered complex character in her own right and the way that she perceives Victor is kind of chilling and just seeing the events of Frankenstein through the eyes of somebody that doesn't already know what's going to happen.  So when Elizabeth starts putting together the pieces because Victor's been up to something and no normal human is going to jump to the conclusion that he will have been reanimating flesh, of course not. When she starts putting the pieces together and he's like, what has he been doing and it has to come to the inevitable conclusion that is just bananas because it is bananas that's what he does. Even though it's a familiar story so you shouldn't be surprised by it you're kind of shocked and amazed and surprised with Elizabeth now because you're seeing it through her perspective sort of afresh and being like, yeah, you know what? Yeah, I'm used to the idea now because I know Frankenstein but yeah, you're right, this is pretty sick. It is so, so, so, so good. This is how retellings should be done. So highly recommend. Next up I have a book that I haven't mentioned in a minute but I have been known to talk about it quite a bit and that is Strange the Dreamer by Lainey Taylor. I frequently recommend this book to people who don't typically read YA. It is just an absolutely beautiful book and if you are the kind of person that really likes the writing of like Patrick Rothfuss of Katharine Arden, very lyrical, transportive, beautiful writing then this is the one for you. Lainey Taylor's narrative structures are very difficult to talk about because it's not a very traditional narrative and it has just, her other series has this problem as well where the majority of the plot takes place after something happens that you don't know about and you can't know about when you start out the book. It's kind of a reveal or a surprise but most of it happens after that and it has to do with that. So it's almost impossible to actually explain what this book and this duology is about. At the outset we follow Laszlo Strange and he is an orphan and he has been sort of raised in and is working in this library. And so I mean, a lot of people find the beginning a little boring because it's just following him in the library. That's actually my favorite part of the book. I mean, I love the whole duology but I love following Laszlo in the library. I just, I could read a whole book about that but Laszlo's personal obsession and pet project is The Lost City of Weep which is kind of like Atlantis in vibes. Like it is a city but it is no longer a city. We don't even have its name anymore. People just call it Weep because they lost that actual name for it but Laszlo is determined to find every scrap of evidence he can find that the city really existed and he's desperate to find it again because he really believes that he will be able to find it. So he's kind of a scholar of Weep. He's an absolute sentiment roll and following him in the library is great. And then things happen and the rest of the book takes place. And you can't really say what it's about but trust me, it's worth it. And Lainey Taylor's writing is so evocative and so emotional and there's a lot of sort of very dark things in this book. It is, people talk about it being beautiful as I just have. It is beautiful and beautifully written but it is melancholic. There are a lot of poignant and tragic things that are described in this book. Very tough situations, emotionally fraught situations and they're written about in a way that is beautiful but it is a tragic kind of beauty. So don't expect to pick this up and think, oh, it'll be like a whimsical fun time. It's a brand-new dream. Like, no, no, no, no, no. It is, it's not light but it's just so gorgeous. Like the imagery, the way she describes the beautiful magical things in this book is beautiful to behold in your mind's eye but also the human side of things, the emotional side of things is also beautifully described and beautifully felt. And it's just a multi-sensory experience and I cannot recommend it highly enough. Next up I have Dread Nation by Justina Ireland. This is the first in a duology as well. I think the duology is just called Dread Nation. I'm not aware that there is a name for the duology beyond that but anyway, this is an alternate history fantasy that asks the question, what would the American Civil War have been like if there had been a zombie uprising in the midst of it?  I hate zombies so much and I will go out of my way to avoid any content that has zombies but I heard so many amazing things about this book and this duology that I was like, okay, I'll pick it up. And something about putting zombies in a historical context does, bothers me a lot less. So like bread, prejudice and zombies actually quite like. So having zombies in the Civil War era somehow is I'm way more fine with it. But so this is also, I mean, this is an amazing example of what YA has the capacity to be and also just how alternate history fantasy should be written. This tackles questions of racism, questions of the actual events of history.  Like that's gonna change what decisions are made, what battles are won, what the sides are, who lives and who dies, how society structures itself, like all of that would change drastically if you suddenly have zombies. I think Justine Ireland did an amazing job of doing that thought exercise of, okay, so what would change? So how would people react to this? What would they do in response to this? How would they handle this? And how segregation and racism and slavery and all this kind of thing would be kind of adjusted to account for the necessity of dealing with zombies. And our main character is black living in Civil Warrior America. And so she's in the thick of the efforts that are being made to have an organized response to protect people from zombies, which they call shamblers, which I quite like because that zombies do kind of shambles, don't they? The main character is a great one to follow. She's got a lot of personality. She is flawed, but it is very, she's again, very compelling to read about. It is a very compulsively readable book. It's kind of hard to put it down both because it's very exciting. There's a lot of sort of dramatic tense moments, confrontations with zombies and this sort of thing, but it's also just very digestible. The prose is very digestible. The book does not shy away from showing you the real darkness of both the racism of just human beings as well as of how gross and dark and violent zombies would be and the lengths to which people will go to protect themselves from zombies, which can also in itself be quite dark, what people are willing to do in the face of such a threat. And yet it is not something that I would say should not have been showed in YA. Like this is a masterclass and like you can totally deal with tough topics, with violent things, with troubling things and still make it absolutely YA-appropriate. So this is how alternate history fantasy should be written. This is how YA should be written. This is how you do it and it's so, so good. Next up I have Scythe by Neil Schisterman. And actually the second book is even better than the first one. Anyway, Scythe is the first book in the Ark of the Scythe which is a trilogy. And this is I guess a utopian dystopian book? It's kind of hard to describe. This is sort of, it takes place in a sort of far future where humanity has transcended death. Death is no longer I think people have to deal with because the medicine and technology have gone that far, that you don't have to die, like you just don't. And so the way that they deal with the fact that you would just have people living forever and ever and ever and ever, they have an institution called Scythe. And the Scythe's have carte blanche to just kill people. And so the idea is that in this way you maintain some of the sort of randomness of death that existed prior to people solving death as a problem altogether. Cause in the way we live now, people just kind of die.   So Scythe's because they kind of can choose anybody at any time to kill them. And once a Scythe kills you there is no reviving you.  That's how they've taken care of that problem I suppose. And everything in the world is sort of run by this AI called the Thunderhead. But the only thing the Thunderhead doesn't have control over, doesn't have eyes on, has no purview over is the Scythe's. And so we follow in the first book two young people, a young man and a young woman who are sort of trainee apprentices to a Scythe because you do need new people entering the force. And so they are both taken on to be trained as potential Scythe's. And so you see them sort of learning about what it is to be a Scythe and learning to become one. And at the end they can't both become a Scythe. So there is a sort of like competition challenge element to it. The first book is excellent but in my opinion the second book is even better. Is it is so good. I have not read the third book yet. I very much want to very soon. But it is a fascinating sort of conceit for a premise that not only have we solved death but that this is how we've solved too much of life. There is a sort of logic to it but it is also kind of bizarre and barbaric. And I think it's handled really well. Like that concept, okay, that's a concept but like I could see that being executed really stupidly. I think it's executed and handled really, really well. And the further exploration of this whole setup and what the Thunderhead cannot do in the second book is even better. There's so many great twists and turns and fascinating sort of questions of morality given the situation, like what is morality when your job is to kill people at random? Like you're basically a serial killer. Like that's your job. Like a sanctioned serial killer. So like the idea of Scythe's having some kind of a moral code is like, well then what would that even look like? So again, I think this explores a lot of interesting topics really, really well in a way that is still approachable for a YA audience. It's not so lofty and high-minded and no one can comprehend it. It's very approachable, very readable, very down to earth. These are still kind of like fascinating ideas to be grappling with. So again, highly recommend. Next up, I have How Madness So Discreet by Mindy McGinnis. This is historical fiction and it follows a young woman who is institutionalized because she has an unwanted pregnancy. And you know, back in the day you just chuck them in an asylum if there's something undesirable or weird about them.  What ends up happening is that because she is an inmate of an asylum, then she has access to conversations and information that a person outside of the asylum, like a doctor or a visitor wouldn't have. So because she's obviously not crazy, she joins forces with the person running an asylum who is a, her African, is he running it or just working with the asylum? Regardless, he's a sort of early version of a criminal psychologist and they were trying to find a killer. And so with her being the sort of like inside man in the asylum and him being the criminal psychologist, psychiatrist type of character, they are able to join forces to kind of find and bring down a serial killer. And it is, it's so good. It's gonna be really, really frustrating to read because the idea of women just being powerless and being institutionalized and already women in this time, in this day and age didn't have a lot of agency, didn't have a lot of rights even if you're free and not institutionalized.  And like that is so maddening. Like that's enough to make you crazy. And so this whole situation, I mean it's painted in a way that will have your fists clenched and you'll be so angry, especially cause you know that this isn't just, I mean this is a fictional book but that this really happens to so many women and just the, oh my God, the like helpless frustration of that. What can you do when you won't be believed? So well done. And then also the mystery and the thriller sort of aspect of finding a serial killer is quite well done. It's an interesting mystery. There's a lot of sort of like tense and suspenseful moments to do with tracking him down. And I just think it's so well done, both from just sort of like the human story side of it of the main character and what her experience of all of this is and what that feels like as well as the sort of the mystery plot is also really good. It is a standalone and it is most excellent. Second to last, I have Salkilla Girls by Claire Legrand. This is a horror book. It is very feminist.  It is kind of chilling. I mean, as it was meant to be, it is horror. So I mean for it to be YA horror, I mean I found it, I knew it would be on the scary or chilling side and I definitely did find it to be quite chilling. It definitely doesn't sort of pull its punches to be like, well, it's chilling for YA. I mean, it's quite chilling. And so this follows three young women who are all on this island, the island of Salkill and on this island, girls keep disappearing. And so there is mystery surrounding who is disappearing and why. And so these three girls, it's not like a friend group. They do know each other but they sort of by necessity kind of have to join forces. Sounds very scooby-doo but I mean like they don't like each other. They are not friends but they are all young women on an island where young women are disappearing and they all have very different agendas and they are very different young women but because of, I mean, needs must when you're facing danger like this. So the creep factor is high but also the young women each is, they are each equally flawed and frustrating like I didn't find myself thinking, oh, I'm definitely a lot. Like you're meant to like identify with this character. She looked and she's the good normal one and the other two are like bizarre or the other two are aggravating or that one's the villain. All three girls are deeply flawed but in quite different ways. And so I found myself both identifying with and being frustrated with different aspects of each of the young women and I found them all three to be very well painted, very well written, very well realized. So I found it fascinating to read about each and every one of them. And again, found myself identifying with or being aggravated by each of them in turn. And again, the plot itself is very compelling. It is a page turner. It is thrilling and creepy. It is also just, it is very empowering and it's in portrayal of women and women taking on this horror that is something they are forced to encounter and forced to deal with. And yeah, I just, I was wowed by it when I read it. And I remember just sort of being horrified, amazed and impressed all at once. So again, highly recommend. And last but certainly not least is Nixia by Scott Brinken. This is a very shiny book. So I'm gonna try to hold it in a way that you can see it without being blinded. This is the first book in a sci-fi trilogy. I have yet to read the rest of the trilogy but I really, really want to. I will need to reread the first one to do that. But so this follows young people that are sort of not tricked per se, but sort of not even, not even core. They're all young people who for one reason or another are willing to agree for a lot of money to go on this sort of space voyage that is very dangerous because there is this new substance that is called Nixia and they need people to deal with it. This is a very dangerous, risky thing. And so the people that have signed up for this don't really quite know the extent of like the danger they're going to be in and don't really even know exactly why but each of them for their own reasons is desperate enough to agree to this. And so the main character that you follow, he has of course his own reasons for agreeing to this but then he's slowly having to suss out who among the others he can trust and who among the others like what their reasons are for agreeing to this. And it is somewhat reminiscent of Red Rising. Not really, I mean, the way that I've described it like that's not really like similar to the plot of Red Rising, but there is sort of something about in particular the first Red Rising book where they're sort of in this sort of battle royale type situation that is sort of constructed by powers that be and they have to navigate that and it is a life or death. That part of it is reminiscent to me of Red Rising and the main character is definitely wouldn't say he's a lot like Darrow but there's a little bit of like a Darrowish type of vibe to him, a smidge. But I think this main character is a lot less of a drama queen than Darrow and the Nixia itself is fascinating. And so there's this sort of mystery at the heart of this story that like you along with these young people are like, what is going on? And what is the agenda of these people? And why? And what is gonna happen next? And it is, it's definitely definitely a page turner. I think I read it in one day when I read it because once you get going, you just kind of need to know. And when I read it, I had an arc of it. So it had a long wait until the next book came out. So like that's why I haven't continued but it is definitely a page turner. Like if once you pick it up, you will fly through what I guarantee. So that's my list of YA books that are not like other YA. Let me know in the comments down below your thoughts and feelings about these books if you've read them or if I have piqued your interest, if you plan to pick them up now, whatever you wanna let me know plus videos on Saturdays, other end of the time, but definitely Saturdays so like and subscribe, join my Patreon if you feel so inclined and I'll see you when I see you. Bye.


So far all of the previous 20th anniversary milestones that we focused on in this series have revolved around cool things that Cobb has done But for this one, we're gonna focus on something amazing that y'all have participated in Over 250,000 access ports. We don't actually know the exact number of new access ports that have been purchased since the release of the V1 But we crunched the numbers as close as possible and over the course of three generations We sold a little over a quarter of a million access ports worldwide So while we pat ourselves in the back to finish up the year and begin a new decade We wanted to give a very big thank you to all of you It's pretty wild to think that there are currently cars cruising around all five of the non ice-covered continents with a Cobb tune on the ECU We still get that fuzzy feeling when we see a photo online from a happy customer or drive by a random car on the highway With a cob sticker on the window once again Thank you for all the support over the years and here's to another 20


Hey, you want me and Dallas switch real quick? Three minutes to pee. Four minutes to pee. Five minutes to pee. Six minutes to pee. So stay clear of the emergency. Our HLZs look at the bottom machine gun hill northwest of French 2. All the personnel will immediately cease fire, go condition 4 and... Great fire, not off right. There we go. You should be able to stop this flight immediately or you'll actually be very more appropriate. Alright, we're in all these real... Alright, it's a good thing, right? This is more at the bottom of 2 level, right? Come on. It's not a good thing. It's not a good thing. It's not a good thing. It's not a good thing. Come on. It's not a good thing. It's not a good thing. Assalments in, push right, 10 meters. Double bound, double bound. Hey, now it's that... Honestly, on me as an assalment, I was just thinking in a complete... Enemy fire from French 2 empty. Heavy fire from French 2 and 3. Off to you right here. 3, 2, out. Get out of here. Get out of here. Second squad. 27. Hey, guns up. 21. Yeah, it's all gone. 19. 20. 30 left now. Kill. Guns out. 8 support. 360 though. Oh, 3, 2, 1, yeah. Yeah, sure. Second squad pushing up to the MSL. Left side, push up. Come on.