Okay, thanks very much. There we go, recording in progress. We've answered the very first question already. It will be recorded. Hello, hello, hello. My name is Steve Shagair. Big thanks to everybody for showing up to this webinar. Yeah, that's a long title. I know, we came up with that a while ago and we're stuck with it. It's long. I came up with some other ones later called Firing Checkhouse Gun and Know What's In Your Bag and you'll find out why I came up with those titles a little later on. A little bit of foreshadowing for you there. We're gonna be looking into software composition analysis, open source, putting that all together, context aware, all sorts of wonderful things as we go through this presentation. Quick introduction to me, if you've never heard of me. My name is Steve Shagair, I am Canadian. If you can tell by the accent, I do live in Britain. I've kind of 50-50, I'm dual citizen. I'm a cloud security advocate, developer advocate. It says Bridge Crew, Bridge Crew is Palo Alto Network. So kind of the same thing. I've been writing code since 19 and we're just gonna leave that one with that. I'm focusing on cybersecurity. I've worked for a few different companies in the space, now focusing mainly on supply chain security, which encompasses an awful lot. You might even say everything. If you find yourself in London, England, I also run a meetup, or I co-organize, I should say, a meetup called SSECOps London Gathering there. So it's running monthly, come check it out. And if you're around on Fridays, I go on Twitch and YouTube with a colleague, ex-colleague of mine, and we just talk about the week in cybersecurity. It's a lot of fun. If you like recklessly clicking QR codes, there it is. There's one for you and we can be friends on LinkedIn. No worries. What's the agenda? Well, it's gonna be pretty exciting, right?  That's exciting. I wonder what I'm gonna say there. We're gonna look at some pretty logos. I like that one. We're gonna reflect on some news and how that changed the face of licensing and open source for forever almost. And we're gonna meet this guy.  And I'm gonna throw a graph up on the screen that makes me feel really smart. This is just some of the things that we're gonna encounter on our journey over the next 45 minutes. But let's begin. Let's begin with challenges. Sure. Mainly challenges with open source. Why am I talking about open source? Well, cloud native applications, in particular cloud native, but really all are rife with open source. I could cite probably a three or four different sources, Ossura by Synopsys, the sonotype state of open source, all of these things, they all kind of align and reinforce each other's postulations that we're about 80% open source at a minimum. And this is across not just our own applications, but even cloud providers are heavily made up of open source and it can be a problem. Why? Because open source libraries and dependencies, they have vulnerabilities. Okay, we all have vulnerabilities, but these ones are published. These are public, that is as useful to us as it is to the baddies. Now they get nice little scores like CVEs, if you're not familiar with a CVE, that's the common vulnerability enumeration. They get a fancy little score with the year in it, see how old it is, that's nice. Common vulnerability scoring system CVSS tells you how risky is it? It's actually a pretty complicated calculation out of 10. I'm not gonna get too into it, that's a whole other presentation, we could get into that. But the reality is they're out there. Now, taking a step back, and there's gonna be a few of these as we go through this presentation. I like to branch off my production main and tell a few extra stories along the way. Why opens source software? Why? Why are we so into it? The promise that when a solution exists, we don't need to reinvent the wheel. This is a big deal. This is why most software is about 80% open source. And doing that, well, that reduces development costs, it accelerates development, it's pro innovation. And plus we don't talk about this too often. Open source is like crowdsourced quality. The good packages, the good dependencies, the good projects, they rise to the top. The world clicks, the star, you can see an example there of 4,400 stars on that project and says, hey, I like this. I wanna follow what happens to it. And that's good for us, because that helps us with some of the challenges. Well, first one being, if you're trying to solve a problem and you wanna do it with open source, there's often several options out there for you. And you don't know which one's the right one. So you're relying on this sort of thing to tell you, this is the one I'm gonna try. Now there are other things to consider other than stars. For example, how well is the code maintained? How many contributors are there to it? How many commits have been made in the past week? How well do they secure this? Hmm, we'll talk more about that, say throughout the entire presentation. One extra one that often maybe we don't think about enough is, does it meet my licensing obligations? Because open source packages, they all have licenses. And we often don't really pay attention to those licenses. In fact, open source packages use open source packages that use open source packages. They all have licenses. They all have vulnerabilities. And that's what we're gonna dive into. But first, a nice little quote from opensource.guide. I actually really like this. So I just put it in word for word. Open source is powerful. It lowers the barriers to adoption and collaboration and allows people to spread and improve projects quickly. It is really fantastic. And we're gonna talk about a great example of it shortly. But before that, let's get back on target vulnerabilities. Really good open source bugs. I'm a bit of a fanboy of really good open source bugs. They get logos and they get cool names. If we go back to 2014, I actually, when 2014, I worked for a company and they are, I worked for a company that found Heartbleed. Heartbleed was kind of the big, got a cool name. It got the first bug logo, I think. I know that they were almost more proud of the logo than they were of finding this bug using a fuzzing tool, it was amazing. But then others followed Dirty Cow, Shell Shock. You can see the logo's over on the side there. And then we got a little bit lazy. We started calling bugs like the Run C vulnerability and the Apache Struts vulnerability.  The Apache Struts vulnerability devastated Equifax. I mean, we didn't even give it a logo. I'm a little disappointed in ourselves. I blame myself actually. But then we got a little better.  All of these really catch the eye of the media. They catch the eye of security enthusiasts. They even catch the eye of developers and they certainly catch the eye of baddies. Now, is there some way that I can learn more about this? You know, it would be interesting if, oh, by the way, this is another aside. While I was searching the internet for this presentation for bug logos, this came up. Now I don't know who Brand Crowd are, but they have some kind of logo generation system and they're ready. They're ready for the next bug that made me laugh. The reality is these things are all published. Where are they published? Well, the National Vulnerability Database. And when I took this image, I learned something. There's also a database they've just published which is known Exploited Vulnerabilities Catalog. So if it wasn't bad enough that we make all the vulnerabilities public, we even have a catalog of all the ones that have been exploited. So if you're looking for some examples, well, I guess there you go. So what about my cloud providers? What if they use open source, I said, right? We got you covered. Open source vulnerability and security issue database. You can go check out vulnerabilities in your cloud providers as well. How about that? Not too bad, right? What if they were already pre-produced known exploits because these are exploited. Are these public?  The exploit database, fabulous. So this is all both exciting and alarming simultaneously, 50-50. Now, the good news is it looks like I gotta put a lot of work in, right?  You know, it looks like there is. Huh, all right. So say I were to use this to, I don't know if I knew where Heartbleed was and I was gonna search for the version that was before where the fix was applied and I do that and I see, wow, people don't patch their stuff. 4,000, this is, and by the way, I took this capture last week. 4,000 people still haven't upgraded past open source. Okay, well, anyway, it's only 10 years old, but I digress. What if I wanted to find the exploit for this? I could go trolling through that exploit. Oh, they have a search for that too, right? Yeah, all right. You get the idea. The challenge, one of the biggest challenges with using cloud, with making cloud native software is that we are just, we're embroiled. It's become a standard that we're using open source and we need to track it and we did track it well. Now, I'm not gonna stop right there. I'm gonna talk a lot about this, but I really wanted to highlight some of the reasons why we don't in a moment. First slide, I wanna highlight the fact that it's not just about vulnerabilities. It's about combined misconfigurations and vulnerabilities lead to new attack vectors. What do I mean by that? It means that when we're looking at creating our applications, particularly in cloud native, we're often provisioning our cloud, we're provisioning our Kubernetes, we're building Docker files, we're creating manifests. This is all happening as code. And then we're putting our application in there. So securing our application is just one small piece of the puzzle. If there's a problem or a combination, for example, well, we'll talk about it in a moment here, where multiple vulnerabilities can combine to create a unique attack vector, then it can be in a little bit of trouble. There's an example up there where you can see there's a high severity CDE insult stack you used in public cloud. And actually there was another one recently, the SolarWinds cyber attack. It's been hard to avoid that, right? How does somebody get into a pipeline and start making modifications without anybody noticing? There's been loads of new innovations in that space and I'll talk about them later on, but it's amazing how we're still learning in cloud native. How can we harden the inside as opposed to just the outside? And then finally, log for shell. How is it being exploited and how to mitigate damage? Well, one of the ways to mitigate damage is to make sure that every aspect of what you're provisioning be that cloud security, Kubernetes security or application security gets the same amount of attention. And particularly when you're being done in combination. There's a tax service for cloud native is complicated, extensive. These are understatements. Our RCE, which stands for remote code execution can be used to exploit, say an overprivileged pod. An overprivileged pod can be used to exploit an overprivileged host. If I can get access to the host, then I can query the cloud metadata. If I can clear the cloud metadata and I can get certain IM details, I can get access to just about everything else. And it's not that hard to see how this can happen because it does. Okay. Here's a real clunker, budget. Budget could be a problem. This is another reason why we use open source. Lower is the barrier to entry. You can try things out. Maybe there's a pay version of it. Maybe there's not a pay version of it, but you being able to try things at our own pace is actually really critical to the success of any security program, I would argue. There was a, this was a, I think this was three or four years ago. There was this came out and I haven't seen anything quite the same since. It was called the CISO report for tribes of the CISO. It was a little unfair on CISO. So I, every time I mentioned this, I apologize on behalf of the authors, actually who I've met, because it's more about the philosophy of security within our organization. Tribe one being security as an enabler. This is like our security in Nirvana. They understand that money spent on security is money saved later on. Worst case scenario, security as a cost center. And it's a great, if you can just Google it. It's, it's, there's only one of them and you'll find it, but everybody falls into some form, one of these camps, and usually we teeter between a few of them. So it's a really interesting article that might convince you that if you feel you're more in the security as compliance camp, give it a read and that'll probably push you a little bit more over to the, to the left towards enabler because you'll start to convince yourself that maybe I could reevaluate compliance. Compliance is a challenge. It's actually also an enabler. So there's two, there's two signs to so many coins. These don't, we don't want these to exist. They exist because we are frankly terrible at writing software by default. PCI DSS doesn't exist for payment systems because we wrote awesome payment systems. It exists because we wrote terrible ones and somebody had to slap us on the wrist and say, hey, this is the bare minimum. Okay. You're talking about people's money or HIPAA, people's medical. These are all important things. They didn't exist originally, they exist because we did things badly. However, compliance as an end goal is a continuation of doing things badly. There's plenty of articles out there that's, there's a great article actually recently that said, if I'm CIS compliant, how vulnerable am I still? Google that, duck, duck, go that whenever your search engine preference is and you'll find out even meeting the bare minimum of clients doesn't mean you're actually secure. So compliance is not an end goal. It's just a beginning. But we can use it as a bit about, let's call it security theater and that's a no-no. Licensing, I alluded to this earlier, licensing is complicated. So quick one on what is an open source license? They're based on the open source principles and I've got a link down there, opensource.org, that's pretty easy to remember. And even if you don't go for the full length, you'll find it. But it's a bit, I don't wanna call it idealistic, let's say free distribution, open source code, the ability to create derived works at will, integrity of the source code, attribution, no discrimination, this just sounds wonderful. This should apply to everything. This sounds fantastic. But there are, let's say, versions of these principles that are been released and are roughly described in three categories, permissive, weekly protective, and strongly protective, and you can use the wrong category very easily by mistake. Quickly going through these, these are your favorites. Permissive, this means you can modify, redistribute, give credit, of course, but you can even re-license a new product within your commercial product. This is fantastic. MIT, Apache, these are some examples of the licenses you wanna look for. And if you're wondering where a really good example of this is, maybe you've heard of Kubernetes, Apache license too, check it out, these are the permissions, these are what you can do with it. Pretty interesting, right? Kubernetes is a fantastic example of where a company owns some internal IP and realize that open sourcing it in all its complexity and all its glory was going to be not just an advantage for them, an enabler, but an advantage for the entire world, as it's become the de facto orchestrator for containers. And in fact, people refer to it as the operating system of the cloud. So there's a fantastic example. Weekly protective license. This has kind of got their legs on either side of the fence, they allow proprietary modules to use derived projects, but you kind of go to tread lightly through these, Mozilla, LGPL and Eclipse are examples of these. And then last but certainly not least, derivative works must remain under the original license. So if you find something that's GPL, you have got to continue being GPL. This could be destructive for companies who don't want to expose their own source code because if you're open source, you have to continue to be open source. And this happens. These are a few examples of where it really did happen. Free Software Foundation sued Cisco. Why? Because Cisco acquired Linksys and Linksys was using it as an open source code, that open source code had a GPL license. Bad things happened. So you really got to be careful and be tracking those things. Now you might think to yourself, I paid for a scan six months ago, so I know what my licenses are. Well, the second warning is, do you? That one I threw up at the beginning, Elastic CEO reflects on Amazon. Elastic changed their licensing because of, well, they didn't agree with a certain use case. MongoDB changes its open source license. There are examples where really, really commonly used open source packages change their license and you upgrade and suddenly, you're getting a little bit potentially caught off guard. So having more consistent monitoring of this is very, very important. Okay, we'll come back to licensing a little bit, perhaps later. Culture, yeah, it's important. Things change a lot in the internal culture of that cloud-native, heavy environment, cloud-first, whatever with other versions of the naming. That's a big deal. You know, when you're, well, back when we used to go into the office and you'd see somebody going into the office, tell-tale signs would be a heavily-stickered laptop. And you see this and you're like, okay, all right, here we go. That means we're probably a microservice environment. We probably have isolated teams creating unique technological wonders that will be united later on as an application. The technical stack will be completely in their hands. Potentially the security solutions will be in their hands. This means you're dealing with DevOps. Yeah. And I can't quite remember what DevOps stands for totally, but I think it means don't ever offer painful security. I think that's what it stands for, but if it doesn't, it does now. But we can deal with that. How? Well, we want early detection of vulnerabilities and licensing issues. We want to be, we want an inventory or a bill of materials, a term that we'll get to later of everything that we're using. And we want to get this as early as possible. We want to know what vulnerabilities would be there. Well, to say that means we want to be friendly with the DevOps teams and the developers. We want them to be part of our security solution. So we want everything we do from a security strategy to be developer friendly. We want the developers in the room when we're making decisions. We want our solutions to be context aware. The same vulnerabilities for one team, they really don't matter to another. When we're talking about microservices, I've got an analogy for this one later on. Context is really quite critical to make sure we can prioritize the things that we find. Otherwise we'll just be swimming in a sea of noise. Everything must be cost effective. That feels like a no brainer. So I'm not going to sit on that one. Quiet means actionable. And finally, if you didn't catch on, developer friendly, also really good. Okay. So if you're wondering what I'm going to do, you're probably thinking, all right, this is very pitches this shiny new product feature. I will be talking about open source. So let's move on. What I want to talk about is, yeah, this is exciting. Software composition analysis. Whoo! Yeah. All right, you're on the edge of your seats now, I bet. That is pretty special when you say that. People sit up and listen. Developers go, wow. Let's make this even more exciting. Let's define it. SCA, which is the short form for software composition. Visibility into the open source components and libraries being used and incorporated into the software that dev teams create. Okay. It sounds like what we want. Can help to manage security and license related risks. You darn right it can. And ensuring that open source, bedded data breach, property, blah, blah, blah, blah. Right? Yeah. It is not the most exciting subject. I'm going to admit that. But in an open source heavy world, this is the low hanging fruit for your security, but provided we do it right. So let's say we're going to turn on the SCA, right? This is where the dog comes in. This is what it can feel like. If you've got a fully mature application or applications that are out there at scale and you haven't done any of this and you just decide to analyze it, you might be thinking or if you've used SCA in the past, because SCA solutions have existed for over 15 years. You're probably thinking noise, inaccuracy, and inflated by dependency bloat. Yeah. You would be correct. SCA needs context. We need to take a new look at it. We need to put it in the context of where it's being deployed. What does the infrastructure look like? What are these applications doing? What are they outward facing or are they inward facing? All of this information is absolutely critical to making decisions such that we're not wasting our time. So we need context, right? And the first type of context we need is actually cultural context. Where is it all going? Can we make it so that the information is not overwhelming the people who are involved? And of course, technological context. Is it easy in the technological environment that's being placed? Is it being placed in this cloud versus this region attached to these resources? This is all very, very important. The good news about culture for SCA, I think, is that from an analogy perspective, we already do DevSecOps. I mean, I don't know if you've heard this analogy before. Maybe if you've seen me talk before. But when we're going to the airport, we're doing DevSecOps. It's that simple, right? We're a control of a container. See where I'm going with this, right? It's analogy heavy. And we put all our stuff in it. These are the things we need.  These are the no-brainer stuff. This isn't like, do I need a college shirt? Do I need t-shirts? This is the stuff I always bring, my toiletries, et cetera. These are all going in there. And then I start loading stuff in afterwards. And then I'm happy. And you get to the airport and they ask you, do you know what's in your bag? Like, don't you trust me? Do you know who I am? Yes, I built my container myself. Thank you very much. Has anyone given you anything to carry? I'm 80% open source. Any dependencies in my bag? I don't think so. My partner did put some spare underwear and socks in there. She took the bag away. I didn't see it, but I'm not going to tell you that. Any dependencies on my dependencies? I don't think even know what you mean there. So yeah, yeah, I'm good. And then they ask you if they can scan your bag and they want you to put it on a conveyor. They just ask you the questions. Don't they believe me? Geez. So the bag goes on the conveyor and that's fine. You go through the host scanner. You got your arms in the air. I don't know if you can see me on the camera there. It scans you and you're an expert.  You got your little baggy. Well, your toiletries, you took it out. Laptops out. You get it all in two trays. You go through and you're clean, right?   This container is clean. Then why are you leaning on the conveyor? You just want to see the X-ray. I just like to see the X-ray in my bag. That's all I want to do. There's nothing weird going on here until the X-ray shows up and you're like, I don't remember. This is actually a true story. This isn't the actual scale, obviously. That would be probably in prison now if this were the case. I had a spark plug wrench in my bag one time because I rode a motorcycle and I was doing local travel and I just rushed and grabbed the same bag and went to an airport. And I don't know if you've never seen a spark plug wrench. It's got this kind of three-dimensional kind of thing to it that looks like it looks bad. When I go through a scanner and I answered all these questions and it's the exact thing happened to me. And then I had to deal with, well, I don't know, the penetration tester, I guess it'd be the equivalent here. But yeah, you don't want that. You don't want that. You don't want any of that. You don't want to deal with security on the right if you're someone who lives on the left. You want to go with velocity through that pipeline and you want to be in the sky as soon as possible, deployed. So this is something that we do. It's a little like safety and security. And these kind of analogies help developers go, you know what? Doing everything in advance does make that go faster. There is, this is security is an enabler here. I hate it when things break in the build in the pipeline, like what just happened to me here and having experienced it firsthand, it's a thing. All right, second analogy. This is how we used to write software, particularly way back in the day, but even when we became internet facing, we used to write big Java apps. They were very capable. They would be outwardly facing and then they would have this kind of security. We'd build big walls. We would have a moat. We would have a drawbridge. Maybe when we thought we were super futuristic, we'd have our WAF. There they are standing in the doorway. Hey, what's this big wooden horse doing in here? Come on, go inside, no problem. That was relatively easy to characterize. Okay, well, it looks secure. It's got little windows. It's got some things up top where I can put some defenses. I think we're good. And then we went to microservices and our application started to look a little bit more like this. That's a complicated surface, if I ever saw one. If I start looking for vulnerabilities, I'll find them, oh, guaranteed. Nobody's building a perfect house, particularly when each house has been built by a different team. What if I look over here? Well, these windows aren't very secure. They are not even double glazed and they're very close to the edge. I don't really like that. Once someone can get over the wall, there's that moat we've got over here, but it doesn't even go around the whole place. And it just appears that there's trees. What if I can get from there into the tree over onto that? I don't know. This doesn't look good. This kind of weird elevator shaft seems like an easy way in, but it's pretty far back, so. And then way over here, well, this is a completely uncovered roof, but it's right in the center. But it's highly vulnerable. It's wide open. And this is a very rough analogy. Now, I didn't even mention the fact that there's a river running around the back of this place. Who knows what kind of vulnerabilities we can find there? But this is more with the attack service of a cloud-native application looks like. But the score of each of these vulnerabilities, in this case, is kind of irrelevant. It's more about their location. And this is what I mean by infrastructure and context-aware. It doesn't matter what the score or the outside ones are. Those are the ones we probably want to look at and fix first. All right, I told you I was gonna do some branches and I'm gonna come back into the main in a second. What is Check-Out? This is an example, an analogy of a problem we have with an open source within cloud-native applications and why we need to be better as developers, in particular, and DevOps teams when we're creating these applications. And one of them is an analogy called Check-Out's Gun. If you're into literature, you may have heard of what Check-Out's Gun is. If not, the analogy into software is dependency bloat that I discussed earlier. Developers might add dependencies. I know I do this because I am guilty. I work on the, we'll be seeing in a second, the open source project check-off. And when you're testing things out and you're making those decisions about open source, you might add things to your dependency file that you then actually don't then end up using because you replace it or you refactor and you just don't need it. This happens. Now, sometimes they get caught by bots. Sometimes they get caught by checks. Sometimes they never get caught at all. And it often can lead to confusion when you're applying security tools and security automation to look for vulnerabilities, as you can imagine, because if you add something really vulnerable and you never use it, well, that's weird. Now, the Check-Out's Gun concept is after Anton Check-Out. Anton Check-Out was a writer, a pretty famous one. And when instructing on how to write for good screenplays, let's see, would say that if you're, or plays generally, if someone walks into a room in the first act and hangs a shotgun on the wall, the shotgun better have gone off by Act Three. Otherwise, what's it doing there? You've distracted the audience. They're constantly thinking about it. It's made a false promise of something exciting. It's going to happen. And that's kind of what a Check-Out's Gun actually is. And you can see I've got an example there. Bond movies used to do this all the time when they got overly keen on, was it Q giving all these gadgets? And then he actually wouldn't use them all. And you're like, what happened to the laser pen? He didn't even use it. Now people use it in movies as a device. Bruce Willis at the beginning of some film will put a weapon into a drawer, two hours later, you completely forgot about it, but it becomes the thing that saves his life. So they do the opposite of it. Look for it now. And now that I've told you about it, you're going to start spotting it in movies all the time. So this is the idea. Not using dependency bloat, because the reality of it is if you start adding things into your, this is my, what dependency bloat looks like, couple of guns on the wall, we're just, we don't need them anymore. But how do I tell which ones are the ones we're using? Which ones are the vulnerable ones? This is not ideal. Some are Check-Out's guns and some are Check-Out's guns, which of these are extraneous. And if I'm looking for, if I'm scanning all of this, then I'm just looking at noise. This is a problem. Now this is a good, this is a good lead in. Let me see what I've done with the word play there. Check-Out, anyway. This is an open source tool. You can go download it free. Check-Out.io, go check it out. I love open source. I think it's a great way to get started with your, not just get started, to be a critical part of your security strategy. Check-Out does a lot. It's been around maybe two years now. It started off just scanning Terraform. And that's all it did. It had about 500 rules. Now it's way beyond 1000. And that's an understatement. It scans for misconfigurations in any infrastructure as code and any declarative infrastructure as code, I should say. And there's some examples along the bottom there. Terraform, cloud formation, any of them in the Kubernetes family, like just straight up YAML manifests or Helm or customized are there. Bicep, which is so much better than ARM for Azure, by the way, I think. And then the major cloud native languages, they also scan the dependency files. Why? Amazingly, you don't think of those as infrastructure as code, but they kind of are, they're declarative. They're saying, this is what's going into my software and there's no reason like we can't look at those and take advantage of all of this public information about vulnerabilities and start showing you those things. And what's even better, we can do it and bring that context that I was talking about, which is kind of nice, right? And we can do it early. So all of the things that I put on the screen earlier, this is a great step into the direction of doing something like that. And it's something you can get developers to do on their own. They can pull this information as opposed to having this security method pushed upon them.  I'm not gonna do it live because I didn't trust the platform to work live. So maybe that's my own lack of faith. I'm gonna use log4j as an example and I'm using a platform called depths.dev. I really like it, it's a Google thing. So here's a screen catch for depths.dev. You can go to it and you could just type in log4j and then you can choose, it brings up the package and you could choose the version. I chose 214.1, why? Because I know that has the first instance of the log for shell vulnerability. And there it is, second in the list, remote code execution in log4j, fabulous. Now we can all do all this manually and this is a good example of why you don't wanna do this manually. I can look at the tool, I can see there's dependencies and dependents. Well, let's take a look at dependencies. How complicated is log4j? Yeah, it's complicated. These are all of the open source packages that log4j depends on. So if you've got something, an SCA tool that says, you had log4j. Okay, did it also tell you you had all these? How deep did it go to tell you these are the things that are bad about what you've got? Sometimes the only report things that have vulnerabilities, which is a great way to filter out noise, but it's just interesting if you're looking at something that generates a software bill of materials, how comprehensive does it do it? Now I'm gonna flip this a little bit and look at dependents, I really like this because this is kind of the reverse. Now there's no graph here, but you can see how many open source packages directly use log4j a lot. You can see why it made such a splash when it was found as a vulnerability. 17 and indirect, this is like, think of it like the Kevin Bacon factor if you've heard of that. This is two level, two bacon factor, two away. 1744 of indirect dependencies. So what I did, and believe me, I only did this once. I scrolled down until I found direct dependencies and I picked one called Genocore. I looked up what Genocore did. It's a framework for semantic web applications. More for looking at, well, to tell you where I found it being used, it was using for a tool parts database. And so it allows you to make certain kinds of queries and I was like, okay, that makes sense. And then you log queries and that all makes sense. So indirectly, I noticed that, look, remote code execution. So it's still new that two levels down, there was log4j and I thought, okay, that's pretty good actually. That is a transitive dependency. That's a dependency on a dependency and it still found the vulnerability, amazing. But there were still indirect dependencies. So I went up two more. Now I'm an owl query. Owl query for an open source project called open Caesar, which is something that tracks parts and things, right? Owl query is what uses to track, to use Genocore to use and then use it logging. So now I'm really far away from the vulnerability, but because it's a query mechanism, log4j is still there. Now you notice two down, by the way, I'm keeping the versions intact. So these dependency chain is correct. Log4j, number two, that's different. That's weird, 9.8 critical. Where happened to my 10? So even using this, I've lost track of a very critical vulnerability that's being used by the open Caesar platform in a particular version at a particular time. Now, if I go and take a look at the graph, now I go back down by a graph, I can see, sure enough, I realize the writing's pretty small here, so I apologize for that. It's very difficult to make it really big, but what that says is log4j 1.2.17. That's a pretty old version, but it's right there at the surface of open Caesar. Now, if I saw the log4shell vulnerability out there, I'd be like, ah, and I looked at my bill of materials and I looked at my vulnerabilities and I saw log4j there, I'd be like, aha, I got it. And there's an SQL injection, so well, this is great. I'm gonna upgrade my log4j and the problem is solved. Is it? Well, I am using Genocore, and if I look at Genocore, I'm still using log4j. Here's an example where I'm actually using two different versions of the same package, both vulnerable in different ways, but the only one I saw was the top one. And that's really a really important lesson and it was so easy for me to find. I didn't pour over all these dependencies to create this presentation. It was found almost immediately. Okay, so let's talk about what this really means at scale. The sources of vulnerabilities, they are very often deeper than surface level and the impact in the environment matters. So if you could see over on the right, I have all these dependencies with all these vulnerabilities and you can see there's multiple layers and multiple packages that are involved and the application of these things is critical.  You're even using containers within CICD workflows, which means CICD workflows themselves have dependencies on open source that could be vulnerable. And if we're not combining all of this and we're not using this knowledge, it can be something that becomes either noise such that we ignore it or such that we're potentially vulnerable. Or we just spend a lot of time on it. It's all bad really. But just the fact that we're aware that we can do this and we can be better at it, I think is a really critical thing. All right, so this is just a quick look at what the open source looks like. I'm gonna try not to run it because I realize I pressed for time. Now, check off as an open source tool runs in the command line. You just run check off and we're good to go. You can see the example. I can just run checkup.h, it gives me help. But it also integrates into JetBrains and VS Code and it's pretty easy to do it. I just go here, you can see I've got check off installed, I go back here and it scans just about anything I said in terms of infrastructure's code. So if I'm just say as much as looking at something, my POM XML, you can see that there's check off down here. And if I hover over, well, I can see that I've actually added a dependency that has logged for J. This is really quite cool. What I didn't count on is that I've got something else here which it's found, which is another, a few other issues that are high. Not too bad. I'm cool with that. But while I'm in the same application environment, so this is the developer perspective. I might even just go look at my Docker file and say, did I do my Docker file right? Cause I'm going to pack this all in my Docker file. And I can see, oh no, I didn't create a, the Docker file is going to run as root. That's really quite bad. Okay, that's cool. Well, if I look at the Kubernetes manifest, the manifest is actually making reference to a built version of that application. And down here. So there's a real abstraction between what this means and what this means. And I can hover over. I can see what the annotations that check off has given me here. And right away I can see that I've not got the most secure manifest. I haven't done some of the low hanging fruit for security for my Kubernetes, let alone some of the earlier things that are really bad. So I don't have a sec comp profile installed. So if for some reason I do have log for J and I can get remote coded execution inside that container, there's already a way I can break it to the host. If I roll down, I see some of the other things, image tags should be fixed. Okay, I've got some bad practices. I can see I've got a high vulnerability here. Container should not be privileged. What on earth am I doing there? But I, I scrolled a little low. If you saw it there before, I roll a little bit further. Hey, it's taking a look at my reference to the image. And it's included vulnerabilities from the image. So I can see that I have all these things in my infrastructure and I'm referencing a third party that is showing me that I've got log for J. What's also interesting, if I roll down one more, there's a critical vulnerability in Apache Tomcat. How to figure that out? Well, I'll tell you how. Amazing Tomcat has my base image for my Docker file. And actually that has a vulnerability. And I got all of that actually in one shot. Now I can do it on the command line. I did mention that I can see all my vulnerabilities. And actually I can, I can see the vulnerability. I can see log for J. I can see my Tomcat issues, all of them. And I'm given, in spite of all these vulnerabilities, I like here that I'm being told, well, you can knock all these on the head just by fixing with this one version. And I have a question, but I'm gonna answer it right away because it's an easier one. The editor I'm using here is Visual Studio Code, but it does work with PyCharm. So thank you, Paul. So that was a, that's a very, very quick whip through on how you can make use of the check-offs. And yes, it will report as you go, palm file to Docker file to final manifest, or even a Terraform. If you're using Terraform to deploy code build and you're making reference to containers, same thing will happen. Exact same thing. It will tell you what you're doing wrong. So this is kind of where we're trying to take a step forward in the way we're doing SCA and make combined scans of things we know we're going to deploy and where we're going to deploy them in what context by bringing you vulnerabilities in the context of your infrastructure. Not too bad, I really like it. I'm a big fan. And we only released it like this week. So you're the first that I've ever told about it. So that's pretty exciting stuff. All right, quick recap and some dependencies and some takeaways before I will open the floor for any more questions. That was a great question, Paul. Thank you. Dependencies. Dependencies means it's a package that you use. Separate piece of software that's imported. It could be a POM. It could be a package JSON. It could be requirements.text. It could be a PIP file. It could be anything that's saying these are the things I want to use. A transitive dependency. This is more like a techie term that is used in security and I don't really hear it in the development world, but it means that's a dependency on a dependency. And if we saw the log for J1, we're talking four levels deep, this can go. You saw how deep those graphs are. They get a bit crazy. A dependent means somebody that's using you for something. Going in the opposite direction of vulnerability is a publicly logged securely related defect often indicated by a CV and CVSS. A misconfiguration is just a bad practice from a security perspective. Does not conform to safer best practices and can result in unwanted behavior, data exfiltration, or lateral movement. So key initiatives I encourage you to look into. Salsa, the supply chain levels for software artifacts. They've just really been releasing different versions of it. It's very new, but it's giving you best practices at different levels as you secure your entire supply chain. Sigstore, this is an open source package for signing and verifying artifacts. I really love it. Sbom, I mentioned it, software bill of materials. Now, this is becoming a big deal in the USA because they're the recent mandate for all open source software. All software, really, to have Sbom's associated with them. It's a lightweight bill of materials. You can use Chekhov to generate a bill of materials. I didn't even say that, but you can. Chekhov is the open source software that can check or SCA. And that can do SCA scanning in Sbom generation. OpenSSA says as the open software security foundation is the brains behind some of these initiatives, like Salsa I'm talking about. And of course, I'd be remiss if I didn't mention OASP because not just for web anymore, tons of free open source security tools other than Chekhov. So your key takeaways, detect vulnerabilities early, embed SCA in the DevOps and DevSecOps pipeline to improve remediation rates. Make sure you're generating comprehensive multi-layer Sbom for risk tracking and compliance. And do when possible, try to create, do context sensitive infrastructure aware vulnerability detection. Of course, wouldn't be the same without license, watching your licenses as well. Actually, I didn't show you this, but back here, I'm showing the licenses as well on the command line so you can get licensed detail as well. Okay, this is the end, just on time I think. There is a blog there below, which is in white that talks a little bit more about what I said today. And that is the end. Thanks very much. Thank you so much, Steve, for your time today. And thank you everyone for joining us. As a reminder, this recording will be on the Linux Foundation YouTube page later today. We hope you join us for future webinars and have a wonderful day.


a rough one for the Brooklyn Nets over the course of the season the Nets have taken care of business against teams that they're supposed to beat for the most part but not the case here the New York Knicks were motivated they were desperate losing streak they questioned themselves after that defeat to the Washington Wizards earlier in the week and the Nets just didn't seem ready for the challenge the Knicks control the action for the most part throughout all four quarters throughout all four quarters and I would also say they really controlled every area of the floor I don't know if you want to start on the defensive end some of the struggles the Nets had in stopping the Knicks or on the offensive end from the three-point line the lack of scoring in the pain I mean there's a multitude of numbers that really stand out to you but the fact that the Nets are third in the league in points in the paint so when all else fails even when they struggled of course of the last few games of shooting from the three-point line they average close to 53 points in the pain and had just 14 against this Knicks team on top of shooting just over 26% from three Spencer Dinwoody is the one player that was able to get some offense going and Timothee, Lewa, Cabaro, the Cabaro the only other net that hit double figures with ten points so those type of things really show what it was like and a night like this at Barclays. I think we've seen a trend as well when Garrett Temple and Tori and Prince just don't have it the Nets have a tough time generating offense it's a lot of Spencer Dinwoody and that's because he has to do it there just haven't been a whole lot of options so while the Nets have played well in the absence of Kyrie Irving they're now 12 and 7 in the 19 games that he's missed there are times where you can just feel it the Nets need another scoring threat to try to balance things out. Yeah without a doubt and I think even you could look at the most recent game for example against Atlanta for as big of a game as Spencer Dinwoody had who are we also talking about after the game the big punch and run that Garrett Temple was able to come out what Deandre Jordan did some big knockdown shots by Joe Harris so there is no question that some of those other key players the consistency of their play is still needed and they've done some really solid things for this group throughout the course of the season but nights like this it's very apparent that Spencer Dinwoody can't do it all himself and some of those other guys need need to be knocking down some of those open looks and shots. And it speaks to the fragility of the depth right now that's certainly being tested for the Brooklyn Nets and a challenge coming up they're on the road at Houston at Minnesota at Dallas this is a difficult part of the schedule that the Nets are now embarking on and coming off a loss that hopefully lights a fire under them as well. And I think when you look at these teams even for example Houston Minnesota and Dallas these are all teams very much in the thick of fighting for even at this early part of the season playoff positionings and where they stand and how tough the Western Conference is and some of those star players that you're going to see there on the offensive end but also for the Nets the need of the offense to start clicking and knocking down some of the three point shots because all of those teams are very tough tasks and you know it comes down to putting this one behind you but also learning from it making sure that you're not just drawing too far away from some of the execution some of the freshness and some of the continuity that we've seen amongst this group. No holiday cheer tonight for the Brooklyn Nets they fall to their cross river rival the New York Nets. Back to you.


This book is titled, The Three Little Pigs and the New Neighbor. Written by Andy Blackford and illustrated by Tomaslav Zlaktyk. Once there were three little pigs. One lived in a house made of straw, which looks like grass. One lived in a house made of sticks. And one in a house made of bricks. One day a new neighbor moved in next door to the straw house. Oh! cried the little pig. It's the big bad wolf. All day the wolf worked hard sorting out his new home. Now I'm hungry, he said, and he prepared himself a tasty dinner. But he knocked over the pepper shaker. The pepper went everywhere. The wolf coughed and sneezed and choked. On all the pepper it even got in his eyes. I need water, he gasped, but I haven't got any. Perhaps that little pig next door will help me. The wolf knocked on the first little pig's door.  Go away, there's nobody home. Wolf knocked harder. But the door was only made of straw. Like hey, so his paw went right through. The little pig ran to his brother's house made of sticks. After me, he squealed. No! wheezed the wolf. There's no one home. I'll try next door. The little pig there might help me. The wolf knocked on the door. And the two little pigs quickly hid. Let me in! The wolf sputtered, but no one answered. Maybe there's someone upstairs, he thought. And he went to climb up. But the wolf was heavy. And the house was only made of sticks. The roof broke and he fell right through. Dear, what a mess! The wolf groaned. Perhaps the little pig next door will help me. The two little pigs ran next door to their brother's house. They cried. The big bad wolf is trying to eat us up. As the wolf knocked on the door, the third little pig shouted. Go away, my house is made of bricks.   I only want some water, coughed the wolf. The three little pigs laughed. Then they gave the wolf as much water as he could drink. And plenty more.


Welcome back to another animation analysis and a reaction video and this time I'm going to take a look at Kena if that's your pronunciation Kena Kena Bridge of spirits, and this is actually the end of the trailer because the title is here, but it's also already very cool So take a look at this already. There's so much in there. That's basically you can almost go back into a bouncing ball But if you have something on a path, I love this how it's actually curving alongside the path So that's for anybody who does something like that sometimes you have you know people drag Anime dragons or something just make sure that if you do fly around you have a bit of that drag And it will follow the tail will follow that that path So you don't want something that goes this way to then just be always pointing this way It's neat when it actually goes and leads into that path there, but it's great You've got really some stretch there with the interesting shape into this and I like how it kind of Curls up and kind of gets into that top side. So even just on something like this There's interesting contrast and complexity and look at that timing too goes Get that a little bit of a fast up with a slight hangtime hold Quickdown so just that alone. I haven't even gone into the actual game or the cinematics to flu You have interesting timing nice contrast falls nice path and here you got your ball Squash and then stretch will would overshoot and settle all of that is in there and it's cute too I like that little transition from this to Now you got eyes popping up the details coming in and in this and even after that you have a cute little blink And it's not just the lids you see a bit of a squash in the body Which is it gives kind of that squishiness and organic feel and the cute little eye darts even at the end Watch is at the end got that little huh and even that goes for contrast It's not just the blink or a kind of a look you can see how fairly I can't even draw it straight But it's a fairly straight line there and then as you go down into your time of a squash and another kind of change of emotion Of whatever that creature is gonna feel now you can see it's not this but it's not going I can't even draw from straight to somewhat like this, right? So you have a slight change this way just for contrast so you don't repeat yourself on this blink You don't want this blink to be exactly the same as this also gives it kind of a cutie pie thing of connected that tilt of a The puppy head tilt to the side with a little bit of extra movement there. Look at this All right, it's so cool. Just that alone if you're starting out with animation You can think about what I'm gonna do just a little bit of a shape thing Maybe a bouncing ball floating around a little bouncing ball with character. Well, there you go You can do this you can add it on a specific piece of set that could be part of a title or not But also this cool thing which I know it's particles But you could technically just have maybe only two or three It's a three of them and animate these by hand and do this you can do all this by hand So I haven't even started yet and I love this already. Let's go to the beginning and Start off with that Very cool I'm always a big fan of contrast in movement You can see how hands are together slightly fists there But arms are up and then the other one comes in Where they're just slightly higher and you can see just the difference the difference in this So and you can see the flop your hands like there were more fist of these are open fingers So this goes back into contrast if you have especially similar looking characters, right? You got backpack is somewhat similar hair is somewhat similar I mean you still have contrast and how that hair is shaped But you want to go in there. Well, how do I make them different? Well movement is going to be something posing is going to be something You can see the difference where it's mostly elbow up and with this it's mostly elbow down So just for that already it's very cute and contrasting and I'm already very smitten just by the looks and the renders These guys are super cute. This is why I wanted to take a look at this You have three different characters three different intros This is for you too if you have three different ones How do I start a shot you have a regular walk and it's definitely in focus This is the first eyes that we see but then you have these ones coming in This character comes in sideways this character Waking up yawning you can see a bit of a Offset there in arms and legs. It's very cute and also I didn't even see this before grabs that It's but you can see all the detail in the lids Again as this goes up and down here You can see how it still influences the rest of the geometry of the mesh It still pushes things up a bit. So it's not super static just gives you a little bit of that organic feel to it And that too it's pretend you have multiple characters right and some of these are out of focus You still want to continue even though i'm focusing on this this color Right as it disappears you still kind of understand is swallowing it and this character is still this one It's still blinking even though the focus is there So this is very nerdy and detailed but even something that's out of focus it keeps going It's still alive. It still has movement. There's still something to do Emberlab is the company and let me scrub forward a tiny bit here and then we have the New character introduction. Look at that. Super cute. Love that. That's always cute That's kind of your your mirroring pose to some degree It's not really putting up its arms like her But this is something for you in terms of body language as you go through your studies of body language If a character agrees with someone else You can try this if you are in a round table discussion or somewhere in a classroom or somewhere in a group of people You will see how if they have a discussion and this person agrees with this person They will subconsciously at one point mirror their pose just because they agree with it Like once you see it you can't unsee it even when you know it I still do it and even they're like, oh, I just did it. I did that that mirroring pose All right It's a bit more of a subtle Breathing and hole but you can scrub through you can see you can see the changes in the corners Mouth corners you can see it in the eyebrows sometimes the Shots that don't really move are the more tougher ones because it's so subtle You don't want to be stiff, but you don't want it to be too Too busy, but you can see here as I mean as you scrub This is a test for you You know when you scrub fast you can see the changes that are happening a bit clearer But you can see it shoulders and the face Still in there. It's very subtle. You can see towards the end. Especially transitions into quick action shots That's something too when you have movements that are really really fast I mean, this is obviously out of focus But as you get into focus you have to be mindful that when you have things That move around quickly interesting that she's not really holding this It's going to be all blurry. So you have to or you I mean you have the Control over what moves and what is blurred. So an arm that kind of sticks in this pose That is going to stand out in that movement. I know she holds that pose at the end And ultimately with the lighting everything. It's a fairly clear silhouette but if you have quick action And stuff is moving the head is moving, but you really want something to read That's if you want to read that expression, then you can continue all that movement But somehow keep that head from moving too much so that the blur gets reduced so you can read it better This is not super evident in this shot But I'm talking about this in general when you have fast movement look at what you can slow down for a read You can see this again here in this shot if you go frame by frame in this It's not quite apparent in this one But this always helps do with the lining that you have some sort of a silhouette It's a tricky thing though with that staff over The body but also the focus is also on this here Here you have your Evasion of a creature cool looking creature, but even something like this, right? You still have your whatever pose it is This is your character pose. It's somewhat alert. You got the knees that are bent. So it's ready to Go down jump. It's not just a static relaxed pose like yeah, it's Wednesday or whatever It's already right off the bat retellers that character is ready You have a clear change in the silhouette for arms, but you have the compression for anticipation to Jump and every new jump you always have a full extension of your legs Clean pose clean silhouette. Thanks for the lighting as well Into that roll even in this got clean posing even on that's nice Into that cool Oh, it's very neat even this here you got your slight drag on the hands even on details like that. They're in the dark Still looking at all the details. And then you got that staff hand off Where you have The hands that the fingers that anticipate when you have something in your hand here Just think about that when you let go of this It's not just going to be that this is moving away from the hand at the same time as the fingers Open you want to anticipate this and loosen the grip and you can see this how the fingers are opening here already then It has its own trajectory hand kingdom off and now this hand comes in very clear silhouette Also nice with the color contrast. It really stands out. So we understand. I am now gripping this With this hand even this here. Look at that. You got a offset there Even on something like this quick and blurry. You still have control over your poses. You want to make sure that it reads properly And it does I mean you can play this in real time and you can see how that That handoff is very clear. Also. What's cool. Look at the staff I should probably change colors again here Look at the staff when she lets go and grabs it again the weight of it See this So you have it feels like this part is heavier. So when she holds this She goes down, but then comes back up. There's a bit of a wobble. Watch this again See that there's a bit of a move and you can see on the on the end sides that go in and out and up and down Really gives us a sense of weight because as you grab this not this doesn't feel like paper So if you would just constrain this to the hand and not consider the weight if you move that wrist This staff is going to move around like crazy and it gives us not the right impression of weight It's very cool. You know something like that just that detail is in there I love that idea too. This is really cool that you have the light effect that she then grabs And that becomes an arrow just from a visual point of view It's very cool. Now. I have no idea about archery but watching making-offs of hunger games They say it has to be very close to the body and no elbow out or upper. I can't remember Something for you archery fans to think about interesting though cool finger pose and now we're going to focus on the head so now Zooming in and getting in there And you got your asymmetry in the mouth. You got a change as well In the eye position and just kind of the opening how big it is But even hair wise you got your asymmetry in there It's very cool Can't really see it. It's probably not there. I would have loved to see um that right before the The letting go a slight change maybe a squinty thing. I mean it is squinting actually here must be because of the light But I've been cool like some tensing in the lips there Very cool effects love that I'm a big fan of stuff like this here too So this is the cool looking render the texture selected a little slight little effects there, but we still have You know characters still in the background there It's very cool. These are really cute still That's just me now not analyzing anything. This is just me looking at the frame Very cool. Lots of really cool effects. This is more for effects people. I'm just marbling at the look of this It's very cool. But looking at the animation. I love that you have that The bubble Right as it goes out the animation is nicely timed there as this finishes Again clear posing here. You have to always look at kind of either it's a is it the color silhouette Or is it color silhouette? I mean it's a body silhouette there, right? But you still have dark versus light Even this here on a slight color change all that reads as a nice silhouette Let me see how those arms go you can see how Leads with the shoulders and elbows especially elbows You're not shoulders the elbows as they come out and you can see here So you have that curve and as she pulls this you can just feel this even if it's over one frame You can see the straightening the drag in this in the fingers It's really crazy once you go frame my frame into an animation You can really see the detail that being put in there also as you go As she moves forward this way the head has a drag this way which then Corrects and goes straight towards the end Little details, but I love that. I love that complexity in the mechanics And just in the posing there Cool, too That's always important there. You gotta make sure like when do you blink, right? Is that She realized what just happened. It's kind of like a I got the squintiness Of the strain teeth together and then the opening with the eyebrows and the eyes But look at this here once she has this I love the The darts Because she's she's looking at something right so anything that's happening off-screen that we don't see She is telling us through her facial animation What's going on? So there's a sense of wonder, but she's also analyzing things because she is darting around It's not a static stare goes. Oh, what is that? But she's looking she's processing like what is this and just through that that gives us a sense of What is she looking at bam? Then it turns into that and that's kind of the answer Ah, but we don't know more clever clever again nice silhouette color Boom, it's very cool. Oh finger animation always hard to do. You got your classic Triangle clean pose and here you can go a bit more complicated. It's not too bad Why not but you can still have complexity within the shape, right? But if you do your squinty test or perfectly illustrated here through the blur This just reads as a nice hand pose because it's an against a classic triangle hand pose there And as you go into something a bit sharper, you still have complexity within that But it doesn't distract from the overall shape. This is also nicely broken here in terms of the silhouette Uh-huh, let me get a little bit of shakiness in there Hopefully through animation layers or whatever setup they have. It's always I mean, that's kind of how I would do it We have at work at least we have controllers where you have a hand controller But within the you know, the outline hierarchy, we have multiple nodes So I can add all kinds of shakiness top or bottom for different Pivots or whatever, but if you would do that, you know, it's built into the rig or through layers So you don't have to do general finger animation hand animation and the shakiness on top of it Again, you can scrub through this You can see the change. It's like you have more strain. You can see how she relaxes a bit here That's cool to see too. If you scrub watch the eye This here that means there are darts. That's really clever. I love this. That's actually I don't remember last time I saw that in a movie The attention to detail where if you have eyeballs and you dart around While your lids are closed you can you can film yourself You can see how the skin of your lid is still moving That eyeball is pushing against the lid and it's still going to move that that lid around and you can see this here And especially again when I scrub You can see that so she's not just relaxing something's going on either. It's In some sort of meditation trans Sleeping REM sleep where they're still thought process going on or she's just thinking she's somewhat awake But still thinking but anyway, that's actually a cool detail Didn't even notice that before Back to this. Sorry. This is just me ogling at this point now. Cool. I love that stuff Just cool colors. I love the composition. I love all this Oh, look at that. It's very cool. I know this is not me just devolving into cool What it is Come on. I said this is a trailer analysis and reaction clips. It's so cool Man, this is cool too. I love animating stuff like that when it's not sims and you have Whatever effect you have and again, let me switch colors here. So you have all this you have a shock wave Coming towards us, right? You can see this here all of this reacting and this goes towards us this goes this way because Because that shock wave is going to the outside there I personally love animating stuff like that Even have stuff like this here. I don't know how this was done if this was sims or done by hand But you know if you have if I had an animation where I would animate a character doing something With a shock wave I would absolutely put stuff in the foreground and move this by hand just because I like it I like animation Curious, this could be the continuation of where do we go here, right? Could this be not this is part of the character. There's no staff. Could this be part of the staff? I'm just looking at connections here if This moment here is after what we saw But anyway, let's go back to seeing what's going on here tricky shots fast shots are tricky In terms of reading the face so you want to be another you have to be brought But it definitely helps to have a you got your eye kicker It really reads big white eyes Big contrast into losing eyes and and squishing this together Back into stuff that I love here Well super slow mo is bubbles. She's on the water. We don't know. No, it's just floating character still here I don't know what's going on, but I like it Like the look of this She is on the water How much to see your animation wise I mean you have clean silhouettes again color You got the dark and the light all of that reads very clearly not too complicated shape with the with the legs And just some movement and keep alive because it is slow motion and on the water Oh, this is cool to look at though Once you're so close you can't just do what let me just turn my blend shape on for Lid closing. You still have to have The skin Surrounding this and all of that react to it and again you can scrub where you can see the amount of changes you actually have A relaxation of that brow going up as the lid closes You can even see a change In the cheeks you can see with that either what I can't remember if that's if she has a mole or not or something on her face But or a shadow. I know not a shadow the shadow wouldn't move on the skin like this, but You can see the amount of detail That you got to put in even though it's You know, it's more stylized Once you're close up, you can't get away with super simple purely just eyelid animation You have to think about the muscles and everything but also acting wise what is going on is she Dying is she just relaxing at whatever the context is? Well, it's not just eyes closing. You have to think about all the other Parts of the face that will tell the story and and push that emotion of the character Ah, and then Oh, man. I love these already I'm super spin by Israel. I have to say I just everything to look of this love that love the character love these guys This is your more of a gameplay Moment that we can finally see what it looks like. Oh interesting. How fast was that? Pretty fast as a patient air into that jump, but that goes into more game mechanics An animation that I am not super versed in it's just stood out as being very fast Cool, though double jump. We got to have a double jump Super spitting by these little creatures though Oh See, we're back into just interesting shapes. This reminds me of how was that called? Drop was called is a Disney short called drop That has something where because of its, you know texture and like composition like it's a it's a raindrop Um It plays around with shapes a lot like this was really cool. I highly recommend that you watch. I want to Disney plus Q q q to Love all that stuff. All right. Looking at her Very bouncy hair not here. You can see that as well Oh Cool, though, you can still have that that little reaction that still goes through the body into the knee If you see this just a little move in the knee So I tell my students all the time if you have if you have a head move, right? You have to think about how that body mechanic movement or just that body part movement Effects the rest and it's going to affect it and fade out. So you have all of this Going into here. So a head move is going to really affect this section here the neck and the chest Probably the shoulders and move potentially because of that the elbows and in this case because she also has You can see this the roots going up and down And the saddle it's going to continue to influence everything else so bottom mechanics are kind of you know need a lot more work is when you just have This joint of the head animated where just the head goes up And there's nothing else moving and reacting and being influenced by that move So this is short as a good reminder of always think about that think about well, what body part is moving and what else is it going to influence Oh cute and we got these little guys Transferring into this cute.   I love this Oh and even that again for contrast. I love that detail. Whoever animated this love it You got the overlap with the detail of one arm and when it happens again It's a leg and it's not an arm just for complexity and contrast. I love this I would love to know who animated this I want to give you a virtual high five It's cute though. This is a really good example of saying well, you have multiple characters to look exactly the same What can you do? Well, all right, you can put some props on there little changes frogs and this But you still have to go through through movement like how this guy dances is different than this guy Jumping around and looking I think that's a good example in that you can start in terms of contrast contrast through movements That's so cool Yeah, it's really interesting to see the changes between the in game and this But I would assume not in game and cut seeing they're cute I love all this again. This goes into contrast, right? So you have this that's a fairly Stabilized pose, but then instead of just going up and going. Oh, I love it. It's cute There's a slight move that gives you a really nice line of action That has a curve that gives you a contrast you can get one leg out for this And because of that the head has to compensate that gives you more asymmetry And then with that the arms are also on this side. It's not exactly in the middle There's so much that goes in this I love this And now she let's go drops a little bit and then squeeze. Oh man, I would have loved for those eyes to Squeeze a bit more For you guys like, oh wait, I love this like what is going on the little eye darts It's cute That even on something like this see contrast and everything. It's not a twin pose But like that and because it care to go so far to the left, right? This gives you the opportunity to go more to the to the left Sorry going to the left gives you room to go to the right again It gives you opportunities for shape changes and contrast. I'm just a big contrast person. I love that And then you get the other character. That's not as important, but you don't want to just do Do nothing and you can still see From that pose to cute and Squatting down to look at that Still have enough changes, but it don't really distract from this And again, you can look at little parts here that have the drag and overlap Lots of squishies. I love the rhythm of this All right Well, you can see it's not again. It's not even in your in your timing hold Down fast up hold Down fast up hold to get musician time or thing, right? But watch this Let's go back a bit back a bit watch this guy now and what what what? Where's the timing of it? It's good stuff. I love it back into game I love that stuff I don't know why but I just had that Breath of the Wild That's how when you have She cursed with all that blue stuff in there Almost Switzerland Alps. I know it sounds a little bit cool look Oh, come on. Just the look of the game is gonna be fantastic. I love this. All right back into Into your gameplay. Let me just see let me just see. Yes. Yes. Yes that again something that students sometimes overlook I love just the idea of having a human with a creature It could be a vice versa could be a tiny creature a tiny human or the big creature But I like the the contrast, right? You got your size contrast But what I was looking at is that okay.  But I was going to look at will this Influence the shoulder and yes it does you can see how the shoulder goes down So don't forget even something small like this has weight and it's going to influence whatever Surface it's going to hit And look at that. She has a bit of a look and change in the eyes. So the focus is there focus change That's probably something I point out to students Not the most that I mean I have my most common animation mistakes list but Something I point out a lot. It's just eye line and make sure that when something is moving that the character Darts and looks and focuses. Otherwise, it looks like they're just completely disconnected I darts and and just eye focus and eye line Um, it's definitely something I mentioned a lot. So it's cool to see that that's in there Even on something like this a bit of a head change Just the position of it Whoa, sorry. Now this is me just nerding out Look at that That's cool. I like this. I like this game Whoa I can do that one pop with is your patient interesting Definitely will be responsive, but you got your full extension full stretch here. It's very cool into your role Tricky though, but you can see how some of these that's gameplay and not Anime just because you got a bit of a wiggly tip there And then again that that one frame pop down It's cool. Look gotta say that's cool too. Sorry. This is not a bit less than animation here, but Although you do still have contrast on everybody's moving at the same time Comes in close. I love that. It's like a Combined attack you have your guys helping you out with this Spilling over into that It's very cool That's cool too for contrast there. You can see just the the weight I know this camera shake but still It's the difference in weight the timing at how Quick like smaller body parts will move faster than bigger parts So you can this has to be slower But even on the bigger creature smaller body parts can still move fast enough so you can still have that that fast Move down on that hand and I like this too where you have your fingers together But then splayed out to come back in here. It's cool contrast in these switching to This is your uh Zelda targeting thing. I know this is not zelda specific, but just all makes me think of breath of the wild Really cool art design and look That's cool, too. Let me look at this again here Oh Well, even on that though, you got your nice posing very clean clean silhouette But even in all of in all of this here, you still have Because you know the always, you know Like you have to really make sure that all the posing is clear with the camera is going to rotate around that even if you target It's going to be pointed towards the character, but still these are very clear posing through all of this Very cool of the weights too as it goes up when and down. Let's check this out again. Just that Yeah, it's neat and you got that leg coming down first that then Takes you know stops momentum with this section can't go further down the legs are stopping it And then you got the buckling and the overlap of this Even in gameplay stuff you can check out stuff for animation body mechanics and principles It still has to be all be in there. I love this by the way straight to the drag That's cool Something for you to think about as you do your body mechanics whatever you have Even the props are gonna have some sort of give that gives us Either a sense of how strong she is to bend this Or the material Of that so cool Yeah, you gotta have your freeze frames Ah cool That I'm a big fan of that's definitely something I talk a lot in my classes and my Actually acting analysis for animators is when you have anything like an outside influence right in this case It's this force field. This energy feels That goes out it is going to influence the hair That to me just feels more like it's really part of this You can see how this bubble goes through and pulls the cloth here you can see this here And then it settles Love that and when that is not happening be it in the game be it in the cinematic be it in the in the movie Where if someone had me the character then the effects are down on top of that But then the character does not react to a shockwave or something. That's just to me always a missed opportunity I love that this is in there also a nice pose Still somewhat clean and it's a bit more complex, but it's close up. It's not distracting color silhouette too Nice little change in the face at the end too Just there Oh nice to it. Let's look at this here for anticipation You got your somewhat squash in the face As the eyebrows come together and then You see the stretch on the on the jaw going down Into this cool too Again Cloth is influenced by that shockwave Still moving up as it floats. It's really cool That's cool too. I don't know if that's just a idol as you stand She takes a step, but it's also somewhat working with as this Goes out You still have the cloth reacting to that and she takes a little step back Cute and you got this guy coming back in here too Lance So cool and that's the ends. Ah bummer could talk about this for Much longer, but I don't want to test your patience here This has been and half an hour or half an hour already. Anyway, that's it That is my nerdy analysis. Whoever animated this Bravo, it looks fantastic. The animation is great. The look is great. This is definitely a game I want to play and that's it for kena if that's your pronunciation bridge of spirits Thank you for watching. Check out the rest of my channel if you want to see more analysis stuff and uh, that's it. Thank you for watching


Hey, Bolo buddies. Thanks for watching. Okay.  So these are big money Bolo's you guys Definitely things that you need to be on the lookout for Some of these things I probably wouldn't have picked up. So I definitely learned from this video. So I am gonna start by showing you his channel here and Here it is it is Dad Planet and he is up to 1.2 K subscribers So I had him on the Bolo show not long ago and I think right around that time He had a thousand so he is definitely gaining some subscribers. So you guys definitely go and subscribe to him Let's get him to 1,500 Okay, so he does do some Bolo videos and he tells you things to look for but his what sold videos are Bolo videos because he is a Bolo finder so definitely go and subscribe to his channel and Put in the comments of his video that Bolo buddies sent you So I'm just gonna kind of scroll through so you guys can kind of see some of his videos All right, are you ready to see some Bolo's some items that we all need to be on the lookout for? Items that we can buy low and sell high. All right, let's get started All right, the first item is This kitchen aid Mixer it is a Cobalt blue Tilt head stand mixer. I don't know. It's like some sort of fancy mixer, but He got this at the Goodwill now. He did pay up for this He paid $99.99 for this but he sold it for $299.99 and the buyer paid shipping So this is a time when you look up comps and you know that you have a Bolo and you're willing to pay up for it So I'm too cheap and probably wouldn't want to ship that so I probably wouldn't have bought this So tell me in the comments. Would you have bought the mixer? Let me know in the comments All right, the next item. I definitely would have bought I love buying inflatables especially the brand Jimmy g Mmy you guys have heard me talk about these before they are Definitely a Bolo this one He sold for $299.99. I told you guys this video is gonna be good He's got some big money Bolo's and he only paid $19.99 Sense for it and he got it at the Goodwill and it was in the original box the box was pretty beat up but that is no big deal and I Also take mine out and I blow them up What you do is you plug them in and they have a fan and that fan creates the air that keeps the thing Blown up so you do have to keep it plugged in for it to work, but They're definitely a Bolo. I've sold Christmas ones. I've sold Halloween So definitely be on the lookout. I do have a video on inflatables also to look for Okay, so this is a Bose sound dock It's a Bluetooth speaker and he got this at the Goodwill for $14 and 99 cents and it sold for $249 and 99 cents and the buyer paid shipping on that. So I know that Bose is A good system. I might have looked at that one, but I probably wouldn't have bought it I just probably wouldn't have This Burberry coat This one Let's see He got it free from his mom and he sold it for two hundred and forty nine dollars and ninety nine cents and The buyer paid shipping the next item is this Casio electronic keyboard piano and I'm gonna show you some pictures here. So it's just a keyboard piano and I know these so He got this at the Goodwill for $14 and 99 cents and it sold for a hundred and ninety nine dollars and 99 cents And the buyer paid the shipping The next item is this vintage lighted waterfall picture with sound. So how cool is that it even has sound? He got this at the Goodwill for 1999 and it sold for a hundred and ninety nine dollars and ninety nine cents and again I probably would have walked right past this. How about you guys? Would you have bought it? I probably wouldn't have bought it because I didn't want to ship it, but it is cool. Look how it lights up The next item is another item that I probably would have parted out I would have probably sold the furniture separately and The house, I don't know what I would have done with the house. I wouldn't have wanted to ship it Maybe it's not too bad. I don't know Let's see He got this at the Goodwill for $14 and 99 cents and he sold it for a hundred and ninety nine dollars and 99 cents in the buyer Paid shipping I may have listed that one actually. I have I have shipped some doll houses. I just don't enjoy packaging them All right, the next item is this pottery barn Glendale pulley lamp antique nickel Again another item. I would not want to ship you guys. Let me know how you feel about shipping items like this I know that I mean the majority of his items are items like I'm like nope wouldn't have bought it Nope wouldn't have bought it because I don't want to ship it at how much money am I passing up on? Because I don't want to ship items probably a lot And store them you have to store them also Okay, so this came from the Goodwill He paid six dollars and ninety nine cents and he sold it for a hundred and ninety nine dollars and ninety nine cents. That's amazing The next item is this crown audio Two-channel Pro amplifier Yeah, I don't want to tell you guys this but I wouldn't have bought this either because I didn't I wouldn't want to test it So I'd love to hear what you guys have to say down in the comments. So this one He got on Marketplace in a bulk buyout So he had about five dollars in it and it sold for a hundred and seventy nine dollars and ninety nine cents and the buyer paid shipping You know what I'm gonna say Anyway, he sold this Hoover. It is a ultra wind tunnel filtration vacuum cleaner. Oh my goodness He got this off Facebook Marketplace for thirty dollars and he sold it for a hundred and forty nine dollars and ninety nine cents And the buyer paid the shipping The next item, you know, what I'm gonna say is a Sears Kenmore convertible sewing machine I think I'm gonna title this video. You know what I'm gonna say and this is tested and working and it's a sewing machine and He put she works. So I guess it's a female and he sold this for A hundred and forty nine dollars and ninety nine cents. He paid four dollars and ninety nine cents at the Goodwill That seems really cheap for the Goodwill. Wow The next item, you know what I'm gonna say So this is a croquet set and I actually found this one to be really interesting because I think I see these a lot I Shouldn't say a lot, but I have seen these at garage sales Yeah, I think I used to play this at my grandma's house But anyhow, he got this at the Goodwill for nineteen ninety nine and he sold it for a hundred and forty nine dollars and ninety nine cents And the buyer paid the shipping. Are you ready for this? He sold another one different style slightly This one he got at the Goodwill for nineteen ninety nine and he took a best offer of a hundred and twenty four dollars and ninety nine cents And the buyer paid shipping So that would be hard to ship heavy awkward He needs to do a video on how he shipped this because I'm not I wouldn't know how to ship that I'd feel like the balls would be heavy and they'd be like Laying on top of the poles and I'd be afraid they'd break in transit So yeah, I'd definitely like to see a video on that if you're watching dad planet Can you please do a video on how you ship these things? The next item that sold is this department 56 village animated sledding hill Christmas decor complete and working How cool is that? I I would have picked this up. I would have bought this one He got it at the Goodwill for four dollars and ninety nine cents And he took a best offer of a hundred and twenty five dollars and the buyer paid shipping The next item is this vintage Thomas museum series limited edition a M FM cassette radio and this one He got at the Goodwill also for nine dollars and ninety nine cents and he took a best offer of a hundred and twenty five dollars And the next item is this Lego eight eight one three battle at the past Castle Knights Kingdom And it looks like he assembled it Which can take some time But his YouTube channel name is dad planet. So maybe he had some help with that But he got this for thirty dollars on Facebook marketplace and it sold for a hundred and forty nine dollars and ninety nine cents and the buyer paid shipping The next item is this antique Wagner cast iron skillet frying pan and you can see here That he has taken pictures of any issues that it has he showed a picture of the bottom. So this is what you're looking for and This one came from the Goodwill. He paid six dollars and ninety nine cents for it Took a best offer of a hundred and twenty five dollars in the buyer paid shipping The next item is this LG B the big train great northern caboose and It looks like it's new old stock and this came from volunteers of America thrift He bought it for nine dollars and ninety nine cents and he sold it for a hundred and forty nine dollars and ninety nine cents in the buyer paid shipping The next item is this vintage 90s the north face Gore Tex mountain light jacket orange Mango so those are just colors that key colors that people could be searching. It's a men's size XXL And this one came from Facebook marketplace He paid ten dollars for it and sold it for a hundred and forty nine dollars and ninety nine cents in the buyer paid shipping. I Love this one. This I definitely would have picked up So it's a love pain and stitches glitter orange pumpkin purse Kind of different, right? It says pumpkin cult bag So I don't know. I've never seen anything like it, but it is definitely a bolo He got this from love pain and stitches calm He paid eighty one dollars for it and sold it for a hundred and forty nine dollars and ninety nine cents So this was a retail arbitrage pickup. I don't know if he bought it and then decided he didn't want it Or if he bought it with the intent of reselling it for a profit So that would be a question. I would have to ask him Maybe he can put it in the comments if he watches the video. He can let us know about that purse The next item is this granny afghan goodwill sold it or I'm sorry paid 1999 for it and Yeah, how cool is that and he sold it for a hundred and twenty nine dollars and ninety nine cents and the buyer paid shipping The next item is this rare vintage Madeline old house in Paris dollhouse By Eden with accessories Okay, here you go. I probably would have picked this up I do love selling doll houses and this one doesn't seem to be super super big Facebook marketplace Free was something else he purchased from the buyer and he sold it for ninety nine dollars and ninety nine cents And I know I told you guys that everything sold for over a hundred and with shipping this sold for over a hundred I think there's only two Everything else literally the sold price was over a hundred All right, this one is a Nintendo Wii bundle So this one came off Facebook marketplace huge gaming bulk buy So he had about fifteen dollars in this and he sold it for a hundred and nineteen dollars and ninety nine cents and the buyer paid shipping So these are Birkenstock London clog Hunter Brown men's size 42, which is a US 99 and a half he got these from an estate sale He paid five dollars for him you guys and they sold for a hundred and twenty four dollars and ninety nine cents. I Don't know what kind of an estate sale He's going to that had these for five bucks, but I need to find out All right, the next item is because the estate sales that I go to they don't they would not have had these for five dollars Okay, this is a margaritaville Bahamas frozen concoction maker Yeah, I think I said that right Goodwill paid fourteen ninety nine for this and it sold for one oh nine Ninety-nine and the buyer paid shipping The next item is this Zajor Rushi It's a bread maker. That's what it is Definitely look them up if you see them This you can see it actually has bread in it. So it looks like he tested it and actually Made some bread. How funny is that? Oh my goodness. Look he made bread That is cool. Now. The question is did he eat the bread and was the bread good? That's what I want to know We'll look for his comments in the description to see if he watched the video All right, he got this on Facebook marketplace for thirty dollars and it sold for a hundred and nine dollars and ninety nine cents in the buyer paid Shipping the next item is this Sony info lithium AC whatever for position battery charger and This came from the Goodwill. He paid nine dollars and ninety nine cents for this and it sold for a hundred and nineteen dollars and ninety nine cents The next item is this Bachman big hauler large scale Chattanooga Locomotive and it's like a train thing It was from the Goodwill Paid fourteen dollars and ninety nine cents and it sold for a hundred and nine dollars and ninety nine cents buyer paid shipping The next item is this vintage topstone rubber latex skull mask with full fur hood from the 1970s and you can see here It's got the Fur and you can see it's very old Came from a church sale. He paid three dollars for it and it sold for a hundred and nineteen dollars and ninety nine cents and the buyer paid shipping The next item is this Oakland Raiders snapback hat. It is vintage and he sold this for A best offer of ninety five dollars, but if you add on the shipping, ooh, the shipping was three ninety nine ninety five Ooh, okay shipping and tax got us over a hundred So really close to a hundred dollars sale on this one I wanted to include it, but it kind of makes me look like a liar because It didn't quite hit the hundred. Well, I bet with tax it did But when I gave it to him I saw the sold for price here And I didn't know he took a best offer. So that's why I picked it, but it still sold for ninety five dollars I mean, it's a Raiders hat.  I would have I Wouldn't have picked I would have had no idea this was worth ninety five dollars So I'm definitely glad I included it in the video even if it made me look like a liar So that one came from the Goodwill. He paid a dollar ninety nine for it and Sold for ninety five plus shipping and tax to make it over a hundred dollars. All right Okay, you guys here is Dad planet is actually dad planet on eBay. I will link his store down in the description and again This is his YouTube channel Sell these toys for over two hundred dollars on eBay. So that's his most recent video So you can definitely go and check that out and in the video of comments again put Bolo buddies sent you so give me a shout out in the comments. Let him know that you came from Bolo buddies All right, you guys. Thanks for watching. Thanks for being here. You guys are great. I appreciate you guys Let me know what you think about that video because I got to say there's a lot of stuff that I would not have bought And he made a ton of money on that stuff So are those items you would have picked up or those items that like me you would have walked past because you didn't want to ship them So again, thanks for being here. There's gonna be some videos popping up Definitely check out one of those and definitely subscribe to dad planet. Thanks for watching