I think it's fair to say that it's not a foregone conclusion that Joe Biden will lose to Donald Trump because I genuinely believe that COVID-19 has shaken up the dynamics of the 2020 race and maybe voters will just make a decision based on Donald Trump's handling of COVID-19. Maybe this will just very narrowly be a type of referendum on Donald Trump, but as time progresses on, more and more people are losing confidence in Joe Biden. Why? Because he has a problem attracting young and Latino voters and he's doing nothing to win them over. On top of that, more and more evidence is mounting against him. Tahr reads claims are being validated. They do seem credible, not that they weren't already, but now we have more evidence, more individuals corroborating her claims. And on top of that, you know, it's very transparent what his campaign is trying to do. They've kind of pushed him aside and they've tried to make his wife, Joe Biden, the face of his campaign. And this is obviously to hide away the fact that he is suffering from cognitive decline. That's such an issue that I don't think he should have run to begin with. Even Obama tried to influence him not to run because he didn't think that he could get the job done. So there is this sense of worry, not just with the left, but with Democrats as well, that Joe Biden isn't going to be able to get the job done. Now the left knows that there's something that we can do. There's a stronger candidate that can beat Donald Trump. It's not a guarantee, but he's stronger, Bernie Sanders. And I tweeted out Bernie Sanders should unsuspend his campaign, and that's probably one of my most popular tweets ever. It got 18,000 likes. And on top of that, a couple days later, Bernie come back, trended on Twitter with nearly 60,000 tweets. So there is a real yearning for him to come back for practical reasons. It's not just that Joe Biden is not instilling us with confidence that he can beat Donald Trump. But on top of that, there's a pragmatic reason why Bernie Sanders should unsuspend his campaign. He was just removed from the New York ballot. He said his goal was to influence the Democratic Party's platform and rules. And in order to do that, he's got a rack up delegate, so he told you to still vote for him. I intend on doing that, but they just removed him from the ballot of a very delegate-rich state. So this can be seen as an out. Well, I wasn't going to unsuspend my campaign, but now it looks like I have no choice because my voters, they need to have a say. Our agenda needs to have some type of sway over the Democratic Party platform. And if the New York State Democratic Party says that I've got to be an official candidate who has declared that he's running for office in New York, then I guess I have to unsuspend my campaign and declare my candidacy once again. Now look, do I think Bernie Sanders would do this? No, I don't. I don't think he's going to do this because he responds to all the criticism he received. Like, we knew that there would be growing pressure for him to drop out. You saw Larry David, you know, tell him to get out. You saw the view hosts, like Whoopi Goldberg, asking him why he hasn't dropped out. So he wouldn't do this. He wouldn't want to do that. And I think that he knows that he still probably won't win, so he doesn't want to get his supporters hopes up. But here's the thing. Joe Biden is a horrible candidate. And one thing that we know for a fact is if turnout is low, if young people don't turn out for Joe Biden, he's going to lose. And he hasn't done anything that changed that yet. So while I admit that Bernie Sanders, you know, unsuspend his campaign probably won't change the trajectory of this race, it at least, if nothing else, will pressure Joe Biden to do better. This is why I wanted Bernie Sanders to stay in until the convention. Because if you run a grassroots campaign where people dedicate their hard earned cash and their lives, like my friend Joy, she sacrificed five weeks of her life to go to Iowa and knock on doors for Bernie Sanders.  And I know that that's not his intention. So I'm not trying to attack Bernie Sanders. And I know that, you know, it seems like I'm crying over spilled milk. And I know that even if Bernie Sanders did in fact take my advice and unsuspend his campaign, it's not like the Democratic Party would let him win, however you want to use the word let. I mean, if Joe Biden fails, if, you know, there becomes so much pressure for him to drop out because of the tower read allegation or what have you. I'm not under this, you know, impression that Democrats will be like, all right, we've got to bring back Bernie, I guess.  They're not going to do that. They'd replace him with some other neoliberal Democrat, Andrew Cuomo, whoever. You know, throw a neoliberal name at a dart. It doesn't matter. So, you know, it's not like this is actually going to change anything. I'm fully aware of the fact that Joe Biden is probably going to be the nominee, almost certainly going to be the nominee. And Bernie Sanders is not going to be president. He's never going to be president.  But with that being said, now, more than ever, we need strong leadership. Without Bernie Sanders in the race, we've already seen how poorly Joe Biden is performing. Once Bernie dropped out, Joe Biden went back into hiding. And he already was going into hiding once he started to sweep states on Super Tuesday, two and three. So it's not like Bernie would have that big of an influence, but any influence would be better. If Bernie unsuspended his campaign and just held a daily press briefing when it comes to COVID-19, that could make a difference. That could, you know, influence discourse in a way. Bernie is still holding pretty frequent town halls online through Zoom with, you know, health experts and members of Congress, such as the squad. So I mean, you can basically run a digital campaign by changing nothing, just unsuspending to put a little bit of pressure on Joe Biden. But I know Bernie's not going to do that. And just the fact that so many people are yearning for a return of Bernie Sanders, it shows you how weak of a candidate Joe Biden is. Like I was thinking about this and I honestly would prefer Hillary Clinton. I honestly would prefer Hillary Clinton because, look, at least she's qualified. Nobody doubts her cognitive capabilities like she would be able to govern and she'd be at least an adequate leader. She'd be better than Donald Trump and certainly more competent than Joe Biden. But I mean, out of how many candidates, like 22, 23, we got the second worst candidate. Michael Bloomberg, I think was the worst, but we got the second worst, Joe Biden. And it was because Joe Biden was the first Democrat to win a state not named Bernie Sanders. If Pete Buttigieg or Amy Klobuchar had won South Carolina, then I think that, you know, that would have been the Democratic Party frontrunner currently.  And I want Bernie to unsuspend his campaign. And look, maybe maybe I'm lying to myself when I think that Bernie would have any sway over Joe Biden to do better. Maybe I'm still better. I think it's okay if I admit that maybe I just want to, you know, give the middle finger to Joe Biden and the establishment, right? Because they do that to us at every step of the way. And I just, I think this is about just wanting any lefty in a position of power to play hardball with Democrats just a little bit. I mean, they just removed Bernie from the ballot just to give us the middle finger. So I just, I want them to get a taste of their own medicine. I want the left to play hardball. And I'm just, I'm so disappointed. I don't know what this would accomplish in bringing back Bernie's campaign. I know he wouldn't win. I know that they wouldn't let him win. They'd stop him. They'd use their institutional mechanisms to, you know, suppress the left like they've been doing. Like it's not going to change anything. So it's just, I don't know what I want. I just, I want him to unsuspend his campaign. And I want things to be different.  Like we could have had Bernie Sanders and Americans turned down not one but two chances to get him. Someone who's genuinely trying to help people. And now we see polls showing that 69% of voters favor Medicare for all. And they've nominated a candidate who is openly hostile towards it, who laughs at people, who ask whether or not he'd ever consider supporting Medicare for all, who literally said he'd veto Medicare for all. This is such a bad situation that we find ourselves in once again. Like you think that after 2016, Democrats, if they wanted to win, would have learned their lesson, but they chose someone worse than Hillary Clinton, which is almost unthinkable. And I can't help but think it's going to get worse. They're going to pick Michael Bloomberg in 2024 or Joe Manchin. I mean, they keep lowering the bar and there's no other conclusion that I can take away from this. Rationally than to think that maybe they just don't want to win or they don't care about winning. They just want to make sure that the left doesn't win. So, I mean, I want Bernie Sanders to unsuspend his campaign, but I'm not of the belief that this will actually accomplish anything meaningful. Maybe I'm just petty.  But he should unsuspend his campaign. And Matt Lech on Twitter pointed out how any grassroots candidate should just opt to stay in until the convention and never deviate away from that plan. Because when you really invest your life and your money in a grassroots candidate who you believe in, it's a huge gut punch to not even get to vote. Like for me, I'm not going to even have a voice in this election. Like my state doesn't vote until May and Bernie already dropped out and I'm not alone. Most states or at least half the states about haven't voted yet. So the situation is just frustrating. And you know, maybe Bernie just unsuspend his campaign will be cathartic. Maybe it'll just make me feel good. But I mean, people want something to believe in. That's the takeaway from this.  I don't know. It's just that we have an opportunity to get someone who actually cares about us into power. Why not try? Even if failure is almost a certainty. Why not give it a shot just to say we did everything? I think he should unsuspend his campaign. I genuinely do.   I don't care. He should unsuspend his campaign and aggressively fight for the nomination. Joe Biden can't do it. I don't have faith in him that he could beat Donald Trump. And even if he did beat Donald Trump, I don't believe he would be a competent leader. So we have nothing to lose and everything to gain by Bernie just unsuspend his campaign. The media is going to hate it. Democrats are going to, you know, bark at him. Who cares? They've already showed that they have no interest in even extending an olive branch to the left. I mean, they just removed Bernie from the ballot. So if they're going to give us the middle finger, we need to just for once play hardball in return. Just once. Probably won't work out. But at least we could say we tried.


Going on everyone, Sam here with late in sports cards. Ripping 10 bucks, Tuesdays 10 bucks, impeccable photo. Basketball mixture number 165, random team style. So we'll get at your random results as always. Find those on the website under the results tab as well as the link that's currently in chat. So good luck everybody. Here we go. All right, we're gonna start with Prism multi-pack. We do them after group breaks, crispy. So we do them, group breaks will end. My guests tonight will probably be around between 12 and 12.30 Eastern time. And then we'll do personals after until two a.m. Probably stopping a little bit early tonight because I do have to input all of our national breaks. So probably end around one at 50. But I will do as many as that are in queue that I can physically get to. Again, Kyle will be ripping personals on channel two tomorrow night. So worst case scenario, you'll have to wait less than 24 hours for your person to get ripped. But everybody who's in queue right now will be able to get to for sure. No doubt at all. Yeah, it'll go after group breaks part. This is all hardship, I believe, right? Yeah, sometimes you get a little funky with the multi-seller. All right, here we go. These are always stuck together. Sorry, there we go. And it's always gonna be based in the front, Silverpaw George, Green, Lou Will, Emergent Silver, Rookie at Patrick Williams, Isaac Acoro Rookie, Pirates Maxi Rookie and Devon Booker Base. Not too shabby on that one. Silverge, Mall Murray, Green, Enos Canther, Enos Freedom, Kobe White, Onyeko Kongwu, Big Double O, Siddiq Bayerookie and RJ Barrett, Siddiq the Freak. Silver, Aaron Nesmith Rookie, it's Green, Dinwiddie, Siddiq Bayerookie, RJ Hampton, Kyle Kuzma, Tobias Harris, LeBron Tribute, Silver Kawai, Green Dwayne Bacon, Lamello, nice one there, it's the Impact Rookie. Rubio Tyrell Terry and Christian Wood. Green and Wood surprisingly still a free agent. Just kind of shocked on that one. Silver, Davis Bertons, Green Mitchell Robinson, Isaiah Stewart Emergent, Bradley Beale, Malachi Flynn, Jake Lehman. Silver, John Wall, Green Troy Brown, Emergent, Denny Avdia, Fred Van Vleet, Kira Lewis Jr. and Markel Holtz on your base and your rookies.  Silver, Dennis Rodman, Green Rookie, Isaiah Stewart, Beef Stew, Joellen B Dominance, K-Love, Xavier Tillman, Peyton Prichard Rook, Silver, Colin Sexton, Green Randall, Emergent Rookie is Green, Obie Toppin, Rodney Hood, Sabin Lee and Magic Johnson. Silver, Yudoka Asabuka, Jeremy Lam, Steph Curry, Tyries Halliburton, Rookie for the Kings, Jada McDaniels and Jalen Smith. Silver, Landry Shamet, Green, Frank Nendalkeena, Dominance KV and no rookies on that one, all base. Sneak Bay, Emergent Rookie, sleep that one. The Atlanta Hawk, Derek Rose, Patrick Williams, Rookie. What's up, Brett? How you doing, buddy? Silver, New Orleans, Noel, there's a green IQ, Emmanuel Quickly, New Orleans, Smith. There's an Ant-Man, nice one there, Anthony Edwards. Fornia and Jordan Noora. All right, onto our red, white, and blues. Face.  You just got jingled on the red, white, and blue. It's been a minute since we've gotten a red, white, and blue jingle. Time to just gotta- Gussels have to take it. Have to take it sometimes. To be fair, it was two new jingles. It was two new jingles today, a pink hyper and a red, white, and blue. Oh yeah, yeah. Tell them out. If it's any consolation, it's the annoying, the annoyance. It's not what I mean. It's because it's not, but I guess it's all right. I guess a lot of fun. Robert Woodard, red, white, and blue. I think I got it all right. Yeah, you're probably right. Face. That is Nick Richards. It's the once. We can get his buddy, Mr. Lamello. Trey Jones rookie, nice one there for the Spurs. Matthews Levine, and the last pass here. Noel Caches Winston rookie for the Wizards. All right, that'll do it for a multi-seller. We're gonna go on to Hoops now. 22, 23, Hoops basketball. God, it's been so long since I've opened this. Wild. It was like mid last year. Chet rookie, not bad. Tramon Green, and Purple and Yoko Kongwu. Kendall Brown rookie, Zion, and Anthony Simon's Purple. Wendell Moore, Clay, Hoops, or Hoopla. Sounds like a lot of Hoopla. Ant-Man, in Watson rookie. No redbacks. Jaylen Williams, Trey, Primetime, Kyrie. Henry Chandler, Nemhard rookie. No redback. That's gonna be Egg Lake Wesley. Brandon Ingram, 299 on the green, the Pelicans. Vince Williams, Throwback, Curry. Redback, Yabate, AI, Caleb Houston rookie, and Jaden Ivy. And no redback. Which one, Brett? Rudy Gay, two, three, no, 199. Oh, the Holland. The Holland was dope, dude. If you're talking about the Holland, the thing was nasty. Christian Brown rookie, and Primetime, Kyrie. No redback. Yokic, Branham rookie, and a D Wade. No redback. Bari Smith rookie, AJ Griffin, and Trey Mann, and a Purple Devante Graham. No redback. EJ Liddell. Ooh, nice. Jaden Ivy Otto, that's solid. Congrats, Pistons. There you go. NBA rookie, Inc. Missed the Jaden Ivy, Paul George as well. There was not. Spain, Jeng, Paolo, rookie. Benedict, Matherin. God of a Mitchell. There's a Monte Morris, redback short print. Nice one there, Washington. That makes it easier if they're on the back. Fine, Gobert, Jabari Smith, class action. Gary Payton, Spark plugs. Jason Tatum. Paolo rookie. No redback there. Usman, Jeng, and Primo, City edition. Benedict, Matherin. God of a Mitchell. Road to the Finals to 999, D Wade. No, BAM. Oh, I said D Wade, BAM. BAM out of bio. Bam, bam, bam, bam. Walker Kessler, rookie. Keegan Murray rookie, Terry Eason, and Jason Tatum, oops. And it might just be one redback per box, but Jalen Williams, J Dubb. And Road to the Finals, Desmond Bain to 2022. It's actually sell fairly well, the Road to the Finals. Yeah. Surprisingly. Nice, Paolo rookie again. Trey Mann and Payton Watson. And last pack of hoops, Shade on Sharp rookie. No redback. And AJ Griffin, now playing. All right, we'll do 22, 23, Don Russ Timo. Cam Reddish for the Knicks. Red, yellow, choice exclusive. Jaren Jackson, Jr. For the Grizzlies. AJ Griffin, rookie. AJ Liddell, Usman, Jeng, and Max Christie. Nice, that is a Shea, 10 of 25. Blue laser, or blue velocity. Come on for the Thunder, 10 of 25. Josh Monats, Shade on Sharp rookie. Payton Watson, Shat rookie. And Blake Wesley. These obviously aren't guaranteed autos. One box in like two 10 box Tuesdays ago, for Paolo Otto. Choice exclusive, I was like, all right. I can't really get much better than that. Kyle Lowry, there's Jake Crowder for the Sun's exclusive. Kendall Brown, Malachi Branham rookie. McGowan's and Mark Williams. Last pack here. Zach Levine, red, yellow, choice exclusive for the Bulls. Devin Bissell, for the Spurs. Got Musa Diabate, Jeremy Sohan, nice one there. Christian Coloco, and Benedict Matherin. Hey, Timothy V, picking up a draft pick spot. Thank you, buddy. Next, do Crown Royale T-Mall. Next, get through some of these T-Malls. Ooh, nice, Snow Globes. Scotty Barnes, 13 of 18 for the Raptors. Congrats, Raptors. Nice one there, 13 of 18. I don't know if I said 10, but that's 13 of 18. Christian Brown, red, Aisha for the Nuggets. Kevin Porter Jr., Ty Ty Washington, Blake Wesley, and Clay Thompson. On to 2020-21, Don Russopte Coby. I'll see a Lamello, see an Ant-Man, let's see a Maxi. Let's see something gold. Let's see a green or a gold vinyl. That would be cool. All-Stars Kauai. Hello, Al Horford for the Thunder. Thunder, Al Horford, oh boy. That was a celebrated rookie for the Spurs. And Brandon Clark, Pink Velocity, 74, 79. Going to the Gris. Nice, Tarris Maxi on the rated rookie. And Hollow, Drew Holliday, Drew Holliday. Ah-ha, good to do that. No. Drew Holliday, meant to Hollow, Drew Holliday. Oh, it's like a hollow, like nothing inside. Skyler Maze. It's a blue, Chris Paul, Stargazing to 49. Nice one there, Suns. Orange, Andre Drummond to 199. Let's go into the Caps. Drumgod, Usan Legend, Donovitch, Tyrell Terry, Stargazing, LeBron, the Lakers. Hollow, All-Stars, Russ. So the Wizards, it's the Wizards, Russ right there. Now that was a season right there. Tyler Pei and Kauai, Leap Dominators. Obi-Toppin, Ain't No Stoppin', now a Pacer. And Raining Threes, Chauncey Billups, Big Shot Billups. Stargazing, Yokoch. That's a Hollow, Fred Van Vleet, the new $40 million dollar man. J.D. McDaniels, Rookie. Hollow, Rated Rookie at Devin Dotson for the Bulls. Say Lyme Green, Skyler Maze to 149 for the Hawks. Nice one there, Atlanta. Nick Richards, that's a Orange, Trey Jones. Nice, there you go, Spurs to 199. Solid one there. Love off the color, dude, so good looking. Nice, I almost jingled you again. Mamella, Raining Threes, Currie. I missed it, dude, I missed it. Pissed, dude, so pissed. Fox, J-Val, Malachi Flynn is gonna be your Hollow, Rated Rookie Autograph, that's going to the Raptors. Nice one there, Raptors. Edge, picking up a spot in the mixer tomorrow night. Michael L, picking up a bunch of spots, geez man, thank you. Two in plates and patches, one in each of our upper deck, Skybox Metal Universe Champions, one box break, random pack styles. Just added those to the schedule on Friday night, everybody. Josh Green, All-Stars, Ben Simmons. And last pack, y'all. Bird, Simmons, and Paul George, Hollow, lights out for the Clippers. Cause we're Jay, picking up some blasters. Gosh, all right, let's do Origins. 22, 23 Origins now. That's been a minute since we opened this, dude. Oh lord. We only had like five cases on release though, we didn't do much of it, but. Here's Cade Cunningham, Dawn to 75, for the Pistons. There you go, Pistons. Rookie, Caleb Houston, Jake LaRavia, EJ Liddell, and Steph Curry to 49, three of 49, nice one there with Warriors. First hit is going to the Cavs, Donovan Mitchell. That is Game Warn, a member of the Utah Jazz. Congrats, Cleveland. Game Warn, Donovan Mitchell. And Otto, going to the Rockets, Terry Eason. On the on card, congrats, Houston on that one. Very nice, very nice. All right, on to Spectre Timol, Asia. Come and go, Rookie. Say Alex Caruso. Got a Drew Holiday. Number to 75. It's like red, green Asia, I think that's called. Or yellow, green Asia, one or the other. Nice one there, Bucks. That is red Asia of Jason Tatum. Red Asia Rookie, Donovan Mitchell, or Davion Mitchell, with the Kings, and then a green Asia Rookie for the Hornets Kaijos. All right, select H2. 22, 23, select H2, and Matherin. The Cell, LeBron, Smart, that is a Brogdon, Quartzside, blue to 99, for the Celtics, and Silver, a Drew Holiday. Undlemore, Sexton, Ingram, there's a J-Dub, Rookie. Disco, Steph Curry, and Cat. Caleb Houston, White to 75. Disco for the Magic, and Silver Tatum. We got gold coming up, Jalen Durin. Gold Disco alert, Palo Rookie. Oshaid Bajie, it's not a gold, it's a blue. 299, nice one there, that always throws me off, dude. The gold on the outside, because the Jazz is like the highlighter yellow. Still a nice one there for the Jazz, and Caleb Houston, very solid. 22, 23, select Hobby now, B, I love select H2. They did a really good job with it this year too, because they put in, you can get autos of like, you can get like Curry autos in it. You can get Vets, which is good, that is new to this year. There's Garland, we got a Redemption. Silver Hero, and Giannis. Real quick, slow roll on this one. Inflate signatures, card number 26. Ja Marant, go into the Grizzlies. Nice one there, Memphis. Peter M, congrats buddy, that's awesome. Ja, Inflate signatures, should be number like, 99 would be my guess on Ja. So that's solid, I would, yeah. Tiger, Silver Brunson, the Brunson burner, Sohan Rookie as well. Williams, Butler, Tri-Color, Marjan Bochamp, and Shea Quartzside, for the Thunder. That is gonna be another Inflate signatures. Wendell Carter Jr., 10 of 25 on the tie-dye. There you go, Magic. Bryce P with Orlando. Joel B, picking up a couple of impeccable team balls, and plates and patches, breaks for tomorrow. Thank you there, Joel. Palo, Tri-Color, and Fred Van Vleet. Yeah, I gotta get our breaks sold out tomorrow, too, everybody. Benedict Matherin, Devon Vissell, Klay Thompson, Blue to 249. A lot of them are sold out, a lot of our tops chrome. Got Matt in the morning with PYTs, got me over here at Knight. Kyle, I think, has two breaks over on Channel Two as well. Rudy Gobert, throwback threads for the Jazz. Nice one there, congrats Utah. Silver Jalen Suggs, and Shreya. Yeah, so Kyle have two over on Channel Two, I believe they're either random or PYTs. I'm not 100% sure. Silver Palo, and Chris Middleton. Then he'll be starting Personals right after tomorrow. He'll be doing Personals all night. Tie-dye, Donovan Mitchell. There you go, 225 for the Cavaliers. It's Jalen Green, so I'm sure he's excited about that. Keegan Murray-Rookie. Tri-Color at Malcolm Baragdon, and Apollo George. That is a unstoppable Tatum. Jaden Hardy, late blue to 299. It's going out to the Mabs and a Max Christie. Giddy, Blue Scope, Yannis to 249, and James Hardin. Jaden Hardy-Rookie, Kawhi, Dallon Terry. Jaden Hardy on the Scope-Rookie, and Jake Loravia, Quartzside-Rookie for the Grizz. All right, last box of 10 box Tuesday basketball, everybody. Jordan picking up the Diamondbacks and a fine SPYT. Thank you there, Jordan. 223 Impeccable, first off the line, first off the line. I like totals. Oh, wow, we had a bar and a Stainless Stars, and just in the pack, so not bad there. Make sure first off the line. Stamp, or sticker, whatever you want to call it. 79 of 99 Ja, Stainless Stars for the Grizzlies. You can go into our pack now, good luck here, everybody. I'll see you one on one. Kristoff's for Zingets, 2049, the Wizards, as well as A.K.M. Thomas, 38 of 75. That is going to the Nets. Darius Garland, 64 of 99. Caps, here's a throwback name. Going to the Knicks, Kazi Russell, 69 of 99. Nice one there for the Knicks. This one's solid, too. Going to the Wizards, it's gonna be Elvin Hayes, 50 of 99. Another guy's really, really good player in his prime. Good lord, man. Jason L with a couple of Breakers Delight Spots, and two Jumbo Random Spots. God, Impeccable Stars. Anthony Simons to 75. That's going to the Blazers. Nice one there, Portland, Gabriel S on that one. Anthony Simons. Next up is gonna be, that's gonna be nasty. It's a 49, Oshaeg Baji. Grats on that, Utah. This next one's gonna be, I love this next card, dude. At least the set of this next card. Who's got them? Where is the team I'm looking for? Just saw them, too. Scott J, you've got a Jason Tatum Impeccable Stats. 31 of 60. 60 points. April 30th, 2021. God, that's so nasty. On card, live, Jason Tatum. Heck, yeah, congrats, Scott. So awesome, man. We'll get that into a mag for you, buddy. In sanity. Jason Tatum. All right, bar card is Johnny Davis, four of eight. One triumph of fine silver that is going to the Wizards. Ice one there, Washington. That is gonna be Alex E, congrats, Alex. There's a little ding on that corner. I'm gonna send an empty box and wrapper just to be safe, but that is awesome. Congrats, Alex. Hell of a hit for him. All right, recap. We've got a Rudy Gobert, Donovan Mitchell, Oshaeg Baji for the Janice, Anthony Simons, Elvin Hayes, Kazi Russell, Wendell Carter Jr., Terry Eason, Malachi Flynn. Nice Jaden Ivy there as well. We got a Ja-Marant in-flight signatures for the Grizzlies. This is nasty, Jason Tatum to 60 for the Celtics. And then our bar card was a Johnny Davis, four of eight rookie, one triumph of fine silver for the Wizards. That'll do it for the break, guys. Thanks again for the fill. Up next is football.


Well, hello everyone. Welcome to the Windows Server 2025 security session at the Windows Server Summit 2024. I am Ram Jay Raman. I work as a product manager in Azure Edge Security Team at Microsoft. And I will be joined by my colleague Matthew Reynolds for the session. I will talk to you about the various security enhancements and new capabilities in Windows Server 2025. I will talk to you in terms of specific pillars. First, we want Windows Server to be a trustworthy addition to your environment. And with that end, we have actually created a tailored security baseline and you can customize it. You can apply it and you can use the tools that we will provide to do that. And we will provide application control enabled in audit mode that will allow you to see the different applications that run on your system and get a view on whether those applications are allowed applications, not allowed applications, and you can take actions based on that. We have made improvements to Kerberos and we have reduced use of NTLM, old legacy authentication protocol. And we have reduced the need or actually got rid of the need to use passwords with service accounts. It's through a feature called delegated managed service account. We will cover all of those in the next few slides. So the next pillar is operational security. Once you enable Azure Arc on your server, you will have access to a number of Azure services. For instance, the Azure policy you can use to do a compliance assessment against security baselines. And you can use a drift protection mechanism that we have built in Windows Server 2025 and apply it against the security baseline. So the drift mechanism basically ensures that if there's a configuration drift that happens over time, it will automatically bring it back to the golden state. So that's a powerful mechanism. And the next pillar is workload security. You can enable Microsoft Defender for control for cloud on your workloads and it can do continuous monitoring and predict against advanced threats. The next is Silicon Assisted Security. No, many of the security features that we have built in the operating system really truly rely on the hardware level security capabilities. If you look at the server ecosystem today, many installations, in fact, many of them do not turn on secure both. That's a very basic fundamental thing. And many of the hardware out there, they don't have a physical DPM. That's the state of affairs. And in truth, many of the features that we have in the operating system can only be fully lit up if you have the right hardware foundation in terms of hardware security capabilities. So to that end, we work closely with the industry, the OEMs and the partners through the SecureCore program. The SecureCore program is essentially an additional qualification on top of the service certification program. And OEMs can actually certify their hardware for SecureCore and listed in the catalog so that your customers know for a fact those hardware systems have been certified from a SecureCore point of view. And with the SecureCore foundation in hardware, you can be rest assured that you'll be able to enable many of the security capabilities in the worst layer. Next one, security foundations. Security assurance is fundamental to any product or feature development. And at Microsoft, we have significant investments that we have made into ensuring that the features and the products that we develop follow the Microsoft security development lifecycle. And with respect to certification, we will certify Windows Server 2025 from common criteria and FIPS. And additionally, we will provide guidelines using which you can actually gain compliance to regulatory standards like HIPAA, PCI DSS and others. And those guidelines will guide you on what specific features and capabilities exist in the system, which will allow you to meet those regulatory requirements. Next, Matthew is going to talk to us about SecureStart and SecureOperations. And then I will come in and cover some of the security capabilities we touched on. Matthew. Great. Thanks, Ron. A core part of our SecureStart and SecureOperations story is, as Ron mentioned, security baselines. And historically, you could argue security baselines have kind of been left to the community to figure out rather than being a core part of the product. And frankly, people have done amazing work with documents and scripts and things, but there are some persistent challenges treating it this way. For example, security baselines have been hard to discover, so not that many systems wind up being protected. Baseline authorship has been kind of squishy and unclear, like who do you call in the middle of the night? And baseline tooling and even definitions have often not been available until long after a new OS has released, making it kind of impossible to use that new OS in lockdown environments. So with Server 2025, we're bringing baselines and other security protections, but we'll focus on baselines for now closer to the core product. And we're delivering a baseline experience which is developed by the Server 2025 security team. Rather than being available a year after release or a month after release, it's available now as part of the Server 2025 preview program. It's integrated with PowerShell. So no matter what deployment workflow you have, it's going to intersect PowerShell at some point, and so you can you can deploy it there. And we think the best time to apply it is during image customization. So by the time you get to a point where you're deploying VMs and masks, they're already preconfigured with the baseline. As Ram mentioned, we also have this new drift control feature powered by a new OS component called OS config. You'll hear more about as Server 2025 comes to market. And so if a random script comes along and undoes one of your security baseline settings, we'll set it right back. And then finally, we're driving good integration with the cloud and tools like Azure Policy, Defender for Cloud, even Windows Admin Center to make sure that not only do your system start secure, but that you can continue to maintain and sustain and monitor that compliance over time. I'll show you a little bit of the PowerShell experience. So what we have here is a we're installing this new module. So for those of you that are familiar with PowerShell and modules, this will be a familiar workflow. Once this module is installed, it's an pre-release state right now, then you can run these commandlets to configure security properties on your system, such as security baselines. Let me pause for a second here on this first commandlet name, set OS config desired configuration. It's a mouthful, but it means a lot. What we're saying here is not only just, hey, spread some settings onto my system, what we're saying here is, hey, operating system, please maintain yourself in this state over time. So this is a richer act than just writing some registry values or something.  The configuration itself in this case is a security baseline, and you may have noticed as the video is going there, the tab completion, so this is all pretty easy to discover, easy to find different scenarios that are available. And once you run that, that's it. You can also customize, for example, let's say that the baseline has a min password length of 14, but you say, no, in my industry, actually use 16 or 30 or something, you can override certain settings as this example is showing, and those then become part of your version of the baseline, which again is sustained automatically by the operating system over time. In this particular example, the customization is turning off the firewall, which curious example, but you can customize these, and you can see the state of your customizations, then see how all of this plays out over time, even remove security configurations if you need to do in a diagnostic scenario. That's probably enough on that topic, so I will turn it back to Ron. Thank you very much. Well, thank you, Matthew. Love the demo. Next, I'll talk to you about application control. With application control, you as a customer, you can restrict the applications that are allowed to run on your system. Now, what we will do in Windows Server 2025 is Microsoft will provide a set of base policies that will be enabled in audit mode, not enforced, just audit. That would allow you to know what applications are running on your system, and those audit mode will generate events that you can view and you can visualize and take actions. Now, use a customer, you can obviously extend and you can customize those policies, and you can also create supplemental policies, and what we will do is provide you an Azure Monitor workbook from where you can actually view those various events from application control and also gain insights at scale. Next, I'll talk to you about service accounts. Those of you who have been playing with Active Directory, who have been installing systems and enterprise, you should be all familiar with service accounts. Service accounts are machine accounts, are actually user accounts that provide the security context that services need to be able to correctly run on the OS. Like, for example, a service may need to access a network resource, and the service account allows it to effectively go do that. The problem with service accounts is that people end up actually using weak passwords, and they actually reuse passwords across different service accounts, and they do not rotate passwords. Now, if I'm an attacker, I'm going to look at it and say, hey, that's a low-hanging fruit. I'm just simply going to take one of those, compromise one of those accounts, right? And it's not too difficult to do that, even what I just described, you know, weak passwords, you know, passwords getting reused. And once they get in, the attacker basically finds ways to elevate oneself into the system, and then they spread laterally. That's typically what happens. Now, with rather managed service accounts, things are better. You actually have the system generator password for you. It's a machine-generated password. It's relatively strong, and it gets auto-rotated. So far, so good. But still, the problem is you are using passwords. Now, that could be a malicious admin who can do bad things with the password, right? Or even if the admin is not malicious, inadvertent disclosure, right, leaking of passwords, suddenly it happens. You can't control it 100% all the time. So fundamentally, the point I'm making here is that there's a problem with using passwords, particularly with service accounts. So I'm going to talk to you about what's called a delegated managed service account. It's a feature that's up and coming in Windows Server 2025. And with this feature, we have endeavour to get rid of the use of passwords with service accounts. So now, since the delegated managed service account are in short, DMSA, it is a machine-bound service account. What do I mean by that? It uses the machine identity that is stored in the local machine, and it uses symmetric keys derived from the machine identity and uses the symmetric key to do the authentication flow at a very high level. So the way it works is you, as an admin, you have a set of service accounts that exist today. And all you have to do is specify which of those service accounts you want to migrate over or upgrade to at DMSA, a delegated managed service account. That's it. Once you specify which of those service accounts need to be superseded to a DMSA, then the protocol takes care of the rest. So what really happens behind the scenes is when the authentication system is engaged in the TGT, a ticket granting ticket key, TGT request comes through, a refresh comes through, the Kribberhausen basically kicked back and say, hey, this service account has been superseded because you, admin, your market are superseded with DMSA. You have left your intent. So that's an indication to the protocol that it has to just simply provision the DMSA account, the upgraded DMSA account with a symmetric key. And that's it. And the rest of the Kribberhausen's protocol just flows as it usually does. So that's it. And effectively, by doing this, we have gotten rid of use of passwords for service accounts. Now, this is based on machine identities that are bound to the machine, as I mentioned, and you can have a single machine, multiple service accounts bound to a single machine and a single DMSA bound to multiple machines. So all n by n combinations are possible. We should definitely wait for us to give you more details on how the protocol works. But rest assured that this delegated managed service account would allow you to eliminate passwords for service accounts. And also you can easily upgrade your existing service accounts to a delegated managed service account. Moving on to Kribberhaus, we have made, I'll actually touch on some of the improvements on Kribberhaus, not all. We have made changes to Kribberhaus where we have made the implementation more crypto agile. What I mean by that is, these crypto algorithms and ciphers, they continue to evolve over time. Existing ones get outdated and newer ones come in and crypto agility effectively gives you the ability to easily upgrade to the newer algorithms, crypto algorithms, without a wholesale change. And that's important for you to preserve your investment and continue forward. I'll talk about quantum safeness. So today, many of the crypto algorithms that exist today, they are based on the difficulty associated with solving complex mathematical problems like integer factorization and so on. Now the existing algorithms on the conventional computers can really break, you know, can really solve the difficulty and rather easily in human time. So that is the basis for existing algorithms. But with quantum computers, somebody in the future when they have a viable quantum computer that's powerful enough to break these complex mathematical problems, solve those problems rather, then they can basically, you know, take down these algorithms that exist today, they can crack it. For example, Diffie Helman Key Exchange today uses discrete logarithmic problem as the basis. Now if a quantum computer breaks discrete logarithmic problem and sure your Diffie Helman Key Exchange can be easily compromised. Now with crypto agility, we have actually ensured that as quantum safe algorithms come into place, you can easily upgrade to those. And that work is ongoing. NIST, National Institute of Standards and Technology has been doing some really good work. It's been leading the industry. Many companies are involved. Microsoft is involved. And you will see more quantum safe algorithms come through. And as they continue to evolve, you can be assured that with crypto agility, you can easily upgrade to those algorithms. The other change with Kerberos is we have got rid of RC4. RC4 is a cypher. It's been popular for a while, but it's getting outdated and it's got problems. In general with Kerberos, there's a type of an attack called Kerberosting attacks. So what attackers tend to do is they get a hold of the TGS, the ticket granting service ticket. Basically it's a service ticket and it's protected and encrypted using a hash derived from the service account password. Now, if that hash was produced using RC4 MD5, it makes it much easier to perform this Kerberos attack. So effectively by getting rid of RC4, we have reduced the chances of Kerberos attacks. So obviously more details to this and I encourage you to attend the session on the evolution of Windows authentication by one of my colleagues, Netpile. On to NTLM. As we discussed earlier, NTLM is an old legacy authentication protocol. It's been in Windows for a while. It has some nice attributes. It's simple. People have been using it and in fact, it's been widely used for many years and people are not changing over very fast. Instead of the weaknesses associated with that NTLM protocol. Now, fundamentally, the problems we have with NTLM is that it uses weak passwords. The password hashing, not weak passwords, but the password hashing algorithm is based on MD4, which is a weak algorithm. We're not able to collision attacks and the password hashes are stored in memory and people can sweep the memory and get a hold of the hash and once you have the hash, you can actually perform a lot of different types of attacks past the hash attack and such. Now, the problem with NTLM is that the client doesn't have a way to authenticate this server. It's not part of the protocol. You don't know who you're talking to. Somebody can come in the middle and play an intermediary but post themselves as the server and take control. That's the relay attack that's possible with NTLM. That said, our immediate goal is to reduce these NTLM. It's not possible to fully eliminate it for the reasons I mentioned earlier. There's a lot of legacy left over and people are just not completely giving up and moving on. It's just not happening as fast. We are working to reduce the use of NTLM in ways we can and ultimately our goal is to fully eliminate the use of NTLM. What we did with Windows Server 2025 was looked at really where the NTLM usage is coming from and we noticed that close to 50% of NTLM usage is actually coming through from the SD negative protocol. It's a negotiation protocol that is used by clients and servers to negotiate on the authentication mechanism that they need to use whether they use Kerberos or NTLM or something else. The negotiation protocol allows these clients and servers to go to the negotiation. What happens is that as part of the negotiation there's a fallback that happens. You look for authentication mechanism A or B or C. If nothing else works then you fall back to NTLM. That's what drives 50% of the usage of NTLM today and what we have actually done is increase the use of Kerberos in more scenarios and therefore reduce the fallback to NTLM. That's work that we have done with Windows Server 2025. Now also as we talked about with NTLM it's prone to man-on-the-middle attacks and the general guidance to protect against those type of attacks is to enable server signing and to have channel binding enabled as well. And what we have done in Windows Server 2025 is enable channel binding by default so you don't have to think about it twice. And also with SMB the server message block file sharing protocol you can make an intentional choice to ask Windows not to offer NTLM as an option when it negotiates protocol through SBNego negotiation mechanism. So that's there today and you can benefit from that. So effectively these are all ways by which you can circumvent NTLM. And NetPile is giving the talk as part of this summit. It's called the evolution of Windows authentication. It's the same talk I mentioned before. Please do listen to it and it is going to go deep into the topic. So that said thank you all for attending this session and it's been a pleasure connecting with you all. And if you have comments or questions you'd love to hear from you and we have a aka.ms link on the screen and a QR code. You can use that to send us feedback and also engage us in a conversation. We look forward to hearing back from you. Cheers.