Yes, huh Demon time Demon time after nine she's alive. Yeah demon time Yeah, that's shaking shaking shaking in her back at the break.  Yeah demon time. She's reading minds. I see the lies. It's in her eyes Her throat swallowed my soul my soul.    Yeah demon time demon time.  Yeah demon time. Yeah, that's shaking shaking shaking in her back at the break Yeah, demon time demon time demon time. I killed the pussy, but she's alive. Yeah demon time She's reading minds.  You better be on demon time right now. No, I'm not I'm talking about I'm talking about I'm talking about on the aspect of just remembering But you now tuned into me me me me me me me me me me me me made I was worth a game. We got the one the only Like to introduce myself You feel what I'm saying he go by the name of we got a legend over here in jail We got a legend in here Got somebody in here, right?  They got something for everybody. Y'all know I got y'all know I got all the CBD at the crib So make sure y'all get in tune with it to make it easier to discover the potential CBD for yourself CBD MD is offering Our listeners 25% off your purchase when you use the promo code game once again that CBD MD calm Promo code game get 25% off your order a CBD premium oils now now We won't give right to if you know for years you see it on Instagram If it's the story is told by gilly he was this hell of a Hall of Fame Philadelphia basketball players, especially, you know High school, but he was you see you got three you got three. I'm talking about three Philly, you know basketball high school players right here me and she was a little bigger than him I played for Dobbins. He played for Franklin. She played for Simon Grats Okay, and just for the records me and she was just for the records Simon Grats and Ben Franklin is known basketball Staples in Philadelphia in Dobbins is not so okay.  All right, cool at the end of the day She could you just let the people know out here that this dude was not NWA CP whatever Worthy Division one like could you please tell the people what black people? Say You know What you trying to figure out from me was my was a nice was I anything I said I was Could he would go back and look at the tape. That's like, thank you. Thank you. It's computers. That's all you got to go back He's nowhere on tape Like you could pull up old daily news articles tessellary called my mama house two three times You don't even know who tessellary is Right, I know sonny hill Man, you knew sonny hill because sonny hill is a known basketball league. That's in Philadelphia You ain't never please believe us.  He was a camp hill man with the big colleges You was a camp hill all-star. I'm gonna say I'm gonna you know now we got an NBA legend. I'm going right into it You had to pick a team, right? Who your team?  Personally chair for no, I'm talking about me. I ain't talking about no one team I'm talking about you picking individual players from whatever leads.  I know the brown on there. I know Mike on there Off the fly For me again, here we go Of course, I'm biased You know cuz I'm a big man. So For me, I would I would guess if I'm picking a team I'm gonna go Big everybody point guard. If I had to pick a big team, it would be magic If I had to pick a big team at a two guard, it would be somebody like Alex English If I had to pick a Three for me I'm showing a little again bias favoritism cuz I grew up in Philly Doc is always gonna be for me and my top five anything because he got me like in basketball Yeah, I mean and then for me my four and five will be Kareem and will That's my big team. How you gonna say LeBron and Mike?  We're just all off my time. What does your top? Who's your top five? Who's who's your top? Who would you say who's your top five? Okay? Would you match against that team right there? I said, oh, I got a shot first of all first of all that team ain't got No, okay. What's your point? Who's your point?  The only the only cat is gonna it's gonna cancel out It's gonna cancel out the only other cat you've been named Hey, but he's not a point I put Jordan at the two I put Kobe at the three I put Shaq at the five Shaq on dunk them niggas in the court. I don't know I know I don't know I'm talking about a young Shaq. Okay, but I'm talking about the diesel So I ain't talking about no old-ass players myself. I'm talking about NA primes, too Hey man, we'll channel in with a put Shaq in that bucket too, bro But we never seen that from will because what was playing against niggas my height True true same thing with True Right, but it's the two tallest niggas in the world at the time Give me a young luau sender what who had who got the only unstoppable shot in NBA history That sky hook And that's cool Shaq with a donkey minute Shaq with a falcon ream out in the first three minutes Mm-hmm. It had four and a half hours man the first three minutes man Come on, man. Who's your top five players all time? Man, I just told you man. I'm more of a I'm biased cuz I go with so okay, so you saying you not picking The real top players you do picking your top players. Yeah No, but you know they ain't the top five all time why aren't they What who's so we got my dog? Who's better than kareem Mike? How why LeBron what what makes them better than kareem? Tell them what makes them better than kareem. Tell me please I mean kareem got as far as the scoring title kareem on that, but kareem play for 111 years man It's not his fault. No, it's not. Okay next but what I'm saying is Jordan was is the goop What makes him the goop because he was the greatest he's number one in One category I give it to him tip my head six and oh in the finals now. That's impressive.  You niggas can't beat me man.  That's how it's the greatest basketball player He ain't number one in no offensive category. He ain't number one in no defensive category.  Shit. I just early I just named a couple guys who got more chips than an eyeball test don't lie. I mean, I'm not denying that Wasn't a great player though. I'm not denying that. Okay, but I'm just saying he wasn't to me He wasn't the great Jabbar is the greatest of all time This man been retired for them there like 30 years or more adult and his numbers is still sitting up there Because he played for 111 years. It's not my fault.  Gil Gil nobody nobody's living for 111 years. It's not my fault, man No, he's right now.    Can we just get this out the way? Man, it's it's hard to say man.    Come on. You retire now.   It wasn't it wasn't to another player I never really had beef with another player all time in technical foul.   Come on. Let's keep it real man I told I told this one ref.  I'm not gonna tell you how I knew about it, but I knew about it And that was one of the things I told the boy and then I would probably say that and I told this one this one ref on the restaurant Right. I knew about it.   All right, so you can take a nigga out of Philly. You can't take the Philly out of there For sure. Nicker tap the ref ain't nigga. Well, listen, you mean to tell me They had a special email chain burnt down based off you.  So it was it was Conversation amongst that So I knew about how did you say it?  No, I was on the slide.  One more tech that bitch's gonna burn no, I I didn't even ask him the name of his restaurant. I already knew it I already knew it. That's what I'm saying. And did he tell all you did he say tell him No, he gave me he gave me a tech But but see that was back then that for me, especially you didn't have to give a reason why You're giving me a tech. So so how much money total did you pay in tech fees? Oh that I don't know To be honest, is it in a million? no No, I got actually actually I got fine 1.2 when I got into it I got fine 1.2 when I got into it with uh With a certain referee And they suspended me seven games.  Who's he was that important 1.2 important? It they I mean at the time that was what I was making, you know divvy debt with my contract. That's when I had first signed a big contract with portland and um It cost me for seven games. It cost me 1.2 And um, I mean through through time eventually I ended up, you know getting it back, but Yeah, man, that was that was the biggest, uh, I guess Fine, you could say that I ever ever probably got 2 million you had to pay it What oh they automatically off top that's like they like uncle sam fan So what you're saying is so what you're saying is so what you're saying is You are in the millions then in fines. Um, well, no, you just paid 1.2. No, that wasn't necessarily a fine That was more of a that was a suspension Like with me getting fine like text like like it was what all right it started out Uh, I think like 500 Then they moved it up to the stack And then they came out with the sheet wildest tech rule They didn't want to say that but that's what it was, you know 16 texts Then you get suspended a game and then each check you get after that is uh, uh another heavy or hefty fine or whatever, but For me it wasn't about that. You want to hear what I got to say?  I might as well go ahead and then you want to hear what I got to say then if I'm right If I know I'm gonna get fine Why not hold on for one second. Let's get into this second sponsor, right? This episode of million dollars worth of game is brought to you by core seltzer Core seltzer isn't your average seltzer rooted in core's long history of sustainability Our brand was inspired by a generation that wants to do good in the world with a mission to restore america's rivers Core seltzer is launching the world's easiest volunteer program Whatever you're doing by simply cracking open a can of core seltzer You're volunteering our waterways are at risk 80 of america's rivers are drying up through a partnership with Through a partnership with change the course core seltzer is helping to protect and restore america's rivers Each 12 pack of core seltzers restores 500 gallons of fresh water to us rivers and and the communities they that depend on them The result 1 billion gallons of water restored to 16 rivers bassin across the u.s And that's just in one year for refreshing flavors one cool cause Calls enjoying naturally flavored black cherry mango lemon lime and grapefruit Aspects are in core seltzer is 4.5 abv and only 90 calories So make sure you get in tune with core seltzer So that we could restore these rivers back with these waters for these communities that depend on them All right appreciate you for every 12 pack sold Through 831 20 21 cores will purchase services from change the course to restore 500 gallons of fresh water Fresh river water details at core seltzer.com. So go check that out And let's help restore these rivers with some water 500 gallons Maybe you could take it to a billion gallons. So all that okay. Listen a beast Was solved Steph Curry Uh, and we talking about from your era. We not talking about from this era. Would the game change? We talk about if they was playing a year ever would they be oh, oh, so Okay, um, you talking my error. So James hard my again my error saw uh Hold on for one second y'all um LeBron James and my error He probably probably would have done good because with his physical stature with him being a little bit bigger Than a majority of the rest So he probably would have held his own But I don't think he would have been as successful as he is Now like now is man You know, I mean like like doing it young boy doing it. You know, I mean so But it was a whole different era back then bro. So Beast of soft I just I just told you a beast that you know, I think I think he would have held his own I can't necessarily say he would have been a beast But I think he would have held his own real Well, Ray played for that era I just wanted to know please in his era was re island of beast. So was he soft? No, no, re island was a monster dawg I see my game a shark shooter Kevin Durant and in that era Uh, I know I don't think he would have had too much success now.  So you don't think Kevin Durant would have been a beast Well, because you got to look at it Back then you had a lot more post the game was inside out. Now it's outside in so you don't you you got guys out there. That's like Rudy go bear They're not even posting his brother up. Now granted.  He made but he made it this far though Doing these little post moves. All right. Which one is Rudy? What team you play for? You talk first motherfucker. They got corona in the league. Yeah, no What's my what's the boy like the team? I That was going on the point score 50 points. Oh, you talking Rudy to the fresh and fruity ran the jail ran the jail league He loved Rudy to the fresh and fruity nigga ran the jail league.  What about uh, my man, uh He left jail league a score Uh, uh, Draymond green Dray, that's Dray. That's my young boy, but he too little But is he a beast more to eat soft and in my area? No, I saw J. R. Smith Um, too little in in my area Got dawg, but it was six full players in yet era But but here's what I'm saying like look at Mike Mike is a classic two guard at six four six five But these other cats here it is now Uh, jr. He's a two three But it's smaller. It was smaller players. Right, you know, I'm saying It's a whole different mindset because like I said, you started inside out.  Yeah, I'm gonna sit there and stand and do that to me all damn day dawg The twins I love them My young boys. Yeah, I love them. Let's go to twin. Yeah, right for sure. I'm rocking with them beasts I'm rocking with them No doubt no my young boys the way we now listen hold on don't think about his outfits We just talked about on the court. All right, you know, you might think about the way that the blue-ass title is um For back then spicy fits I think he would have held his own too for the simple fact of his scoring drive like he has a high Presence to score and we and we wanted content and definitely before his little knee injury Before his knee injury. He was he reminded me of a kid And I don't know if y'all remember a young boy by the name of Randy Livingston. Yeah That's who he kind of sort of reminded me of but The way it wasn't a point. He was a tube. I mean Randy was a point, but That athleticism for a guy aside like yeah, he was he's he said He one way or another he's gonna score Okay Let me say this friend.  No doubt. No doubt. I know I just want to ask you something true I heard Mary J Blige and you was off the henny and Mary J Blige tried to give you some of that goddamn I'm just thinking I'm just I don't know.   I'm just saying I was just saying I heard Mary J Blige tried to give you start laughing It's a good old days But but um Yeah, man, that was back then though. That was back then, you know a long time ago it was uh Everybody was was kind of tipsy and drunk off of that henny But when she was when the tipsy was drunk did the song play the was the song playing What you're gonna do without my love was that playing in your mind? No, it was another song playing in my mind A song that was somehow involved with me that I didn't want to be part of So no, it was And plus at the time I was married So I'm like, oh no, and my wife was over there. You give me that now Yeah, yeah, I'm divorced. My wife was giving me the ice grill at the time too. So. Oh, no. Oh, no, I'm not a back then the slogan was a Happy wife or happy life. No, I never been my motherfucking slogan. I mean she my slogan happy husband.   I'm talking about dress three dollars. What you going to do with that? You go to harry's dot com slash million and they want to take care of you, but let me show you something See that Look how clean it is Look at that. Look at that You can even hear harry's is harry's is outstanding. Look at that. You see all that here You see all that here?  Look at that Nigga love the jacket.  You can see this this is just like it just It just pours its glide it just smooth It hooks you up man. I'm looking at look at that smooth. It's you was ratchet. Now. You got a leather jimmy That was a paper one thing I love harry's is just smooth and one thing it's about is that The handle is just great. I'm talking about the weighted handle I'm talking about they're going to get you everything with the kit You're going to get the foam in jail You're going to get with the allo in it. You're going to get everything to travel cover to protect your blades while you're going to go I'm talking about everything, but what you got to do is you got to go to harry's harry's.com slash million i'm talking about they're going to take care of you man these these blades is just Unbelievable quality german injured listen. I'm talking about engineer blades. They're unbelievable. Listen. I've been using this for a long time This thing is why y'all see me when my head is glowing when it's shining my face is super clean No bumps these i'm talking about these five blades is something i'll stand in it once again harry's dot com slash millions I'll finish this when we done So you're going to do rest of the show with your ship like that. Yeah Like like a mohawk Right now it's cool. He said in jail. He was used to having green on his head because I like to hit it with the hot water But right now I forgot about I ain't handle hot water. So that's another story.  Why would they call me that? That's the lowest That's a little special, but you kept you kept you coming out the more way That's cool Let's get back to right rise and Mary J. Blige Yeah, so when she laid it down sprayed it out. Yeah negative ghost rider. Oh, you never did No, no, she was just trying to get baked.  I'm not trying to end up in no song Give me some hot water.  Because how did you like how you not bake Mary J? Like in a prompt. Yo, let me ask you a question before you get it. You were scared of your wife Oh, for sure. The whole merry thing. That was something crazy. How was the groupies? What I know y'all go from city to city was the groupies did the groupies used to just be at the mba players hotels Yeah, waiting for y'all like like in the lobby bar area. Yeah He was no longer married No, no, I'm not married.  Now, uh, when I was married no Nick, it's not married no more. So you can tell the truth.  No, I mean maybe Oh, no real talk real talk Maybe a couple here and there but you didn't you didn't want to get caught up in that circle for the simple fact of Exactly what you just said The groupies so we playing them on we playing the city on tuesday So we get there monday night. All right, they In the lobby or if the club is popping back then strip club or whatever. All right, they there boom We play we city had the best strip club back then. Um Shit, I mean alana was cool. Detroit is cool uh Houston was cool.  It was fun.  Yeah, they was It was a hell of a ride Did the group ever mess your game up? negative So a groupie never sent you to the game was a weak. It's a weak need negative because I can't mess the brand up fan There's also what I heard about you and another team made on the team out in uh Portland strip club, they said they used to call y'all the Portland tailblazers Oh, no, so y'all used to tear them bitches up. No, no a negative ghost rider I remember I was in jail. See the article the Portland jailblazers. They see y'all was in no joke Y'all was my focus was getting locked up on that team like crazy. Here's the crazy thing about it Ain't nobody ever get locked up. Well, why they call y'all the jailblazers because at the time It was all part of that that image and it was the only thing that rhymed with trailblazers What's going around tailblazers?  But I mean nobody went to jail though You know, we didn't have so they just wrote a fake Well, I mean that was that was just Um, I mean it was it was one of them joints. It was it's one of them. I'm not sure who started it Yeah, me neither. I'm not sure who started it. Yeah, but Yeah, it ended up coming out. Oh, Portland jailblazers and this and that. Oh, and and then your man adopted it to, um, bill walton And all that stuff. So But ain't nobody go to jail though, dawg So that was the thing that always mystified us about it, but It was just because we weren't media darlings at the time we were the only that was sports illustrated portland jailblazers We were the only show in town portland. Yeah Only professional show next next big city was seattle and you know, they had at the time they had the mariners They had the seahawks. They had the sonics In portland just had The blazers right and so we were the main focus and and cats wanted to I would I would say beat writers wanted to get up out of there. And so now all right. So what's the best way? Let me write something negative. Maybe one of these other big papers in another city or catch it and think I'm doing good And now I'm off beat writers. Yeah No, that's why that was my whole Rant with the media.  It was it was it was foul, you know some media cats, man they they went to the point where Might be out. It was one black club Right at the time in portland was one black club And so the guys are coming there, you know after maybe after a game We're coming off the road and maybe if we get home before uh 130 So boom, we go in there, you know for a little drink or whatever and Or if we hanging out in there During the regular time we're home.  Let's go to the club. Whatever. All right, cool We're gonna go to the bar They will have people in there counting our drinks The reporter boys will be sitting outside and it's a quick tip for the cops. Boom. Yeah, um This car looks like it's swerving. Da da da.   You know what I mean and uh You know him and his agent was cool. I'm talking about Kick it. I know his agent met his agent. I done kicked it with his agent a couple times.      Yeah, I'm gonna find out man. Man.     Well, I mean, I got a lot of it as far as you know, can I borrow this amount or that amount? um Can can you co-sign for me for this car this house? uh Can you open a bank account and put it in my daughter's name? You ain't gotta put it in my name put it in my daughter's name or my son name Man, I heard everything. Oh my you know the kids need some toys for christmas. Um My mom's sick. Oh damn, you know, the morgue.  I heard it all.  It's like You know rash got 50 million and and the fact that it was right asking for three. Thank you for me, right?  Um My first two years not much my first two years, uh, I mainly I just got myself a truck and uh, I bought my mama crib and that was it so I was I was stingy, but it was uh When I first signed my big contract with portland and the one thing that they always do with basketball players in the usa today Every year they print what they make from the first dude on the team to the last dude on the team, you know from the 20 plus million to the guy that's making the league minimum with 1.2 They print it all in there. So everybody again, like you just said a second ago know what you're making So, yeah, you getting them calls now when you go to these different cities.   I'm responsible Me personally I'm responsible to take care of my mom and my brothers my wife and my kids That's how I felt, you know back then at that time What was the hardest thing about marriage for you For me, I don't know. That's a good question.  You know, I was thankful to be able to catch the things I did but I wish Back then we had these like the whole video calls or whatever then okay I could at least see a little bit of it but it's one thing When you there and you see it and I missed a lot of that man, you know just being on the road, but you know My son said to me one day We're all driving. He got a little play. He was doing right my youngest son. He said all right He said dad you coming to the play. I said, yeah, I'm coming. We all driving there now. So boom as a family We mobbed to a school So they've been in the back prepping And I got to get ready to go because we got a team meeting because we about to start the season So boom I'm like, oh man All right, boom. I had to leave so he finds out, you know, he comes out perform My ex-wife was telling me she's like, oh, he was looking for you and this and that So he was like this and the stands and didn't see you and he was sad and it's that right?  He was like He's like what he said Dad didn't want to see my play.    No, but that's just me, right Obviously rise to that Yeah, I had to do it man. Get up out of here. Yeah, I had to do it for real. Hey, listen, let me get into my uh Final sponsor, right? This episode is brought to you by uh new Amsterdam vodka Where's my new Amsterdam? Hold on, man You over drinking my new Amsterdam? Oh negative New Amsterdam vodka was born from uncompromising Passion for great vodka this commitment to excellent Enabled new Amsterdam vodka to produce a superb taste and unparalleled smoothness new Amsterdam vodka is 80 proof vodka Made from the finest quality Grains from america's heartland. It's distilled five times It's filtered three times for a clean crisp finish new Amsterdam vodka is slightly sweet on the pilot Smooth enough to drink on the rocks mix well with any juices sodas or you can make a new Amsterdam mule new Amsterdam Vaca is the official vodka for bar stools sports shout out to the new Amsterdam queen my wife tooty You know what i'm saying? She'd be making all types of cocktails and stuff when the Girlfriend is over with new Amsterdam vodka.  He said of all times who's the best uh NBA player to rat All way up to today That's a good one because you won't do the uh, I will have to say Between um, I like dame dollas Well, wait, can I put myself in there because I did play in the gb I did play in the mbh gb.  Oh, what's up with mine shumper and dame dolla?  No, I mean one platinum man.  I don't care what you say Platinum is platinum big fella be like she stop it. Stop it.  Oh How many times Truth Didn't he dunk on who didn't he dunk on? I don't know man.  How many times you dunked on your boy too many trying trying to help help side Coming up poster So so so it was so it was never he backs you straight down and just no I I never guarded them straight up as far as like like that until I got to detroit when I was in, um Portland. Yeah We say here shag talk about how you used to dunk on rushy wildest for the pocket Actually, uh, that's not true He said he ain't dunked. It'll be quite a few times. I was trying to help with the bonus What's good big fella Man saying saying sitting up here with my family doing a million dollars worth of gain What's up, man That's right. That's right. That's right. That's right. Shack Damn, there burby. You got shack. No, we bring another shack album out We bring another shack out of my cash money All right, let's go over here. All right, good brother Yeah, man, that's what's up. Me.    He at one point. He was the best athlete on earth Let me ask you a question. I because I personally and I always say this I say that She killed nil was was the most dominant player In league history. Yes for sure For sure. You couldn't stop it.  That's that's where the importance of like that that that 11 12 and 13th guy on your bench. Hey, you got six. All right All right, y'all go on there. Just hacking Just hacking if you don't go on you. So what just hacking put him on the fire line. That's what a lot of coaches thinking but man straight up Yeah, he was I will have to say he was the most dominant force to play in the league real talk Especially a young shack or what? That's what I'm talking about.   Come on, I need this Um Who you slap? No, I like like I said, I never had no beef with no players.      So it was pretty much like Zach Y'all remember the cat quint quintel woods. Yeah jumper.  So, you know Zach, of course taking up for his homie.  Cincinnati's eat weights.  Yo, we was like, whoa So he's like everything stop stop stop and Zach was hurt for a couple days though He's like he missed like a game or two. So I felt real bad But Doll and then so look it carried over.   So the it carries over so boom. All right, you know Zach gets better And it carries over to practice, right? y'all So we in practice so rubbe is still beefing with quintel And out of nowhere dog Zach Buses orbital socket Orbital socket.  It took me Bonsie Dell Davis pit And like two of the other coaches to hold rubbe back this one we had mo cheeks is our coach out importantly That whole rubbe at rub under the killing. He was like, she I'm a killing.       I was like this big brook is orbital ball all this up in here Fractured all of me. He hit him crazy.     I ain't going front.  That might be you. Yeah. I mean He did you know that like I said, that's all zbo got back. He waits You could tell zbo from the hood.  Yeah, and yeah, they had to Oh, no, no, no, no, no, no, no, we had we had a we had a sneaking's kind of Ain't had no choice. Hey, you gotta get that check for your family. No, no, no, listen every day We would have been sneaking each other. We'd have been Ain't there in practice that nigga wouldn't have been able to shoot a whole layer of that Like because the reality of this is we agreed to the wrestling man Yeah, we never agreed to no wrestling and I and I worked you out a lot of times Whoa, well, you know, he was he when everybody knew he was the captain of the wrestling team in jail He wants you to know.   He just dangling his body. You know what I mean?  First of all, he always sneak me He don't never get me like how Zach Randolph in the boy was straight up. You said Zach made the wrong move That's how you do. You make the wrong move in your mouth.  Let's let's get into uh stories from the cell She ever gonna lock the negative.  They know I played for Penn State So that was it. You know, everybody always wanted me to ball.  I was in jail the first summer league I ever went into I might have played about In this summer league, I might have played a good six minutes, right and I realized that uh The level of game I played Was higher than level of the game to please dudes played in jail We playing and talking about man, you know, you In jail when dudes talking shit to each other It's a little different level of of you know, it's a little danger there That's not might not be there on uh on a regular court in a regular court Right and at this time I wasn't I wasn't up to date on the danger Right, somebody brought me up to date on the danger of of basketball leagues and prison So dudes get to talking this down the third and like when you when you playing but you don't got no refs You got like dudes that might be refs like a fishery.   That's it. Okay.  Yeah, I might be next.  See see this one thing about you dudes out there Don't understand about me People say damn I said one thing about me. I was a I was a life. I was a life in prison.  I get locked in That's who you was We they could just muck the ref Give me the ball I knew how to de-escalate the danger when I when I seen it but anytime I was in view of danger Okay, I was a relocater.  You know dudes coming from jail wearing the way everybody tough. They come on They got these mad stories. They lift some weights. They ain't got no drugs in their body. Oh, I'm tough. I'm big I wasn't that in jail.    Hey, yo, what's up?   You wouldn't you wouldn't you know what I had niggas happy up there One thing I know about you. I'm wild.  Doug. You the one that sit here talking. I'm the one that brought energy to the jail I'm the one that had I turned smiles upside down He wanted somebody to touch you you want to get touched He turned frowns upside down in the prison It's my brother rash, man you know Be been, you know, call me since high school. Of course. He went to the legend day grats. I went to the legend day I went to the legend day divas.   You mad because you want to cabrini right? And I want to say this before we leave because we need to get into this How did you was gill big and feeling on rap? I just want I want your opinion Well, when I was in coming up, yeah, was he big and feeling a rap?   I just want to say this I was listening to the figures all day, but gill gill gill.     He just went on tours and bars. You keep hyping your name. Yeah I did a showdown can to see that I did So you say they paid him in drinks. I don't know what it's sometimes All right, right you get it on that He do he do like he do like he do like 40s. He do like these things. You would you rather do what would you rather do?  He was in it twerking and she He didn't even sales twerking.  There's like while I heard you used to rap with gilly out there. Yeah Well, come in niggas.    He live in north.  Don't be a neighborhood rapper young boys.   He came on black parties to shows Yeah, I did a black party tour. You did a black party tour.  Yeah, I did the show you keep adding on Yeah, I did 2263 shows you do black party shows He do he do picnics in the park shows. He walked on the picnics with a speaker. Yeah. Yeah Let me tell you something.  They could be running karaoke night of the prison up here Keep typing and listen to Whitney Houston. I'm everyone. He always hypes. It's all in me Nobody can listen. None of y'all know his raps. Nobody knows raps Oh, they said you something like this talking about I'm every woman It's all in me anything you want that baby. You got a song.  Use a bum rapper Like this dude, you don't know none of these songs young boys. Do you know any of these boy songs? No He didn't even know y'all They would think y'all wouldn't like each other No, he's a loser.   He's a bum rapper. He's just like that Bye


Currently the most common method of COVID-19 diagnosis is by QRT-PCR which is slow and requires expensive instrumentation. Here the authors report an electrochemical biosensor based on isothermal rolling circle amplification for rapid detection of SARS-CoV-2 in clinical samples. This article was authored by Fanyarat Chai Bun, Jai Racha Puenpa, Tachanan Ngamdi, and others.


You might think that it will help them to see the faults that they have made. You might think that it will make them want to seek help and change their ways but it rarely works out that way. When you call them out on what they're doing it usually makes them worse. If you tell them that they're a narcissist they're not going to accept it. They're just going to say that you're the narcissist. Whenever you bring up a narcissist's faults or mistakes they're not going to own it. In their minds this false self that they have constructed is perfect and cannot do anything wrong. So if you try to confront them on their faults and mistakes they just go to deflect it onto you. They will make you feel as though you're doing something wrong by confronting them or they will shift the blame onto you or bring up something from your past. Whatever it takes to take the heat off of them but they will not accept that they have made a fault or mistake. They are shame-based individuals doing everything they can to avoid reflecting on their shame. So they are not going to entertain the idea that they are the problem. They are not going to identify themselves with anything negative regardless of how they act or behave. They will only associate themselves with positive things. People generally view the word narcissist as something negative. As something imperfect or faulty. And that is why they cannot identify themselves as being a narcissist. But when people find this information and they recognize these traits in a relationship partner, family member or friend. They often feel compelled to tell them as though they think it will suddenly awaken them and then they will be able to change. But it doesn't work out in that way. When you tell them that they're a narcissist it just makes them feel fear and shame. And as we know when narcissists feel fear or shame they attack. Which is why I do not recommend telling them that they're a narcissist. Most narcissists are not educated on narcissistic personality disorder. And even if you bring this information to them. It does not mean that they are going to understand it. It will be like you're speaking a different language. Although the word narcissist has gone mainstream now. Many people do not fully understand what it means. They just know that it's something negative. So if you tell the narcissist that they're a narcissist. They're just going to take it as an insult. Another reason to fight with you. Telling the narcissist that they are a narcissist. It's not an effective way of dealing with these situations. Most of them are not aware that they are narcissists. It is not something that they would ever associate themselves with. They believe that they are above anything that is negative or defective. And it will be like telling them that there's something wrong with them. When they have constructed this false self that is perfect in their minds. Narcissists have an exaggerated sense of their own importance and abilities. So they are going to see it as something that is beneath them. Even though they may have many traits of narcissistic personality disorder. And they may be proud of their ability to manipulate and control people. They see manipulation, deception, exploitation, lying, cheating and stealing. Praying on your vulnerabilities and weaknesses. As behaviors that show high moral standards. Qualities that are considered morally good or desirable in a person. An advantage or benefit. A useful quality because it gets them what they want. And they believe that it makes them superior to other people. They know that they're liars. They know that they manipulate people. They know that they're exploitative. But they do not associate that with having a disorder. They do not associate it with them being narcissists. Because in their minds, they know exactly what they are doing. And they are doing it consciously and intentionally. It's a strategy. A plan of action. They see narcissists as people who are unaware and don't know what they're doing. While they have a reason for doing it. They have an intentional objective. They don't ever consider that narcissist as well as all of the other cluster B disorders do know exactly what they are doing. Which would include them. They know exactly what they are doing. They just don't care. They have no pity or compassion for you. They're not even thinking about the pain they cause to you. But they are fully aware of what they are doing. They just don't see anything wrong with it. As long as it gets them what they want. As long as the situation works out in their favor. They will do whatever it takes to win in any way possible. Regardless of the consequences. Regardless of anyone who gets hurt in the process. Thank you for watching. I hope this video resonates with you. Please like, comment, share and subscribe. Click the bell icon to receive notifications for my future videos. If you're delighted to meet, my PayPal link is in the video description. Coach the inquiries you can hear me at 95ercoaching.com. Thank you for watching and I'll talk to you soon.


Your four wheeler doing this. I'm going to show you a couple of tricks I want to look for solve the problem All right, so does your sportsman 500 idle good, but once you hit the thrall she wants to die I got that issue with this one and I've been getting quite a few questions on why that is You know it could come down to timing, you know that your valve adjustment That's you know a little far off, but a lot of it stems down to is the carburetor The fuel pump The airlines The air box itself So I already took the air box out And uh On this particular box the little tabs are broken off. So So This lid actually does not seal properly.  I've noticed um This hose going to the air box is not correct So you got your vent hose going it should be to the top of the Oil fill which is down here And that hose comes in through the top. It's the breather hose And this is a 96 so this one doesn't have The breather hose coming off the engine and up to the air box This one is in a different spot Normally if you have a newer style one like a 97 98 there's a breather hose coming off the block in the front comes up and there's a There's a filter and then it goes up to the air box So you want to check to make sure there's no cracks in any of those hoses because This vacuum operated carburetor is very temperamental When it's not getting the right air flow You got cracks in your hoses wrong style holes leaks in your air box this particular ATV Was sitting for I don't know six months to a year and when I got it the carb was all gummed up from the gas So I went through and I cleaned it and You know, there's some guys that say yeah, you should just be able to get away with a good cleaning on the carb And that's it I I don't buy into that I I usually get a carbure build kit because you get nice clean jets The fuel is going to flow through a lot smoother than you know older Jet that may look clean, but could be a little crusty So I Decided with this video. I want to show you guys a little trick of what I like to do Um, kind of bypasses the guesswork You know, could it be the carb? In this case, I I think that's the majority of the problem Is this carburetor? Something doesn't seem to be opening closing right if I hit the gas takes off like a rocket But then all of a sudden she's just blah and if I go up a hill it wants to die um a lot of that could be the uh The diaphragm on top of the carburetor here Causing that maybe it's not opening and once again, that's a vacuum issue Um not right about air flow um carburetor even though I cleaned it still could be uh Something minor somewhere that uh that I'm not seeing So I ordered myself a bunch of goodies and uh, this is my Little quick tip of the day You want to bypass all that stuff?  That's uh an aftermarket carb Um, I'm not knocking the product, but uh from what I hear Uh, they only last a year or so and then issues happen. So but I don't know 37 bucks I uh I don't know what's worth more your time or your money. I'd rather throw away 37 bucks Try it out see if it clears up the issue or spend four hours trying to figure it out So that's number one Number two, I got a fuel pump It might not be getting enough fuel as dirty as this is. This was the uh, the one I called the cow in my last video I can't see him either. That uh, that fuel pump is pretty dirty and crusty and who knows what got in there So it may not be pumping alright. It could be a vacuum issue with uh, Not enough fuel pumping into the carburetor Um, and once again back to the airlines the air box um So save yourself a lot of time on headaches Give this shot first you know You probably wasted money on worse things already. So $37 carb find out if uh, it improves power And then you know where to start So and then from there I would replace the vacuum lines um, do those two things and uh, depending how old your 500 is I would uh replace the fuel lines too Only because uh, once they get old they get soft and once again that vacuum from the Fuel pump makes the fuel lines collapse if they're soft Believe it or not, they do and then they pinch off the the amount of fuel going to the carb So what I'm going to do first is I'm going to throw that new cheap carb in See if that cures my problem I'm going to replace the fuel lines and the vacuum lines Put the air box back together and um, I also uh got myself a clean brand new air filter Which will help also But if I can get that air box sealed up nice get my new uh fuel lines and vacuum lines in And put that carburetor in I bet you that's going to cure my problem. You know when I hit the throttle it's not going to die So stay doing it and see if I'm correct. Another quick tip you can try is, uh While you're driving Hit the override button Sometimes this can be an electrical issue And um, say you're going in reverse and what spits and sputters you hit the override button The problem goes away Uh, try hitting it while you're in drive and hold it And see if that improves anything. So if that's your issue it could be An issue with the cdi box Or the uh reverse limiter And that would cause your, uh ATV to spit and sputter and want to die too So keep that in mind. Um, like I said, I'm going to try the cheap carb first See if that uh solves the problem And uh After I replace all the vacuum lines and fuel lines That doesn't work. I'm uh I'm going to go check out some electrical stuff. That crazy override button can cause some problems So there's a way to bypass that So keep that in mind But I'm going to start here first. Start taking that car boat And uh, put the new one in and see what happens. So I like to free up As much stuff and get it out of the way as I can so To loosen up the bolts for the gas tank lift that up a little bit And now I'm loosening the uh The clamp on the boot For the carb. Okay. So another thing to keep in mind Is that carb boot It's to get a little dry rotted And uh, you can get some hairline cracks in there. You might not even see Uh, sometimes you'll be sucking an air through there and that'll lean out the carb causing it to backfire Um, it's a couple tricks you can do. You can leave it run spray a little starting fluid at it or um Um, carb cleaner If it acts like it revs up higher, then you know you gotta leak Um Usually what I like to do is, uh, I'll replace the boot if I can Or if it's something minor, I'll just try to repair the boot But uh, that could be a cause of a backfire issue as well All right, so I've done this so many times. So Kind of forgot to show you viewers.  I made a special special wrench It just kind of Took an old wrench and I Packed the sides so I can get that choke cable off That'll fit in there Just give it a turn That way it fits in there. It's easier to suspend it. Here's my uh choke. You get a new choke with the carburetor So use that one pull that out a little spring back Actually get a spring with it too. Oh one carburetor moved. I'm gonna put the new one on All right, it shed a little more light on the subject. So I got this threaded in where it needs to be and Keep in mind you might have to adjust the throttle cable to When you're done with this up on top there's an adjustment. I'm used to doing this from your side. So I'm doing this backwards for me. So It's back We're all getting in place Got my stopper in there. Got the cable behind here. There you go. Got her So I'm gonna go ahead and bump it up just a little bit right away It needs to be and I'll go ahead put the car rod and put the carb back in All right. Got my new carb hooked up I didn't put the air box on yet. I want to see how she responds with all the air box and I'll show you what she does This bad boy out adjustment or there's a small crack in the car boot I think I got a very good shot of this, but I got the carburetor off the boot And what I'm doing is I'm prying up and down on it And right about here. You can't see with my finger in a way When I flex on this I see cracks in the car boot You can see that light So one of my quick fixes is I like to take black electrical tape And wrap it around the carb boot And I'm going to put the car back on and see if She's still sucking air and acting like she wants to quit And so that tells me I have to replace that carb boot But for now just to see if that is the problem. I'm going to put some electrical taper on it Put the carb back on and the clamp clamp her up and see what happens. All right, a little electrical tape to the rescue Got it on that carb boot Hey, this stuff can come in handy So I wrapped it a couple of times are on that I don't know. You guys call it An intake boot. I call it a carb boot But the boot that goes from the carb to the head Had a crack in it Watch this So if you got issues with your carb Or wanted to choke all up You know, like I said, check your fuel lines In this case, it was the carb boot.  Um, the old carb. I was actually having a hard time Uh, starting it Let me show you She was pretty crusty Even though I uh cleaned it Uh, I don't know. Like I said, uh, unless you have one of those electronic carb cleaners Um, I don't know. I would check into this by rebuild kit for the carb. But in this case, it was the carb boot so You saw how it was acting before I hit the throttle It would die It would idle beautifully I want to check this out. Like I said, go through everything Fuel lines replace those minor soft um I found that odds, uh My uh vacuum lines They aren't correct. Somebody put them in the wrong Put the wrong type of hose on that's not correct at all and uh Fixed the air box and this bad boy should be good to go Hope this helped you guys all with your carb issues or your uh Your quad uh puking out on you Because I've had a lot of questions on that so I thought I'd shoot this video and and uh Show you guys what to look for So subscribe to my channel hit the bell if you want to have notifications for my new videos I've got tons of videos on uh Polaris ATVs from two strokes to four strokes And like always till next time


All of them are famous problems related to software security, but all of them regardless how big or how problematic the problem was, all these bugs were completely innocent. The developers did it not maliciously, they didn't intend to do it. When the problem was discovered, they tried really hard to fix it. That's one of the things which is completely different from our aspect of supply chain, because at least with the way we look at supply chain, we look at people who try to do malicious stuff. They try to hurt you in purpose and not exploit non-malicious issues. If we're talking about software security and we're still not in supply chain, those who cannot remember the past are condemned to repeat it, that's a known phrase. If we're looking at the trend of CVEs, we see a big increase. Both because we have more software, both because we have more bug bounties and more researchers trying to find issues. I guess that some of it are not very interesting issues or issues with very unpopular software. But of course, some of it is very important, very big issues and we can't ignore it. You can see both the trend in graphs and numbers, both of these statistics were taken in the last few days. Now when we're talking about new avenues of software or infrastructure, we're going to talk about something as code and we have plenty of it. We have infrastructure code, policies code and a lot of other stuff we'll see in next. That makes me think what happens to those who don't learn from the present. We're not talking about the past but just recent present. I want to review a few of the things we've seen just in recent August. Everything I'm going to show in the next few slides is from the past month, month and a bit. I'm going backwards. We saw the first phishing attack against Pipe users trying to steal accounts and then they can of course upload packages, of course, target popular packages. But these actions people do intentionally, they try to steal stuff. It's not innocent mistakes anymore and when they succeed and if they succeed, the things they're going to upload are not going to be innocent problems with the packages. We saw a threat actor publishes more than a thousand malicious Pipe and NPM packages. They took either existing packages and duplicated them or tried to add something on top or tried to do as little change as possible to fake the renewal package. But now you have a lot of others and 1,000 might be a drop at the sea for both Pipe and NPM but if they have a mechanism that does this automatically and if they succeed and wouldn't be caught then they can increase the numbers until they succeed and that's quite different from the methods of someone trying to do one package manually, maybe it works, maybe it doesn't. It doesn't have a lot of resources. With these numbers at some point they'll succeed. That is just statistics. We saw another user try to strike with Taipo squatting, starjacking and especially tailored packages with malware and both starjacking is trying to get credits from another project and making the reputation of others and then when you check the package you think, oh it has 1,000 stars, 2,000 stars, 5,000 stars, everything looks okay. It looks like a good choice but it's completely malicious. Taipo squatting you choose a different name or something which is relatively similar to the origin and then people might get confused. I think popular add IO to the end, to the beginning, something in between, dot IO or whatever. Some packages you just add pi at the end if it's on Python related or something else. Another famous example although it's completely not malicious can be Angular and AngularJS. Both of them actually exist and it's confusing for a lot of people. Google at some point switch from one to the other. In another Taipo squatting campaign that's early on, sorry, in mid-August, targeting Python's top packages again trying to get malware into these packages or something which is a copycat of them. With such a similar name it might be actually confusing. The last one we're going to go over and that's from the beginning of August is another campaign to create fake GitHub projects. All of them are clones of existing projects. I did one or two commits with malware trying to hit them. In that case it wasn't uploaded to other places but it caught the attention because we monitor GitHub as well. All of these few items are stuff which our software supply chain team both tracks, catches and reports to others. We intentionally report on all of these actions both for the community to know, for other security company to know and of course that's been reported to the relevant entity, GitHub, NPM, PyPy, whatever registry which is relevant. Trying to help them make the code they host more secure or at least eliminate the bad actors from these repositories and it's a daily and continuous work each day or actually also each night. The team gets new reports, new problems, new things. They are marked as suspicious and need to be checked and we see a lot of completely weird stuff and the sophistication level of the attackers gets higher. Going back to something as code we talked to about infrastructure, Docker files, Helm charts, AWS cloud formation and the parlance from other vendors and so on. We see policy configuration and actually there's a trend that says everything as code, even your anything you might program or might do manually you might find a way to automate it, build a framework for it and do it in a more automatic way. And that's in a lot of cases actually good. But from my perspective there's a disadvantage because along all the benefits it brings both the efficiency, the ability to reuse and to repeat the same things. You want to deploy the same exact and same environment in a few places use the exact same configuration on a few both deployments, environments, projects, whatever it makes everything much more easier. And of course if it's code and it's usually easier to maintain and then we enjoy the benefits of software development life cycle, GitOps, Git in general and so on. And anything you benefit from saving it as text and something you can easily change. But we also get dependencies or famous from other places, dependencies as hell and also supply chain problems and some of them we just saw with software mostly around Python scripts and JavaScript but it's true for the whole ecosystem. Go has its own problems because of direct dependencies or no repository which fixates the packages and versions you download everything else source. Ruby has its own problems Java of course. So these two are just the biggest examples but it's not unique to any of these languages and it's not the fault of the languages or the developers. It's something important to say. If we're talking about the efficiency of some infrastructure as code we're talking about the from of Docker files which are based on other Docker images and other Docker files. Include by the way wasn't accepted. I checked and I saw that it was requested a few times but it wasn't allowed. Terraform has its template. Kubernetes has the helm charts. CloudFormation actually does have an include option for that and many more. And this is great efficiency to have and it's important for us to use it but then again we're starting to use sources not written by us or by peers in our company or in the organization we trust and trust is an important thing. We start to get in files and sources and templates from the while the internet and then we need to start to think. Do we trust them? Do we not? How do we check them? If we check them and most people don't check them. How many of you just saw instruction of how to install something? Yes, add this helm charts repository edit just do install and that's it. You never check the details. You didn't read all of the files. Probably this my guess is very little of you did it. Same way a lot of people who install NPM packages or other packages don't check the pre-installed scripts the post install scripts which is by way another attack vector done on these packages. You might get a completely non-malicious package except the pre-installed line which brings something new to your system or try to mess with the dependencies and then it's different from what is being declared. If we're talking about supply chain and containers specifically first in a lot of cases there's a challenge to finding the right container which is the process in a lot of cases similar to finding the right NPM pipeline package by others. Of course most of you use base images or whatever for especially the distribution itself sometimes for something higher in the application stack would it be the programming language the application server like Node.js or something else Java and so on and then you try to do only your bit on top of this container trying to find the largest base container you can so your portion would be the smallest which makes a lot of sense from maintenance perspective. I want to do only my part I'm trusting others to do their part and using the benefiting from the ecosystem which is of course great don't understand me wrong but when you try to find it that's a process which have some risk in it and when you find something how much would you trust it so we'll do it together I want to for example to use Minayo it's a project I used quite extensively in the last year and a half and it's a popular project I'm going to GitHub it has 35,000 stars it's quite popular there's a startup that supports it everything here looks perfect now I want to find a container or a Helm Chow to install it first okay I'll go to Artifact Hub I'll search Minayo and already I have a few results and here the confusion starts because some of it might be official some of it might not be official I have no idea who to trust and who's not and even if we're trying to see who's the official channel there might be difference between what we want and what they supply for example we have something that says Minayo official it has two stars it was updated 10 days ago and the image has de-security rating I have no idea if it's actually official it's updated relatively recently but I'm not sure the version doesn't say hello to me by the way and notice there's both version and up version which is confusing if we check in something else we see another Minayo the repo is Bitnami both the up version and the version are completely different so I have no idea what I'm getting here and there it has more stars it's a verified publishers but the images have lower rating security rating and I'm still not talking about what's behind this security rating so what would I check I have another one which says sorry this was updated a day ago okay maybe it's better maybe it's worse I have another one with the logo of Minayo the repo is Minayo again what's the difference between Minayo and Minayo official updated two years ago very nice version it's not clear version 8 and version 4 version 4 is from 10 days ago version 8 is from 2 years ago it starts to be a little bit confusing and the clarity here is not always easy to understand and this is relatively a very simple example by the way if you look at this something else still the official logo 9 hours ago from a verified publisher I have no idea whose true chart is it and how true is it no idea okay and then I might go to try to find something or what's the source the project refers to would it be okay for me what's the difference between what Bitnami brings and I don't know it's a verified publisher it might be better and so on all of these issues are part of something I look at it as levels of typosquoting we have a logo for that because we reported quite a lot on different areas but in this case we have problem both with the Helen chart name and other infrastructures cause it's the same problem we might have problem with the container name which is the next phase and of course later on when you have a specific container we might talk about the status of the software packages in it are they updated not updated do they have CVs and so on and again we have the same problem with trying to find the right container we just looked for the right Helm chart and again I'm going to look at this time at Docker Hub I'm sorry to remove the header and I see bitnami verified publisher updated a day ago looks great 10 million downloads and 50 stars I'm not sure the ratio makes sense but 10 million downloads I think it's good enough again Docker Hub verified publisher interesting I see another verified publisher Rancher Minayo Minayo updated two years ago doesn't make sense IBM com it's a big company Minayo update three years ago but it's a verified publisher what does it bring me differently than bitnami the number of downloads starts to go lower and lower 10 million 1 million 10k this one is the client so we'll drop it for a second I have no idea and that's the first page if we continue actually the official images is Minayo Minayo it has no specific logo it was updated depends on the image if you're looking for the client or the server and this one has 500 million downloads but that's not the top result bitnami is the top result because it's a verified publisher and that's a point we might get confused what does the status of a verified publisher means when we need to select something and what's the process of becoming that and in how many cases these verified publishers are not the official release and I'm not talking about the content yet I'm talking about where the origin source and which is the open source project which produces these images and this gets more and more confused and we're talking about projects with these stars on Github it's quite popular, it's a big infrastructure if we take more esoteric examples the results are going to be more weirder and weirder and harder to find out what's going on there we'll look at another example and remember we still haven't talked about the contents of the container we'll talk about container supply chain there's recently I saw a blog post I'll reference in a few slides about the content of the official WordPress container that's actually published on Docker Hub they don't have an organization because it's official so it's just WordPress comparing to something else and you see that Docker file has from PHP some variant of PHP both the versions and the web server that Docker file has which is based on Debian Buster which is one of the flavors of Debian and Dash Slim we know that we have containers we have different layers you can see these different layers I'm not going into the content of each of them but just to have in mind that whenever you install WordPress from the official container you actually get the official container of the PHP project and then something from Debian distribution that's actually official in this case as well if you want to look at the container sorry the Docker files themselves you're more than welcome that's a little bit of reverse engineering to understand what we're having because that's the easiest way if you want to look at other ways or the metadata the container has it starts to get a little bit more cryptic so it's easier to look at the Docker file itself if it's available if we look at the Debian container it actually has from scratch and you have a root file system that's it so in this case we have no idea what's going on in there and how can we trust it when people just say okay take my terrible use it as your system can we trust it can we not trust it and so on and if you look at where the files are at you see the addresses start to be a little bit weird it's not github.com. and it might make sense it's an artifact but I think it's I don't know and I'm a Debian developer and that started to look a little bit weird for me so I kept digging and I end up in a web page that says Debian Docker image checksums and you have the complete numbers and all the checksums it's available it's actually available on Debian domain and Debian has both dot org and dot net so if you want to verify at least Debian you have some way to do it which at least lower the my level of suspicion but again I didn't check the numbers themselves and I would expect people and especially on mission critical systems and production to find a way to do it but I guess almost no one does it and the question is if something gets changed would we know it and in this case the question is after you've seen all that do you feel safe exactly it's probably I guess most of you start okay I'm feeling a little bit weird and that weird feeling is good because that would hopefully make you at some point start to check your environment and I want to give you a different question in that sense that who said that the docker images sorry the docker files I showed you are the actual docker files used to create those containers we have no idea we can guess we can think they're relatively similar but we're not sure there's no way to do it to make sure in a one to one relationship and to verify that and that's something not done when you upload an image to docker hub you're not required to upload the sources of the container both the docker file you don't need to upload it the other sources it's not a requirement and then comparing that to the way for example in Linux distribution works where you have all of the sources all of the scripts available for production and that's a big difference in a lot of cases and I've done it for the last 15 years as part of Debian I build everything on my machine I make sure it works I verify the binary and I can decide if I want to upload all of the sources and one binary to the servers to the build servers or just the sources they build the whole platform for every architecture in that case Debian supports it's the same for reddit Canonical and every distribution out there they build all the artifacts and we know it's coming from the same source and again how would you know it or how would you verify that is a critical task which is not something which has a definite answer and that's something from my perspective of supply chain which is very worrisome you might say okay I'm safe because I can just scan the container that's a good answer but it's a wrong answer because and this is an article published by Dan Lornek he's actually part of the conference he published it two weeks ago and his title is what your scanner and container scanner doesn't know can't, sorry can't hurt you and what he's describing in his blow post is that the container scanners are dependent on what the distribution package manager or the software package manager like pipi npm and so on would report is installed in the container and this is what it actually scans and I wouldn't repeat because Dan did a nice job in the blog post and gave a few examples I wouldn't repeat it live if you're interested you can look at the link at the bottom and I checked a few other scanners on top of one of what Dan checked and some of them has extra rules for new cases or new edge cases for example if you install node not from the node packages some of the container scanners might notice that but it's one application server very specific one I'm not sure if it's related to the location so on there are easy ways to hide it and if you're looking at these scanners to report about content and then CVEs it's relatively easy to fool them because they're taking the naive approach which in a lot of cases is good or good enough but if we're talking about supply chain it's not good at all because we trust too much about what we have in the container and the version being reported I can go to the registry inside the container and change the versions to something which doesn't have a CVE and give you whatever binary I want because you'll have no idea because the scanner doesn't have any idea and that leads me to the importance of metadata we have in the container so if container scanners mostly and this is something worth mentioning if they mostly verify the package what package manager see important otherwise we're going to see nothing or be blind we want to invest more in those custom scan rules for popular special cases no GSS I mentioned but remember that's an endless game of cat and mouse or wakamoli or whatever you want to call it because people who want to attack will find a different way which is not part of your world if your scanner is open sourced it's disadvantage of they also know what you're doing which is still okay but it's part of the game and one of the results we want to do is re-use existing artifacts instead of rebuilding them and that's quite important because a lot of people decide to rebuild again and again or build from source and that has its benefit because you control the build but in a lot of cases it has the disadvantage because you're now the one responsible for security upgrading the versions, applying patch if it's relevant because the patch might already be available but it's not being released officially or as official version and so on and here in some cases building from source instead of relying on an official distribution both the Linux one and the whole ecosystem and also true for a few certain softwares sometimes like shooting yourself in the leg you take a lot of responsibility on you and probably on your organization and now you need to give the answers or be responsible for them and going back to the WordPress example in that case they use the official PHP images which are built from source do not use the PHP packages built by Debian and hence they don't get the treatment of the both the Debian security team the PHP team at Debian which does a lot of work to make sure they have all the newest patches taken even before the official release and I know that because I've done that in the past and this is also why I chose the example I know how much hard we work as part of Debian to make sure the security fix is available as soon as possible and not only as the regular release which might be once a month once in two months and so on depends on which project and what the release policy is sometimes we have security issues which are not critical enough to deem a new release but as maintainers of that package we want to include it because we have a lot of users and we feel responsible and that's also something we did at the PHP team in Debian another benefit of reusing existing artifacts sorry, wrong direction is that if we are based on a Linux distribution it has its own mechanisms for example in this case Debian I looked at the rootFS container I showed you earlier I actually opened the tar file to check what in it and I saw the files which are based for the Debian packaging systems and one of these files is actually MD5 sums of all the files including the binaries and this means I can start verifying stuff because I'm based on an official Linux distribution I have something to compare it to so I know what's in my Debian containers actually something I would get if I would install Debian on a VM or regular machine or whatever it's easy to check and especially the important part are both the libraries and binaries if someone changed the main page the documentation I don't care that's something I would be happy to actually remove from the container because it's not relevant but this verification is only possible if you're basing yourself on a regular Linux distribution and you didn't try to do something in between to reduce the size or to remove the metadata and in that case welcome to Distribless Container this is a work by Google from 2017 which takes some of the binaries from the distribution but removes a lot of the data we can use to verify these images the process it's not so friendly to say at least and it's easier to verify things even if we wanted and the benefit of size doesn't always means we have a benefit in security yes it's nice to remove access packages some stuff we don't need documentation other main pages translation to other languages that's all make sense but if you don't give me a way to verify the binaries in the container I would start to worry and that metadata is quite important yesterday I heard a talk by Canonical to say how they created their own quote-unquote distributionness containers and they found a way to better chop the packages but they keep the metadata so that's a much better way and lets us at least verify stuff if we want to the reason I'm mentioning availability is because the Linux distribution works hard to make sure their builds are reproducible it's enough for being done in Debian for the last I would say 10-12 years the credit for the team is well deserved and that make sure whenever the binary is built it has the same checksum no timestamp in it things which we can verify both over time both over different architecture and it's quite important and that's something I think we should keep for containers because otherwise we might lose the great benefits of this work and that's important for security from security perspective we can enjoy how the ecosystem works and in this case and especially around security sent us double checks and recipes to build because it uses all of them and that's a great service I'm not talking about licensing and other stuff it's true for Ubuntu and does it the same for Debian and who does it for containers do we know of a project that verify containers I wish we have all the sources and in most cases the answer is no we have a way to we usually accept containers which we send stuff from website tar balls and just extract them that's not necessarily a good way for reproduction you might say yes we'll just sign containers we have great framework for cost sign which is a great solution to verify the origin but it doesn't help to get type of squatting all of the containers and hand charts I saw you earlier could be signed and then you have the same choice between signed containers or keys used to sign could be easily faked there's one time emails and so on it's easier to take over someone's github account and then sign in his behalf so every mechanism we need to think what would happen as part of the supply chain and at the end it just verifies the origin it doesn't mean the container is safe there was earlier this week there were a few hackers injected malware into an extension done for Magento they injected into the proprietary extensions not to the open source because they know they were signed and shipped automatically to all the clients and we're talking about over 200,000 downloads so signature is great to make sure it's come from a verified source but it doesn't mean the source is actually could be trustworthy and it's a supplier welcome to supply chain if we're talking about solutions and I'll do it quite fast we need to talk about container creation best practices we need to get the code from verified sources we want to prefer gith for accountability and transparency that's better than writing checksums which you can't verify or verify from a weird website we want to go with that in a different level to also do it for the software and we want access to docker files which is not always available and I think that is one of the questions we want people to ask if we're talking about securing container creation that's where kicks keep infrastructure as code secure project is one of the ways at least one of the ways I'm interested in doing that it's an OPPA based rule sorry it's OPPA based scanner that go over your docker files health charts and whatever infrastructure code formats you have it applies some of the checks with Salsa it's available as complete open source on github although it's funded by a commercial company the project is completely open source and free example for these kind of scans would you want to block docker files which download or extract a tower ball as a bad practice you can have a rule against it in the process of writing something like that and we try to balance between too wide or too narrow for that world because in some cases it might be acceptable you want to check your base images are they okay are they verified are the source trusted were they scanned and so on and that's something that we're in the process to to achieve Kix is supporting a lot of platforms beside docker and docker files and health charts we try to support everything cloud native release from this week introduce crossplane Pulumi the YAML version serverless and K-native and it's already adopted by github so it's actually working and working quite well I leave this for key takeaways they're both containers and infrastructures code is code infra but it's actually still software with software we have the same problem with regular software packages biggest one of them at least to date is supply chain and we have to verify things in our supply chain because we don't want to take things from strangers and that's the logo for our supply chain team just a quick example for typosquoting all of you probably know salsa everyone call it salsa but if you go to the website salsa.dev you'll get this okay this is actually salsa.dev but if you go to github and you go github.com slash salsa you get this because the project is actually salsa without the A and that's a great example for typosquoting inside our own trying efforts to secure it okay thank you very much I'm available for questions both here or our side according to our time limits and thank you very much for listening thank you very much guys what would be your number one could you repeat it for the mic of course so what would be your number one recommendation for those of us walking out of the room terrified what we should do immediately well being terrified it's still a larger problem for all of us okay so you're in good hands out of no better alternative I would start checking first the two things that worry me are first checking the base images because their effect is the biggest if someone tried to take over the account of one of the distributions base images would it be Alpa and Debian, Canonical whatever I think the whole ecosystem is a very bad place so these I want to make sure they are verified the second that container scanners at date check only part of the packages and started part of the information we need to check them more thoroughly both checking the diffs and checking what's been added okay so even if you don't use a few levels of base images make sure you know what's the content make sure you have access to the docker files you can reproduce it and then I think the level of wariness could be lower gladly further questions thank you very much guys


I need the action. I don't, I need that. Action. Those are mine. The internet has done it. The internet has created a combination of my two favorite things in the world. It's when people transform themselves into their dog. The first time I saw this was Dope2111 who actually did all those eyes and stuff. She invented that trend, the trippy double vision makeup. She recently transformed herself into her dog. She like wore a prosthetic and like the whole puffy like dog outfit and stuff. But then I saw on Instagram a makeup artist named Alexis Stone who does like celebrities. Like he makes himself into anybody and everybody. And he turned himself into my dog Kermit. And I was like, all right, if I wasn't sold when I watched someone else transform themselves into a dog, now I'm sold. I need to become Kermit. I'm gonna really struggle with this because I'm not, I don't know how to like paint. I've tried twice in the past to do like actual artwork on my face and failed miserably. It's not my forte. You're bad. That's like the whole comment section in this video. You're bad. I'm lucky that I have like an artist template of like what to follow. So I'm really gonna be following his video here. First things first, let me get my hair on my face real professional like.  So for this video, I really went all out when we went to the art people store, you know, for people like me who are artists. You were absolutely- I got like face paint, but they only have black and white so we got other ones to turn into gray. Step one, I'm gonna take off my choker and yes, you guessed it. When I take it off my whole head will fall off.  It's not a tutorial, but he does glue his eyebrows down. So we ready. I know how to do that. You've did that before. I've did this before just a little bit everywhere. So within like the first second of the video there's so much happening. All the way under the lip and down here. And what? Nothing. I'm gonna flesh back some when we did this before. I don't have enough lip for this.  Something under here, something under here, something going like this, something going like this, some stuff going on around here.  Stick it up there. Don't tell me to stick it up there. Quiet on set. There's no one here. Breaking for lunch. Good man, good man, come here. He has like way more teeth in here. I can't fit anymore. What? Is this like, do I need to add water to this? I'll show them a close-up of what you're using. Okay. I'm in bold water. Water, come here. Your mommy needs Jesus. Oh, here we go, beads. I can do this. You know what? That's it. I think you should stop there. I have to put this in my nose, Julian. It tickles. I don't think this is right.  Give me a pair of towel? Yeah! Oh, that lip color though. Kylie Jenner's Quake Gim. Oops. I got it on my teeth. I gotta mix the gray. I don't know how to do this. I have to make a perfect Samoth Gray. How's this? That looks perfect.  This feels so nice. He has this like, an outline around his eye that he did.  Yeah, I know. I think that's where he like stops. Why is it drying like sort of blue? Kermit's like lighter than this, isn't he?  All right. What? Why are you like this? It's so bizarre, man. This is a thing. Why is it bizarre? It's natural and normal. You ready for the eyes? Woof, woof. Woof! Now we start going down onto the neck, which he's already drawn lines on.  Am I too gray? Very concerned about this color. It's so much darker than Kermit. I don't know what's going on. I like did a little like here and here, but then he does a lot of it with like shadow after. Oh my God, it's already a mess, Julian. Please help.  Yeah, I'm getting it out of there. Look, it's a lot on it. I'll hurry up. Oh yeah, thank you. I had to cough and I can't look my lips. Oh my God, what if I get thirsty? Such clean like white lines.  It's actually starting to get a little creepy. Really? Yeah. The white's so hard because you can like see brush strokes. So he powders like the top of the face. Oh, beach, oh, beach. Oh, it feels terrible now. Felt so good when it was wet. Now it just feels like, ooh, am I starting to look like him? Yes. Oh God, this is so extra. When people ask you what your girlfriend does for a living, what do you tell them? Light happening up here. I'm an artist. Little like here. You're shady beach. I'm a shady beach. You wanna go to the vet? You wanna go to the vet? You ready? Oh no, am I ruining it?  Oh, sick. He does it like under here. Like right here. We're in the double chin, you know? Can I just like honestly say that after watching his video like multiple times, I was positive you were gonna be way worse at it. I thought you believed in me, beach. I'm believing you do a certain extent. This is very hard and you're doing very well, sweetie. Oh, I'll get you a man who sorta supports you. Oh, you're so good for a person who's not artistic. I'm an artist. Honestly, at this point, I just don't even know.  What? I'm asking honestly for a friend. So good. I missed like 10 stuff. I just went upstairs and got my eyeliner pencil and looked at myself and, whoa boy. So now that we got that far, guess what time it is? We do the ears.  Oh, oh, I should have taken my earrings out. What have I done? I'm turning back now. Ooh, like a whole glob of paint went down my bra. Stop judging me. I can feel you judging me from here. Don't do that, don't threaten me.  Oops, that's too thick.  You can do it. You know what? This whole like not having a gray and then mixing it myself every time is really not turning out well for me. I have to fix in my face for quite some time. I'm finally ready to try the whiskers again. Look at that. Why are you looking at me like that? I'm just watching. This normal stuff. All right, then he does a couple of brow hairs. Oh my God. There's so many things in front of me. All right, now I need my wig and my salmon. All right, Kermit. I feel like we got these beautiful matching wings. Oh my God. Can you zoom in? I feel like I can see that. I know I don't usually post thumbnails where you can see the end result, but like, is this a thumbnail? Unfortunately, Kermit doesn't really have front teeth anymore. So we're not really gonna match, you know? Stick your tongue. How'd I do?  Kermit, you wanna go... Don't ever talk to me in my son again. Don't ever talk to me in my son again. I've reached my final form. I don't have any, I don't have any words that I can't believe. Smash or pass. Smash probably. Collective smash. Come on, you wanna go. This is so weird.    He doesn't even care that I just spent all these hours doing this to myself. Do you care that I did all this work? The internet cares, Jenna. This took a long time. Stop trying to get away from me. Act like you like me for the end of this video, please.  Kermit! Put your weight back on. Like, what's that mean? I wonder what Jenna Marbles is up to. It was like incredibly difficult, but like if you spend enough time, you can do it, like anyone can do it. It takes a specific set of skills to look at a picture and then do it on yourself. Like, I could only do it because I watched someone do a video. Yeah, true, true, true. It's so creepy. It's still so creepy. Should I close my eyes more? Well, this was this. This was this. So make sure you subscribe to my channel. I put out new views every Wednesday slash Thursday. Ah, no! You guys look like evolved and unevolved version of a Pokemon. I guess I'll see you next time, but... In for wearing wig, and goodbye. And goodbye. When you're trying to get a boy to like you at school, so you get into his interests. I guess I'll take a lonely adult shower now. Bye!