Good evening all, I am Lalit, I am here to present developing Scalable PHP apps on AWS. Let me introduce myself firstly, I am Lalit Nama, working as a system analyst in Rhenosis Technologies and I am really passionate about PHP and I am working on the PHP since 4 years and with the Amazon Web Services the cloud attract me and I have experience of deploying more than 15 applications on AWS cloud so I am just exploring that and Amazon is working deploying new services so there are a lot of services and I am continuously exploring those and taking the benefit of that. So the topic developing Scalable PHP apps on AWS AWS you all know and this topic is a very big topic and so I have to summarize in 30 minutes so I am just covering only 2 points, the 2 services, simple storage service S3 and SCS, email service. So let's see, this is the table of contents, firstly I will talk about AWS SDK for PHP and version 3 release and installation of this and then I will move on S3 and SCS services and the best practices to use SCS what problem you can find and a short demo to deploy a sample PHP application so moving straight. So first thing these are the services I just take a snapshot yesterday, more than 45 services Amazon already launched so but to deploy a PHP application you do not need all to know, only the few services you may need like from server side EC2, you use storage, you use S3, database, you use RDS so let's see a list, the likely services you generally use to deploy a PHP application, first one is EC2, you know the server elastic compute cloud to host your PHP application, second is S3, simple storage service to store the user content, aesthetic files like JS, CSS, images you can store in that and you have to use S3 to be really scalable because that time the user content will be in the S3 and you can run multiple web servers, so aesthetic content will be delivered from S3 and your application, the PHP core application will reside in EC2 and the database is your choice, RDS, RDS provide you MySQL, MSSQL or RECL so you can use or either you can choose DynamoDB, the next service you generally use is SCS, simple email service to send the email from AWS and another one is the deployment service, they are major two deployment service cloud formation, elastic unit stock, so we will talk about that, cloud front is a next service you may need to use if you are really concerned about the speed of delivering the aesthetic contents to your user, so cloud front is CDN and it can deliver the content fast from near well region of user if you use that, the next one is cloud watch, cloud watch is the monitoring service of the AWS instances, AWS other services, it give you a statistic about if you talk about EC2, it can give you a statistic of server usage, memory usage at any time and there are two type of services in cloud watch extended and normal, normal give you the states in five minute period and extended in one minute, every one minute you get the update of your different services and the last one, identity access management, you can go with the root credential but there are many services, 45 plus services, so you can find your control, the control which you want to give to your user, if you are developing application, there are many developers, so you can directly give that this person should only access to EC2, this person only S3, so that fine level of permissions you can set using IAM role, so these are the services that likely you use only, the first thing, first SDK, PHP SDK, AWS provide PHP, SDK, it is a bunch of classes to utilize the AWS services, like if you want to start EC2 instance, you can use the AWS SDK to start instance, you want to store files in S3, you can use SCK, so it is the way to interact the AWS services basically, although most of the functionality you can directly perform from the console, AWS console, but in the programming, you need it and majorly you need it for imagine S3, because whenever user upload a content, like file user is uploading, you have to store it in S3, so that time it used, so firstly the SDK installation, you can see there are three types of installation, first is composure, there is dependency manager, so you can just install composure if you not installed and then there is one click, one command, you can install the dependency of your project, AWS SDK will download and you can use that, the second one is for PHP archive, you can download the package from GitHub account and directly include that class in your project and you can use the AWS SDK, the easiest way is just download the zip and zip it in your project folder and start using it, so that's simple, yeah these are just for reference if you are using different techniques, how you will include that S3 object or AWS object in your class to use, so using composure you have to require your autoload class and if you are using far, AWS far you have to include in your project, using the zip, in zip there is it comes with AWS autoloader which you have to load and after that you can utilize the services of S3, EC2, SES, many other services you can directly use, yeah so moving forward as I talk, we will talk about S3, so S3 is a simple storage service and it will enable you to really scalable, so S3 is only a file system service, so it only provides you to store the files, there is actually no server running and S3 is only using the APIs, REST or SOAP API available, you can only access using those and it is truly unlimited, you can store unlimited amount of files in that from 1 byte to 5 gigabyte and there is no limit in the bucket, you can really fill this and all objects are stored in a bucket, in S3 there is a bucket, bucket is a container where you can store your files and each account, AWS account has a limit of 100 buckets and this is the format of bucket and if you are bucket name in my bucket, then it automatically have a URL, my bucket.s3.amazon.aws.com and slash is a path of file under that, so if your file is my file.txt, this will be the path to directly access that object using HTTP, yeah so I would like to introduce S3 stream wrapper, you may be familiar with this, this is the easiest way you can use S3 without going into deep of SDK, SDK also provides you a way to store the files, delete the files, retrieve the files, but they are also providing stream wrapper in that you can directly use the PHP core methods, the similar kind of methods which you already aware and the underlying architecture will take care of all the things, so you can directly use f, open, copy, rename commands and to use the S3 stream wrapper you have to include your S3 client and then register your stream wrapper, then a protocol S3 protocol is available to you to perform any operation, so if you want to perform any operation on object, objects are the file actually, here in the S3 terms we call objects is actually files, so this will be the path of your files, so S3 will be the protocol and you have to define your bucket name and then path to file and this is the path and now you can perform any action on this, if you want to delete it just use unlink method, let me show you how easy it is to use S3, simple, unlink you know unlink we use to delete a file on our server, so instead of our server file use the S3 protocol, pass the bucket name and the path and directly it will delete from S3, so that is really easy how we can utilize S3 in our PHP projects, similar kind file size method you can directly use, file exist you can use copy, copy is a good command here, copy you can copy from one object from one bucket to another bucket or within the same bucket also, so it is really easy as a start point if you are going into AWS and want to use S3 services, so now moving forward another service is simple email service, AWS provide you a simple service, it is reliable and cost effective, you can directly use it and you can use it for transactional emails and promotional emails also and it support both SMTP, it provide SMTP credential directly you can use in your PHP Miller class and start sending emails or either API based from the SDK, there is SDK you can directly use those APIs also to send emails, also it provide DKIM support, so each message will be signed of your DNS record, domain record, so receiver client email client can understand that it is a legitimate domain, the email is valid and AWS concept is pay as you go, so you have to pay only whatever amount you are using, so its cost is very low only 10 cents per thousand email you have to pay and rather there is another cost to send attachment if you are sending attachment the data transfer charges also applies, but the good thing is it provide 2000 emails per day free if you are using EC2 service, because AWS promise you can use any single service also or the different kind of services, so if you are hosting your application on another server like on your dedicated server you can still use SCS, but if you are using EC2 then they are promoting to give some free emails on the per day, now the problem when you are scale in SCS, they provide SMTP service, they provide API service to send emails and if you are using directly SMTP service that is slow, because you know the SMTP that make the connection personally and then send the email, then connect the connection and when in the PHP script you are sending the email it actually wait the response from the SCS endpoint that email is sent or not, so the major problem is you can see the SCS service is only available only in three regions North Virginia, Ireland and Oregon and we are in Singapore, we prefer to host our website in Singapore region, so we are hosting our website Singapore region, our EC2 is running in Singapore region and SCS is in North Virginia, so the latency will be much high and in that sense it can take 1.5 to 2 seconds to get the response and that is enough, that is more, so in that case your application will be slow, so this can be one point if you are using SCS and your application is low, you just have to wait to continue on the script execution, so this is the problem now what we can do in this, so this is the solution, first solution you can use still SMTP but reuse SMTP connection like if you are sending 100 emails in a script you can use the same SMTP connection or you can use to create few parallel connection of SMTP to send the emails, so this is the optimized way of that, but still if you are sending one email only in one script then it is taking time, so the other alternative what you can use, so I am explaining one alternative here you can use SMTP relay, so what in that you need, you are hosting your web server on EC2, so EC2 is your IAS infrastructure as a service, so it is providing you a virtual machine, so whatever you can install, so you have to install sandmail email package there firstly and send emails through the sandmail, but configure the sandmail, so it can internally use SMTP that is SCS SMTP, so if you know from the server if you are sending email it is very fast or if it is using local mail relay, so when and the PHP execution when you are sending the email the pointer it returns immediately and continue the execution yeah in this we cannot guarantee that email will be delivered or not, but sandmail will retry it, so there will be less likely that it will not be delivered, it will be delivered, so this is the one solution you can use, so for that there is a prerequisite that you, sandmail must be installed and in the couple of commands you can install that on the liners and another is you have to verify your form email address, because SCS is a service to send emails, it do not host emails, so if you are need to host email you have to purchase email service, from anywhere you can purchase that and assigned a elastic IP, your EC2 must be assigned elastic IP to send an email, otherwise it will not be sent and you are requested for the production assess, because if you are in still sandbox you can send email only on the fixed number of white level emails which you verify and last one you have to generate SMTP credential, it is very easy, just go to SCS console and download your SMTP credential, so host name is fixed in all the three regions, different host name for three regions and you can just create SMTP, it will give you username and password and just use that to send your email in the PHP mailer, so but here what I am suggesting is you can configure sandmail, so you have to just follow the steps with AWS, AWS wrote a good guideline in the developer guide, you can directly find there, because in the 30 minute that cannot be covered there is a series of steps around 20 some Linux commands and that actually what doing is they are changing sandmail configuration to send email internally using SCS SMTP, so from your PHP script you send email, they go to local mail server and then it is delivering slowly slowly whatever the speed, it depend upon package and sandmail configuration if it is using multiple SMTP connection, not using, it is using same connection that depend upon the sandmail package configuration, so if you installed sandmail and you configured it to use SCS, you can test it, just there is a command sandmail from email address to email address and you can send directly an email, a blank email and how you identify it is sent or not using SCS SMTP or the general sandmail package, so here is, it is an email snapshot, it comes with wire, imagine scs.com, if it is there it means it is delivered using SCS service, not the core sandmail package and other way around how you can use it, you can use SDK service, that is STTP API you can use to send email, that is fast here I am writing some statistics which I measured, if you are using directly SMTP in PHP Miller it is taking around 1.5 to 2 seconds because multiple round trips from Singapore to North Virginia is doing so the latency comes in there and it takes time, using direct SCS API almost 1 second, 0.8 to 1 second it is taking because it is allowing you to continue the script execution and in the callback method you can get receive your response if it is delivered or not, while using local mail relay it is negligible, only 0.10 seconds it is taking to send one email and your script execution continue and internally the sandmail package is sending using the SCS API, so these two services we covered here and now I would like to demo application on AWS cloud how you can host it and how it there are features to truly scalable, so let's see a quick demo so here I told there is many deployment services, you can deploy your PHP application directly on EC2 instance or you can use elastic been stock, there are many services, here you can see elastic been stock cloud formation, there are main deployment services which you can use to deploy your PHP application, so I am picking one elastic been stock so let's see here it is elastic been stock I am just I just created an application PHP meetup demo app and here you have to start an environment of your servers, so just create one environment here, so here the two options are there web server environment or worker environment worker environment you need when the application is running on different server and you are creating a job batch of job and just you are sending those job in the SQS simple queue service and from worker environment they are doing work on the jobs, picking the job from queue and just processing the request and giving it to the server, so we need a web server really, so first we are selecting, it is something problem here, let me refresh sorry I do not know to internet I may need to come let's see a quick demo how we can deploy a PHP application and make it truly scalable so create web server here and as we are deploying PHP application it is providing default configuration for so many languages, so I am picking PHP and environment variable is a single instance if you are you need only one instance then it is not scalable and so to scalable you can use load balancing here, so it will start a load balancer next we will see here so first is application version, you have to upload your application jib here that directly the Elastic Minister extract on the server www folder and it will be accessible using the URL, so let's select so I created one page app here, so I am selecting that and here the batch size deployment limits when you deploy another version of the same application you can choose how you want to deploy because if you need really less downtime then you can choose like fixed instance I generally choose here so one instance will be replaced by the new application version in one time when it will be running again then it choose the second server to deploy your application version, so you can decide the setting here next you have to give the environment name here whatever you can give so I am just giving the name and you can check the availability of this name so it's available and a description you can write here so moving next here the two options RDS but I do not suggest to create RDS here as a part of Beanstock application because when Beanstock will terminate your RDS will also destroy, so keep it outside just start RDS directly as you normally do from console and use that data and feel free and you keep it easy to server free from RDS no dependency you can use directly there another thing is you can use VPC it is a virtual private cloud in the public cloud it can provide you service is a private cloud which your local application can connect using it secure tunnel so but we are not using that so next there is a couple of types microstance we are choosing and easy to keep here it is on it provide you PEM file and that is the only way to access your server using FTP or putting if you do not have one PTP pair you cannot access your server directly so I am just selecting one PTP pair here and email it yeah sorry so here are other settings you can check those settings and that is the configuration of how your application will behave so these are not so important so I am just going forward and pressing here to identify your easy to instance and instance profile and the service role is there two IAM roles and these IAM roles will actually have access to your deployed services so using these IAM roles you have to give permission to these IAM roles which I am selecting here and then it will work so I am just selecting I just created it service role and here is summary and you can directly launch it this way your application will deploy the firstly the GIP will be uploaded to S3 and there from there it will extract to your server and it will start so it just take two minutes and once deployed you can see your application on this URL it is currently deploying okay so now I am just showing you the scalability of this so here is the scalability here you can decide the number of web servers the minimum servers are one at a time running and maximum four this I am setting so this setting will trigger a new server when you will set some configuration here this is the scalability trigger which we use I generally use CPU utilization so CPU utilization the every CPU utilization in percentage I am setting here 5 minutes so every 5 minutes it will check the CPU utilization and what it will do if it is going upper threshold I set it generally 70% and lower threshold I set it 30% and upper bridge scale increment is 1 and lower is minus 1 so when your server will be at 70% usage for 5 minutes it will start another server keeping the limit 4 so if you are getting more customers more visitors it will start another web server and the web server there is a load balancer your traffic goes to load balancer and load balancer decide which server is free and route the traffic to there that way it makes a truly scalable app so this is the basic of how you can deploy elastic finished application same way you can use cloud formation also that there is a JSON template based system so I am hoping it is just a big topic so I just covered a few points here hope it will help you thank you do you have any questions for me one or two questions if possible yes is there any way to scale up the database as the number of machines go up yeah you can write but you can create redeplica of RDS RDS provide a feature redeplica in that you can start another server RDS instance same kind of visitor instance and there it create a replica and how do you connect it with the scaling from here here I asked earlier that I am not connecting RDS here directly I didn't started RDS I am having loosely coupled RDS so you have different control of RDS you can connect it with any server if I bind it with elastic then when I will destroy the environment or somehow my environment will destroy the RDS will also destroy and I do not want that so I am managing those differently I understand if I am saying as the number of instances go up yeah the number of connections to the RDS goes up yeah yeah so that is point you can create start the redeplica of the servers database server the question is can you automate that yeah in RDS there is setting yeah auto scaling in that database also there you can set also if the CPU utilization RDS instance is going high start another redeplica so same scalability is there also any other question yes it is a PHP application to be deployed so it is starting a server here you can see directly this is Beanstalk service and if you go to services and EC2 you can see it started a server really server here the one running in stock is coming here so this is just started any normal server you can directly set using ftp or putty so instead of instead of doing it manually this kind of does it for you basically automatically spins up instances installs software and then low level deployment it is handling I know that EC2 supports windows linux you can issue yeah if you want to use another server like windows server so you have to create AMI of that server so you if you know the AMI ID every server which is running have an AMI ID AMI ID is the image of linux or any operating system so in the there is a configuration where you can change the AMI ID and just start it so it will restart destroy all the old instances and create another instance with the new that AMI so that can be windows that can be linux ready to go into anything we can load our windows application to run together with our web application yes yes can I wait to do that yeah you can do it you can take this offline I think it is a possibility to speed up two different web servers or something or it is possible but you can think it is offline for implementation details about this thank you


You should brush your teeth That too Well, this is shady. Okay.  Oh Instead of the Raptors game instead of the Raptors game. Oh, we have to turn that off copyright or turn it on the button Copyright basketball game. Yeah, news copyrights you the most What's this even called the whisper challenge right the whisper challenge We're gonna do rides edition and then our other channel will do something a little more inappropriate. Oh Like where we can swear All right, so my phone is gonna play really loud white noise We tested it. I can't hear anything like really loud This was so spontaneous. We could have prepared like lines or something to say like prepared if we prepare Then I would know what you're gonna say I have my own you have your own genius Yeah, I know but okay, this is gonna be harder than it looks. I know I don't know how to lip read. I've never done it lip read Leviathan is just a baby fury You have to go slow. Leviathan is just the fire chaser express Leviathan is just a baby fury Leviathan swear word on behemoth No, is just is Just Why not say that word just Leviathan is No, just Just Leviathan is just a baby fury chopping Leviathan is just a baby fury Leviathan is pooping on You're saying the S word of pooping though. No, that's what it looks like just Leviathan is just a baby fury. I see behemoth after the word. No, you're not saying behemoth at all. No Leviathan is just a baby fury I'm not gonna guess this Okay, say it slower Leviathan is Just a baby fury Leviathan is such a bad Stop it just a baby fury is a floorless coaster Just a baby fury Just Leviathan is just a baby a baby giga Fury Leviathan is just a baby fury. Leviathan is just a baby fury. There you go. Oh my god Floorless co-starry I love that one. Oh man Okay, your ears are very warm. I am warm. Yeah Wow, it's really weird. I can't hear you. I know Okay, I used to be scared of behemoth and Leviathan until I met you Amusement inside is like behemoth and Leviathan close though I used to I Used to huge toad No used to I I uh I I I okay used use used used to to Be scared be scared. Is it I used to be scared of roller coasters? of Behemoth behemoth and Leviathan and Leviathan until Until It how's he so good at this though until and Houdini No until Until I met you until I met you. He's looking at me right now until I met you Until I met you Such a bad duo. Yeah No Until I met you Since I bet you I'm so long. This is really hard until I met you Before I met you. Yes, same thing. Yes Whoa Damn, I got Houdini in the noodles. It was a mess Steel vengeance has a really loud lift tail Steel vengeance has a really loud lift tail Steel vengeance has a really loud lift tail steel vengeance has a Really loud lift tail a weird sound effect No, a really loud lift tail weird sound ah Really weird really really Whitney really Really loud lift tail. Hey, it's Whitney. You know you the only reason I got that ending So easily is because we had that conversation over the last like five days. I Am willing To take a pay cut Moving forward. Oh wait. What's it again? I am willing to take a pay cut moving forward I'm a really bad guy before work No really Willing weirdy willing willing Weirdly I am willing I apologize. I Am willing. Oh, I'm willing. Yes. Okay to take Fusa to take to the to take for the to take to take to die Beating like opposite ends of the spectrum a pay cut Pentagon a beating.  I know on the other channel ride Sling shot. I will ride slingshot with you By the end of June I will ride slingshot with you By the end of June I could just imagine what he's thinking right now. Oh my god. This is so bad. I will I won't I will I will Ride ride slingshot slingshot with you with you By by the end of June of June so easily. Yeah, did I get it?   When'd you get Godzilla from yeah that confused probably because I went to see it yesterday Don't want to be an American Mindbuster is better than vortex One more time. Mindbuster is better than vortex. I heard you burp One more time. Mindbuster is better than vortex Mindbuster I Got Peppa Pig sweat all over my floor. So what's all over my floor mind buster You know, I think is I can see why Mine buster would leave him to say like the M in the B Mine buster my something mind buster Mine buster is better than vortex Something is better than something Okay, mind buster Why do I keep seeing? Mind buster your buddy Mine buster mind buster mind buster Dust buster No, almost almost mind buster my buster Mind but mind buster. Okay is better than is better than vortex. It's better than what vortex Shoes Vortex Kleenex close Vortex. Oh, yeah better than vortex. I'm offended. I haven't any music playing. It's just white noise It's a party in the USA. Oh, yeah Krega is the face of amusement insiders Something about your toes Someone's literally on the floor over there.  That's true, but Krega Krega.  I think you're saying is a B word.  Crush on a certain ride operator Something about Olive Garden have a certain I have a crush on a certain ride operator Olive Garden has to wash something They probably do Good point. I'll go and take notes short Show certain Sir 10 Sir 10 Chantel certain Sir 10, you're not saying shorty. Are you know certain Chantel sir 10 have a crush on I have a crush on a Sir 10 Sharktooth it's either Chantel or Sharktooth one of the two certain short one Hey, I have a crush on a certain Certain Jordan certain Jordan sort certain position Certain ride operator She wouldn't tell while I'm aware Certain ride operator Certain ride operator. I have a crush on a ride operator certain Ride operator Chantel's ride operator Coming to Wonderland in 2020 Chantel is it not Chantel. No, okay Certain ride operator certain ride operator short ride operator. You know what? Yeah Certain ride operator. Oh certain only peasants don't have fast lane Who is the best? It's one word. Is he pronouncing it with his lip properly? This is starting to annoy me Something it's one word. Okay only It's something like oak Lee Lee own Lee Is it a ride? No? We interrupt this broadcast Trying to do a video here. Thank you, sir. Oh, no, I'm good. It's like Oakley. It's close But oh oh Tee something Tee oh Tee no Tee Own Lee one word. Yeah, that's he's gonna say pregnant Peasants don't have fast lane only fast lane Well only peasants best Peasant peasant Bested peasant peasant peasants I says Peasants fastest peasants peasant look at him peasants baskets peasants bastards No peasants passes peasants Zint peasants say the first part of the word Peh tomorrow. I'm going to Wonderland on a date with a girl That's too easy tomorrow. I'm going to Wonderland with a girl. Oh, did I get it? You left that apart cute girls are what you said no Tomorrow I'm going on a date to Wonderland with a girl tomorrow. I'm gonna get with a really hot girl Well Tomorrow okay tomorrow. I'm going on a Forget how I phrased it now Tomorrow I'm going to Wonderland on a date with a girl tomorrow. I'm going to Wonderland Tomorrow was Wonderland tomorrow. I'm going to Wonderland tomorrow. I'm going to Wonderland on a date on a date with a girl with a girl Why are you so good like and then now I just need me for the next 15 minutes me struggling I'm not hanging out with the young you pop eating up a bill to get Millennium Force has a flat tire People at vortex are slow ups Millennium Force has a flat tire Millennium Force has a flat tire Fast-ops is the last word Millennium because Millennium Bunny rabbits Millennium Millennium Popsicles Millennium Force Bhutani Millennium has a flat tire I has a Has has a flat tire No has And force there you have get that joke Millennium Force has a flat tire knock it even get the M at the beginning of Millennium Force All right, I feel like your lips don't do the proper like I was offended from the first thing you said You haven't gotten shady at all. I Did you just had headphones on what is she watching? Well, that's been a video oh Right, it was just one more each wasn't it yeah, oh Comment down below if you want to see any more of these They're fun You maybe even suggest like a topic we have to go over so it's not so random like this like a park Yeah, that would be good. Okay, so comment down below the next park we should cover That might even help us educate Greg on things and then I thought studying right Okay, I know this is really random for a museum insider. So we're trying out some new content and stuff It is roller coaster related. We kept a roller coaster related It's like borderline like we made it roller coaster related with the topic, but now we're gonna go back to watching the Raptors Unfortunately, I don't even know the score. I haven't checked at all. We're not sports people I don't even know why we like I even got snacks and everything and then we're like sitting here watching YouTube videos We literally become such youtubers. I Think the words you're looking for is losers who got like an entire stomach size The mysterious man behind the camera that's been dying throughout the whole video You can't keep a straight face through this. No, you can't no, it's it's so much fun Even though it's so frustrating this crag is let's do no lips will blame me Okay. Well, peace out. Don't forget to hit that like button subscribe if you haven't and share this video I don't want to do his jingle What's your jingle? What would your jingle be if you were to end a video come on? Later alligator


Right. Welcome everyone to the July 28th hyperledger technical steering committee call. As you are all aware of two things that we must divide by. The first is the antitrust policy notice that is displayed on the screen. And the second is our code of conduct. So as we move down the agenda, we have our standard announcement. The dev weekly developer newsletter. I'm doing this from memory. It goes out each Friday. If you have something that you would like to add to that, please consider clicking on the link. And there's a wiki page where you can add your comments. If somebody wouldn't mind whoever sharing their screens going down on the agenda. Thank you so much. Any other announcements that anybody has. So Julian Gordon VP for Asia Pacific type of leisure is currently visiting India. And there are a couple of events planned. So he's in India for a week now. And this Saturday there is a public meetup event in Bangalore. So if anybody is around or if you know somebody in Bangalore, please let them know about the event. And yeah, it will be an in person event. Thanks for sharing. Anybody else have any announcements. Okay. There's no other announcements we did get in the hyper ledger saw to quarterly report. There was a slight glitch with our project calendar reporting. It was supposed to be saw to it's not transacted last week we had transact on the list but it was supposed to be saw to it's she got the reminder for such is not the reminder for transact looking at the calendar. I did see that those two got reversed for some reason in this quarter. So I fixed that we didn't get the sautees report please take the time to review it. I didn't see any additional comments coming through other than the ones I made but does anybody have any comments on the sautees report. Okay, I know a lot of us haven't had the opportunity to review that yet. Since it did just come in yesterday. Please take the opportunity to review that I will leave it on the on the meeting agenda for next week in case anything comes up that we need to discuss. Next week we have coming to the hyper ledger areas and the hyper ledger indie reports. So if you know anybody in those projects. Please feel free to remind them that they have that coming do with that. As far as I know we don't have any TSC business to discuss this week but does anybody have anything that we should be bringing up to discuss. Sure Tracy I think I pasted similar comments on the TSC group as well sometime back and taste back to what kind of project should we attract and what should we do to get those projects incubated and the hyper ledger labs or hyper ledgers. How do we invite those collaboration. And I don't know maybe we can open it up for comments and then if not now at least sometime in future. And does this relate or do you think to the project gaps. Task force that they know has been leading or is this something else. I think we can consider them as part of the task force as well. And I think the task force is aimed at identifying the gaps but does it also aim at how do we collaborate or bring in those those kind of projects or how do we start those projects. I when I put the objectives out I think the collaboration and the bringing in is the next step. So yeah, I think it does feed from the task force. The project gaps task force results. But I think it would be a separate task force action more than a task force and ongoing thing. To outreach to projects we think that would be positive for hyper ledger. So I think it's shrimp stems from but I don't think we should limit it to the task force activities. Thanks. And a room do are there certain projects that you think would be worthwhile to approach at this point. And that's why this is coming to your mind. I see a need for using some of those projects so that's where the need comes from. And if such thing does not exist anywhere and if others are also willing to show an interest, then that could be an initiation of how we take that forward right. It's a way to find similar if many people have similar interest, maybe that could be an initiation. So yeah I was just hoping for those kind of discussions to happen at some point. Okay, I think I think two things are one, you know, obviously after the project gaps task force we can talk through projects that might get the gaps that we discover right during that task force. And then secondly, let's see what we can do if you have certain projects you already have in mind to get that list together so that we can have a more focused sort of conversation. So, with that any other discussion items before we move on to the security task force right seeing a coffee, which says I'm away on the screen here. So a room and I think you're supposed to be driving us through the security task force today. I'm hoping you're not really away. All right, sounds like maybe he is is there anybody else on the screen task force you might be able to let us know current status and what we're discussing today. All right, looks like maybe a room your back. It's we see. I'm sorry, I got disturbed. It was an emergency call. What was the topic I missed probably. Yeah, so I think we're at the point where we're ready to go through the security task force. Right. So in the from the previous call that we had at the TSE. I think one of the feedback that we strongly received was that these recommendations are fine but what are we doing about. I think I'm sharing the right screen. Seeing a black screen with the line down the middle. Same thing. It says my screen is passed. It's asking me to resume, but when I click on resume, nothing happens. Is there a is there a wiki page or something that I should share. Sure. That's the task force recommendation page. Right. So one of the strong feedback that we received in previous previous TSE call was that we needed concrete proposals and not recommendations. And we needed plan of actions that as a TSE we can ask projects to start implementing. And since then we got to meet for once and next August 2nd we have the next meeting. But if you scroll down to the bottom, I think in the previous call we were trying to come up with a concrete proposal for one of the item, one of the action item. And so the first point I'll probably skip that every project to have a security representative. I guess we already added that in our requirement project requirement for any project to even incubate we need that as a requirement. And the second point that is put up over here in terms of concrete proposal. This is related to addressing CVS on a timely fashion. And the recommendation over here is we definitely don't want to be pushy for all the CVS but at least for the critical ones and the definition of criticality goes with the score that associated with it. So at least for the ones that are highly highly coming up, which are more critical, which are easy to discover. And these are the factors that will determine if a CV is critical and to be objective onto it. It's it's it can be considered as anything that is that is having a score of greater than 0.7. And and the proposals are in the goals over here is to avoid any such things being left out without fixing them for a long time. And we can we treat them as a highly exploitable ones that are to be addressed so much. So the proposal is that every project will be issued with a best practice badge. I know Tracy you had a comment on that, but I'll probably just complete this and then we'll go with the questions. So the proposal is to have a best practice badge issued to all the projects. And this badge will be issued on a on a merit basis. And this will be reviewed or reconsidered every quarter based on the project's report that they fill up to the TSE. And when a particular project is incubated, this badge will be awarded to it on on the basis that it is incubated. And the badge will remain with the project as long as they retain the status to see status of it. In case if the project is is is not maintaining the conditions which are said further, then the badge will be revoked. And if about badges revoked, then the project has to prove that they are following the process again, and they have to prove it for two consecutive quarters, following that revocation. So that was the intention. So there is no punitive measures over here. It's all about having that extra batch that gives the confidence to the consumer of that particular project saying that hey, this project is pretty much active in considering at least fixing the critical vulnerabilities, right? Ideally, we would like to have all of those to be fixed. And in two, in order to support this, in our quarterly reports will introduce a question that clearly states that if your, I mean, if a particular project has any critical vulnerability with the score of over here it is assumed to be seven and again that's open for debate. We can always revise it to another number. So we will ask the question if the score, if they have any CVs that are not fixed for more than 90 days. And if as what, which are those, and this is on the premise that after 90 days, all the CVs will be made available public. Of course, there will be consent taken from the project and project team has to give an explanation for why it should not be reported. So that's an exception process. Then, right, so the next point actually talks about that extension process and how long such extension can be allowed. So two such extensions can be given but not more than that. And this entire process itself will take the CV to be more to be to be active for more than like close to three quarters, right? So that's the next point. And the last point I decided deals with the revocation and the rules for again gaining back the batch to be to be on the normal list. So this was the only concrete proposal that we were able to put up after that call and the next call is on second. I think I see nano Tracy and hard raising hands. So one of the things to consider in this is that we don't hold all the cards when it comes to see the reporting. Whoever proposes CVE they're engaging in a responsible disclosure in agreement that they won't disclose it. After certain reasonable time and 90 days is a pretty standard thing unless there's negotiation. But you know these might be researchers and after 90 days you might say I need to publish a paper. And unless it's going to burn down the internet, I'm going to publish it. So I mean, we can, you know, how these rules said to delay publishing the CVE is that sometimes the project or hyper ledger is not in control of when the CVE gets disclosed. So that's that's one, one aspect to consider in this is we can use all the characteristics we want but we don't control the destiny on it sometimes. Okay, thanks for that input. Hey, Tracy. Yeah, so I actually have three points. Maybe we'll start with the second one since it kind of relates to what Dan just said. You know, I think in here, you mentioned that if yes please list the CVE is I think that is a no no. So from the perspective of if it truly is a CVE and it hasn't been fixed yet should we really be reporting it out and to a document that is publicly available to anyone. My second point here is, I don't know what a score greater than or equal to seven actually mean so for those of us who are not familiar with that maybe we need to be more specific about what it is that seven reflects. I think that's a very much a magic number in my mind. And then the last point that I have is the one that I made in the comments which is, I feel like a badge given to a project that's never had a CVE that says this project is following the best practices within the CVEs is not accurate. Right. I would prefer that if we do this we have like a never had a CVE type badge and a yes this project has dealt with all their CVEs within the whatever this 90 day period might look like right or within the time frame that has been agreed with whoever the report it was so I think, you know, there's, there's some challenges with claiming you are good at something that you've never done. And then also when you restore the badge. After they've resolved that particular CVE I think it's not quite right either, because we still don't know that they're good at dealing with CVEs within the amount of time that have been specified so I just feel like we need to be a bit more robust in how we're issuing these badges and when we're revoking these badges and when we're re issuing the badges. Thanks Tracy. I should like answer, I'll probably go with the round robin fashion. Hey, thanks. Yeah, great points. Tracy and Dano. I do want to, it wasn't clear to me whether we were still by default releasing CVEs after 90 days. I think, you know, the automatic release without petition to the TSC is a good thing. As Dano points out, you know, a lot of CVEs are found by researchers and other people that that have incentives to release them. In particular, we've even seen some CVEs brought by competitors that have, you know, lots of financial incentives to release CVEs on hyperledger stuff so you can guarantee that they're going to get released.  So, you know, I think by default, you know, we should be releasing CVEs after 90 days.  You know, the scoring is always a little bit subjective. So I'd worry that that could be gained a little bit. You know, so if this were, you know, totally up to me, I would just say, let's release all CVEs in 90 days. You know, sort of no matter what happens, you know, unless people ask for a TSC and if something is very minor, you know, well, maybe you can release it if it's not totally fixed, right? But, you know, that sort of addresses the point here, which is we want people addressing, you know, high severity CVEs, you know, but we should also be transparent about the less severe CVEs. So, so I'd prefer like a mandatory release policy. Because I think in practice, we're going to have to pretty much do that anyway. And there's no reason to hold these back. I'd be curious to hear what everyone thinks about that. Thanks for it. Yes, hi guys. And I apologize. I missed the call. The task force. I since in the reschedule, I don't have it on my agenda. I need to fix this. I actually meant to attend. But so my point on this is that in fact, a bit of follow up to what Dano and Hal said, the, I mean the open SSF recommendation is that you should try to engage with the reporter and try to translate the time frame for the disclosure. And as you know, hot and then said, I mean, they may have their own, you know, timeline, and the experience shows that in fact they are not always nice players. You know, it might be because there is competitive incentives, but there may be all sorts of reasons why people don't necessarily want to respect, you know, to give you enough time to fix the issue. And that's the reality we're dealing with. It's to the point where open SSF is actually now planning on developing a guide for, for reporters, and it's well understood that they may ignore it, of course, but the thought is that maybe if you know, we give them an insight as it's like to be on the other side, they might be more amenable to negotiating rather than forcing their own schedule on on the project, which sometimes can be quite challenging, right? You have to figure out whether this is real, you have to be able to reproduce it, you have to figure out the fix. And this may even with all good intentions from the project, it may still quite, you know, take quite some time. And so I think it's important here to take that into account. And I agree with Daniel that, you know, just saying, oh, 90 days. Well, in some cases, they may be, you know, agreeable to making it longer if, you know, it's a really hard problem to solve. And they might accept to give you more time. And other cases they may just say, well, screw you. I'm going to release it next week. And you just have to live with it. So I think that the, I think our policy needs to reflect that, you know, this is not casting stone and it is dependent on the reporter and their willingness to negotiate or not. Thanks so much. That was a, that was an option we did not know about. Thanks for that. Hey, try. Hey, so just a few thoughts. I think the first thought is, you know, part of this proposal sounds a little bit like information gathering and better transparency. Another part is this the badge concept.  I think, you know, maybe if maybe if the focus was on on the more the transparency aspect and not so concerned about, you know, rule setting about badging that might be easier to get started. The other thought is about, you know, projects like areas that have less and more mature sub projects within them. A badging exercise like this might be fairly difficult, right, whereas, you know, stats gathering would probably be easier. So those are my thoughts here. Okay, I think we have so many questions to discuss and debate about so I'll probably start with you try. So the intention is not to have a badge, but intention is to have it easily consumable and probably incentivize projects to do their best so that the consumers of that project, they feel confident about the project. Right, so that's the intention behind it. So by just probably the easily conveyable an idea for somebody who's just looking into project and they want to know, hey, can I trust this project or is the project maintained to the standards that we expect. And if there are other recommendations apart from badging, then this will come those as well. And probably this ties back to the idea that Tracy was talking about that we may not be good with single type of badge. Because of certain reasons that in a project is incubated they have not done any best practices, it's just that they're starting to work in an open source community. So they may not be, they may not have exposed to certain scenarios which other projects might have already been exposed. Maybe like all their maintenance are occupied doing something else. So I completely agree on that aspect. So if not a best practice in terms of CVE, we can always say that the project is good for last two quarters right in terms of how they are managing their CVEs. So that can be a badge. And that badge definition can go by saying that the project is in good shape for the last two quarters and it's given through these reports and other means and either it had no CVEs reported or it's following its best to address them. So that can be the badge. I mean, again, it can be a badge or it can be any other means of conveying that message. And to another point that spoke about extensions and the minimum, I mean, disclosing it after minimum number of days that are, that's an interesting aspect. And also, I guess that ties back to what are not said in terms of negotiating with the person who has raised that was issued that CVE, right? So I have added that as a comment in the notes. I think the page is not in edit mode. That's why it's not showing up, but we will discuss that in the task force call to see if we need to do anything for now. I think disclosing that after 90 days without having any extensions, because some of them, as you said, it's not in our control. It makes sense. And we can put that up. And I'm not sure if projects would be happy to do it though. At least from a process point of view, we can state that. And did I miss any point? Just from my point, projects like Aries, which are more client frameworks and not blockchains, have multiple projects within them. So these proposals tend maybe not to address that issue that something like Aries may have a very, very fresh sub project versus, you know, a more long running sub project. And it's fairly difficult to have this global rule just for like say something like Aries across the board. I agree. So each repository or each project within Aries is considered as independent one, like that's what you mean. There's like several different frameworks of completely different containers, right? So it's more challenging with that kind of framework project than like say the blockchain projects to have a kind of a global scope like this. Okay. Hey Art. Yeah, I mean, Troy's point makes sense, but there's no reason we couldn't do this sub project by sub project, right?  And if it, you know, if we need to do it sort of like repo by repo or sub project by sub project, you know, I don't see why that would be an issue. Would that satisfy some of your concerns, Troy? Yeah, I mean, I guess we have to start identifying that a little bit better. But I mean, I think part of my point was just, you know, I think the information transparency thing is easier than, you know, trying to trying to adjudicate badging is just a personal thought as well. So, yeah, it totally agree with you. I would agree with the repo transparency thing doesn't go away with this. I wonder if maybe there's something that would actually help general project discovery if we have the maintainers group repositories and say, these things are all part of one whole. And these things are all each kind of standalone, maybe because they're different implementations of the same protocol or because they're maybe different plugins that are on the sit on top of the core and so vulnerability and one doesn't necessarily reflect on the others. It feels like that organization and that making that hierarchy more visible would help with both the badging and in making the project more approachable. Right. I think going by that right so if. So, for the things which we use as a library as a dependency sometimes we see that, hey, this particular framework has an issue but only in this programming language or so right. One consideration, but again, your question is how do we show that how do we showcase that to consumers point taken. I think I'd like to really highlight and dig in on choice suggestion because I think it's not not going through and so maybe we can state it a different way, which is focus on the data first. Right. What is the data that you want to collect about CBEs and that data is CBE name date reported, maybe the person who reported it the date that it was resolved, which would then allow you to calculate you know how many days was passed, whether it was within the agreed upon days to resolve right so maybe that's an initial sort of capture my point of data that you capture. Right. Once you get all these points of data that you want to capture about a CBE, then you can decide what type of badges right and maybe it's, you know, here's a couple of SQL statements or whatever you want to call to say like, this is the data that you would need to see what the average amount of time it was to resolve CBEs for this project this repo this whatever it is that we're talking about right. This is the, you know, number of times that the CBE was resolved within the agreed upon timeframe. So all of these sorts of data is available then to you after you get that data collected. And from there you can decide what the badges are so let's, I think Troy suggestion is really good and so I want to see if we can focus instead of on badges. What is the data that we need in order to determine whether or not a project is doing good resolving their CBEs. Troy excellent point makes sense. We need to figure out what kind of data we can collect. I think all the data points that you said should be able, we should be able to get those. And I guess I missed one other point. I think you wanted to understand how did we come up with the score seven and what does that really indicate. So score seven as you said for now is a magical number so we just considered that anything greater than seven to be critical. But again we can change it right so that was that was a proposal. I had that in mind when when writing this proposal. And I think right sharing the screen. And whenever somebody reports an issue. They will have to fill through our answer list of questions. And so it's a preset list of questions in the sense that we have to know, like how much of a weightage am I giving for each of these aspects of that issue. And on what a particular reporter is saying we that the calculators like it determines the score of that particular CV. And once it gets reported and probably while talking to them and we can, like, there can be a process which which is established which which where a particular maintain or somebody can go there and talk to them and tell them hey, I see that you have considered this particular aspect of the high, but for from from our definitions, because we assume certain things in the project. Our security threat model does not consider these cases. So that's where we don't think this is high. So we, we will change this to let's say another value. And that can reduce the score as well. So this score gets calculated through this questionnaire that somebody answers. And one of the recommendation that the task force also had pause. Since we are dealing with blockchain technology and multi party systems, if needed, we will bring in additional set of questions into this to have to have influence on the score that gets calculated. Those additional set of questions could be very specific to blockchain technology. And this at least should work for the core protocol projects that we have about six of them in my pleasure. Again, that's not imposed on all the projects and the hyper ledgers. It's specifically for those. I also want to, I was showing earlier for fabric. We have this public dashboard. It shows the number of reports, our policy, et cetera. And you can dig into this and see how many CVs, et cetera. So there's more clicking you can do I will post a link to this in the discord chat. And scoring. I mean, looking at the site, it's github.com is this something that is built into GitHub. And if so, how would we go about making those changes that you're suggesting a room about, you know, if there's blockchain specific types of things that would need to be added. I can answer the first part. This, this is built into GitHub. What I did for this was I started draft security advisory on the governance repo. And just started answering these questions. And once once you get a score here, you can go in here and set this yourself. If you want, I'll give you a walk through at a later date. Right. I see art also raise. Yeah, I would also take a lot of the CV scores the big grain of salt. So for instance, if you have a bug bounty program. You know, everyone wants to extract more money from the program so they generally we see that people try to inflate their scores when possible. And that's one thing. On the other hand, if it's like someone from a project reporting a CV, sometimes they will tend to underreport it. So, you know, we should be careful with the CV scores, particularly for for the bug bounty programs and CVs that are that come through that way. I will say that I spend a lot of time closing basically bogus reports on hacker one. So heart's point about overinflated is. Yes, very much so. I think one other question that you had Tracy was when we have our own set of questions. How do we consider them and here right so that aspect is not exploded. Do you want to see on the screen. Sorry, I think the other question that Tracy had was, and when we bring in our own set of questions, which are other than the one that we saw on the GitHub page. How do we consider those in the scoring criteria. I think that's an open question. So, I would require request the TSC and also the maintainers of all the projects to join in the next security task force meeting on Tuesday. Because that's really the time where we dig some of these questions into deeper and we we do discuss a lot of lot many things. And the summary over here captures. It's probably a gist of what happened in the call. But there's a lot that goes into those calls. Okay. Is there anything else everyone or anybody on the screen task force would like to cover today. I will take that as no. So I guess we will say that we are complete for today. Next week. Bobby will be presenting some of the work that they've been doing in the learning materials working group to come up with some guidelines around documentation. They had a task force going on there. So we'll let Bobby and the team present that to us next week. If there's any other items that people think we should discuss as a TSC, please let me know and we will make sure to get that on the agenda as well. And with that, I will close out the meeting for today. Thank you all for attending. Thank you.


Alright boys, Eagles CFM, this is the throwback CFM, as you see we got T.O. down at the McNabb, but we're playing the Texans. Now the Texans haven't had very many good teams in their history, let's take a look at which one they want. Mass Shob. We got Arian Foster, one of the more underrated running backs of all time. We got Andre Johnson. Kevin Walter. Lester Jean. Kishan Mara. So he has two, he has obviously Andre Johnson is going to be a handful. Lester Jean, I don't know who the hell this is, but he has no good abilities yet, so he's working on that guy. Tyden Owen Daniels. He's got Dwayne Brown with ability. Let's see, he has two hours here, so he shouldn't have another alignment, he doesn't. So we'll have to use Javon Curse strategically. JJ Watt, 98 overall. And we got Brooks Reed, Brian Cushing. You can't, you madden won't let you write his name Cushing, so they blank it out. Connor Barwin, Eagle Great. Jonathan Joseph, Kareem Dems, Quinten Dems, Bryce McCain, Kareem Jackson. Decent secondary, Decent, Daniel Manning. What abilities have put on him? Nothing, he just made him superstar. Alright, he's got to make that guy, I don't know why he picked that guy for superstar, but okay. Alright, let's get it, let's get it, let's get it. This guy is one in six, so should breeze, should be a breeze, we'll see. I mean, JJ Watt has to be the number one Houston Texan of all time, right boys? Like he has to be. Yeah, Watt and then Andre, yeah. But Watt was like a multiple defensive player of the year, like the girl 27, Clint and Michael Escobar, man. He caught that, that's nice dude. John Richie just acknowledged somebody. You don't tell him JJ Watt is not on the field, but he's in the stream, so he's gonna know after this. In fact, we're gonna actually no huddle so he can't put JJ Watt on the field. Stay in bounds so I can no huddle. This might be the worst player I've ever played. I don't know. Look at Curse.  Curse, did he get a sack and a tackle for loss? Reno, if you return a punt here Reno, you will be a tic-tac legend. Simple as that.  Tio, Tio, Tio, Tio. Tio, Tio, Tio, Tio. Let's go Freddy. I don't know, that's a good guy dude. They run guns, guns, guns stack. Do you want to try to run the ball again in eye form first? Nope, he's committed to this one. There's just no way, dude, this is the bummiest offense you can run. This is a CFM offense right here. Honestly, as you see what I learned is that the better my team is, the worse people like watching it.  There's just no way, this is like what's going on right now. Good job dawg. And Shab wants to climb the rushing list, she does. Curse, 3 sacks. There's just no way, that's a real pit, like dude, you're joking my life right now. Oh my god man.  This is absolutely miserably bad. My man not putting a different route on the field, he not hitting a motion, he not doing nothing. This is like absolutely miserable man. I don't even have to guard anybody. I'm running around lurking like nobody's even close to getting open. Dogg, what the f- Oh my god man. Just get me, just get me out of this, just get me away from these morons. Just get, please get me away from these morons, please. Please just get me away from the morons, please. Absolute just s- Absolute just shouldn't even had a game. Shouldn't even had a game, should be doing something else, should be on Minecraft right now.   Empty wide stack dude, watch out for it boys. Watch out for it going around the streets right now. I mean he just matched so, he just matched so clean to that. Look at Donovan. Look at Donovan, that's some real life Donovan stuff right there. Freddy Mitchell baby. Just so free dude, you're just so free kid.   Too bad you can't run wide stack on defense. Too bad you can't run wide stack on defense man. This could play bro, that's just awesome. Bro, he's not open. Dogg, like what the f- are you throwing man?  There should be no way we don't get interceptions here. This is like absolutely miserable man, it really is absolutely miserable. Curse. Like dude, get me the flag dog. Oh my god man. I have no idea why a human being would like this mode over mutt. I don't know why any human being in the right mind would like this mode over mutt. Get out. Stupid shi- Glad you can hold LB and Chuck. Glad you can hold LB and Chuck. I want to know why? Like why would you think this mode is better than mutt?  You just can't. You can't. It gets intercepted, it gets knocked up, it gets intercepted. You cannot just Chuck the ball in the coverage. You can't do that. And how can anybody that plays madden be okay with him just Chucking the ball in coverage? Seriously. That's how all these CFM dudes play the game like that though. That's how I've played every single person that plays this. Chuck's the ball in coverage. Come on Trey, Tom. Bro, that's not acceptable.  Another example of why you literally high ball every single pass. No matter how good you did the free form's going to be, no matter how bad you want to catch that- In with momentum, anything. You high ball every single pass in Madden 23. You don't think twice about it. You really don't. Just add- now I'm in a hell game because I just tried to not high ball. Watch out, he ran a screen pass.   The worst.  CFM man, it takes real skill. You don't have all the abilities to throw through. If you don't have all the abilities to throw through, it takes real skill. Real skill, W. Real skill. CFM- CFM is real skill. A $5,000 team. Anybody can win with a $5,000 team. Anybody can win with a $5,000 team. Anybody can win with a $3,000- $5,000. Ah, that was a bad pass, man. Good hit stick, bro. Let's go, Donovan. Let's go, Donny. Let's go, Donny. This dude really has 7-D blues on the field, man. Just respected. Right, boys? All you can do is just flat out respect it. Oh, he manned them up with good play. Good defense. Real skill is real skill. I mean, the wildest part is how I'm not going to walk in on this inside zone. That was the wild out. First of all, the de-tackle got unblocked. All right, I got a win. Because they already cheated me out of one win in this season. I got a win, dude. I'd be in first place, but they cheated me out of one win.  Dude, why? Like, how am I not catching? Like, what do I got to do? Strafe? Like, come on, dude. Only CFM, do I not catch that? I didn't press Y? What do you think I do this for a living? I didn't press Y right there? Are we serious? My ball, please. I mean, he just blindly chucked that pass. Like, he didn't run a route. He didn't do anything. He literally just chucked that route. Like, he just chucked it. Like, he just chucked it. And he almost got first down. Just the audacity of people to say this mode is good. Nice defense, dude. Like, come on. How many route combos do I need against you? That's what I want to know. Like, how many do I need? Seriously, I just swear to God, like, I, I love you, guy. But inside zone should be so free right here. I'm still appalled, and this is what they say. Oh, you're winning by so much, why are you so mad? Because it's s*** s*** sanct clean, in my heart, in my soul, it's s*** sanct clean.  This is what makes me so god mad about this game. That this f*** moron has not been smart enough to put his good left tackle on the right side to stop Given Curse the whole game. game. He has let Javon curse him for three quarters but he has not been smart enough to put his god good tackle on that side. But yet he's playing CFMs right? Oh man it takes skill. Like all you gotta do is put that one guy out. Oh my god there's just nobody. I swear they're just trolling me.  And the craziest part is he's in the chat now so now we're gonna boot up and his good tackle is gonna be on the right side. Look! Look! You can't make it up! You can't! I can't told you! You can't make it up!  Three quarters! Three quarters that I had to remind him. Now look I'm gonna move him to this other side. Look oh he wasn't smart enough to wait. Absolute f***ing bags at the game. Oh yeah run more shop! My quick pass wasn't open. Look out! This kid right here he could hide his own easter eggs. This kid could hide his own easter eggs. This kid. Oh screen! Screen! Screen! This offense doesn't take five thousand dollars W. It's not pay to play this offense. It's not pay to play. That's what you don't know. Who's going to the middle here? Which post do I gotta guard here boys? Here we go boys. Let's get my shrey phone here. Where is it gonna go? It's going to this guy definitely. Definitely. Up! Caught it! First down! CFM! Where the real people play? This is where the real skill is in CFM mode. Watch out now. Watch out boys. Watch out now. CFM mode. Watch out now. Guess what plays? Oh screen time! Look out! Oh he didn't do it. This kid is so f***ing lost in the sauce dude. This dude is just along for a good time. He is here for a good time. This is a f***ing good time. Dog like he has just thrown at f***ing Daniels. He has just thrown at this guy. Look at quitting Michael. Look at... I mean how fast is Shab in this game? 99 speed? This airhead has not had JJ Wad on the field all game. I don't know where he's got JJ Wad at. On the bench? Coaching? Is he a mentor? I don't know. Big spin. Big spin. Big spins. This team is honestly too good. If I played this guy with the Vikings team... Oh my god boys. If I played him with the Vikings, I never... Oh he put JJ Wad in. He did it. Oh there he is. Nice. I never thought I'd run this play in CFM. Might be better in a CFM. Hold up. Hold up. I couldn't... I couldn't really go nowhere. There's so many people for me to juke. They should listen to me. I feel like putting JJ Wad in was like top tier with smart comms. Am I wrong? Frozen right there. Frozen. I can't believe he really... I can't really... He really switched the tackle on call, didn't he? He's just catching that pass. Is that just a catchable pass in CFM?  Back the whole guy. Oh my god, man. There's just no way. Well Tony needs to go to Yankees, man. So I'm sorry. I'm not even a Yankees fan, but he needs to go there. Javon Curse would be in the sixth sack of the game. Owen Daniels could not come up with that one. Don't... I swear to God if they quit, I swear. Quit. He'll give me another... If he quits, he'll give me another superstar. Please, come on. Just give me another superstar. Just give me free money now at this point. Damn, I shouldn't have said enough and damn. Bro, the method of most Curse franchise in the world. I couldn't scramble right there. I hate...  I hate that I couldn't scramble right there because if I ran up the middle, I was just like the saving man's up and running back here or let's me score again for the 15th time. That's real McNabb play. That's real McNabb. That's real McNabb. Tio, Tio, Tio, Tio. I'm pissed off at this guy. I'm pissed off that this guy said I can you play right now. I need to play right now. I'm pissed at this. I was like, can you play right now? I'm pissed about that. He knew better. I don't know. Are we really going to run stretch right now with four seconds left in the game here boys? Is this what we're going to do in my chat? Nice dude. That was such worth the time out. Keep my head. GGs, buddy. GGs. I would be god in one, but they cheated me out of a win. Ani. Big don of a McNabb game. Can we get the McNabb JJ White handshake? Poor Matt's job. Tough game for the kid.  You left it all on the line. Your coach really wasn't ready. GGs, GGs. It was that move right there. It didn't see it. They didn't see it. They didn't really see that move. Obviously you saw that one, but it was this one that did it right here.


He rescued this creature from under a bed, but he had no idea what it really was. When Paul Russell was checking in on a relative's home, he never thought he'd be walking into a scene out of the movies. In fact, Paul said what he encountered was straight from the movie Alien. With his heart thumping, he shone the flashlight into the bedroom, illuminating the creature darting out from under the bed. But before he could see what it was, it scuttled down into the cellar with a low growl. At 82 years old, Paul Russell's distant relative had just moved out of his Pittsburgh, Pennsylvania home. The man had been living on his own until a mysterious illness made it impossible for him to take care of himself. To better keep an eye on him, his family moved him to a nursing home that was closer to their place. While this was clearly the best thing for the man, little did his family know, moving him out would set off a chain of events too weird to imagine. Controversially, the nursing home did not permit any animals on the premises. Sadly that meant Siam, the man's beloved 17-year-old cat, had to be left behind. This is where Paul jumped at the opportunity to help. Paul and his wife, self-described animal lovers, already had a few cats. So what's one more? Well, as Paul was soon to find out, Siam wasn't the only animal in that house. Paul walked up the drive, opened the front door, and flicked the light switch on and off. Nothing. He'd have to go down into the cellar and find the breaker, but first things first. He went back to his car and fetched his emergency flashlight. But when he shone the beam into the hallway, he almost dropped it. The smell hit him first, then the sight in the hallway left Paul reeling. The entire house was stacked from floor to ceiling with trash. Broken furniture, boxes, and newspapers lay in heaps and dishes piled up high on every surface. The windows were blacked out, and, stranger still, there were weird markings all over the walls. As Paul moved slowly through the house, he couldn't shake the feeling that he was being watched. He tried to stop thinking about rats, snakes, and worse. The hair prickled on the back of his neck as he shone the flashlight's beam over the etchings on the walls. Who, or what, had done this? And where was Siam? Paul inspected the marks on the walls and realized that they were scratches that had been gouged into the wallpaper. What had happened here? He walked down the hallway with his heart in his throat. Kitty, kitty, he called softly. A strange feeling came over him and, suddenly, all his nerves were screaming at him to run. He had to find Siam as quickly as possible so he could get out of there. Paul walked into the kitchen and located Siam's food bowl. He filled it with the cat food he had brought with him, but strangely, Siam didn't come running. After calling his name for several minutes, his heart sank. If Siam was hiding, he'd never find him in the dark, there were too many hiding places. He knew he'd have to go down to the cellar and flip the breaker switch. But before he had even reached the darkened stairway, he heard a sound that chilled him to the core. A screech echoed through the house and Paul froze. Then, he heard a thump, but this time the noise came from another room, the bathroom at the end of the hallway. Willing his legs to move, he slowly approached the door, shaking. He pushed a door open with his foot and yanked back the shower curtain. To his relief, there was Siam, camped out in the bathroom tub. The little guy was scared and ravenously hungry. Who knows when he last had a decent meal. Paul began thinking about what he was going to do with Siam, then he heard another sound coming from the darkness that made his blood run cold. Paul heard a low scratchy growl, echoing from the room across the hall. But if the cat was in here with him, then what was out there making that sound? At first, he reassured himself that it was probably just a scared raccoon that made its way into the abandoned house, that would explain why Siam was hunkered down in the tub, right. He crept over to the doorway and was met with a sight he'll never forget. While most of us would probably just take Siam and run, Paul's curiously got the best of him. I started searching around, and suddenly this huge creature darts out from under the bed and runs down to the cellar, and I thought, what was that? Terrified, Paul dashed straight out of the house. He'd need to muster every ounce of courage he had before going back down into that cellar. Now with his wife, Jill, by his side, they entered the house again. This time, Paul was prepared. Armed with a trap and flashlights, they crept down the stairs. Then, they spotted it. The next day, I went into the creepy old cellar. I'm down there with a flashlight looking, it was almost like a horror movie. And I found her hunkering in the corner, Paul recalls. They managed to corner the creature and push it into the trap. Jill stood back, incredulous. She hadn't believed her husband when he had said that the creature looked dusty and appeared to have huge glowing eyes, but now she had seen it for herself. Just what had they found? They rushed the alien looking creature to the vet, hoping for some answers. At the vet, Paul and Jill were shaken. What could this animal be? Paul speculated that perhaps it was a wild animal he'd never heard of, or a common animal that looked like nothing he had ever seen. The vets had never seen anything like this before, either. But they didn't know what it was. What they were looking at was a cat. But what had caused it to transform beyond recognition? After a series of discussions about what the next move should be, the vets eventually came to a decision that the only sensible thing they could do was give the creature anesthesia. The cat, aptly named Heidi due to its affinity for hiding, was also trapped under pounds and pounds of its own matted fur. Sadly, its 82-year-old owner had completely forgotten about Heidi for a very, very long time. Heidi was really overweight, so that makes it harder for cats to groom themselves, and that's when you see matting happen, Western Paw Humane Society Senior Marketing Communications Manager Caitlin Lasky said. But how could they safely remove the cat's dreadlocks? The vet team was stunned at Heidi's appearance. They hadn't seen anything like that, Caitlin Lasky, Senior Marketing Communications Manager for Western Paw Humane Society, said. Even looking online, I had a hard time finding anything similar, so it's definitely a unique case.  But the team couldn't afford to make any mistakes. After putting Heidi under general anesthesia, they carefully began cutting away at the mass. Our medical team shaved off the pounds of intertwined fur from her body and, needless to say, this cat is feeling so much better now, read the shelters Facebook post. The fur had accumulated up to two pounds in weight. Lots of fur. It had to be years of matting for it to get that long. In fact, Heidi turned out to be not just the hairiest cat in history but also one of the fattest. And now Heidi had an even bigger problem, she had no place to call home. Thankfully, after Heidi was discharged from the vet hospital, Paul and his wife decided to take both Heidi and Si am in. Both felines now have a forever home with the Russells and instant siblings in the couple's three other cats and two dogs. It will take more time to see who Heidi really is, but she's slowly adjusting to life without pounds of overgrown fur. She may not realize it yet, but she finally has a chance at a happy and healthy life. But could Heidi ever trust humans again? After years of neglect, it's clearly going to take some time for her to settle in. She's been hiding under the bed for the last couple of days, Russell said. I've been dragging her out and holding her, and she purrs a lot. The last couple of days, she's climbed out from under the bed on her own and into a cat bed I have. So she's starting to work her way to see people more. The companionship of a pet can bring many positive benefits to the elderly, however, owning a pet is a large responsibility, said Dan Rossi, CEO of the Animal Rescue League Shelter in the Western Paw Humane Society. And he also has a warning, as well as some simple advice on what to do in this situation. If a family member, friend or neighbor owns a pet, please help them to make sure there is a support system in place if slash when mental faculties begin diminishing, Dan pleads. Also, open door shelters such as Animal Rescue League Shelter in the Western Paw Humane Society do not turn any animal away if there are no other options for the pet. It will take more time to see who Heidi really is, but she's slowly adjusting to life without pounds of overgrown fur and starting to come out of her shell. Other than being standoffish, you hold her and she starts purring, Russell adds. However, Jill thinks there's much more in store for Heidi in 2018. In six months she'll be running the house, Jill says. And hopefully she'll be a little trimmer. Thank goodness someone had finally realized that Heidi was suffering under all those pounds of fur and had taken her in for professional care. Hopefully, this story will help prevent other incidents of accidental pet neglect among the elderly.


In today's video I will be showing you guys my top 10 most expensive Yu-Gi-Oh cards. Put your guesses in the comments. What could they be? What's up guys, Rexxon34 back with another video and in today's video I'm going to be showing you guys as you guys saw my top 10 most expensive Yu-Gi-Oh cards. Before we do that, the giveaway for this video, I'll be giving away these three cards. We have Exotic the Legendary Defender, Wing Dragon for all and Scythe the Sky Dragon all from Megaton 2019. Really cool promos. All you have to do is like the video, be subscribed and let me know your most expensive Yu-Gi-Oh card or one of the most expensive if you don't want to say. Let's go ahead and get into it. There are 10 cards here obviously it's a top 10. All Graded cards because that just makes them so much more valuable. It's hard for a raw card to be worth more than you know most Graded cards so let's go ahead and start. Number 10. When you have a Graded card there's not an exact value every time because there's there might be a sale higher might be a sale lower you pretty much have to go off of sales sometimes there's no sales for months so you kind of just have to guess or figure out what it might be worth so these values are not 100% concrete they're just kind of what I think they're worth or what I heard from other people or a sale that happened recently something like that. So let's start off with number 10. We have Monster Reborn this is the one I pulled out of the Legend of Blue Eyes box first edition the only 10 I got from the box but still a really cool card so this card is worth I would say around $2,000 it is a glossy print it's not a wavy print I think a wavy print went for like $3,000 I could be wrong somewhere around $2,000 the reason this card is so expensive is number one it is graded in a perfect gem meant 10 so that is important then it is an ultra rare from Legend of Blue Eyes the first ever Yu-Gi-Oh set so it's pretty expensive at the time when I pulled it I think it was worth around $850 and a 10 so it has gone up since January when or March whenever I post March I think yeah so this guy I would say is my number 10 most valuable card Monster Reborn from Legend of Blue Eyes my number nine most valuable card my ninth most valuable card I would say is Beast Skull Dragon from Metal Raiders this guy is worth I would say similar to the Monster Reborn maybe a little bit more I put it ahead of the Monster Reborn because it's a more iconic card but I think the values are around the same so I'll give this guy number nine just because it's Beast Skull compared to you know Monster Reborn school but this is a huge monster from Metal Raiders one of the best pulls from Metal Raiders it's this Summon Skull or like Gay Guardian of the top cards so this guy my number nine most valuable card my eighth most valuable card I wasn't really sure what to value this guy at because I have gotten I once put it up on eBay like a while ago like a few months ago and I got a $2,000 offer like right away then I did I took it down I put it up again later it was up at like $5,000 or something like because I didn't really want to sell it but there's something I wanted to buy so if it was going to sell for a lot then I would sell it someone else offered me $2,000 so I got two $2,000 offers so I would say it's safely $2,000 because that was a while ago I don't know if the value has gone up or down you don't see these sell very much so I have it at least $2,000 probably a little bit more so that's why I have it ahead of the other two cards I have a $2,000 this is an ultimate rare version by the way there is a huge difference being super and ultimate there's a super rare version of this as well that card's probably worth like a hundred bucks in a 10 compared to this one which is worth a lot more the ultimate rares are much more valuable so we have cyber dragon ultimate rare I think I bought this for $750 or $725 I can't remember something like that last year so I think it has gone up quite a being the ultimate rare and one of the iconic gx cards cyber dragons you know cyber in dragon is probably more iconic but this one is still really strong so I would say it's my eighth most valuable card my seventh most valuable card is blue eyes tune dragon this is a secret rare from magic ruler for a long time this card was worth 300 bucks or less in a ps8 and it was not worth much because there were a bunch of these they there were so many magic ruler boxes from like I think 2017 to like 2018 they were just everywhere blue eyes tune dragons were everywhere like they were pretty easy to get but a recent auction went for one of these went for $2,200 so even this guy which originally was not super hyped up has gotten actually pretty expensive $2,200 blue eyes tune dragon secret rare it is gym mint 10 if it got a nine it'd probably be worth much less I think the near mint version is now worth what the 10 used to be it's like 300 bucks so I actually pulled this one in a magic ruler opening I open a booster box you guys can check out that video up there if you guys want to see it I'd say he's my seventh most valuable card my sixth most valuable card is the one and only red eyes black dragon this one was actually pretty difficult to figure out a value one I'm not totally sure what it should be it is in a beckett nine case but it also graded that ps a nine you guys have seen that on my channel if you haven't you can check it out up there but it's been a ps a nine and a bgs nine so I feel comfortable pricing it at a ps a nine price however the ps a nines aren't really coming up too much you're seeing around 2000 1500 but this glossy red eyes the one we pulled from the video was absolutely insane front's really nice the reason it got this nine is it got it had like print lines you can't see on the back so yeah I would say this guy's my sixth most valuable card my fifth most valuable card is this black rose ghostry you guys saw this return recently it got a nine unfortunately I think it honestly should be a 10 I'm probably going to crack it and send it back in so for now it's a nine and at a nine I valued around 2500 maybe a little bit more tens are worth so much because you can't even find them so it's hard to even value a 10 it's hard to value anything but I would say this guy's worth around 2500 and a nine such a super just a super tough card to get I I would say it's my fifth most valuable card even with a ps a nine which shows you how valuable this card is if you can get a gem meant 10 my fourth most valuable card this one is a little bit weird it as I said almost all of these are really hard to find like a real price and kind of price it out because I get a lot of questions and they're like hey what do you what do you price this at I can price it you know but there's no real price it's just kind of what do you think it's worth what has a sale been but there's just not many sales for this I think there was an instagram sale for $3,500 for this one but that was a while ago so I'm not totally sure I haven't seen much since then so I'd value it around like 3000 maybe 3500 I'm not totally sure the reason this guy is so expensive is hobby gx is the most ridiculous thing ever you have to open so many booster boxes to get an ultra ultimate and what do I mean by ultra ultimate in gx if you have english boxes not european europeans different you have retail which you can only pull the rares then you have hobby which you can pull supers and ultras as ultimate rares but in retail you can only pull the rares as ultimate rares so this guy can only be pulled in the hobby box so you got to pay out for the hobby box then you have to pull the ultra ultimate which I've opened a lot of of hobby boxes it's like 20 boxes or something and I've pulled like two or three ultra ultimate it's super hard to pull them so it's extremely hard to pull then you have to get the 10 which you guys saw I pulled this and then it got a nine for a year it was a nine so I re-graded it to 10 so you can't even get a 10 guaranteed that's why this is so crazy expensive it's also a cover card from gx so the cyber dark impact cover card is cyber dark dragon that makes this card extremely extremely valuable and if you're collecting the cover cards you got to pay a lot to get one of these because there's just not very many of them that's why this card is my fourth most valuable card my third most valuable card is the one and only genzo this is the one we pulled in the 10k special this is the one I pulled out of our first edition ferro servant box and my 500 subscriber special yeah all the way back at 500 subscribers and then it graded a 10 which was an incredible pull at the time I think it was worth 1000 or 1200 bucks and a 10 which was a lot obviously it was like it was I think it was my most expensive card at the time which is pretty cool and now it's gone up I think based on what I could gather it's around $3,000 cyber dark dragon may be worth more than this one but I just like this guy this guy has potential you know I being the secret rare ferro servant iconic genzo I'd say that I would bump him ahead they're pretty close though a lot of these numbers like third and fourth can be interchanged but genzo first edition ps8 in probably worth around $3,000 not totally sure you guys can give me your sales numbers or what you've heard recently and we can you know figure it out together in the comments but that's what I've got for genzo first edition ferro servant we're down to the top two and I second most valuable card ancient fairy dragon ghost rare this one is tough these go these first edition ps8 tens are tough this guy is extremely expensive and the reason why this and the black rows are so expensive is they are from packs that do not have first edition north american booster boxes the first edition packs only come out of tens or they come out of like pre-release I think which barely exists anymore so it's basically you have to buy a 10 you get two first edition packs and then you have a 1 out of 288 chance per pack so like super low chance to pull the ghost rare if you do you go crazy then you have to hope it actually gets a 10 it's a ghost rare so it's unlikely so the value of these is just crazy in ps8 10 I think the pop's like 13 on the sky or 12 so not many of these at all very expensive ghost rare ancient fairy I'd value it around $4,000 and honestly that's not too bad for how expensive the stardust and the black rows are in 10 this is actually pretty cheap comparatively this one in the majestic star I think the one from stardust overdrive those two are a little bit underrated right now I think but this guy had a value around $4,000 for my second most valuable yugioh card finally my most expensive yugioh card is morphing jar ps8 10 from tournament pack 2 this guy far and away is my most valuable card for many reasons one it is an ultra rare from tournament pack to the second tournament pack probably the rarest tournament pack in general it's very difficult to find those packs I actually opened 20 of them on the channel go check that out we didn't pull that we didn't pull this out of that but I did get this guy in the trade I graded it to 10 it's one out of 108 tournament packs tournament packs are about tournament pack twos at least a hundred bucks per pack there's only three cards per pack you have a one in 108 chance so if you pay a hundred bucks times 108 just to get this guy if you can even find 108 you know that's $10,800 or whatever a very expensive expensive way to pull this guy and you might not even get it because you have to buy sealed boxes and those are going to be even more than $100 per pack so it's really tough then you have to actually grade it to 10 I think there's 22 of these in the population but not like they're almost never for sale I was offered around $8,000 for this card so I would value it around there maybe a little less if it's going to be you know an actual sale because you know offers offers mean something but if they don't actually sell then you can't totally value it that but I would say it's worth around that I think there was a trade recently at about $8,000 value for a morphine jar so it's pretty fair to go with but obviously even if it's worth two thousand less like six thousand it's still my most valuable card one of my favorite cards it was an epic pickup that I graded an iconic card that was played back in the day so a really cool card my number most valuable Yu-Gi-Oh card so there it is you guys saw my top 10 most valuable Yu-Gi-Oh cards let me know if you guys enjoyed it in the comments I'll pop up a total value of what those 10 cards are worth yeah so it's a lot it's Yu-Gi-Oh cards but they are now they are now worth money they're not worth nothing anymore it's kind of crazy how expensive they are but let me know in the comments some expensive cards that you own or some cards that you just really like that you have graded or maybe that you haven't graded so I hope you guys did enjoy this video we will be opening up another 2003 tin this weekend it's gonna be pretty awesome and we're fast approaching 25,000 subscribers when we hit that we're opening all six Yu-Gi-Oh tins from 2003 it's gonna be crazy I also have an epic mail day coming up possibly tomorrow we're on Sunday I don't know which one yet I'm gonna be showing you guys an epic product we're gonna be opening it was the one I teased on my story it's crazy so that's it for today guys I'll see you guys later peace