This is covering the spread part of the fan dual podcast network We have got a massive weekend in college football coming up in week number 10 We got Tennessee at Georgia, Alabama LSU and some other big games to break down So we're gonna bring on Ben Ben Brown of pro football focus to get his read on that game And so much more the college football playoff rankings to get you set for week 10 in college football This is covering the spread right here on the fan dual podcast network and number fire calm My name is Jim Sonness. I am a senior writer and analyst for number fire calm joined here as always by dr Ed Feng find his work over at the power rank calm He can catch add on Twitter as well over at the power rank and happy week 10 Happy college football playoff rankings complaining Wednesday to you. How you doing today? I'm doing better than TCU fans.  Yeah, and I was reading bill Bill Elliott nascar on the mind but Elliott's Twitter He was talking about how like he's given up on putting stock in the college football playoff committee and what they say early on I feel like I'm kind of on board of bud here Yeah, I mean, I don't know. I mean, we'll see we'll see how this all shakes out, but I'm not that upset over it. I mean, I mean, I think those those other teams are better than TCU and We'll see how we'll see how it goes We certainly will and I think the one blessing of the CFP rankings last night as we can pitch the Tennessee Georgia game Is being one versus one depending on the rankings, which is pretty fun Don't get that very often to break down that game love Ben and brown a pro football focus here as well He can find a Ben on Twitter at PFF underscore Ben Brown He has does both college football and NFL bed and work over at PFF and Ben Great to have you on the show today. How you doing today? Yeah, I mean, it's been a little awesome so you guys have me on but I definitely appreciate any time I can come on You know and chat some college football I think this is you know very much the week that we kind of want to focus on you know college football from a betting perspective It's we have I would say a lot some of if not the best, you know marquee matchups and you know what the rankings coming out It obviously, you know the the playoff picture and everything else now That's gonna break down as you know very much fresh on people's minds So I'm excited. Thanks for having me on. Yeah, it gives us fodder to discuss So I guess that's always good for us even if it's not the most predictive stuff They're rankings and all that we can still talk about we'll talk about that Tennessee Georgia game We're also talk some futures markets because Ben doing some pretty cool work for PFF around the football playoffs And we'll talk about that in just one second a first a reminder to make sure you are subscribed to covering the spread Wherever you get your podcast, you can also check us out on the fan dual YouTube page to subscribe there And also search for covering the spread wherever you get your podcast NBA season is underway And it's the perfect time to download faddle America's number one sportsbook because right now new customers get a no sweat first bet up to $1,000 to $1,000 back in free bets if your first bet doesn't win Fandals all your favorite bets from the money line to point spread to player props You can even combine your bets for a chance at a bigger payout with a same game parlay plus with live betting You'll get updated odds on games that have already started the fandals sportsbook app is safe secure and super easy to use so download Fandals today to get your no sweat first bet up to $1,000 make every moment more this season with fandals official sportsbook partner of the NBA Must be 21 plus and in select states first online real money wager only refund issued is non with drawable free bets that expired 14 days Restrictions apply see terms that sportsbook dot fandal dot com gambling problem call 1800 gambler or was the fandal dot com slash rg in Arizona one hundred next step protection acceptify 3 3 4 2 in Connecticut 1 888 789 777 777 Over the ccpg.org slash chat in Indiana one eight hundred nine with it in Kansas 1 800 1 8 8 789 777 777 105 2 2 400 or ks gambling help calm the numbers all run together Louisiana 1 877 770 stop in New York 1 877 8 hope and wire text open Y in Tennessee call the redline at 1 889 979 in Wyoming 1<PHONE_NUMBER> or in West Virginia 1 800 gambler dot net let's take a look now at Week number 10 by starting things off by talking about those playoff rankings last night Finally get our first read from the committee of what they're doing Obviously we can be skeptical of what they're saying if they're trying to drive up rains, etc. Etc But there could potentially be some takeaways here. So Ben before we talk about Your simulations over a pff and stuff like that Were there any betting takeaways for you from what we learned last night quote-unquote learned last night from the committee? Yeah And I think you guys, you know, maybe touched on a little bit already But I think you know TCU kind of big kind of being where the price step Basically to make the college football playoffs plus 500 on draft king or being a dual sorry 16.7% of my probability you could say whatever book you want just of the record you can go ahead We're not gonna care, but this was very much Yeah, this that is the number of fandom behind is very interesting to see, you know We're the committee ranks I'm kind of based on you know The difficult stretch schedule they're gonna have after this match against Texas Tech I think they're you know nine and a half point favorites minus two eighty five on the money line And they have you know back-to-back games against Texas and against Baylor We actually kind of think that you know, they're a little bit undervalued in the betting market right now that plus 500 price We have them closer to you know a 20% implied Probability to make the playoffs a lot of that is you know based on where we have them powering dead in comparison to a team Like Texas and Baylor, I think that's you know, obviously playing some sort of role in it But I also think that you know having them seventh below a team like Alabama kind of you know At least initially forecasting the idea that you know very much a one-last SCC team is going to get ahead of TCU It is maybe I think you know Providing a little bit of value on them to be honest with you We have them as you know the eighth best EPA per pass play so far this season I was also in really good Russian the football and it's kind of you know flipped on its head a little bit from You know the TCU teams of the past that were very you know very dominant defensively And really couldn't move the ball all that effectively I think they're good enough offensively, you know to kind of run through this difficult schedule So I like them at plus 500 I think you know the question is always with some of these futures bet is Are you better off kind of like rolling in that money line if they you know kind of need to run the table in order to get comfortable after you better off betting them You know on the money line for these next five games are just you know catching up that way And I think you know based on where you're kind of projecting the spread for Texas and barely to be at That could be an even more profitable angle to approach TCU than it just is on you know the college ball playoff futures market. I would say Then where do you have TCU in your your PFF numbers and what's going into that? I presume the PFF grades are a key component, but are there other factors as well? Yep, very much so so we do we do definitely do the grades, you know quarterback play specifically We do basically kind of take all of our opponent adjusted Fasting grades and kind of throw that together to kind of build out this power ranking and then we use you know a few different power ranking Approaches within our simulation and also you know in our green line miles and those sorts things So not trying to like you know do a bunch of different work But I think we have what I would consider like you know three underlying power metrics and those things kind of go into then you know Create some sort of like composite score for how we view every team So we have a TCU you know seventh basically right now Kind of using that combined metric and like they you know sit right below a team like Tennessee who we are I would say Very much low on especially in comparison to the betting market I think that's you know our one real main blind spot with kind of how we have You know these top tier teams kind of fleshed out a little bit, but you know outside of Tennessee being wrong I do think that there's you know a very strong case we made for any of these other seven teams You know potentially, you know having what it takes I would say to at least get into the cultural platforms in there You know knock off an SCC team and you know win the championship outside So it's it's it's interesting. Yeah, we have long-winded way of saying we have TCU Seventh I would say in our power rankings metric you alluded to the simulations and the tough part with that is that it Does depend on the human element because there are literal humans who you lean on metrics to make these decisions But how do you kind of bake that into a model because it sounds like a very that probably would be the toughest part So I might be asking you a very difficult question But like how do you account for that when building that model out? Yeah, and we very much, you know rely on Like situations and decisions that the the committee's made in the past, right? I think there's very much been you know a bias towards an SCC team with a one-last team Still getting in if they don't win their conference championship So we very much priced it in where you know if you're not in if you're not in the SCC You're essentially not gonna get in if you don't win your conference championship I would say you know obviously, you know the teams like Notre Dame and all things considered They're obviously not gonna play in it But that that is of course folded in as well We do have you know some level of Expectation of a team like Notre Dame and what they have to kind of accomplish to get in so we basically have you know In idea and model for every type of team and every type of conference and from there You know based on the simulation results as we step through each game We kind of price out, you know Who's the most likely or the or the top-end teams that the committee is gonna choose in this particular simulation? So it is you know, it's very much I would say not a not a perfect science or whatever it is You know something that you know, we try to improve upon it We probably improve on it, you know as much as we would have liked to in the offseason, but It is a you know kind of an interest and a fascinating question because of the you know Like you said the the human element of you know These trying to size up two teams that didn't play each other and don't really have any common opponents and you know All these other factors that go into it And very much I would say, you know, unfortunately prize some biases as well that you know We see kind of year in and year out as far as you know What teams the and what divisions and what conferences, you know The committee may be over or under values a little bit Awesome, let's move on to some big games Obviously the biggest one is Tennessee at Georgia Georgia's eight eight and a half point favorite total of 65 and a half Tennessee's obviously looked very good this year So is Georgia so what is your take on this game? Yeah, I mean I think you know from our from PFS perspective like I said I think we're sitting lower on Tennessee than what I even you know In some ways would be comfortable with right now And we still kind of have them only as you know a six-point differential on a neutral field right now Obviously, you know the fact that this is in Georgia everything else flips it to eight and a half But we are very much kind of on market in this particular match up But you know throwing all of you know what I'm looking at at least as far as like our model specific metrics I think I think Tennessee has a Pretty clear advantage in this match But I think you know some of our stuff still bakes in In an expectation of a Georgia defense. That's probably not as good as what we're actually Probably thinks it's a lot better than what we're actually gonna see on the field here You know on Saturday We still have them as the third best run defense in the SEC second best coverage unit But 11th best from a pass rush perspective and no Nolan Smith, right? I think the pressure situation specifically with Hennan Hooker has kind of been the One spot where he's maybe had a little bit of a hang up and I think that you know scheming with people's You know offensive scheme and how they're kind of gonna approach that they're gonna be able to alleviate a lot of those pressure situations And that makes me Really nervous that Georgia, you know, it is gonna be able to contain Tennessee's offense enough to actually keep this game You know within reason and I just don't know if you know, Georgia offensively maybe has Enough of a top-end range to win a shootout matchup with Tennessee So I think if you're leaning, you know in any one direction It very much is setting up as you know Despite the somewhat widespread Georgia to probably cover at this game to go under or in a very wild game You know kind of not not the same ilk as the Tennessee Alabama game You know a game that very much gets up there and scoring And Tennessee has the possession of wins that and that's kind of you know The the the two I would say pretty much straightforward handicaps And I think it's kind of tough to deviate from you know that expectation based on what I'm looking at right now Does that wind up being a stay away for you then based on the two very clear paths or do you be looking to potentially a You know a a dual situation thing maybe you parlay together a Tennessee plus eight and a half with the over or Georgia minus eight and a half in the under I think that like you could go that route But it seems to me as if the read was that this being more of a Don't bet it and enjoy the game situation more than anything else Yeah, and or you know the other nice thing and something that I've you know Trying to probably actually done a lot more this year than I have in years past Is kind of you know read out the first couple of possessions You know watch the first couple of scripted plays specifically and then and then kind of see if you know if If Tennessee's you know very much getting the ball out Maybe they have a drop or something or maybe they have a you know a negative play from a penalty perspective or something like that That kind of stalls out one drive. I still think that would maybe be a reason to you know Potentially buy into them a little bit and if they are moving the ball, you know somewhat effectively You know playing something on the over even if there are you know a couple early scores would Probably be something I'd be pretty comfortable with as well So I think you know understanding You know directionally how you kind of see the game playing out and then you know waiting for that initial confirmation It's also something I think can be You know pretty profitable and pretty worthwhile strategy to explore One more thing in this game you mentioned that your that pff is a bit lower on Tennessee than the market And they actually viewed them as being properly valued in this game Does that mean you're also a bit lower on Georgia than the market? I mean I see I don't know because we have Georgia as the number one team in the country, right? And I think it you know, it's pretty clear that they are You know pretty sizably You know ahead of the rest of the market, right? We have them, you know kind of like two and a half points better than Ohio State on a neutral field You know three points better essentially three and a half points in some ways better than Alabama. So it's it's it's weird in that You know, I would have expected to probably be on Georgia Maybe it's just you know a bias towards us not really wanting to play some of these more heavy Heavy favorites in a lot of situations. I think is partially why the model is, you know Not finding a ton of value on Georgia specifically in this match up All right, let's move on to the next game. We have Alabama at LSU Alabama is pretty big Road favorite 12 and a half points here total of 57 and a half Freshman looks like he's back from that injury My numbers have liked LSU this year. What are you saying? What are you saying in this game? Yeah, I I still I I've probably bought into Alabama more than I should this year But I think this is a spot that they you know, definitely take her business I think you know a lot of what has been successful for LSU offensively has come You know jade and danos and kind of these you know scramble situations high level of success You know in breaking the pocket and kind of making his own plays and I think that you know, Alabama specifically has You know very much enough from an athlete's perspective on the edge to kind of try and contain him Maybe some of those plays, you know If they're not going for big gains they're only going for short losses because Alabama's kind of able to keep Contained with him in the pocket and I think that you know could very much cause The LSU offense to kind of break down the last situations and like you said with with bryce young back and in the fold I'm expecting a little bit of you know a show out game I would say in some ways for Alabama who you know probably wants to put on You know a few quality performances even as a one-last team to you know Maybe look good in the eyes of the committee and everything else I think we've seen that kind of play out, you know in years past So I think it's kind of Alabama a bust for me in this spot But I'd be I'd be open to hearing the LSU case. I just I'm having a hard time kind of seeing it for this particular match up Yeah, my number is like LSU on both offense and defense when I look at adjusted success rate 13th on offense 19th on defense. It is a talented squad But you know, I mean Alabama is also really good and they're going to have the best player on the field as well So it's just a matter of whether that number is too big Whether what else you can get a backdoor cover or potentially even keep it close keep it within a one-square game Now do you want to talk about bryce young really quickly while we're here because you do some work around the NFL draft We had you wanted to talk NFL draft back in April. I believe Talking about that with bryce young, you know, what's your read on him? Do you think that he we should be viewing him as like when we're trying to you know Bet these college football games ed's talked about how NFL draft stock of quarterbacks can actually matter in terms of this stuff How do you view bryce young in that regard and what does that do for you for viewing this Alabama team? Yeah, I mean, I think I do think he is, you know, one of the two best quarterbacks You know that we're going to have in this class at the NFL level for sure And I very much think that you know, it matters especially in big time spots Um, you know kind of gravitating towards that guy who you very much think is you know pro ready And kind of showcasing that I think it's you know, very much a reason to buy into and I think that you know bryce young kind of finally coming back from the injury a little bit Maybe feels like he has a little bit of ground to make up or whatever, right? And I do think that you know him putting forth a good game, especially after a buy You know, especially given, you know, some of the things that we've heard at least as far as like where he ranks from You know a quarterback prospect perspective Uh, very much can can kind of be baked into that equation. So, you know, he's he's been really good I think he's pff's Um, I want to say top graded quarterback so far this year in his limited sample size I don't have a quick front of me, of course, but um, you know, it has very much I would say Um, showcased at certain points that he can definitely be, you know, a top end guy at the NFL level And I think that you know that and him kind of finally being at full strength Definitely matters for this particular handicap in this game, I would say Yeah, Jim, I definitely believe in in looking at these guys NFL prospects as Part of handicapping college football games I will say that I've been kind of stunned that at one point Anthony Richardson would have the fourth highest odds to be the first pick in the NFL draft Uh, he's no longer the fourth highest That was a wild week That was a wild week and like um So I tweeted that out and someone tweeted back like, uh Have they watched him throw the football? And then the sportsbook tweeted back like we don't watch the games. He's not a running back Oh, no, that is a weird week Which I thought was awesome And then and then also like will levis is also pretty high on these markets to be the first pick and um You know, I saw a little bit of the game against Tennessee. I I don't see it on the field Tennessee is a team that the one thing they can't do is defend the pass that well and Yeah, I don't know. Maybe his hand is still banged up. Um, I don't really know what's going on there, too but uh, it's interesting how, you know, some of these markets kind of Mesh with reality sometimes Right You know, I think it is really interesting and the will levis thing Especially it's like, you know, not a lot of people were talking about him and then, you know, some of the guys I would say specifically in the draft community kind of start to say, you know, he's very much, you know This intriguing type of prospect and then also me vaults up to being, you know, very Very likely to potentially be, you know, at least in the discussion for the number one pick But, um, you know, his injury situation as well, obviously is very much, you know, uh, you know playing A part of that but he I think he's the guy as well that can is going to You know look really good in, you know, shorts and a t-shirt Probably is going to make you every single throw in the football field from that bingo and that's in that situation, right? and I think that, you know Pricing that out and at least trying to evaluate that in the context of the actually actually watching them play college football as well as Is kind of a really interesting, you know Really interesting endeavor at least as far as, you know, how how the off season workouts can greatly impact, you know The movement of these players and where they're going to end up going in the draft But I think you hit it right on the head if we'll love us is Stetson Bennett's height Right, right, right the same odds to be the first pick in the NFL draft Yeah, they stole the tall guys. I don't blame them, but uh, it's definitely still a thing Let's finish up here with Clemson at Notre Dame some movement here in the uh spread It was four and a half yesterday Clemson now a three and a half point favorite at Notre Dame total is 44 and a half and Clemson's played a lot of close games this year, uh, but they are still undefeated You know that counts for something I guess so what's your read on Clemson entering this game and the betting markets for this game? Yeah, I mean I just haven't really been I would say all that impressed with the Clemson offense I know it was really easy to hate on, uh, you know, dju galloway early on in the season But I think it's more, you know, the scheme situation in the play con I mean they really only run, you know, a handful of plays they run like rpo's bubble screens And fade or gall routes or whatever right and that kind of seems to be Their offense and there's there's no unique wrinkle in a lot of ways And I think that you know looking at you know a team like Tennessee versus a team like Clemson like, you know Josh Uphill is very much adding in a lot of these things and maximizing his quarterback's potential And I don't think we're really seeing that you know from Clemson's viewpoint So I think it's a little bit of you know a rebound spot for Notre Dame once again I think they're gonna, you know, even get even more back on track after, uh, you know The performance against Syracuse last week and kind of a you know, a dominating win I would say uh and kind of kind of escape a little bit of their, you know early season struggles So I'm leaning in Notre Dame's direction. It seems like the betting market You know has kind of moved from like, you know, even four and a half and we were kind of first talking You know up to three and a half now So, um, you know as we kind of get closer to game time and some of those, you know Limits change for people and we could see, you know some further movement Maybe we even do test three right now So I think Notre Dame is, uh, you know, kind of the play I just haven't been, you know All that impressed with Clemson bringing it, you know, every single drive in a lot of situations They've had a few big plays but uh, if Notre Dame kind of forced them to, you know, play underneath I think they're gonna get off the field quite a bit on a lot of drives, I would say Well, the scheme thing is something that was there even when they had Trevor Lawrence Like it was like really frustrating to watch them because it's like you have like this like Perceives like generational like talent and you're like running screens Like what do you like this the scheme has been this way for a while and it's like I don't know. It's somehow more frustrating that it's still happening now Than it was with Lawrence there and it would like drove me nuts at that time Right because and they and and and not that they don't have the athletes to run it now or whatever But it was very much like, you know, we're watching this quote unquote generational talent Like you said and they have Travis ET and it's like, well, you know as a first round pick or something Maybe you want to get your ball the ball on the your playmaker's hands But it is it's kind of been the same thing and you know every single year if they continue to kind of roll it out I feel like that's, you know, one more reason why defense should be even further ahead of them And I think that's why, you know, they're very much Even though they're still winning I would say they're very much not thought of as like, you know, the elite level Clemson teams Partly because of the talent but partially because uh, there's just no creativity. I would say offensively Awesome. Uh, any other games that uh, you are liking this week then Yeah, I think, you know tonight in match and I was I was kind of ice cold yesterday riding Buffalo But I'm gonna go back to the well here with you know, central mishkin line has moved against me a little bit I think it's up to like five even five and a half right now I kind of like them as you know first half play plus three and a half I think they're kind of interesting. So if matching's kind of your thing Wednesday night I don't think there's any baseball or too many other, you know outside of outside of the mba or something too many other options So I like central Michigan tonight And one that I think is, you know, you know another rivalry game Talking about but Miami plus seven seven and a half against florida state I do think that you know anything could kind of happen in these matches, right? But I do think Miami, you know, I would say from a from a quarterback perspective, uh, you know better quarterback We have this much closer from a power rankings perspective We would basically make florida like, uh, you know a two and a half point favorite on a neutral field So the fact that we're getting you know, plus seven and a half I very much think this game is setting up as a one-score game So I definitely like the hurricanes plus seven and a half, you know, as well as when my favorite bats here for week 10 I respect the commitment to action over the world series I'll be watching the world series, but I respect the commitment I I didn't I feel like they just played baseball yesterday That also I had to assume that it was but I guess there was a rain out or something right, right No, we're getting it every day for the next couple days You've got your band your brand band. You got to stick to it. I respect there's no other way to go than that Ed, what about you? What do you see if week 10 based on your numbers? Yeah, I mean, I think the most interesting game that I see, um is Uh is this uh Texas A&M and Florida game So my numbers have the total at around 50 Ben and I are obviously giving out the best bets in the history of podcasting this week because it's also moved against me today Went up from about 54 and a half to 55 and a half Um, I've been on Texas A&M. I'm unders a lot this year Their defense has actually played up to the level of recruiting the Jimbo Fisher has had The offense absolutely has not. Uh, it's been pretty bad A lot of that has to do with the quarterback position Haines King came in got benched back up got hurt Uh, Haines King actually dislocated his shoulder against South Carolina and they had to pop it back in and then Conor Wegman Came in he was a true freshman kind of struggled to finish out that game But then you know had a pretty good game last week against old miss and I think this total was high Kind of based on that performance I just I just don't you know on the other side of the ball Let's talk about Anthony Richardson Right like a guy that I trust to to get yards with his legs But not really to throw the football he's going to be going up against a really good Texas A&M defense Texas A&M and offense, you know, I mean Florida is not the best defense they haven't been uh this year under Bill and apier. So I feel like the market has moved a little bit because of one performance from a freshman quarterback Um, I've gotten burned a bunch Fading freshman quarterbacks. I think it's a different era than than what it used to be Uh, I think these kids play so much more football. So so maybe this kid is going to be great I'm not buying it. I like the under in this game. Uh, Texas A&M in Florida Fun feeling to have everything moving against you. I've had that at times too So I I get it for both of you guys, but we'll see At least we're open in admitting it, you know, yeah, some of these other shows like, oh, yeah I mean Didn't help me to get movement on the buck's money line last week. So maybe maybe clv's overrated and I'm just I'm just a dog did not help me to get massive closing line value on the Rams last week either So did not help jamar chase stay healthy got the the movement on the Bengals and it all went away Once jamar chases out so who cares at this point That's the way things go. That is ben brown checking out on twitter at pff Underscore ben brown ben of course to an NFL and college football worker over there ben We appreciate the time. Good luck to you with the maxion and good luck to you overall on week 10 as well Thank you guys. Yeah, good. Good luck to you as well and have a great rest of the show. Thanks for having me on Thanks ben appreciate it. Uh, and what is going on for you over at the powerache? Oh, yeah, I'm writing my free sports betting email newsletter Talk about bets that I make and also 7 o'clock at saturday, which is a curated list of sports betting tips and news So check that out at the power rank dot com And what's going on for you on the football analytics show? The episode isn't out this week, but uh, it'll be It'll be a good enough episode that I will plug it next week when I'm on Okay, that's what they call a tease folks So a good good episode coming up on the football analytics show check out that podcast feed to eagerly await When that one does drop. I am on twitter at jim sonnis a j i m s a n n e s You can also follow the fan dual podcast network at fan dual podcast big Thank you to everyone for tuning in for today. Good luck to you if you decide to tail ben on that maxion We'll talk to you once again tomorrow to break down week number nine in the nfl This has been covering the spread right here on the fan dual podcast network


Next topic we want to talk about, going back to that dreadful Atlanta Falcons team, letting the city of Atlanta down. Sometimes it hurts being a fan of a, I don't even know how to describe this team, just Dan Quinn's got to go, he's got to go. But it's not about the Atlanta Falcons, it's about Nick Foles and how he came back to beat the Atlanta Falcons. Looking over for Mitchell Trabisky through that game, was it midway or was it through the third quarter that they took over for Mitchell Trabisky after he threw that interception to Ray Wilson. So Foles comes in, he throws touchdown after touchdown, went to Jimmy Graham, went to Anthony Miller, that ended up being the game winning touchdown, and he looked solid. He came in and he's going to be the starter according to Matt Nagy of the Chicago Bears team. Let this sink in for a second, that Nick Foles took over for the Chicago Bears. The Bears are three and oh, and the media treats the Bears like they're oh and three. Believe it or not, they're three and oh.  Granted, only one of those teams has a victory. The Detroit Lions upsetting the Arizona Cardinals this past week. Still though, three and oh, you're off to a good start, but it doesn't feel like it with the Chicago Bears in their quarterback situation with Mitch Trabisky, just because they feel like he's been playing so poorly and they decided to move on finally and benching him, and this is the first time that Trabisky has been benched and lost the confidence of Matt Nagy ever since that weird two minutes, one minute in the fourth quarter against the Los Angeles Rams in that one Sunday night game last year, where they put in Chase Daniel. So Foles is the unquestioned starter at this point according to Matt Nagy. He's going to be playing and he's going to be starting for the Chicago Bears until further notice. Do we feel like that this is a good decision on the part of the Chicago Bears? There was a show of time of football that we did a few months back. I think this was back in March. We had a co-host Ali Razak coming up on the show and we talked about the topic of Nick Foles being traded to Chicago. It was around that time. And we talked about is it should Biscay or Nick Foles going to be the starter for the Chicago Bears? And we kind of explain it perfectly on why we think that Nick Foles should be the starter or is going to be the starter for the Chicago Bears. So we're going to roll that clip real quick and we're going to get back to you guys. You don't start or you don't trade for someone with that big of a contract unless you have some sort of plans for them. And I don't believe the fact that the Bears are just going to trade for him just to push Mitchell Trubisky just to give him that healthy competition and hope that Trubisky will be the better quarterback. I think at this point, Foles is more than likely the quarterback that can hey, we'll start you. We'll restructure your contract just a bit, even though you're going to get 15 million guaranteed for sure this upcoming year in 2020. He's going to start for sure. He's more than likely if it works out for the Bears. Foles is willing to accept less money when he needs a newer contract. Mitchell Trubisky, he's at the point right now where he's entering his fourth year in his contract. The Bears don't know if they're going to pick up their fifth year option. And he's a rookie that's looking to make a lot of money. So if it works out with Mitchell Trubisky, he's going to be that next guy like Dak Prescott, who's asking for like 30 million, 35 million a year. So I just don't see that happening realistically. I feel like Foles is going to start, whether it's going to be day one. I don't know. Day one. But you eventually think that he's in the start. I do. I do. I feel like Foles is going to be the next quarterback, starting quarterback for the Chicago Bears right after Mitchell Trubisky is benched. So that's my hot take on it. So I don't show that clip just to say, hey, bragging rights. I was correct. But instead I showed that clip because it describes the situation with the Chicago Bears perfectly about how Nick Foles came in and was traded from the Jacksonville Jaguars to be that competition for Trubisky. And Nagy and the general manager could say that, listen, Trubisky is our guy that can say it all they want. But the fact of the matter is he was on a short leash. He was. They wanted it to make it work. He was the second overall pick back in 2017. They traded up when they pretty much shouldn't have. They could have gotten Trubisky at number three if they wanted to. They passed up on people like DeSean Watson and Patrick Mahomes. They wanted Trubisky to be a thing and make it work. But at that point, short leash, like I said, Foles brought in a bunch of money. You have to move on with Nick Foles. So what does that mean for the future for the Chicago Bears? If we want to talk about the future, we want to talk about Foles making a lot of money while they worked with him, they restructured his contract instead of making that $22 million a year that he's making in Jacksonville. He restructured before the season started on April 1st, and he said that he's going to be making $8 million a year, $21 million of that three-year contract is guaranteed. So that's taken a lot of money or taken away a lot of money for the Chicago Bears. So he makes that contract team friendly. For Mitch Trubisky, they were in a situation where, hey, listen, does he want that contract extension? He's going to have to approve it with Chicago. And at this point, he doesn't seem like they want to pick up on their fifth year option for Mitch Trubisky. They're eventually just going to move on with Trubisky and just go ahead with Nick Foles for the time being.  And what do they do with the future at the quarterback position? For the time being, they're going to roll with Nick Foles. But in the draft, in the NFL draft, are you going to get another quarterback?  And you're already 3-0. So if you're looking at a team that's going to be getting Trevor Lawrence with the number one overall pick, you're going to have to look at the teams that haven't won a game yet, potentially the New York Jets could get Trevor Lawrence with the number one overall pick. So you're going to have to draft a quarterback later in the draft or at least trade up to the mid-around.  There's a guy from North Dakota State University, Trey Lance, that has been jettering some NFL interest that they threw an whole entire scrimmage just for him. Or at least he was one of the big names in consideration for throwing a game together because his conference was not playing football because of the COVID-19 outbreak. And they decided to have just this one game where NFL scouts could come and they can look at Trey Lance, who did not throw a single interception last season. So he's a pretty good quarterback and he's being talked about as a first round talent. So could Trey Lance go to the Chicago Bears and replace Trebisky, absolutely, but potentially falls later down the road in the future? A lot of things to unpack. But for now, we do believe that it is a good decision for Nick Foles to be the Chicago Bears starting quarterback at this point.


Well to celebrate our 20th anniversary of Lakeland News, we're taking a look back at some of the memorable local stories we've covered over the years. We're calling it 20 for 20. 20 stories in all, one for each of the 20 years we've been on the air with Lakeland News. In 2009, the Bemidji State Men's Hockey Team made history, when it advanced to its first Division I Hockey Frozen 4 in Washington, D.C. Beaver Fever was running rampant in Bemidji and the small school beavers had the national spotlight on them. Put on any tape of any coach, any level, you know what? Just play it. That's what the same keys are. It doesn't change. I don't care if it's Squirt Hockey or the National Hockey League, you better take care of the puck and you better get after it and you better make sure you have good special teams and you better have that person between the pipes getting it done for you. Sports Director Nicole Darin traveled to the nation's capital and brought us the report, which you can watch in its entirety tomorrow on our website lptv.org. The beavers ended up losing to Miami of Ohio 4-1 in the semifinals. Two years later, BSU joined the prestigious WCHA conference and opened up play in their new home, what is now known as the Sanford Center. Next Wednesday night, we take a look back at a story from 2010.


So, yeah, I wrote a handful of topics that I was thinking we might be able to cover, and I don't know if other people have other issues that they want to look at. But so there's questions about the different key servers that we have available, how we might want to deal with key server synchronization, maybe trying to introduce some idea of actual cryptographic validation on the key servers. I'm wondering whether there are particular OpenPGP workflow use cases that we want to streamline if people have suggestions or ideas for how to do that. And some examples of use cases are like new key generation, key signing. I'm wondering if anybody know if people can report on whatever new implementations they have. And then I'm also wondering how much we might want to consider diverging from upstream on some of these packages, in particular GPG and SKS. We don't diverge a whole lot from upstream, but we do somewhat, and some upstreams are more responsive to the concerns that we raise. So people have suggestions about changes to configuration that we might want. People have best practices that maybe Debian should recommend. There's a whole bunch of stuff that we can't possibly cover entirely in 45 minutes. But anyway, I kind of wanted to open up the floor and see what people had. I might call on noodles if nobody's responsive. Daniel and I have had a number of conversations offline. I'm actually reasonably against diverging from upstream where we can avoid it. I agree with that. We have a history of diverging from upstream on cryptographic projects that did not work well for us. So let's not do that where we can't. I mean, the conversation I've had with various people offline, we've been moving slowly to stronger keys. And part of that's about having a bigger key size than one or two four bits in general for that, but also largely driven by the weaknesses found in the SHA-1 hash algorithm, which is what binds signatures to user IDs and subkeys by default in previous versions of GPG. And what's become apparent over the last week as I've done various digging and investigation is that lots of us have stronger keys that are 2K or bigger that are actually bound using SHA-1. So we're not getting the benefit of the stronger hash type. And the main reason that seems to be the cause of this is that GPG, if it finds a self-signature on your key, will use the hash type of that self-signature for any new self-signature rather than your preferences. So if you create a key with an old GPG, but make a big key, make a 2K or larger key, hadn't set your cert preferences in GPG, then you'd end up with a large key with a SHA-1 signature on it. You then subsequently change your preferences to SHA-256 or better, any new key you sign gets the benefit of that better signature. But your key doesn't get the new hash. Sorry. Go on. So this is the default in GPG and there's been a discussion about 2009 Daniel. There was a patch sent to the list that would then use your cert preferences. Upstream GPG said no, this is a surprising change. We don't want this to happen to people. And I think the argument we would make is that, well, I changed my preferences that said I want to use strong fricking hashes. And the fact that you're not doing that is not the principle of least surprise. And there's an argument to be had there and I think the argument there should be had with GPG upstream rather than us doing the right thing for our users and not really helping the rest of the ecosystem. If GPG have a good reason not to them, we'll listen to it. But I think they're wrong. So I don't think they do have a good reason. So that's the sort of divergence that I was implying. Not anything more risky than that. I mean, there are, I did some stats on this. I pulled out all of the insecure hash types from the Debian key ring, including Debian maintainers, Debian developers and Debian on uploaders. And we lose 97 keys that should have strong hashes and just don't. Including mine, I should point out I'm there and I will be fixing that when I get back home and have access to my private key again. If you look at the Debian key ring, we have what's called a reachable set. So there are two terms in PGP web of trust that are quite interesting. One is the strong set. And strong means that if you have any key in that strong set, you can get to any other key in that strong set. So if you're in strong, you can get to any other key in strong. And any other key in strong can get to you. And then there's a weaker relation called reachable. And reachable is all of the keys that can be reached if you have a key in strong. So the standard Debian key ring is a reachable set size of 1,051. So that's, I can't actually tell you how many keys are in all of Debian. It's not very many more than that. It's most, a few dozen more than that. So we are an extremely well connected set. And of those 1,051, actually 965 are in strong. So we're really well connected. In general, if someone signs your key, you tend to sign them back. And that gives us strong. You take away all the in-secure hashes. Our strongly connected set size goes down to 154. That's like nearly 10 times smaller. Reachable is still only 243. And that's partly because we actually only have a couple of hundred strong keys in the set. There's a couple of hundred keys that are bigger than one or two four. And it's actually notable that Debian maintainers are much better at that. They have a much higher percentage because a lot of them are newer keys, I guess. They're there's more active group than Debian maintainers. So that's kind of why we care about this. And I haven't really, I'm going to blog about it at some point and put up the list of everyone's key who's affected by this. But there's actually no simple way to fix it at the moment. Technically, I know it needs to be done, but GPG doesn't have an interface that lets you do the necessary re-signing of all of your SEGs. Of your self-segs. Your self-segs. In particular on sub-keys, there's nothing you can do. For a self-seg on a UID, you can go in, delete your self-seg, and then create a new one because it doesn't see any self-seg. Then it will create and honor your digest preferences, but all your certification preferences. But for sub-keys, there's no edge of his I can see. And even doing that for primary keys is a colossal pain. If your key has any number of signatures on it, the process of deleting your own self-seg from your key is actually incredibly tedious and weird because of the GPG user interface. You have to go in and say delete signature. Specify which user ID you want to delete a signature off of. So you have to do this for each user ID. And when you say delete signature, it walks you through every single signature that's over that user ID and asks you, is this the one you want to delete? Is that the one you want to delete? I am not sure. I just wanted to ask if you then confirm that you want to delete a signature if it continues or if it starts off from the beginning because you have to redo that. Yeah, I don't remember. I did it once, and that was it. And I never want to do that again. I think it's mentioning Tom's tool. Before I mention that, I wanted to ask you about the sort of the permanence of pushing keys to the key server. If I had a weak self-seg that's on the key servers and I change it and I repush it, does that actually overwrite my weak signature self-seg? So the GPG model says that for a primary key and you're trying to attach some piece of data to the primary key. So for a signature over a user ID, you're attaching that user ID to the, you're saying this user ID belongs to this primary key. And that certification is made by one issuer. So if you as an issuer make a new self-seg, the date on the new self-seg will be incremented, will be larger than the old date. And the rule that RFC4880 says is that we will only look at the most recent certification from any given issuer over any given content. So the old self-seg will be up there, and the new self-seg will be up there, and the new self-seg will have a newer date, so compliant implementations should respect the new signature. Now as a contrast, if somebody signed my key with a weak signature, and I uploaded that because I was sort of careless, and then I convinced them to re-sign my key with a stronger signature once the weak one is in the key servers, can I not delete that? There's nothing wrong with having a weak signature in the key servers. It's just that at some point we are going to want to not rely on weak digests. So for example, right now, MD5 is considered a bad idea for signatures. And so we would like to say I don't want to rely on any certifications made over MD5. And so yeah, there could be a certification made over MD5. It's not hurting your key that it's there. It's just that you wouldn't want it to be there. You wouldn't want anyone to rely on it. So it's as though there's nothing there. So at some point, if SHA1 becomes significantly more broken, we may want to try to deprecate SHA1. There are some significant problems with doing that deprecation. But the point here is to prepare ourselves so that at the point that SHA1 is actually broken in practical ways, we can move forward without relying on that digest. OK. And then the other pointer is I sent a mail to Dibconf discuss last night with a link to my KSP utility, which basically just annotates GPG list keys with the strength of the signatures. And it's a fairly hacky Python script and probably wants to be rewritten with live nettle. Is that the one? I haven't had a chance to look at your tool, so I'm not sure what it does. So I couldn't tell you, actually. Sorry. OK. Well, it probably wants to be rewritten in that. But anyway, look at that. Look at the documentation. Ask me questions about that. I think one of the things that's missing that I put on Gaby is that I'd like to do a better how-to on how to fix signatures. And I hadn't really considered how to fix self-signatures, but that should also be part of it. But it makes me want to ask you about changes in the keybox format and to what degree is that going to be something we need to be worried about? So the keybox format is a change in the way that GPG is going to be storing keys. I probably shouldn't be the one to talk about it, because I actually haven't really even experimented with it much. But that will not affect the nature of the open PGP packets. It's just going to affect the way that they're stored on disk and how GPG accesses them. So I don't think we need to worry about that for this particular discussion. As long as what you're working with is the output of GPG export, it doesn't matter what GPG has, how it stores it internally. OK, that's a great clarification. So it looked like people were adding a whole bunch of stuff up here. So one of the questions that was just asked was, how do you tell what digest there is in a given certification? And the answer to that is that you do GPG export with whatever options you need to make sure you're exporting the right thing. And then you pipe that output into a program that can parse the GPG packets and print them out. One such program is GPG itself. So you can say GPG export whatever, pipe into GPG dash dash list dash packets. But GPG list packets lists the number that identifies the digest, which you then have to go look up in RFC 4880.  But you can also install a tool called pgpdump. And pgpdump will actually print the human readable name of the digest. Oh, or Tom's KSP SIG script. So we have multiple choices here. That's also a thing where I think upstream is actually unreasonable, where they say that it's something for developers, so there should be no readable digest name there, because you really want to see the number and to look it up in an include file. That said, the new 2.0 release on the master branch has changed so that dash dash with dash columns actually also prints a digest type. OK. As an numeric, of course, as a number. OK. So OK, that's interesting, and might be useful for people who are parsing the output of GPG. So I think one of the things that we're sort of dancing around here is the fact that GPG does not offer a programmatic interface that's capable of doing the kind of work that we are talking about. And so I think in some sense we have to acknowledge the fact that we are, I think we're struggling right now because we don't have enough implementations. We don't have an implementation that currently that we can manipulate in this way. And there are a couple of other implementations, but we need to think about, I think as a community, if we're interested in seeing OpenPGP be something that we can use and that we can drive this kind of change, I think we do need to think about having an implementation that gives us a programmatic interface that's beyond GPGME. So I don't know. Is anybody working on those things? Noodles? So you're not strictly speaking correct, and that there is a library that we have. We did discuss the other thing. There's NetPGP, which is originally sponsored by Nominet, the UK Demand Registry, written by Ben Laurie. It's got a Git repo up on, I can't remember if it's GitHub or Gitorious, it's in NetBSD, but the issue with it is that it links against OpenSSL for all of its crypto and therefore it's kind of an issue if you want to talk to it from GPL code. And there is an RFP for OpenPGP Lib, which is what NetPGP, I don't remember which one of them diverged from the other, but one of them had, but neither of them are particularly active. There's an RFP from me on that, and then when I looked into it and realized all the licensing issues I was going to get into, I backed off of packaging it for Debian because I didn't want to introduce still more dependencies on the OpenSSL license. So most of the stuff that I've seen actually just calls GPG directly. If you look at any of the pearl bits and pieces, any of the Python interfaces, any of the hacky scripts that I and others have written, they call GPG an attempt to parse it. The with colons interface from GPG at least gives you something that you can hopefully more easily parse, but doesn't necessarily always give you the information you want. What Daniel's talking about is I actually am the author of a key server. I think these days there are pretty much two key servers that are in use by far and away the most popular is a key server called SKS. It started out as a very interesting set of papers on synchronizing sets of numbers, and they turned it into a very practical application of a key server network that actually makes sure all of the key servers have all of the keys. And I think if you looked at it, 99% of the key servers in the world use that. Unfortunately, it's written in OCaml, and while I'm sure that's a very nice language, and I try not to remember what I knew of OCaml, it's not very easy to pull it out into a separate library, and that's certainly not what they've written their code to do. It doesn't do any cryptographic verification. It's very much a key server code. The other is the key server I wrote, which is called ONAC. It's written in C. It's designed to be a key server, so again, it does suffer some of the problems about doing things that are key server related rather than doing things that are more generic. But one of the things I've been looking at doing is putting more cryptography into the key server and actually making it so the key server would verify packets and only accept keys that it could verify. And to that extent, I've done some of the hashing work. I've done some of the extra parsing work of packets and what we had a discussion about offline was maybe we could pull some of that code out into, I guess, an LGPL library or something using the existing Netlin-Hogweed libraries to do the crypto work and adding the PGP functionality on top and then giving us something that we could build a set of generic tools against. And I think there are two advantages of that. One is we get a library that's designed for other programs to talk to and is hopefully a CNN interface that anyone can link into and we can build scripting language bindings to and the other is we hopefully get a reasonably comprehensive alternative implementation of PGP, something that we can interoperate against and drive innovation, I guess. Right. So one of the big challenges, when I looked at the NetPGP or OpenPGP lib, was that they were shooting to try to create a tool that could be a drop-in replacement for GPG, which is a Sisyphean task if I've ever heard one. I mean in terms of complicated interfaces to re-implement, I think we can't. So to give you an idea about the sort of thing I've already got, I wrote about a two-dozen line program that will walk through a key, will read a set of keys in, walk through the keys, strip out all of the insecure signatures and write the code back, the signature backup. Now it's written in C and that links against the stuff that I've already got. So it was actually just a set of traversing link lists. If there were bindings to Perl, it would probably be about three lines of absolute line noise that would just do what you expect. So that's where I find it. Because it's my code I'm familiar with, that I throw together things in this to play with PGP, that if we had sensible bindings for a scripting language, I think would be very accessible for other people to throw together. Well, hang on. The idea of your sake-checking thing is easy with this. You just load it in and you go, well, what is the sake? And you wouldn't have to worry about parsing the output or doing the evilness or whatever. Slightly off topic. DKG, could you go into Gaby quickly? Oh, okay. Never mind. Okay. What happened? Yeah. Mike. Okay. Sorry. My preferences. You know that it crashed when that was... You're not going to use my input stack is all fucked. This is the thing that was crashing it earlier, right? You guys want me to crash it again? Is that what's going on? No. Highlight current line of remote users. This one here? That was the one that was crashing it, but shall we try it? Oh, it worked that time. What if I do this one too? Or I'm not going to push it. Sorry. Well, so what do we need to do to get that LGPL library pulled out so we can start doing programmatic stuff instead of person colon stuff? I put the code... I mean, the code's been in a public BZR repo for years, but I put the code up on Gatorius today in Onak. So that's the full key server. There's some thought about whether the interface is appropriate and actually pulling it out into a separate library, but the code's up there and you can have a look at it. It's all GPL license at the moment. I think that pretty much all of the bits that we'd want for the library I wrote most of and I'm happy to do it. I think LGPL is a better thing. I'd rather see this widely used than tied down. So I'm happy to re-license the bits that I'm willing for as LGPL. So we need to decide about what we need to pull out and what makes sense. And I think there's probably an initial set of core functions we pull out to start with and then more we pull out over time as we discover what we need and see how it works. So I guess feedback from people who've written these sorts of tools and the sort of services they need would be a good start. I've never written bindings to Python or Perl, so if anyone's done that and has some thoughts about the best way to make the interface look, that's probably a good thing to think about from the get go as well. I think if we can actually provide a set of bindings for Python and Perl, it lets people just play with these things and do some validation, that will be really give us quite a lot of interesting tools. That was a licensing question. Are you thinking about LGPL v3 or later? And the answer was a shrug, I think. So my experience is that if you give people a C library, the Python people will make Python bindings and the Perl people will make Perl bindings, and it's really not a problem. No, ONEC is not a library. ONEC is the key server. And the code is currently in the key server. And so there's a process of extraction that's going to need to happen to pull out an interface that seems like a sensible library interface. Oh, yeah. O-N-A-K. So, Noodles, here's a question. Do you have any sort of a regression test suite for ONEC, or is that something that we should, especially as we refactor the code, start to build up? There is a very, very minimal test suite that does test out of a key, remove a key, look up of a key, and a key server that will then walk through various code paths. It's not going to be suitable for a library, so there's certainly work that can be done there. It's very minimal and actually it does find issues, but it's about the key server interface and any testing of the actual PHP code paths are all through what the key server interface, rather than being unit tests of individual C files. So, it sounds to me like we actually have, I'm also happy to commit to helping working on breaking out the interface and maybe even doing the pearl blindings if that's useful. So I'm wondering, it sounds to me like we have a decent plan on actually having some tools available to us thanks to your work. So, I'm wondering if we want to move on and maybe try to talk about what use cases we'd like to try to streamline or if there's other parts of the other potential topics people want to cover? I have an issue with maskey signing parties. Okay. I actually also have issues with maskey signing parties. I don't know what the answer is, but once you get above a certain number of people who don't really know each other, they just don't seem to scale. I find there's an issue with a hugely varying degree of knowledge in the room. You get people who are quite happy to do the signature verification checks and know what they're talking about and really are just using it as a way to meet people that they know they won't be bothering to ask for fingerprint exchange, and you get people who probably should have their hand held a bit more and probably should have some sort of an introduction at the start that says, this is why we do this, this is what's going on, but I don't know how you deal with that, and I don't know how you deal with 100 people turning up and wanting to cross sign keys. And the splitting out into smaller parties helps in some ways, but it's always a free-for-all. None of them are perfect, and I'd love to... I think the problem at the moment is that by the end of the key signing party, you could wander in and everywhere is knackered and they'll go sign, sign, sign, sign, sign. So the way you could reverse the situation there is that as soon as someone decides not to sign someone's key, they should shout about it and shout out the number of the key that they're not going to sign, and then the person next to them has to decide whether they're going to sign it, and that would actually raise the bar, because then it's basically the standards of the most twitchy person in the room that end up being applied rather than the least twitchy. Another approach that I've taken and I regret that I didn't make this announcement just before the latest mass key signing is that I've made it clear at different times that I will put a fake key into the key signing party, any key signing party that I may attend. I reserve the right to put fake keys into, and if those keys ever receive signatures, I will publish those signatures and identify the people who signed these fake keys just to let people know that there are some fake keys in the key signing party. And I think just that level of paranoia, there's a possibility of being publicly embarrassed if I didn't actually do my checking, I think is useful.  So you just missed the announcement and you did the fake key thing, right? I won't say. I make a key under a different name, yep. And it's a real key and it's present in the key servers, but it's not, but no one is claiming it at the party, or I certainly am not claiming it at the party. There are a number of keys that were in the key server list that were from people who had to leave before the key signing happened, people who didn't bother to show up, people who are out getting beer, and there may also have been some fake keys as well. So if you're just going through a list from a key signing, signing all the way down, like Phil was suggesting that's probably a bad idea. And yeah, maybe we should try to make that kind of a scenario more visible, more regularly. I'm kind of torn about that because I think for us it's great to raise awareness, but with the idea of trying to get the freedom box as a vehicle for expanding the web of trust, even though I know you don't like that term. In the extreme, we want grandma to be able to manage her key material, and if we make such a huge amount of stigma about how to participate, I think it will just frighten people. But the concern that's being raised here is about mass key signing parties, not about key signing in particular. And I think it's worth pointing out that you could have, there are other ways to encourage people to sign keys that don't involve mass key signings that still might make it easier to have key signing happen. So, thank you. So for example, one of the use cases that I would like to see streamlined, and some work has been done on this, and again, not enough. But we all walk around these days with devices with high resolution display screens, and I've said this before to many of you individually, but there's no reason for humans to have to repeat long hexadecimal strings to one another anymore. For a one to one key signing, we have the possibility of streamlined approaches where I show you a high density bar code, you take a picture of it with your device, I've got my trustworthy device, you've got your trustworthy device, note that I'm not saying telephone, and I can transmit a chunk of data that is about the size of an open PGP fingerprint very easily that way. So there's no reason that I need to be able to remember D217-399 or anything five times longer than that. We ought to have those tools, and those tools ought to be built into our contact managers. If you use a contact manager, I don't know whatever the one is used by the different tools, but we should be building that stuff in, and that will improve, I think, key signing uptake more than any number of large key signing parties, and I think it will mean that the signatures that are made are more actual legitimate signatures of like I actually met this person, not I was in a room with 100 people, one of whom I think had that passport that I think I checked it sufficiently. Just to be clear, are you suggesting that if there were an Android app to do that, we may not be able to trust the entire stack? Well, if it's your phone, then maybe you can, but most people don't really own their phones, but this is a, I don't want to diverge the discussion off into that territory. I think one of the ways you can kind of mitigate a mass key signing party is you actually have like a key signing hygiene training, like as part of the early part of the party, and maybe it's like old news for some people, but for a lot of people, it's going to take a long time before like good key signing practices become like second nature, if ever. So just continually refreshing and re-educating people about that kind of thing, I think could really make a big difference. Yeah. I'm saying it not just re-educating, but even educating for the first half of people in key signing parties, we encourage new people before they enter Debian to, we require them to get signatures. So coming to key signing parties is like a step for them to join Debian, and they might have an idea about security and what's not. Right. Much as I dislike key signing parties, I do think they serve a great use in terms of making sure we have a strong web of trust and meaning that if some keys fall out, we are still well connected. I just don't think they're perfect, and I'm not quite sure how to make them better. I fully agree that some training at the start, even for those people who may think they know it all is a good idea and a good refresher, I think part of it is that it's a scaling problem once you get that many people. I'm not an expert at all, and part of what I had trouble is there's not a lot of guidelines either provided by Debian or out in the community that help you decide on certain things. So an example I still struggle with is how many UID should you have? What's considered best practice? What kind of tradeoffs there? How, what you brought up was about how to make sure you don't use SHA-1. I still don't know how to do that, to be honest. Yeah. So there are a couple of folks who have worked on writing up OpenPGP best practices documents, and I did you send the email to the list that linked to the RiseUp page? Yeah, and that was excellent, but that's just really a start. No, no. I mean I've contributed to it, but it was not written by me. Yeah, so that's written by a range of people actually. RiseUp.net, activists and interested in security technologies. Yeah. So yeah, making sure that we link prominently to that kind of documentation and that we maintain that documentation and try to improve it as we understand new best practices would be good, I think. So an experience from CACER at the door, let's not go there, that's a good idea or not, but at some point like they had this whole thing of trying to emulate the level of trust, the level of trust, and at some point they noticed that people were assuring other people without checking anything or without doing anything. So they put a test to become an assurer. You have to pass a test. The idea of the test itself is also dubious, but you were sure that people were going to read the documents. They had the document that you should read. Best practices document. And in Debian, we don't have something like that at all. We have PGP in all of our day-to-day work, but we don't have something in a Debian place. Are you suggesting that something like tasks and skills would contain some idea about key management? The task and skills could be just a document that is referred to a central Debian place about best practices, like the developer's reference, maybe. There are a few questions about PGP handling as part of the new Minty inner process. There's a, in terms of generating a key without child one, Anna's guide that she blogged about at the time and is actually linked from keyring.debian.org. It's not the only thing out there, but it is a pretty good guide about you need to do these steps and this is what you need to do to get the key out and this is what you do with those steps. So if you're generating a new key and if you don't have a key that's 2K or larger, please go and generate one and start to get signatures on it. Yeah, and now it's a very good time to do that. You've got a lot of people in there. Yeah, I think we're going to get a lot more pretty active about trying to get that done. I think there probably is a space for Debian to have these are our best practices and guides for it. Is someone doing the undue? I hear this latest version of Gabi has undue. I hope so. From a personal point of view, best practices procedures are often a very personal thing and if you put two people who know enough about security to be dangerous in a room and you'll get three opinions out and at least one of them will be insecure. It's not just that people disagree. It's that actually best practices might actually be different for different people in different situations also. In the context of a private company, I have a consultancy, we use GPG internally, but we have to manage it differently. It's more like a CA model where we have one person that signs the keys and also has a revocation rights on each of the keys. That wouldn't be appropriate, I don't think, in a Debian context. Right. But the standard gives you the flexibility to implement that different workflow. I am interested in talking about monkey sphere and how that integrates the SSH. So at the moment it integrates via the same kind of interfaces that we were talking about. We're using the with-colons output of GPG to extract what information we need. Does it interface to the new certificate facility? It does not. The certificate open SSH because they didn't like with some reason they didn't like the X509 model which was already built into open SSL which they're already using. They said we don't want the increased attack surface for the ASM1 parser. Turns out that was a good idea in the last year there have been serious bugs in the ASM1 parser found. But they basically said the existing certificate models are too complicated. We don't want to use the two complicated models so there's a new type of certificate that we're making up right now and it belongs specifically to open SSH. And so as a result there's no way to actually use the same certification scheme across different crypto systems. So the so no open PGP stuff doesn't hook into that because it can't. The cryptographic routines are slightly different and the way that they're composed are slightly different. So from open SSH perspective I can see why you would do that but from the perspective of let's not make every different application protocol figure out a new way to certify all of their users it doesn't do you much good. So as an admin now you're deploying six different vulnerable to bugs in one mechanism that you can try to improve. So I wanted to mention I was digging through some old emails trying to answer a question that Noodle's had about about the certificate digest self sig digest updates and found an old email that I had written that referred to an idea of like an open PGP lint so that it would be I think in terms of best practices documents are good and nice to be able to just run a piece of code that looks at your key and says hey you might be interested in you know I don't know you might be interested in cleaning up these the car insurance yes exactly so I don't know I don't have a good set of use cases for what things open PGP and a hypothetical open PGP lint would cover but that might be something that would also help us to break out the library interface in terms of having a separate tool and then and if people want to just write up suggestions maybe add them to the scotty document of things that you would want to see checked for that you don't know how to check for or that you think is currently too tedious to check for by hand which is pretty much anything then I welcome suggestions on that front I think our time is up yeah I'm glad to see so many people here for a topic that's pretty arcane but also pretty fundamental to the mechanisms that we use so thank you all


Good morning. Dear viewers, this is Tulip welcoming you to my show, Coffee Time. And this is a lovely morning in Amherst.  I don't want to lose a single moment of it. These glorious warm summer days and the blue sky and the breeze and the rabbits. Oh, not the bear though. I don't want that. So the song I was singing is opening lines of a Tagore song which speaks of doors being opened by the sunrise in the morning. And you know what? My phone on which I am recording the blessed phone, smartphone that's on the branch of a tree because I don't have an iPod with me. And it's a lesson I have learned from a friend who told me what you need usually is around you. So when you need something, you want to make something, look for all the materials around you in your house, within the boundary you move each and every day. And if you don't have them, then you can go farther away and visit shops if needed. And that was one of the most valuable lessons I have learned in my days from my friend. In these times of the COVID-19, I often think of her and how we have learned as a whole world to put things together to become creative. Schools have learned all of a sudden within hours to be holding classes online. To a remarkable graduation days, all the goings early in the morning to work place have come to eight o'clock Zoom meetings. But the world is going, it hasn't stopped. There might be slower and faster days and days in between but we have not stopped because we have learned to carry on with what we have. And perhaps anything that comes with a downsize and we think this is really bad is not that bad at all. There is a lesson to be learned in everything that happens or does not happen at all. So keep in mind that we can be resilient. In fact, we have to be resilient. Life is not a teacher that pampers you all the time. It gives you hard lessons. Life is tough love. Either you survive or you go. So let's read a few lines from Kahleil Gibran who speaks of sorrow and joy. As he says, your joy is your sorrow and must. And the self-same well from which your laughter rises was oftentimes filled with your tears. The deeper that sorrow curves into your being, the more joy you can contain. It's not the cup that holds your wine, the very cup that was burned in the potter's oven. And it's not the loot that soothes your spirit, the very wood that was hollowed with knives. When we sing, when we write poetry, when we love, there is always a silence before and after and we rise in between. Just as the sun is coming up now after the night, we wake up from the beds of nothingness and we go to the world of nothingness. And I would like to sing another piece from Chakur who speaks of love that's seen in the eyes. You see, when you look at life, between what we have and what we have not, we see life through his eyes. So to life, let's sing a song. And with that I'll be saying goodbye still. We'll meet again in one of this another summer day. For me there and thank you to Amherst Media and its great team for which I can do these shows no matter where I am. Special thanks to Faith Gregory who is awesome kind and does all the editing for me now. Thank you.


Welcome traders to another Tick Mill weekly market outlook for week commencing the 24th of October, starting in the US. Lots of important numbers out next week in the US, but none are likely to change the market's forecast for a 75 basis point interest rate hike on the 2nd of November. Third quarter GDP is likely to show positive growth after the technical recession experience in the first half of the year. Those two consecutive quarters of negative growth were primarily caused by volatility in trade and inventories, which should both contribute positively to the third quarter data. The consumer spending is under pressure, but while residential investment will be a drag on growth, markets are looking for a 1.7% annualised rate of GDP growth. We will also get the Fed's favoured measure of inflation, the core personal consumer expenditure deflator. This is expected to broadly match what happened to core CPI, so markets are looking for an annual rate to rise to about 5.2% from 4.9%, with the economy growing and inflation heading in the wrong direction, the Fed cannot afford to start slowing rate hikes just yet. Also, look out for durable goods orders, Boeing had a decent month, so there should be a rise in the headline rate, although extra transportation orders will likely be softer. We should also pay close attention to consumer confidence and house prices. The surge in mortgage rates and collapse in mortgage applications for home purchases has resulted in falling home sales, with housing supply also on the rise. Markets expect to see prices fall for a second month in a row. Over the longer term, this should help to get broader inflation measures lower given the relationship with the rental components that go into CPI. Moving to charts from a technical perspective, two key levels I'm watching as we head into this week, 1.11.50. If we can get a breakthrough there, I'm looking for a grind to the downside to retest the prior swing lows here, rain sport just above 1.10. If we can get through there, we're looking for this equality objective versus the biggest swing structure here in that 1.13.80 high. It gives us a downside target of 1.09.10. At this stage, any close back through that 1.14 handle would be a bullish development and invalidate this bearish setup. Then we'll be looking for retest the prior cycle highs 1.14.70 on route to an ideal 1.15.40. Moving to the Eurozone, and really focused this week is going to be on the ECB, who hotly anticipated their 75 basis points rate hike. The Hawks have clearly convinced the few doves left of the necessities to go big on rate hikes. Contrary to the run up to the July and September meetings, there hasn't been any publicly debated controversy on the size of the rate hikes. In fact, European Central Bank President Christine Lagarde seems to have succeeded in disciplining a sometimes very heterogeneously vocal membership there. To this end, it's hard to see how the ECB cannot move again by 75 basis points at this week's meeting. As the 75 basis point hike looks like a done deal, all eyes also will be on the other open issues, which are excess liquidity, quantitative tightening, and the terminal interest rate. Size the ECB, which will be the key focal point for Eurozone traders, will also be looking at survey gauges of the economy next week. The PMIs on Monday will be critical to determine whether the Eurozone economy has lived further into contraction or whether an uptick has occurred. There is not much evidence of this, though, but Monday will provide more clarity on how the Eurozone economy is performing as of October. So from a technical perspective, the Eurodollar obviously trading pretty much inverse to the dollar index. So looking for the Eurodollar hours, we take out this triangle resistance. Look at some follow-through here earlier in the week. Back through that 99 handle, should set up a new vent to test the prior swing highs there just below parity. And as long as pullbacks remain supportive, then we're going to be looking for an upside extension into our equality objective, which is 1-0-0-90. At this stage, any close back through 96-30 will be bearish developments, opening up further downsides to retest prior cycle lows down to 95-30s and then on towards the 94 handle below there. And moving to the UK, obviously, political massimations continue to be the focus there. The ruling Conservative party has said it will fast-track plans to get a new leader in place by this Friday and potentially even by Monday, if only one candidate makes it through the MP selection round. Candidates have until Monday at 2pm to clear the hurdle of 100 MP nominations to make it onto the ballot paper before Conservative MPs vote on the outcome. Now, importantly, at this stage, what we know as of Sunday is that Rishi Sunak is the only confirmed candidate to have exceeded that 100 level. There is rumour bounding that Boris Johnson also has the 100 MP nominations required to make it onto the ballot. Penny Morgan, the other candidate, the other confirmed candidate, only has about 23 votes at this stage. So unless there's going to be a late search for her, it looks likely to potentially be between Johnson and Sunak. But if Johnson cannot deliver those 100 MPs, then we could be looking at Prime Minister Sunak being anointed at some point tomorrow. Importantly though, there's only a week to go until the medium-term fiscal plan. It's usually delivered on 31st of October. There's inevitably a question of whether this is enough time for a Prime Minister to rubber-stamp Chancellor Jeremy Hunt's plan for debt sustainability. Traders are probably rightly assuming that Hunt will remain in position under a new leader, but the bigger question is whether the Conservative party can unite behind a new leader and whether a more stable political backdrop can actually emerge, because if it can't, then not only is there a surrogacy surrounding future budget plans, but also whether we would be moving closer to an election in the UK. From a technical perspective, in terms of sterling, whilst we hold this swing low here at the 10920s, I'm actually looking for an upside extension. Take us back through resistance here, 1.1435, on then to grind it out to the upside into that 1.27 extension at 1.1816. Ultimately, the upside objective versus the swing structure here and the swing low at that 10920 gives us a 1.20 upside objective. At this stage, any close back through 10870 will be a bearish development, opening downside targets 106.93 and then to a 105.30s. Moving to Japan and in terms of data, we have a release on Monday of the services and manufacturing PMIs, last time out 52.2 and 50.8 respectively. Services supported by looser COVID-19 restrictions, but manufacturing really does remain in a fragile state. Then the focus is going to move to the back end of the week on Friday when we will get the BOJ meeting. The markets don't expect policy changes at this week's meeting. However, the odds of a shift on the yield curve control are on the rise and recent developments support this, but a rise in the corridor will occur into March. BOJ's core inflation, ex-fresh food and energy jumped to 1% on an annual basis in September, while momentum in wage inflation is also building. The trade union confederation is requesting a 3% increase in base wages for next spring in terms of wage negotiation, the highest in almost 30 years. However, market pressure on the BOJ has also intensified and we did see another round of intervention late on Friday. From a technical perspective, it's interesting to note that the intervention that we saw on Friday, if we looked at the last period of intervention, it pretty much matched it in scope and scale in terms of the price reaction. If we don't get any early follow through into agent trade through that 146 handle, I could actually see us grinding it back out here in the market, pressuring the BOJ again, similar setup to what we saw here. So I've been looking to move back up into that 150, 150, 151 area and then we'll see if the BOJ acts again. At this stage, it will really take a break through 145.90 with some downside acceleration and early agent trade set up and moved to test monthly projected range support and the pivot there 143. And in terms of data rallying things out down under in Australia, Monday, RBA assistant governor Ken speaks at a global markets conference in Sydney. Then Tuesday, the federal budget is released for 2022, fiscal year 2023. Last time the budget deficit was $31.9 billion. Looking markets anticipating the potential for a negative 45 billion as the deficit widens on expenses. Then heading into Wednesday, under inflation data, CPIs year over year, trim green year over year, looking 5.5, 7% respectively, food dwellings, electricity and domestic holidays all driving headline inflation higher. There is significant uncertainty regarding the impact of the electricity rebates and markets expect that they will be significant holding the increase to just 1.1%. Then heading into Thursday, export price index. Last time out was a positive 10.1% print. But there was a whisper number in the market here that we could see a negative 7% print as commodity prices have really come down from highs on global growth fears. And then we round out the week with Q3 PPI on Friday, 1.4% last time out. And really markets going to be focused on the impact of construction costs into that number. And so from a technical perspective, Aussie Dollar traded to the target zone of that $63.90 on Friday. So what I'll be watching for now in terms of the bullish case is if we can maintain prices above the high volume load here, $62.60, $62.70. I look for further upside extension initial target on a move through $63.90 will give us $64.50 and then on to the $1.6.1 extension at $6.508. At this stage, any loss of the $62.10 level on a closing basis with bearish development, hoping we'll move back down into Tesla's $61.60. And then I would guess $61 would become the downside magnet. But for now, focus on the upside looking for a grind here into the $65.00 handle. And let's just check in with Bitcoin to get that weekend risk barometer pulse here. Still trading within the triangle here Bitcoin. And so we have resistance $19,300 and support coming in $18,850 till we get a sustained break in the triangle at this stage. Personally, I can see it's trading up into the resistance area $19,930 of an upside break. However, if we take out the $18,800 on the downside, we're then looking at $18,690 and then into range support down to $18,195. And as I'm sure you're all aware by this stage for the regular watches of this analysis, $12,185 is that downside equality objective. Okay, traders, that wraps up the weekly market outlook for week commencing 24th of October. As always, traders, plan the trade, trade the planner most importantly. Now it's your risk until next week. Thanks very much.


Hello friends, I am Sanjay Gupta. I welcome you on my channel. You can watch various programming related videos on my channel. So you can search it. You can subscribe it for various updates. It contains more than 800 videos. You can search those videos through the keyword programming by Sanjay Gupta on YouTube. In this video, I am going to demonstrate you how you can use variable length argument list in Java. Variable length argument list means you have to define a method and that method can receive different quantities of arguments through its call. So let's do it how you can implement this concept in Java. So name of classes, where length, arcs. In this class, I will be defining two methods. One will be defining how you can receive variable length arguments and another method will be calling that method. So this is first method whose name is sum. Its return type is double. It is of static type. It will receive double arguments, but quantities of argument is not specified. So I have used these three dots. Watch these three dots carefully with data type. So double then three dots. It is a notation which is used in Java so that a particular argument can be converted into array. So this ARR is not a variable here. It is an array which can receive different quantities of arguments which will be passed through the calling of this sum method. After defining this method, another method will be main. So inside main method, I will be calling this sum method. So let's write calling first then I will be finding it. So I'm going to declare three variables of double type. Inside system.out.println, I will be calling sum method and I will be passing arguments in it. So you can see at line number 11, I have called sum method and I'm passing two arguments. At line number 12, I am calling again sum method and this time I am passing three arguments. And for these two different calls, I'm going to define a single definition. So here I am declaring a variable as which will be containing sum. Then I am going to implement a loop. This loop will repeat ARR dot length time. So see this condition carefully. We don't know how many arguments will be received through this ARR variable. But these three dots have converted this ARR variable into array. And in Java, there is a special attribute that is known as length available in array. So if you don't know the size, you can use ARR dot length to identify the size of array. So that's why I have used it here. So this statement will be calculating sum. After completion of this loop, I can return sum. So this way I have implemented the complete core in front of you. First method, which is sum, is calculating sum and it will be receiving different arguments. And in main method, I have called sum method twice. First, it is passing two arguments. Second, it is passing three arguments. So this is not possible with C and C++ because there is no such kind of feature available. You have to pass a required number of arguments at each function call. But in case of Java, you can pass different quantities. Now I'm going to execute this code. I forward to save this code. It is in the output of previous code. Now see this. I have passed two arguments A1, A2. So first argument is A1 whose value is 2.5. Second argument is A2 whose value is 5.5. So if we add these two numbers, sum will be 8.0, which is correct. If I add 3.5 also, like at line number 17, I have passed A1, A2, A3, 3 arguments. So 2.5 plus 5.5 plus 3.5 makes 11.5. So this way you can see the program is working properly. I hope you have understood how we can use a variable length argument list in Java. So using this feature, you can pass different quantities of argument to a particular method. I hope you have understood whatever I have demonstrated in this video. If you want to watch more programming related videos, you can search the keyword Programming by Sanjay Gupta on YouTube. Thank you for watching this video.


Insecurity and the lack of dividends of democracy are responsible for the low turnout of voter registration. These were the words from the INAIC Resident Electoral Commissioner in Imo State, Professor Francis Isionu. Isionu was speaking when he paid the Imo State Governor, Hopu Zodima, a visit. While responding, the governor said the government will work with the commission to sensitize residents to get their permanent voter cards. We're into a new election cycle and currently we are on with the continuous voter registration exercise. And the state is not doing so well. So we've come to ask for one to brief him and to share with him some of our challenges in the field and then to seek for his intervention so that we can change the narrative as it used to be. We want to see how to up the number of new registrants. I think that's the basic thing. And then, of course, also to get his reassurance that we are working together, which we have now. In terms of registration exercise, I think we are coming a distant last. In terms of numbers of new registrants. And we think we can do better. And we've come to share ideas about what we can do to improve the situation. So we would really like to support you to cure the two challenges you've expressed. That of our party and that of insecurity. Insecurity, I will tell you, we are currently on top of the situation. And I will advise and encourage you to go about your businesses without fear of any molestation. The awareness that must be created will support you. I will send my officers to you to not only allow your access to government media, we can even support to pay for the private medias to aid whatever misuse you have.