So I'm doing this for my third year now. I'm coming and trying to talk to you about security, because it's what I'm interested in. And I try to sort of vary my talks between attack and defense. So last year's talk was all about mess, ploy, and attacking stuff, and I'm afraid I'm back on defense stuff this year, which is the slightly less interesting side of security, maybe. Well, I don't think so. But anyway. So practical security, practical strategies for securing your web applications. I thought I'd start off with the very inevitable introduction slide, who am I? I've been in security for the last 15 years. I'm currently the director of a company called Seven Elements, based in Scotland. And I'm the Scottish chapter leader for OWASP. I do this every talk I do. Sorry. Who's heard of OWASP? Okay. Anyone use of their stuff apart from the OWASP top 10? Okay. Yeah. OWASP is a project which is designed to create materials for securing web applications. And they've actually got quite a lot of good stuff. They have a securing Ruby on Rails guide, which is also on Ruby guides. So that's worth looking at. I'll get past this. And onto this. You will never be secure. No system, no company will ever be secure. And there's kind of a good reason for that. The security industry has sold for many years this idea that you can do X and you'll be secure. By firewall and you'll be secure. By anti-virus and you'll be secure. By something, our new widget that goes in a box that goes in a rack and a server rack. And you will be secure. But basically if anyone ever tells you do X and you'll be secure, they're either very badly mistaken or they're just abbreviating because they don't think you'll understand. When someone says the system is secure, you know that they're not correct. They're maybe not lying, but they're not correct. And there's two reasons for that. They're missing out two parts of that statement. Who am I secure from? Who am I secure from? Because no system is secure against everything. You can have a brilliantly secured web application. I have two guys with guns walking through the front door and say, I'll be having that server. You're probably going to give it to them. So you're not secure against that. And the other thing, when someone says your system, my system is secure, my company is secure, my service is secure. Well, what do they mean by that? Do they mean the server it runs on? Do they mean that and the database server? Do they mean that and the underlying infrastructure services? Do they mean that and the admins' laptop? Do they mean that and the admins' home machine that he comes into to do administration at night? Do they mean the outsourced code suppliers security? What do they mean by that? So if anyone ever says my system is secure, then say no, you're not. And you can ask some more questions. So what I wanted to do with this talk to start with was go through a couple of ideas and techniques. When you're thinking about your security and you're thinking about what you're going to do and what you're going to spend your time on, because the other reason I wanted to give this talk is security people will try and say you have to do all this stuff, otherwise you won't be secure. And everyone knows you don't have enough time to do all this stuff.  So what do you focus on? It's actually quite a hard question and in a lot of cases security people don't address that very well. They'll just say it's all this stuff or nothing. Either you're secure or you're not. I respectfully disagree with that point. So the first part of the equation, as I said, is secure from who? Secure from who matters. If no one ever attacks your system, it doesn't actually matter if you don't spend anything on security. Literally. You just do nothing. If no one attacks it, who cares? Nothing's going to be exploited. So a brief digression. Safes. Safes are secure, aren't they? Big, huge steel boxes that you put all your money into. Has anyone heard of the Underwriters Lab? Okay. So the Underwriters Lab certifies safes. But they do not certify safes as saying this safe is secure. That safe is not secure. They certify safes by saying, how long will this safe resist attack by different types of tool? And how long, what areas of the safe can you attack? So can you attack just the front? Can you attack all six sides of the safe? And what type of tools can you use to do the attack? Now, you compare that. So that results in a rating compared to people saying their systems, they just say it's secure. They don't say it can resist attack from this type of attacker for this many minutes before he's lightly decayed. They just say it's secure. So that, to me, is perhaps a more realistic way of describing your security. Describe it as saying who people you're expecting to be attacked by and how long you expect to be able to resist the attack. So who is going to attack you? You know, as I said, if no one attacks you, all this stuff doesn't really matter. I was thinking about this. I was trying to think how to present it because security people spend a lot of different times wondering how to describe attackers. So I thought I'd go with this as a model and people can say whether it works or not. Okay, first off, we have automated opportunistic attacks.  They just want a system. They don't mind whose it is. They just want resources. Something of value, actually, not even necessarily resources, something of value. And if you've got something of value, then they'll go after it. So an automated, an example of this would be, I don't know how the Lisa Moon worm has been doing the rounds the last couple of months. So about 6,000 sites got taken out by an automated SQL injection attack. This guy wasn't targeting someone's service. He just wanted to put malware. And essentially what he did was he put an iframe onto the site that redirected anyone who went to visit it to some Windows spyware stuff. So all he was doing was looking to make money and he went out with an automated attack and he got 6,000 servers, not a bad return. And he's probably made a decent amount of cash out of that. And that's an automated attack. Basically, if you're on the internet, if your service is live on the internet, you will get automated opportunistic attackers just by the virtue of being there. If you're accessible, they'll attack you. So that's inevitable. So who attacks me? Those guys, every single time. Opportunistic manual attackers. This is, I suppose, how does it use the term? Script carry is perhaps the term I would use. So this is people who want to just get a website to something to face it, usually something to face it. And they'll do something like cross-set scripting or SQL injection. And what they're looking for is they're doing it for fame, profit, fun, whatever. But they're not, again, they're not really looking for you. They just want a site. And again, they might be doing it for resources. So they might want to do it for somewhere to store games, somewhere to store data for a period of time.  They don't want to use their bandwidth. Great. I'll compromise your server. Directed automated attacks. And I'll kind of put directed. Directed attacks are a different game. So directed attacks is where you have something specifically that's sufficiently valuable that someone's going to take the time to target you. You just want you. And these guys, this kind of attack becomes a bit more interesting to defend against because they won't just come in through the front door. I'll talk a bit more about this. But essentially, these guys are more likely to be more versatile and they're likely to be harder to avoid. The kind of example is if you process credit card numbers. It's a great example. You're probably going to, if you do an lift volume anyway, you're going to get attacked. But other opportunities for being directed attack, if you control something of value to someone else. So if you control DNS infrastructure, if you control certificate infrastructure, so your certificate authority guaranteed you're going to get directed attacks these days. Because the ability to issue certificates is really valuable. Because if I can get this certificate for Google.com, then fantastic, I'm Google. Because most browsers don't know. There are 60 different certificate authorities in every browser which are trusted. Anyone who gets a Google certificate from those browsers will say, yep, you're Google. I'm happy that you're Google. And I'm just going to let you, I'll display the nice green bar. You're obviously Google. Fantastic. And skill levels. So in all this, the skill levels are variable. And this is what sometimes makes it hard. You get everything from someone who will put, or 1A equals 1 into every single field you've got on your site, all the way up to people who will code a zero day. And they'll use that zero day to attack you. Now, zero days are becoming more and more used in real life. And if you are up against really high level directed manual attacks, you pretty much have to guarantee they're going to try and do that. So this is a process where they'll do research and they'll find a previously unknown, or previously undisclosed security vulnerability. And then they'll use that to compromise you. And that's actually pretty hard to defend against. But it can be done. So, know your enemy. So opportunistic attackers, what we've said is they'll attack indiscriminately. They'll attack anybody. So you guarantee you're going to get attacked. They're just looking for resources. They don't really care whose. And sometimes they're looking for specific info. Yeah, so if you leave credit card information lying around, then they'll definitely look for that. And they're increasing complexity. So before it would just be a single attack. They might just do basic stuff that look at the version number of your web server and see if it's vulnerable to something and try and crack it. Now, SQL injection, they'll go much more up the application levels. And it could be curious users of your application. So sometimes users will try for either good reasons or bad to attack your app. It might be that they're just thinking, hey, I bet you any money if I put a single quote into that field something interesting will happen. Or it could be that they're annoyed with you. So one of the things I've seen on government sites is that people think, hey, my money's being wasted on this terrible government site. I'm going to prove how badly done it's been. And I'll go and find cross-excripting vulnerability. So no, your enemy. Two, directed attackers. So they're looking for something specific. Cardholder data, sensitive information, publicity for defacement. And I'll kind of draw this one as being, if you look at these three good examples, actually very handily for me, these three good examples in recent press. HB Gary got attacked. So HB Gary are a security company. And they made the perhaps dubious mistake of suggesting that they knew who the leaders of anonymous were and that they were going to disclose this at a conference. And anonymous took this rather badly and decided to attack first the best defense being a good offense. And they used two different means of leveraging this attack. One, they found a SQL injection and they got control of a server that way. So really classic web app attack. It's been around for 12 years now and is still one of the most used ways of compromising servers, which is a bit embarrassing really. And the other way they did it was social engineering. So they didn't bother with a technical attack. What they did was they faked some emails to come from the CEO. And they said, hi, I'm at this meeting with a client and I really need you to stop an SSH server on this port. And could you set the root password to be this? And the admin said, oh, my boss says I better do this. Right, okay, here you go. And they compromised their servers, they compromised their email archives, they compromised, and then they published it all. And when they published all this information, a lot of interesting things about what they'd been up to came to light. Like they were doing black ops against American journalists. Or they were proposing to the government that they would do black ops. There's no actual evidence that the government took them up on that offer. But they were proposing to do various dubious things. So they weren't attacked because they didn't think of value. They were attacked because someone didn't like what they were doing. So if you're doing anything which could be controversial or which there are groups who don't like what that site might do, then you have to expect that these people will at various levels of skill decide to attack you. The second example is RSA. Have you ever used a two-factor authentication token from RSA? These little key fobs. They're very common for using two-factor auth. RSA got broken into last month. And they still haven't said what the attackers got away with. They got away with something relevant to the RSA algorithm.  First, they said use pin tokens. And they said make them longer. Which implies they've got something of significance to how RSA tokens are secured. How did they break in? They didn't touch the external systems of RSA. They didn't touch their servers. They didn't touch their websites. They sent an email. They sent an email with an Excel spreadsheet to some low-level employees. Inside the email was a flash attachment. In the flash attachment was a zero-day attack. So they had an unprecedented disclose vulnerability in flash, which isn't that hard to find these days it would appear. And when someone opened it, it led to their systems being compromised. Once the attacker was inside, he seemed to have little difficulty in finding the information he wanted to get. So again, RSA were targeted because they had something of value. They had the algorithm which protects RSA tokens. Most people rely on RSA tokens for two-factor. Away they go. And the last one was, it's a little too very high. So they will attack other people, partners and staff. And the last one, which is a good one, was Komodo. Komodo are an issuer of SSL certificates. And they recently also got, actually they didn't get hacked. A partner got hacked. So it wasn't Komodo themselves. Their security wasn't compromised as far as I'm aware. But one of the people who does work with them, who was able to issue certificates on their behalf, was attacked again by a phishing email. So they phished the guy. They opened an attachment, compromised machine, you see where this is going. And they were able to issue themselves certificates from Google, from Microsoft and a couple other places. And the only reason this came to light was because a researcher was looking at Firefox's commits and said, hang on, why are you committing that these certificates are explicitly bad? Why are these certificates bad all of a sudden? And they said, ah, well, that's kind of because someone stole them. So in terms of, if you get directed attackers, it's worth thinking about that. Are you going to come under, and if you are, then it's worth thinking, hang on, I need to think about other stuff, rather than just my website security. It's not just about my security, my website, my web server. It's more about, who do I do business with? What about my staff? How do people get access to my systems? Because the bad guys have kind of worked out the directed attacks aren't always the best way to go. In fact, it's much easier to go and attack a workstation. You know, there's a lot more code there to be attacked. So people have flash installed, people have Java installed, people have a variety of pieces of code that have known vulnerabilities. So, they'll attack that. So what can they get to? This is the kind of, this goes with threat, threat model is kind of a fancy name, we're just saying, who's going to attack you? An attack surface is a fancy name for saying, what are they going to attack? What can they attack? The more they can attack, the more opportunities they've got. So, they can attack your network hardware. And this is the other part of the question. When I said, I'm secure, he said, well who's going to secure from who? And what do I mean by I? What do I mean by I'm secure? Is it your network hardware? Is it the operating system you run on? Web server? Yeah, it's probably in a scope. It's still relevant. Framework code? So people use Rails. If you use Rails, essentially you're relying on the security of Rails for the security application. If there's a vulnerability in Rails, then your app's vulnerable. By default, you're running on Rails. Is it the plugin code of the gems? So do you clone a GitHub repository and use that as part of your production code? Probably. So that's another place that, if someone finds a vulnerability, and they're especially the code's public, they may be able to find a vulnerability. If there's a commonly used gem, why wouldn't they attack that? The web app itself, that's the kind of obvious one. Support systems. So, everyone has systems which support their main services. They have admin systems. They have build servers. They've got various other bits and pieces that go with it. And each one of those is a valid target. And administrators' workstations. Like I said, the easiest way these days, compromise a workstation. You look at the client. If everyone is going to look at Metasploit as a project, so Metasploit's a hacking framework written in Ruby. They claim it's the biggest Ruby project in the world. I'm not sure if that's actually true. That's definitely their claim. And Metasploit, most of the exploits getting checked in at the moment are client-side. So they're taking client-side code, Java, Flash, whatever. So I had this idea, okay, so that's the general concepts. And I think if you're looking at your systems and your services and you want to think, how am I going to secure myself? It's worth thinking about who is going to attack me. And it's worth thinking about what can they attack? So, if it's just opportunistic attackers, there's some things here, which 10 minutes we'll see. But there's some things that you can maybe do quickly that will actually cut down the risk of you getting attacked. If you're getting attacked by direct attackers, to be honest, nothing that you're ever going to do in 10 minutes is going to help, but it isn't going to be the end of the game. Okay, so we're going to go through this lot. And I'll just crack on. Does everyone need to see your site? Well, yeah, we want everyone to see our cool site. We want everyone to use our service. But, okay, what if you're writing an app for a business-to-business application? So you're not writing it for customers, you're writing it for a specific company. Does everyone actually need to see that site? Does everyone need to be able to access it at an IP level, a web server level? Well, maybe not. So not everything needs to be universally accessible. B2B sites, sites accessed by a single company, sites with a specific geographic market. Maybe you're selling something that can only be consumed by a given country. So, GUIP, I mean, you'll see this from things like marketing. So you can market based on geographic identity because IP addresses are tend to be assigned on a region-by-region basis. So, what about restricting at a firewall level? What regions can see you? Or what companies? Ideally, what companies? I mean, if you can see, I'm selling to Acme Enterprises. Acme Enterprises have a public address range of this to this. A firewall rule, only people can get to the server or this to this.  Maybe we'll have to get in some other way, but you've cut it down. And if you can't do it by company, do it by country. Again, if your service is UK only, for example, you might want to say only UK IP addresses. That's what I've done. We've got an administration server that's coming around. I just put that in as a... It took a little bit of time, Matt, about half a day maybe, even just to create a list, put it into the firewall. And because 99.99% of the time, we only ever come from the UK. So, great. And now, it isn't going to stop a directed attacker. So this will not stop directed. But it will stop opportunistic. And this is what I'm saying is, some security people will say, well, don't do that because it won't stop this class. Well, yeah, but it might stop these guys. And you might get away with it as a result. Reduce the number of opportunistic... And the other thing about reducing attack numbers, does anyone run like an IDS, or like OSSEC or anything like that on their servers?  And you'll see lots of them. And to be honest with you, if you see enough alerts, you'll stop looking at them. If you can cut down the number of alerts you get, then the ones you do see, you can say, hang on, this is real. I actually need to do something about this. Whereas right now, if you're on the internet and you're just listening to the noise, then yeah. Okay, don't tell attackers things that can help them. So yeah, using security... Right, okay, so security through obscurity gets a really bad rap. People say, oh, that's just security through obscurity. You can't ever do that. That's a terrible idea. And so it's not bad. Just don't rely on it. Don't tell attackers things you can help them. So if I take it back to like lock and safe, kind of physical analogy, if you see it on keys, if you ever look in an office, you got all these locks on like the drawers that come under people's desks. They have a pattern number on them. And they'll say on them something like 7F3E. And if you know what type of lock it is and what pattern, you can go to the lock manufacturer and say, can I have pattern 7F for this lock? And they'll give you one. So leaving, for example, banners on web servers, it's kind of like leaving the pattern on your lock. You're telling everyone what version you're running. And if they know what version you're running... I'm sorry, I'm a pen tester. I do ethical hacking for a living. And the very first thing I'll do when I get a web server is I will get the headers. And I'll look at the headers and I'll say, right, you're running Apache version of this with these modules, version this, this, and this. Great, I'm going to go away to my vulnerability database. I'm going to look up that version and I'm going to see if there's an exploit. Then I'm going to look at my exploit database. And if there's an exploit, I'm going to use it. Great, excellent job done that I get to go home early. Don't tell people that. Because if you tell them... So if you hide it, yeah, remove banners, remove default pages, the other one. If it's really easy to work out what you're using, then it's really easy to attack it. If you take this stuff away, so there's two different things. One opportunistic attackers will just move on. So they don't care about you, they just want a server. So say, for example, I've got a zero-day and Apache version X. And I'm scanning around the Internet looking for this. If I don't get your version number at the very first attempt, I'll move on and I'll go to the next server. I won't come back to yours. So at the very least, it could be buying you some time for Apache to get a patch out. Or for IS to get a patch out, or for any other server to get a patch out. But if you don't tell them this stuff, then they can't use it. And the other thing is if it's a directed attacker, so today they really want you and you've hidden your banners. They may still be able to work out what you're using, but they'll have to be more noisy. They'll have to make more noise. They'll have to do more requests. So they might do timing. They might look for default pages. But they do the sort of thing that you could detect and react to. It makes them work harder. I think, yeah.  Don't expose so... Yeah. So the most popular form of hacking is using stolen credentials. If I can get someone's username and password, I don't have to break into the system. I don't have to use a zero-day. I don't have to use an exploit. Keystroke logging malware is pretty common. If you've used machines that you don't know the provenance of, so you've logged in from somewhere, there's a reasonable chance they could have a keystroke logger on them and they'll have all your usernames and passwords. Common usernames and passwords are disappointingly still very common. You still see network chip with admin-admin. And the very first thing I do, again, you're doing a scan round. You find a web service for an administration interface. The very first thing you do is go look at the big long list there is a default usernames and passwords for that service. You try them. If you get one, great. Excellent. They get an easy day. And harvested from other site compromises. Does everyone use completely unique passwords on every single site they go to? Fantastic. Do you use a password safe to achieve that? Wow. So there's some really good memories in there. But if that's not the case, password safes. So one password, password safe itself, key pass, it's worth having different passwords for everything. Because if you're tall, can. Because if you've got the same password, say for example, there's been several big website compromises. So forums and various other places have been compromised. Gawker got compromised in their password database. So if you're an accountant Gawker, and you use the same username and password in other places, you can bet that someone went scanning around every single site for those usernames and passwords and tried to use them to break in. So if you use that for administration interface, happy days. You don't have to do anything fancy at all. So exposed down for admin interfaces are a great way to get access. Again, I don't have to attack the website if I can attack the admin interface. So if I can break into C-Panel or I can break into some other thing that you used to administer it, I don't actually have to attack the website at all. And I'll still get my goal, whatever that might be. So running on a non-standard port, another piece of obscurity that gets roundly slagged off, which I actually think is quite a good idea. If you're running SSH, don't run on 22. If you run on 22, all you will get is a huge amount of noise of people trying usernames and passwords trying to break in.  You put it on a different port, any port, much higher up. Then if someone starts hitting that port, you've got a fair bet it's a real attack and you can actually do something about it. It's a fair bet it's actually happening to you. It's not just some random noise on the internet. Again, source IP restrictions. Do you need to administer it from every country in the world? Do you need to administer it from China? Do you need to administer it from Australia? Do you need to administer it from Brazil? Probably not. Lock it down. And certificates. Yeah, certificate-based VPN, if you want to go really heavy, that's probably the way to go. Actually using something like Two Factor. Because admin interface is the key to the kingdom. If I'm getting an admin interface, I can get a hyper, there's a counter and admin interface. It's game over. Maybe you probably wanted to put a bit of effort into locking that down. Password management. Yeah, so use a password safe. Password safe, and this is another one where it's kind of a double-edged sword. So use a password safe and that's great. But if your password safe gets compromised, you're in trouble. So it's all about who you expect to attack you.  If it's directed, they might do that. So it's who do you think is going to attack you as to which, what's the trade-off? Do I go with that or do I sexually hang on? I'm so paranoid because I'm going to get directed attack that I have a completely separate system which is not connected to the internet and I put my passwords there. Which, if you get directed attacks, might actually not be a bad idea. Limiting functionality. Yeah, every function is a point of attack. Everything you put up there is part of the attack surface. So some things are more dangerous than others. File upload is really dangerous. Doing file upload well is hard. There's a couple of reasons for that. If you allow file upload, how do you stop people uploading illegal stuff? Stuff that's going to get you in trouble with the law? That's quite difficult. How many money has YouTube spent stopping people? Obviously, that's their business model, so they're going to do it. If you don't have to, maybe don't do it. What's the stop some uploading malware? Great attack. I upload malware, then you look at it because for whatever reason the other person looks at it. Bingo executes and it looks like the site is coming from. Rich text entry is just hard for stopping cross-out scripting. If you allow HTML tags in your site, it makes stopping cross-out scripting really difficult. Really, really difficult. There's a couple of good cheat sheets out there on the internet which goes to the incredible depth with HTML5. You can go into vectors that you would never, ever think of in a million years or actually run executable code. So those two things are hard. We're thinking very carefully before you include them on your site. Yeah, certain type of data invites problems. Credit card data invites problems. If you want to Ryan's talk yesterday, you will know credit card data is poisonous. Do not allow it anywhere in your site because if you do, you'll have a whole lot of world of pain, both from regulators and from the bad guys because credit card data is worth money. It's not worth as much money as it used to be, but only because so much of it's been stolen. The price in the marketplace went down. And user personal information. If you're running a site in Europe, you nominally speaking have an obligation under the Data Protection Act or whatever European equivalent thereof to make sure it is handled in a secure way. And that's literally all they'll say. So what does that mean? I'll be honest and say no one knows. However, if you've got it and you store it, you must have seen the site. They go to a site, you try to register for the site and it asks everything about you. It wants your home address, it wants your date of birth and you just want to view the content. Why are they collecting it? I do probably make up fake data, but why are they collecting that? Because if they're collecting that and it gets compromised, they're in a world of pain from a regulator, from the legal standpoint. Think about it yourself. Another two-edged sword one, but I think relevant. Yeah, consider whether it's better to let someone else do this stuff for you. If it's not your core business, if it's not integral to what you're doing, then it's worth outsourcing. It's worth getting someone, you know, using a third-party module, using a third-party service provider, getting someone else to do it for you because then it's potentially not your problem. However, if you're going for a high-security level, you're running something where security is really kind of important to you, then the problem with outsourcing is how do you make sure they're doing the right thing? You just acquired yourself a new problem because it's really hard to certify security on systems. You'll see things I've never seen ever had anything to do with SaaS 70s. SaaS 70s is a data center. It's an American auditing standard, but basically all the data centers you use will say, oh yeah, we're SaaS 70 certified. It's completely meaningless.  And the auditor says, yes, you're doing those things. Whether that actually is right or not is pretty arbitrary. So proving someone else's security is really hard. So if you're doing something high-security, outsourcing can be a bit of a hit-and-miss concept. So what can you outsource? You can outsource your platform. You're in the cloud. You're already doing it. You're essentially saying, Amazon, Google, whoever else, you take care of that piece for me. And I'm relying on you to do that thing for me. And if you're doing it right, if you're doing it fantastic, if you're doing it wrong, well, I'll find out the hard way. Authentication, you get gems to do it for you. Writing authentication can be hard. Writing crypto is even harder. The one thing I'll say almost always outsource, every single time is crypto code. Do not write your own crypto code. It's very, very, very hard to do correctly, and it's very easy to get wrong. So I would say almost always, unless you've got some really specialist requirement, don't write your own crypto code. Get a library. There are lots of them out there. And credit card processing, again, yeah. Credit card data is poison. Do not have it on your site. Yeah, and let frameworks do stuff for you. And this is the great thing about Rails. So Rails will do certain things for you, by default. It will do cross-out scripting, unless you turn it off. It'll do SQL injection as long as you don't write raw SQL. And it will do cross-out crest forgery as well, as long as you don't turn them off. But be aware of the stuff it doesn't do. So it doesn't do business logic. So say, for example, someone wants to go in and you've let them buy a product with a minus price. Rails isn't going to help you. Rails isn't going to help you with authorization problems. It's going to do certain stuff for you. So it's a question of knowing, these are the things that Rails does for me. This is the stuff I have to think about myself. Scan yourself. So, yeah, this won't replicate a manual attack. So as we've said before, you're thinking about who can attack you and what can be done to you. Simulating manual attacks is kind of hard without employing pentesters, because that's kind of what they're meant to do for you, although it's worth making sure they do the right stuff. Simulating authored attacks. Different attacks for different layers. And this is the other thing to realize about security scanners is it's not one-size-fits-all. So infrastructure. So I've got my servers and I've got my web servers and my database servers and everything else. There are free scanners. So you can use, I think, OpenVas, which is a free scanner. You can use NexPo's Community Edition, which is a free version of a commercial scanner. And what these will do for you is they will tend to say things like, I have a piece of software. You're running stuff with no issues. And that's the kind of information it'll give you. Also, if you let it log in, you can give it creds. They'll log into your servers and it'll say, these are the patches you're missing. These are common security errors you're making. The other thing that's really useful for it is if you do have compliance problems, so you're going to get audited, run these in advance if the guy's turning up, because A, it'll just make your life so much easier. The report will be a lot thinner. This is a good thing. It's the same thing. It's about $1,200 a license. So it's not free, but it's a year's license. And it's pretty good. You can use it to go around and actually scan all your servers. It will do something for web apps, but not as much as they might like to say, I personally wouldn't use it for web app scanning. So web app scanning. This is the other thing. As I've said, there are people going around and they will scan your site for SQL injection. They will scan your site for cross-out scripting. Yeah, there are free options. So Arachne is a Ruby project. And W3AF is a Python one. The same sort of idea. They'll scan your sites for looking for application-level issues. The thing I would say very strongly about these if you're planning to use them is, don't use them on your production system.  They're dumb. They'll spider your site like every URL, and then they'll go in and they'll fill in all the forms. And if you do it on a live system, they'll fill in the forms about 50 times, looking for different issues. So your site sends an email the time someone fills in a form, unless you want a really large number of emails on a production system and hold it up to people going, what have you done? Don't get a copy of the app. Run it there. Paid, Burp Suite. Burp Suite is a bit more of a pen testers tool, but it has a scanner with it, which is useful. And NetSparker is another paid-for commercial scanner, which is pretty good. NetSparker's party trick, actually, is if it finds SQL injection, it'll get a shell. So you just point at it. You go press button and you get a shell out of it, which is kind of nice. It also is quite nice for demos. You want to prove to someone, hey, look, this is bad. Look, I've got shell. Invest in detection. So this is not a 10-minute fix, but I wanted to talk about it. If you go back to my safe analogy, so I was talking before about safes, and I said that the certification of safe gets is I will resist attack for a certain period of time, say 15, 20, 30 minutes an hour. The idea about that is the fact that within the time that I'm going to take for you to break in, someone will respond and will actually do something about the attack. If you never find your main attack, bad guys can take weeks. Think spend months doing this stuff. In fact, there have been attacks where people do. There's a thing called the Verizon data breach report, which goes into stats from real incidents, genuine incidents. And they said in about, I think it was something like 90% of cases, there was data in the logs which would have disclosed that there was an attack ongoing. And yet, in about 60% of instances, the party was responsible for telling the company they'd been compromised. In a lot of cases, that was credit card information, credit card processor going, hey, you've been cracked, because we're seeing all your cards getting used. So the information is there, but it doesn't tend to get looked at. And this is why logging is kind of good. But yeah, back to the safe analogy. So an application level, so if you're writing an application, it's worth thinking, can I get my application to notice when something bad happens? Because something bad in a lot of cases can be kind of obvious. Someone starts trying to log in with random user IDs to your application from a single IP address.  If someone's feeling likely known attack strings in two parameters on your app, so someone starts putting all one equals one into the fields in your app, or single quotes in every single field, or cross-excripting HTML tags, it's a fair bet you're under attack. At an application level, it's reasonably straightforward to actually say, hang on, if I see this repeatedly, this person's attacking me, do something like at the very least you could terminate their session. Kick him off. You'll annoy your pen testers no end if you do that, because that means they can't automate anything after that. They have to do it all manually. It's a real pain. But it's really useful. It's slowing attacker down, no end. Because if he's trying to do an automated attack, so it's one of these low-end automated attacks, you kick him out of their session all the time, or you blacklist their IP address, or for five, ten minutes, so not all the time, because you might get down on service that way, but blacklist them for a while. If you react to the tag, again, you've got a chance of stopping them, or at least detecting they're doing it. Feeding arbitrary, yeah, dated select fields. So if someone puts data into a field that's like an enumerated value, so you've got a field for country. Does someone start putting random strings in there? Guarantee you're being attacked. So great. It's easy to notice and easy to respond to. The other one with Rails apps, it's really kind of easy to notice. If someone starts looking for... Rails has got predictable structures, it's kind of easy because you know how everything's going to look. You know that there's all the controllers, and if I put one, that's the first ID, and if I put edit, that's editing that user. If someone starts hitting those URLs in that fashion, then you've not exposed them deliberately. It's a fair bet you're under attack. And if you notice that sort of stuff and react to it, you can make the attackers life more difficult, because none of this is about do this and you're safe.  It's all about putting little barriers in the way of attackers to make their life more difficult and down to give you time to stop them, or to give you time to notice and do something else. If you don't... If someone just attacks your app and can sit there for six months trying to work out how to break in, if there's anything, they're going to find it. So, and one more thing I want to talk about for questions, which is compliance. If you have compliance, then kind of disregard everything I just said, because basically do what the compliance says, because compliance isn't reasonable and compliance isn't risk-based. It tends just to be do this stuff. And I was in Ryan's talk yesterday about PCI and the weird part in the security industry if you were in that talk, is PCI is considered the most exacting and most precise and detailed standard in the security industry. Most of them tend to go as far as saying, do good stuff. And if you don't do good stuff, a regulator or a government will come and slap you for it at later date. But they won't tell you anything more, so PCI is as good as it gets. So if anyone's got any other ones like HIPAA or SOX or any of these other things, they're worse than PCI. If you don't get anything that says, this is a SOX project, run away really quickly. Because auditors got to define, basically the big four audit firms got to define what good meant in that world. What that meant was they got to do lots of auditing work for very large amounts of money. Questions? Yeah. So hopefully not. So the Pentage company should never disclose anything about the customers they do work for under any circumstances. So no from that perspective. What I'm expecting for me is if you get someone in to do it, don't just say do a pentest. Do the thinking I was talking about about who's attacking me, and what do I think is going to get attacked before you get the pentester in. Because one of the problems I have when I do the work is people say do a pentest. What does that mean? You'll give them like four days, five days. So you want to get them on to the type of attack you're expecting to experience and the type of scope that you're expecting to look at. They should find level 11 stuff and if they're good guys and you give them enough time and enough scope, they'll find better stuff as well. So Rails, in a way, Rails really helps because Rails takes a lot of the weight off your mind in terms of things like cross-out scripting. The fault is it's good. The only thing I would say about Rails is the predictable aspect. Rails values convention over configuration so the conventions can be used by an attacker. He can say I know where, because there's a lot of apps. Have you ever seen some of the old Java apps? They've got URL strings as long as this. It's an impossible task, definitely in a short space of time. With Rails, I know exactly where all the other actions are. I could, for example, easily probe for common controller names. I could probe for common... any common patterns that I expect to find. So, for example, using gems for authentication, you might know where those are going to be. It makes the attacker's life even in terms of discovering and it also means that with a Rails app you have to be very good at authentication because you can't rely on someone not finding it because they probably are going to find it. I think it's challenging about Rails apps because we can move so fast that as soon as you have a test done you can deploy a feature which needs to be tested and then two days later or two hours later you can deploy another feature which needs to be tested. Is there anything that helps to deal with that? I don't... There's some tools that will do software as a service scanning. So there's people like Qualis who will do... but the question then comes back to how good are they going to be at finding the kind of issues in a specific to a Rails app. They have to be in the same way as automated scanners. They're looking for certain patterns and if they're not used to the patterns in your app they may not find what you're looking for but they'll do a good job of saying this is what other people with scanners are going to find. So essentially you can think of them saying this will take you as far as other scanners. I've often thought that there's something to do and I haven't really looked into it with the idea of testing and Rails and then using TDD for things like cross-out scripting and SQL injection. So you could describe what a cross-out scripting is and respond to it. That'll get you somewhere anyway. It would count some of the cases. So software as a service stuff I don't think there's anything else or running scanners back over it. You start seeing stuff and I don't know if it will work for Rails but there's tools like Fortify which come from the Java world where they are code scanners so they're source code analysis tools and they take it from the white box perspective so they look at the code and look for badness there and that's the process. So every build this runs and then the person's build either gets rejected if you want to or gets flagged to say hey, you had problems in this build so every time you commit code essentially it'll do some checks. And I've seen some people say that the best way to do it is just do something, build up a list of things which are bad and check for that on every commit and say so using this library is bad so certain known libraries are bad or if you're doing things like opening files that's dangerous. That's the way to approach it. On that, the one thing that turns out to be quite difficult is where apps start making more heavy use of JavaScript things like spiders start falling down so the common technique for all scanners is they will spider your site to find resources and then they will test those resources. If you're starting using things like well if you look at Twitter or Facebook as an example and they're using the hash band syntax a spider's going to look at that and say that's a comment. So everything after the hash is a comment that's standard URL syntax which we obviously would just completely fail. I'm actually not sure, I've not seen any scanners actually deal with that concept well yet. It's probably not widespread enough to make it relevant but in time it obviously will be. Anyone else? Cool, thanks very much.


This is Dr. Kabeen Raj Dev Singh. He is one of the best students ever graduated from Danny Institute of Medical Science with an impeccable academic record. May I come in, sir? Corbin Singh. Why don't you sing for us Corbin? Who we reveal we are. We, one that nobody's really been thinking about, nobody's talked about at all. Just a little one that kind of slipped in. Some of the little unknown actors in it as well. Yeah. Called Kabeer Singh. It's going to be part non-spoiler right at the beginning and then we'll do a spoiler review for you. Right. Right after that and I'll let you know just so you can hear about it because it's new. So correct. You can go away and watch it and then come out. But this is a remake of Arjun Reddy which we did not get to see. Sorry. Sorry, I know a lot of you are mad. Lost time this week. Yeah. But apparently it's a shot for shot remake so apparently we saw the same film. Yeah. I do. Kabeer Singh is a remake of a Toluga movie, Arjun Reddy 2017. That's a really quick turnaround time to remake a movie. Where a short tempered house surgeon gets used to drugs and drinks when his girlfriend is forced to marry another person. Gets used. Used? Gets used to drugs. Gets used to it. Used to it. A short tempered house surgeon gets used to drugs. Used to drugs? Not used. He gets addicted to drugs. Yeah. This isn't very good.  I wasn't an addict. I just got used to drugs. I guess that's another way of saying that. Hey, are you an alcoholic? No, I'm just used to it. Yeah, I don't have an alcohol problem. But it's directed by Sandeep Reddy Vanda, who also directed other movies. Well, Arjun Reddy. Oh, I didn't realize that. Same director of Arjun Reddy directed this. Yes. Wow. But obviously it's starring Shahid Kapoor. Say her name for me. Kiara Advani. Who I don't believe we've seen her work before. If we have, it was very, very, very small. She's in M.S. Doni, which we haven't seen in the trailer. So yeah, this film, obviously, I think deals with... I don't know if I agree fully with that synopsis. Yeah. Getting used to drugs and alcohol. This is about, not his relationship, this is about an alcoholic drug addict, guy with mental illness and depression, who is a womanizer and slightly misogynistic. More than slightly. And that's, I think, the big controversy with this film is that people think it's praising misogyny. Right. And all that kind of stuff. I wouldn't agree with that at all. Me neither. I think this is a... Was he misogynistic? Yes. Was he a womanizer? Yes. Did he hit her? Yes. Or they're alert. Sorry. But that... Maybe it's... If somebody told me that in India, they don't have a lot of films like this that feature characters. It's either they're a good guy or they're a bad guy. Right. And this is a complex character. A complex character who has lots of flaws. Right. And this story is about a guy who is deeply flawed as a human being in multiple aspects of his life. Who does take a sizable character arc? Oh, yes. Most definitely. And he... What was I going to say? I don't know. If I was your brand, I could tell you. Thank you. You're welcome. I was going to say something. Come back to us, Corbin. Sorry, I've gotten used to alcohol. Him in this film and also I don't see this film as glorifying... Not in any way. Just because a film is a film doesn't mean it's glorifying what it's talking about. There's a ton of films that talk about awful people. Murderers? It's not glorifying murder. Right. Well, it's the same thing that people will talk about. Movies that use firearms and say that the film is glorifying firearms. Most of the time I think you have to use your brain and know what is right and what is wrong. This guy was a misogynist and was a womanizer and did hit her who he did and that was wrong. Not saying it wasn't. And it's not a trade as a good thing in a film. Yes. In fact, when it happens, you're like... And people just did that. It's awful. We can talk about that in this further review. But Shaykh Kapoor's acting off the charts is phenomenal. He's always good. I thought you were about to fight you. No, no, no. It's like with Nawazid and it was like he never had a false moment. He was phenomenal. I loved all that. The film, if you're not invested, I can see why people... When he walked out, he said it was long and I said I'm not going to say that it wasn't long. If you're not invested in this character or this relationship, which I was. I can see why people might think it's a little long and drawn out. I didn't really have that issue. My biggest issues with this film would be the score and not necessarily the songs. I love the songs. It's the editing of them. Okay, that was the issue for me. And for me, when it first started, I thought I might not like it. I actually liked the weird edits. Yeah, you think? I actually... Well, it's just like there would be silence and then the next movie was like... Well, it was used comedically a couple of times. Yeah. And it worked great with that comedically. And then it did that shift and I just was in this place of... He'd go perky director. That's kind of how I felt about it. I can see why people wouldn't like that. And I would not have a bone to pick about it and try to fight with them and say... For me it was just... He used a lot of the sound to convey emotion sometimes. And I was like the actor could have done that for me. If you would have let him do it as opposed to putting this... But the songs. Yeah, no, the songs were phenomenal. I loved the songs. As was the little... There was kind of a pretty theme. Oh, yeah. She definitely had a theme. She had a theme that kept coming back. But yeah, I would definitely say go watch this film if you want to. If you have issues with... Because a lot of people apparently have issues with glorifying misogyny. I think if you use your brain, you can know that it's not doing that. They say multiple times in it that this character...    I was more bothered in a sense with the dad and gully boy. Oh, yeah. And the way he treated his wives. Yeah. And that was... That was more offensive to me. That was way more offensive to me. And obviously when he hit her. Yeah. He does hit her once. So let's go into spoilers and talk about it. Yes. But I would definitely say go see this phenomenon. Absolutely. Especially for Shaheed's acting. That's really good. And her... I thought she did an exceptionally good job. She did very, very well as well. Yes. But if you don't want to hear any spoilers. Go away. Leave now. All right, so spoiler time. So yeah, this film, the relationship... Did you like how they did the whole story? It was kind of... It started out with him basically already... I believe it was already strung out, right? Because he already had the beard. Well yeah, because they did kind of... They did flashbacks in an intelligent way. And then forward. Yeah. And then back and forward. And one of my favorite flashback moments was him stepping on the glass. And it immediately going to a foot with a glass in it. And it's actually her. Not him at that moment. It's her from the past. Yeah. And I liked those quick little... The director was like, You're smart enough to track with the fact that I just did a flashback. Yeah. That was great. Well, I will find anybody who says Shaheed is more attractive without a beard. He literally turned to me when the beard came back on. And he's like, Yeah. And I at one point, because it was so funny, the times... It was right after the moment where she's giving the speech. And the guy says something about it being boring. And he comes out and is like, who said that? And he's standing there. I turn to Corbin and I said, Don't talk about my wife. You can relate to that character. I did. I would love to play that character. That is a Corbin Miles character. Freaking much. And ever there was one. And here... Back on the thing with the people that think it's a... Misogynistic, horrifying. And we can talk about that a little more here. Films are meant to tell stories. Correct. They're not meant to tell just good stories. They're meant to tell stories. Right. This kind of story happens all the time. Correct. And so you don't need... And that can also be one of my second biggest issues with the film, which was the ending. I knew you wouldn't like the ending. I didn't... No, not all the parts I hated. I know what you don't like in particular. But... I love it. But the story... Films don't have to have a good guy and a bad guy. True. And they're both black and white. And he ends up with a happy ending or blah, blah, blah. And bad guy, if it's a film about a anti-hero basically. And I wouldn't even call this guy a hero. Films, I think that's one of the biggest issues with a lot of films in India. Their main character is the hero. The hero. He is not a hero. No. At all. No. He is a deeply flawed person who is drunk and alcoholic. Correct. And major anger issues. Major anger issues.  It's his anger issues. But here's the thing. Let's talk about his character arc and continue along with this aspect of it. I saw a really well done in terms of it being believable for a human trajectory of transformation. Because he doesn't just go from being screwed up to now I'm clean and I'm great. That would have been awful.  But I don't like who I am. The court scene goes great. In that place. He played that phenomenal. And he says to his brother, you know, my whole identity has been this.   It's got to stop. It's got to stop. It's got to stop. And when he says I'm an alcoholic, that for me was his moment. Because everybody who is a drug addict or an alcoholic or a womanizer and comes to the realization that their behavior has been bad has to have a moment. They have to have an epiphany. It does come. And I believed that that moment for him was the epiphany moment when he said that. And I loved the way that that progressed because it wasn't just simple. It remained complex. And that's why I didn't view his behaviors as so, the way a lot of people are jumping up and down and freaking out about this. I don't understand why people are saying this glorifies it. Yeah, I think it's because they don't see this a lot. Because we watch Oscar films and so they deal with these kind of characters. This is like an Oscar role.   And the gangs of Wasoper. Yeah.  No, wasn't it. In Sacred Games.  He slapped them, raped them. And there's a lot of films we've seen with men slapping women. Yeah. And it bothers me a lot. Yeah. And nobody said it glorified it. But for some reason this one is doing that. And I really don't know why. Here's why I think it is.  And so they're like, I don't like seeing him like this. That's not what it is. I think that's what it is. That would make sense because that's very much in line with what SRK has said about what he does with his movie choices. And knows what his audience expects of him. So he tries to balance the artistic license to stretch himself without alienating himself from the people who love him for what he's done. Yeah. So that would make sense. If people don't like seeing him be this kind of a character, then I understand that. I think that's what it is. But I loved it. Me too. And I love that he made that choice as an actor. Me too. He's just so phenomenal. Okay. I love you, my best friend, Shahid. Now, here's what I want to know. How invested were you in their relationship, him and Preeti? I was, but then I was also okay to let it go. Okay. I wasn't. I wasn't. I wasn't. If my creative... I was fine. Like we can talk about the end now. The end where obviously he came back and... And I might cry again. We'd be asked, by the way, I cried like a baby. I didn't. If I had let myself... If I was watching that at home, I would have made noises. Yeah. I would have been just sobbing at that ending. And I was actually fine with... I didn't totally understand maybe you can explain it to me. How they got around the whole arranged marriage? Did she just get a divorce or what? She just left. Okay. She just left. Three days after the wedding, she bolted. Gotcha. Okay. I don't think I caught that. The subs were white and a lot of the screen was white. And so I didn't catch a lot. A couple of times they just trick and put a sub up there like with two sentences and it was up for half a second. Yeah. It was like, hank. It was a little weird.  Yeah. I love that scene. Okay. I know what you don't like. But I mean at the end... No. Yeah. I didn't. I hated it. I knew you were like, come on. Don't do that. I hated it. That's not believable. I loved it. I would have ended it differently. Of course you would. I know. I would have ended it exactly the way it was. I think that's why a lot of people are upset is because they ended up back together.  But I think they kind of... I think he knows it was a mistake. I think I do too. It would be one thing if he was like abusing her the whole time. Exactly. And he kept hitting her. Which he was. He was verbally abusive. He was verbally abusive and it was the tension between a man being forced full and going after what he wants and being protective and saying, you're mine. There's a positive to that. He took it too far. Obviously. But he changes. We watch that change in him. One thing, if he was like the guy from Gully Boy or he was hitting her all the time. Right. And all that kind of stuff. No. If he had hit her, if it was a repeated act of hitting, it would be like, okay, you do not need to be with this guy. No. One time it was like an atrocious offense mistake. And I feel like she forgave him in the end. Also why she hit him. Which also, if you're upset about that, you should be upset about her hitting him. Multiple times. But whatever. We'll ignore that right now. But I think she forgave him and she hit him a bunch of times. I think that was kind of her frustration and forgiveness. For sure. For sure. I thought it was beautiful. I thought that was fine. I would have ended it differently, but I was fine with that. The issue I had with it was that the rest of it, it all's now up in a little bow.  But now I understand because I love my daughter and she loves you and I forgive you. Heck freaking yeah. I don't like it. Yep. Makes me want to drink. Sunshine makes me want to get used to drinking. Happy endings. We need more of them. Yes. And the thing that just destroyed me. And there's a lot in the movie that destroyed me. We don't need to get into it. But, and I'll probably start getting emotional when I, because I didn't see it coming. I don't know if you saw it coming. I did.  Are we talking about in the copies? Really? You saw it coming too? I didn't, because I'm so not, when I'm pulled in and I'm rooting. I heard you. I am verbally said it in the theater. I am, I am waiting. I'm waiting. I'm like, okay. There's no way this movie ends with pretty just being gone and married to that guy. That can't happen. They're supposed to be together. That would have been nice though. They're supposed to be together. He's got to go back to her. So when he goes back and she turns and she's pregnant.  That would be great. And then when he comes back. That's real life. Right?  But did you notice when he said that I can go talk to him. He wasn't being his old angry self again. Where he's like, I'm going to go and I'm going to get in the space. I'm going to tell him that you're mine. Well, he was deferring to her at that moment and saying, tell me to go talk to him and I'll talk to him. And so she finally says what she says. And then when she said, there it is. But she says he never touched me. I thought, okay, what did he just, obviously it wasn't an intimate moment. He probably just used you for the sex. And wait a minute, she's saying more than that. And when she said to him, this is your baby. I lost it. I saw it. I lost it. I lost it. Yep. I was done. So it's, it's definitely a, I didn't actually, I didn't know cause we didn't see Arjun ready. And I'm sad we didn't, but I'm also happy we didn't. Right, me too. Because I think most of the reviews you're going to see are people that have seen Arjun ready. Right. And so they know it's a shock. They knew what was coming. Right. It was a completely new experience for us. But I wanted to, one of the reasons I was kind of happy to experience this is because of how much we like Shane Pippor. Yeah. And really, really like to be introduced to this character in the story with him because we've really grown attached to his work. Yeah. And he just plays freaking lunatic, angry, beautifully. But, but subtly. But subtly and the thing I was happy for and I was, I wanted to see and I knew it was there because I've seen it in other roles he's played, especially believe it or not. And at the end, when, when the walls were down and he actually got emotional as she was talking to him, I needed to see that from him. The investment. I believed 100% that these two people were in love with each other. Believed it 100%. Totally. Yeah. That was just really, really well. Yeah. And I didn't know it was a love story. Oh. It taught me by surprise. Yeah. I didn't know it was supposed to be like this big love story. Big love story. Maybe why people are also upset because they don't think people that have problems in their life should be in love. Yeah. It's true. No one, not only the people who deserve love should have love. People are perfect. They never make mistakes ever. Those are the ones that deserve love. The broken, they don't need love. They don't deserve love. I just don't get it. I don't either. I don't get it. If you don't like, if you didn't like a film because of that, that's your thing. That's fine. I didn't see any glorification of anything. I saw it as all, it was all bad. No. I love characters like that because that's how real life is. Yes. A broken guy. People's stories deserve to be told regardless of if they're good or bad. Yes.  And I believe part of the reason he was able to get through to the other side of all that was because of her. And no, he's not a perfect person. There are no perfect people, guys. No, he's far from a perfect person. No. It was actually, maybe you can explain. I thought it was a very similar relationship partially in terms of notebook. Do you ever see the notebook? No. Oh, never mind then. Yeah, never mind. I wouldn't know. It's an awful relationship. Is it? Let's see.  People think it's like this big rent. I'm like, they have a terrible relationship. No, I've seen movies like that. There are people like, oh, I love that relationship and that love story. I'm like, that's not a love story. That's a poisonous relationship. This wasn't that at all. At the beginning. At the beginning it was the way he was initiating it. But in a notebook, she is that way to him. Ah. She's like a verbally and emotionally abusive person to this guy. Yeah. Yeah, there's some films I can't catch any off the top of my head right now that are. It's like, why are you guys rooting for this couple? This is a really awful, unhealthy relationship. But yeah, I would say definitely go see it. I would definitely give it a B plus A. For me it's an A. Yeah. Yeah. The only thing, and again, this is the fricking, I really wonder, they have to have done the money comparisons to see, is it better for the theaters in India to have the intermission breaks so people can buy the concessions and things? Or is it better to have more show times because the run times are shorter and sell more tickets, which is more profitable for them? I'm guessing they've done the math, which is why they had a big uproar about don't take away our intermissions. Because I think this movie would have benefited from, and I've grown accustomed as you have to the runtime, I would have liked to have seen this clipped by at least 25 minutes, at least pacing wise. It could have been. I could have seen that. Yeah. But it doesn't deter me from it? It didn't bother me that much. It doesn't deter me from it. My only thought of that was how potentially, and I was thinking specifically about an American audience because I know you do too. Yeah, American audience. I want to see films from India seen in America. The theater could have and should have been full, and it wasn't on opening weekend. No, we got recognized in the bathroom. Yeah, we did. We really did. But one of the deterrents to Indian film is going to be first, obviously, the subtitles, and we can't do anything about that because you can't fix stupid. No. Second is the long run times because Americans will see the runtime in about three hours. Is it an Avenger film? Yes. Because if it's not, why would I do that to myself? Yes. And that's where I'm like, on the one hand, I wouldn't change a frame, but on the other hand, it's like, man, to make it more accessible to a broader audience. In certain films do that. I think that's why you see a lot of two hour films. Yeah. Yeah. Now. For sure. But yeah, I understand what you're saying. Yeah, I would definitely go see this film. 100%. 100%. Well done. Good job. And this girl, I really love this girl in this. And the director as well. Yes. The director did a great job. I thought, we don't need to go into all the other things we've done long enough, but as far as, we didn't talk too much about her. I thought she was beautiful. And I thought, I believed her as someone to fall in love with. She didn't even say very much. Didn't need to. Exactly. Didn't even need to. If you didn't say a lot and you had that emotion come out for her. Yeah. She doesn't really say much until the very, very end. And then she just lets it all spill out, which made that scene so much more powerful. Which is very similar to Brokeback Mountain with. Yeah. Yeah. Very good comparison. Very internal. Internal work. Internal work that there does come a moment where they just can't take it. Which for her, I thought it was beautiful and it was directed so well. I would love to know if the director used multiple camera shots on that park bench sequence so that they could just capture everything in a moment. Yeah. Rather than try and get it from his vantage point and her point of view. Because that just felt like it was a singular moment, especially for her. Because that moment for her is her cathartic pinnacle moment for her character. And I thought it was beautiful. Yeah. So, yeah. See it. Go see this film. Cabir's. Wait, hold on. Your Corbin's saying Corbin's saying out.


His physical mannerisms are aggressive so and and I am concerned about I feel threatened by him Marjorie Taylor Greene channeled her in our Central Park Karen today when referring to her own colleague Jamal Bowman And the reason why he gets under her skin so much I think is because he gives her a taste of her own medicine and she can't take it See she's someone who likes to be rude and confrontational to her own colleagues Corrie Bush had to move offices when she was first elected because of Marjorie Taylor Greene's Confrontational behavior, but yet when somebody does that to her all of a sudden she feels threatened See she can dish it, but she can't take it So let's listen to her remarks and then I will provide you with the context to demonstrate how she is lying about Jamal Bowman I had to have so much security. There was not enough. I was swarmed. It's all on video everyone can see this But I will tell you what's on video is Jamal Bowman shouting at the top of his lungs Cursing calling me a horrible net calling me a white supremacist, which I take great offense to that It's like calling a person of color the n-word which should never happen Calling me a white supremacist is equal to that and that is wrong Jamal Bowman was down there cursing at me telling me to get the f out of there And he was leading the mob right outside the vehicle I was sitting in we have this all on video And then at the Capitol steps yesterday He was the one that approached me even CNN reported that yelling shouting raising his voice. He has aggressive His physical mannerisms are aggressive and he just recently shoved Thomas Massey At just outside the house chamber. I think there's a lot of concern about Jamal Bowman So and I am concerned about I feel threatened by him He not only let a bob mob there, but his boisterous lies and I'll tell you another thing he said outside there He was saying save your party. I kept telling him no save the country. It's not about political parties We shouldn't care about political parties We should care about the country because no matter what our political beliefs are Jamal Bowman, I don't know what his political beliefs are. I know what mine are but we both We both swore an oath to serve the country here in Congress as representative So I I am very concerned about Jamal Bowman and he's someone that people should watch.    It's your white supremacist beliefs that are offensive Now she's gonna turn around and claim that pointing that out is tantamount to calling people of color a slur I just what do you even say? This is somebody with an immense amount of power.  Let's get to the exchange where she claims that Jamal Bowman made her feel threatened because he was being aggressive So this is what she was referring to that took place on the Capitol steps yesterday Save the party You know parties hanging by a thread The party's hanging by a thread You gotta say the party Listen, no more QAnon No more No more debt ceiling nonsense. Come on now. Save the party No, we gotta save the country. Save the children. Do something about guns. Right, so close to order Save the children What about the children? Hey, where are the kids? Where are the migrant children? You guys have lost them. We love them. We love the migrant children. They've been lost them. You can't find them. Where are you talking about? Who are you talking about? Yeah, migrant children. Listen, you don't know who they are. Oh, you are sadly a single force. Hey, let me tell you something. I need you to say it to the party. Save the party. Save the party. Yeah, so as she was pointing and yelling herself, she felt threatened. I mean, you were being as aggressive, if not more aggressive than Jamal Bowman. Why shouldn't he feel threatened by you?  They're as big as Jamal Bowman's. This was an impromptu playful debate. His mannerisms were very clearly not aggressive. He wasn't even angry. But yet, she claims that he had a threatening demeanor. Okay, Karen, sure.  Everyone can see that she's embellishing and she's lying, right? She knows what she's saying about a black man. She knows the stereotypes. She knows what she's doing. Now, she also referenced how he was yelling at her when she was in New York protesting Trump's arrest. And keep in mind that she, on her own volition, traveled to a state that she does not represent to be purposefully antagonistic. She knew her presence would trigger counter-protests. And it did. And yet, she had to leave because the crowd didn't like what she said. They were getting too rowdy. But yet, she conspicuously places all of the blame for the rowdy crowd on the big, scary black man. Let's watch. Now, let's talk about the truth. Get out of here. What inspired that today? What inspired that today comes in? I was born and raised in New York City. This is the city that I love. It's a city focused on hard work and love for all people. We will never accept hateful rhetoric in our city. Any rhetoric that is divisive, any rhetoric that uplifts white supremacy, we are pushing back against that in all its forms.  Do something about affordable housing. Do something about childhood poverty. Do something about poverty change.  You'll need to be in New York City talking that nonsense. Go back to your district. What are you doing here? You're here for politics. You're here because you want to be VP. You're here for your own fundraising. You're here for your own nonsense. New York City stood up to Marjorie Taylor Greene to get today to let her know, get the hell out of here. Don't open one word in our freaking city.  Didn't you hear that that's deeply offensive? Have you apologized to her?  I saw the video and as you saw, after she was already in her car, that's when he yelled, now let's talk about the truth, get her out of here. And then he proceeded to talk about how much he loves his city and how she needs to focus on serving her own constituents. That's threatening. That put her in a dangerous position. Now I'm not saying that it's absurd for her to feel intimidated by a large crowd because anyone would. There were a lot of counter protesters there and that's why she left.  Now you saw what he said, but let's go back to her claims about him because it'll become obvious that she lied. Jamal Bowman was down there cursing at me telling me to get the F out of there and he was leading the mob right outside the vehicle I was sitting in. We have this all on video. Right, we do have this on video unfortunately for you.  And in the video he deliberately waited until she left before he started more explicitly criticizing her. But when you have the context it's easy to see, she is obviously embellishing. But let's talk about her claim that he shoved Thomas Massey as well and I'm assuming that she was referring to this viral video where Jamal Bowman was shaming GOP politicians for failing to pass gun control after another mass shooting and Thomas Massey chose to engage with Jamal Bowman on his own accord but according to Marjorie Taylor Greene Bowman shoved him. Well, let's see for ourselves. More guns need to more death. More guns need to more death. Look at the data, you're not looking at any data. You're carrying the water from the gun lobby. Look at the data. More guns need to more death. Good states that have open carry laws have more death. States that have open carry laws have more death. Are you listening to what I'm saying? Call your children are dying. Nine-year-old children. The dissolution is not army teachers. Have you ever worked in a school? Have you ever worked in a school? Have you ever worked in a school? Have you ever worked in a school? Listen, yes, it's a question. Have you ever worked in a school? You will not answer my question. Don't stop and talk to me. Okay, I'll bring it down to that. Have you ever worked in a school? I worked in a school for twenty years. I was a teen, I was straight up in a full new year that interrupted me. I worked in a school for twenty years. I worked in a school for twenty years. I was a teacher. I was a student. I was a middle school principal. I was a college student, I was at the high school every day of life. Bravo, you can't even answer a yes-and-no question.


1960-2007, Kosovovence models were reviewed and categorized into theoretical, semi-empirical, and empirical models, with log-linear and juibana-cree models being suitable for solubility correlation studies. The simplest model, log-linear, estimates drug solubility in water-cosolvent mixtures using aqueous solubility of the drug, while the juibana-cree model predicts solubility with acceptable error but requires an additional data point. This article was authored by Abalgasem Jouiban.


As amazing as homology modeling is, there is one challenge. In particular in science and research, we tend to focus most of our attention on the white spots in the map because that's where we want to explore. And on the white spots in the map, homology modeling usually doesn't work because there are no known homologues. So what do we do then? Well, then we have to resort to these various forms of ab initio modeling. There are two methods that stand out from the crowd here that perform significantly better than anything else. The first one is a very long-time effort by David Baker's lab and it's a program called Rosetta. Obviously named after the Rosetta Stone. So Rosetta can do many things. Rosetta can do homology modeling and other things too. But the main power of Rosetta, I would say, is the fragment-based modeling. So if I have a brand new sequence, the idea here is that maybe I can take my sequence that I don't know what it is and can test how well it fits. So maybe I test fold A here and then I test fold B and then I test fold C and see how well does this work if fold A, what score do I... If I force this to be in A, how good is it? If I force it to be in B, how good is it? If I force it to be in C, how good would it be? That concept would be called fold recognition and for a while we did that with entire proteins. What Rosetta and some other programs do though is that they've made this with fragments instead. So that you start by kind of stealing things from the protein data bank. I know it's horrible. And if I take fragments of a 3, 5, 7 or 9 residues long in the protein data bank and then I start by picking the most common ones and instead of forcing the sequence of the entire structures which didn't quite work, I try to assemble small fragments here. So if I see that this is alanine alanine glycine tryptophan then I check all the places in protein data bank where alanine alanine glycine tryptophan occurs and then I say, ha, they occur. There are 14 different possible segments here that they tend to occur in. Sure, technically it could be others but in all likelihood it's going to be one of those fragments. So then I will pick my fragment A for the first part here and similarly for the second part I will pick fragment B and then maybe fragment C. The problem is of course there is not just going to be one fragment for each part. There will be fragments B, fragments B, prime, B, this, etc. There will be many, many fragments I have to combine. So this is not being a fairly large search problem in the end. Trying to combine different fragments together first testing the fragments and then combining them in different ways twisting the torsion angles a bit. So this is not quite a simulation but it's kind of a similar search problem that I'm trying to give the fragments now. I've made the problem more tractable. I don't have to look at each amino acid individually and now I need to somehow try to fold up these fragments with some more or less physics-based scoring functions. It turns out that this works remarkably well mostly because of the efforts David Slavitt put in Rosetta. So what you would do is that I think currently they pick assembled fragments of three, six or nine amino acids. The fragments themselves will of course not form proteins but they will be parts of secondary structures. Then you make a database of them and this database is present in Rosetta and this is the database now that I have a sequence. I query the database and see what are the candidates for my first nine residues here and then they need to overlap a bit. The other advantage is my fragments are locally correct. There are no clashes in the fragments and everything so I no longer have to move every single atom as I would have to do in a molecular dynamic simulation and if we're lucky you can even use a Monte Carlo optimization and move an entire fragment related to another one than using some sort of implicit solvent model. At some point when we're starting to be reasonably content here we switch over more to physics-based function literally similar to the molecular dynamic simulation and the idea here is that if we think we are really close to the actual protein local minimum at some point I should be able to just go downhill and minimize the energy here. Fundamentally it's not that different from the molecular dynamic simulations you're doing. The key difference is that in the molecular dynamic simulation you try to actually model the kinetics, the natural motion of the system. Here the goal, we don't care about the natural motion here. We don't care about how the protein folds. All I care about here is trying to predict what the end result should be and that occasionally enables you to take some shortcuts. If I haven't praised Rosetta enough I will keep doing it. The key difference in Rosetta is it's not a rocket science method you could argue, but the effort here is in the consistently having spent 20 years tuning everything and really made all these algorithms work. A couple of years ago David published a paper in Science where they showed that they could actually predict picking 16 small proteins that could predict all of their structures within a few angstroms. I think five of the 16 were within 1.5 angstrom resolution. Again, you might not have any idea how good that is but at 1.5 angstrom that's better than the resolution you would have in a cryo-EM experiment. A really good x-ray structure might be one angstrom but at 1.5 angstrom you're good enough. There is simply no point in getting anything better. So at least for these small proteins Rosetta was competitive with experimental structure determination. Now, if this was not enough they continued a few years later and added more information. So now we need to find a way to add more biological information. How can we do that?


So we're here at the ZTE booth and this is a new ZTE S6 Blade S6, so How big is the screen? five inches, so we have a five inch screen and Okay, that's the Android 5 so lollipop system and ultra core and 2 gigabytes of RAM 16 gigabytes of ROM and And the front camera is about five megapixels and the back camera It's 13 megapixels 14 megapixel. It's a nice 15. It's a nice back like this you have a micro USB down there and Nice thin very thin design Nice buttons looks pretty cool a good display. This is a 720p display and and So here the specs it runs Android 5 and It's an octa core CPU, so let's go a little bit than the settings There you can see that it's really Android 5 There it is Android 5.0 is our price so how soon is available? $250 that's a really good price available online And there's a one button down here, there's no buttons on the side three buttons that two lights you can see Whoa, yeah, just more lights right here and there. This is a menu and back and you can modify and put Here the menu and Nice so this is This is a much better price than certain other company name I think 250 is great. Let's go around here This is the big one we're talking about the ZTE blade six. Can you hold this also? Let's go on the other side. Yeah, so here ZTE blade S6 S6 plus this is also octa core. Yeah, eight nine three nine octa core CPU So it might be a 64 bit The new midi flex 64 bit. I'm just guessing and Let's go around a little bit. It's very responsive. It's nice display What's the price of the plus? It hasn't fixed yet because it isn't in the market. It would be itself on every is this one already in the market Yeah, all your life. So April this one available. Maybe 300. I'm just guessing maybe yeah, and we go in the settings here also It's a very smooth experience with Android 5 I'm thinking maybe 300 and let's let's look in the back of it It's also very thin That's not metal. It's plastic So it could be less heavy but it's a very cool Build quality and We are We are something that I think is much better value. You know this as much better value Then iPhone 6 and iPhone 6 plus that's that's what I think much more affordable I Can show you the gesture control that it's available in that one and it's like if you shake twice the flash turns on You shake twice again, it turns off, but you maybe can do like this Yeah What does that do? What is that for? For the front camera, it's on. Oh front selfie. Yeah, like a mirror and if you want and you do like this It's improved that moment and then it does The normal camera, yeah And we can see that the camera is really Complete so you can What is the resolution things? It's 30 megapixels So it also does a high-quality video You quality 1080p nice so you in many of the pictures Yeah, we got you All right and So a nice phone coming out Everywhere know as it coming out in Spain everywhere. Yeah, yeah in Europe, I think all right cool. So check it out


Land imager, OLA, and thermal infrared sensor, TURIS, are currently operational for routine Earth observation. Cross-comparative analysis is very necessary for the combined use of multi-decadal Landsat imagery. The new sensor had lower values for the shortwave infrared, 2.11 to 2.29 m, banned for all land cover types. This article was authored by Peng Li, Lu Guangjiang, and Ji Mingfeng.