Jesus is not a good man, maybe he's wonderful but not a good man. If you don't let that man rise within you, then you will remain good and dead. That part of you which has been kept dead for too long, it's time to raise it. Whatever we are referring to as Jesus is not about some man two thousand years ago. It's about a certain possibility within every human being. So that has to rise. It's not that there is no Jesus in you, it's just you kept him hung, impotent. He needs little empowerment. He needs to be raised. So the whole effort is that part of you which we can call Jesus or Shiva or whatever you like to allow that to rise. Can you say Shiva is a good man? No, but he's fantastic. Even Jesus is not a good man, wonderful, not a good man. Anybody who disturbs the existing situation is not a good man, isn't it? Yes or no? In any given situation, someone who disturbs your family situation, somebody who disturbs your social situation or political situation, national or international situation, he's not a good man in that society, isn't it so? So Jesus is not a good man. Maybe he's wonderful but not a good man. Shiva definitely not a good man, but fantastic is. If you don't let that man rise within you, if you do not let that aspect rise within you, then you will remain good and dead. Dead is good. Dead is always good. Yes or no? Once it happened, a five-year-old boy and his mother went to the cemetery. He had never seen a cemetery in his life, this is the first time. The mother was dedicated to one particular grave, she sat down. The boy went about everywhere, reading all the inscriptions on the tombstones. He went through the whole cemetery, read everything and came back to his mother and asked his mother, Mom, where do they bury all the horrible people? Every tombstone says this was the most wonderful man. Dead is always good, isn't it? Dead is good. Living is trouble. Because living is trouble, we reduced the living to half-dead. Fifty percent life is safe. That's where most people have settled. We must decide. Dead or alive? Half-dead is not good, isn't it? Once Shankaran Pillai was arrested for mixing horse meat in chicken cutlets and selling. So when he went to the court, there was nothing else to do, so he pleaded guilty and they asked how much horse meat and chicken meat, how did you do? He said, fifty-fifty I did. So he got some fine and some kind of thing and then he came out. His friend asked him, what did you mean by saying fifty-fifty? He said, one horse, one chicken, that's fifty-fifty. This mixture won't work. You have to raise the dead. You really have to raise the dead. That part of you which has been kept dead for too long, it's time to raise it.


And in entertainment news, Alariewadjou Ogumefun, better known by his stage name Vector, is a Nigerian rapper and songwriter. He has released three studio albums including State of Surprise and The Second Coming. In anticipation of his second studio album, he released the mixtape titled Barrax La Fiaji, which was released in December of 2016. He's also released a mixtape in October of 2018, The Rap Dialogue, in an effort to keep the spirit of Nigerian hip-hop alive. He also had the longest freestyle rap in Nigeria. Earlier in the year, however, Nigerian rapper Vector released Crown of Clay featuring M.I. Abaga and producer Fields. On July 22nd of 2021, the rapper followed it up with a remix which features Kenyan rap legend, Kali Graf, Jones and Senegalese rapper Deep Adunda Guaiz, inspired by Peruzzi, the song cries, for a Peruzzi or one-day-core feature.


the new catalyst was developed by combining rhodium and nickel with TiO2. This combination resulted in a unique structure that allowed for a stronger bond between the metals and the support. This bonding strengthened the catalyst's ability to convert carbon monoxide and hydrocarbons into hydrogen gas. As a result, this catalyst has been shown to be more efficient than other catalysts at producing hydrogen gas. This article was authored by Hao Meng, Yi Zinyang, Tian Yaishen, and others.


Almost a year to the day that Louisville police officers killed Breonna Taylor during a no-knock raid. The Kentucky State Senate passed a bill which makes it a crime to insult and taunt cops. If SB 211 becomes law, you could get up to three months in jail and a $250 fine if you flip off the fuzz in a way that would have a direct tendency to provoke a violent response from the perspective of a reasonable and prudent person. It's just one example of a slew of proposed new laws that are chilling free speech. While free thinkers are rightly worried, the private online platforms such as Amazon, Twitter and Facebook are increasingly and often arbitrarily cracking down on speech for political reasons. The much graver threat comes from government at all levels seeking to ban or compel speech. If Amazon won't stock your book, you can still hawk it on Barnes & Noble or on your own site. But when the government says no, there is nowhere else to go. Earlier this year, legislators in Kentucky introduced legislation that would make a user entitled to damages if a social media platform deletes or censors religious or political posts. Conservatives who rightly yell bloody murder when Christian bakers were forced to make cakes for same-sex weddings are now trying to stop social media platforms from running their businesses the way they see fit. In Florida, Republican Governor Ron DeSantis has proposed legislation that would ban Twitter, Facebook and other social media platforms from suspending the accounts of political candidates. They would face fines of up to $100,000 a day and the new law would also allow regular users to sue platforms for damages if they feel they've been treated unfairly. Similar legislation has been proposed in Oklahoma, North Dakota and Texas where Governor Greg Abbott has said without citing actual evidence that conservative viewpoints are being systematically silenced. Pretty soon, he bragged such supposed censorship is going to be against the law in the state of Texas. That law, SB 12, is poised to pass the state senate. Back in the pre-internet days, you could count on conservative Republicans to scream about the need to regulate sex and drugs on TV. But these days, they seem to want social media companies to do no moderating of content. So maybe that's progress. At the same time, liberal Democrats who used to scream themselves about violent video games are pushing for more regulation of speech they don't like. In Colorado, a proposed law would create a digital communications commission that would investigate platforms to make sure they don't allow hate speech, undermine election integrity or disseminate intentional disinformation, conspiracy theories or fake news. All exceptionally vague terms that aren't even defined in the legislation. The commission would have the ability to order changes in the way platforms operate. At the national level, two congressional Democrats, Anna Eshoo and Jerry McEarney, have sent letters to the heads of Comcast, Verizon, Dish and other cable and satellite companies demanding to know why such private services carry Fox News, Newsmax and other supposed purveyors of misinformation. As reasons Robbie Suave put it, the demand was an act of intimidation. It's a rare week when high wattage politicians such as Elizabeth Warren or Ted Cruz don't threaten big tech with some sort of reprimand because they don't like what's popular on Facebook or Twitter. The good news is that laws seeking to control individuals and platforms are blatantly unconstitutional because they compel the speech of private actors and because Section 230 of the Communications Decency Act allows broad discretion in running websites and platforms. When challenged in court, these laws will almost certainly be struck down. The bad news is that the laws just keep coming because politicians of all stripes want to control speech in a way that favors their agendas and they don't care whether a law respects the First Amendment. We should loudly criticize platforms for kicking people off in arbitrary ways that diminish our ability to freely argue and disagree about politics and culture. We want more participation, not less. But it's even more important to recognize private citizens and businesses right to freely associate with whomever they want. I find it disturbing as hell that a member of the band Mumford and Sons felt compelled to cancel himself for the pain he caused after publicly praising a book by the controversial journalist standing now. I'm deeply bothered that eBay has delisted old copies of Dr. Seuss books and that Amazon, which once aspired to sell every book in print, sees fit to drop titles that rub some activists the wrong way.  But far worse than such private cancel culture is when politicians tell us we don't have a right to insult cops or when they're the ones setting the rules about what we must prohibit or allow. That way madness lies and it makes the online outrage of the day look absolutely trivial by comparison.


Hey guys real estate gaming here today. We're gonna be playing SCP 96. I'm here with Captain as you can see. Oh, yeah, I can go third personnel. Are you kidding? Okay, so this game acts up. Well. Oh, yeah, seriously come on is here, too We're seriously. Oh, there she there you are. All right, so let's begin So we have to find this SCP 96 Listen where this guy is that I mean we can hear screaming already, but we know what direction he's coming from Okay I just hear a bunch of screaming We're in a giant maze right now, so we have to find this guy The thing is if you look at this guy, oh Wait, we could zoom out. There you go.  Oh, no wait, is that at the end? Okay, stop. Oh God. He's chasing somebody right now Oh, no, all this is at the end Okay, so we're gonna have to go all the way around. Oh God. Are you kidding me?  Oh God we took the long way. He's coming this way actually you guys see him over here the red glowing We're gonna go straight to him.  He's so angry What are you doing? Are you kissing? Are you with us or kissing? Hello, Mr. SCP. Why are you angry, mister? Okay, now he's red Now he's white. He turns red and white. Oh, maybe he could have flashed that point at him Oh, no, look at Captain. Look at Captain's face looking at him I gotta get that face. That face is funny looking Oh, no, but he's not kidding anyway. Wait, did she have an arm or is that the flashlight? Wait, her arm is- she has like double arms. She has an arm holding a flashlight. What? That makes no sense Okay, watch out Captain. Who is this guy chasing? He's not even chasing anyone, is he? It's a sad- sad face for all faces. Oh, you can change your player. Oh Awesome, I didn't know that Let's put a scared face Now what?  R-6 Sounds I don't care if that's by it Oh, no, now he's in killing mode of things Yes, give me everything. I want the hats. I want everything. Oh That looks cool. This is where this hat Okay, let's wear this hat. No, who wear this one? Sounds Where did it go? Okay, wait, let's see what else I have. Victory? Where did they go? Okay, they took this way Oh Goodbye, oh that's from like the credits like when you're watching adults swim Bye, have a beautiful time Wait, oh no, let's do the spa. Oh explosions. Wait, how do we okay? Let's go to the SAP now. Oh We can dance. Oh look at that I think we're having more fun with the animations Then the actual SAP. Okay, let's go to the SAP.  How do we get out of this? Okay, let's go to the SAP. Where is he at? What can we zoom out? Okay, how do we get to him? We go this way No, we don't go this way that way is the dead end Okay, then you need to fix this maze. They're mostly everything is a dead end here. Okay, we go this way Then we go this way Nope, it's a dead end. Come on man Okay, how do we get to that SAP?  What's up? Do you know the way? Do you know the way? Tell me Oh Captain's here. So captain How do we get to the guy? How do we get to the SAP? Let's go to SAP Okay, um How bruh wait, how do we get there though bow?  Why is he typing? Okay. Goodbye guys. It gets this way. Hello. This is for the spawn Where is he at? Oh, he's over there. How do we get over this wall? We have to go like all the way around the whole map.  You see you can't even go through there. How did it get through there? How? Maze is tricky. I think we have to go all the way this way. I'm not so sure you guys Please tell tell what oh I got game pass. She was talking about the hat. She's like what happened to you But I got the hat. I mean I got the game pass Okay, so how did we get there? What do you mean this maze has no edges? They're all dead ends bro I can't even wait is that guy on top? How's he getting on top of them? Did you guys see him? He's literally jumping across the walls. How did he do that? Oh, let's go back around. He's crying. He's crying because he's so lonely Come on captain All right, did you in the video? No I'm trying to find this guy. I'm trying to go to this SAP Okay, maybe this way or was that his shadow? I was like I running so fast the gaming mate Wait, how is he on top? How did he get up there? Oh, I I found the oh no, I didn't find the way you see look at the clothes This maze is insane. And that's another dead end great. It's impossible to get to him To ghetto him It's impossible to ghetto him. How do you get to this guy? I give up bro. This is like the hardest maze I've ever oh, I think I found the way Follow me everybody. I will lead you to the end of the world Well at least to the SAP Oh, no Oh, yes, I did find the way I knew it. I always had that That Don't matter Traded me There you go Let's just dance for this guy animations are 15 dance one. It's not dancing ever. Let's just Dance Wow, he slaughtered me Are you kidding me my guy?  Thank you guys for watching Thank you guys for the amazing support and I will see you guys next time You guys in there. Bye. See you next time


All right, I have just spontaneously decided that I'm going to film a day-in-the-life video right now. I literally thought of it two minutes ago. So let's do this. I have no idea what's going to be in this video. No idea what's going to happen.  All right. It is 721 a.m. and I woke up like 20 minutes ago. So let's get into it. I genuinely am in as good as a mood as it looks like. That is not acting.   Well, let's get dressed. All right, let's get started. So I'm going to go out. You guys can see what it looks like. It looks like to wake up here. Jengu Bali. Oh, unicorns. Unicorns. Okay. Let's see. All right, I'm going to rest in his room to wake him up.  Still sleeping.  Still sleeping, huh? Hmm, interesting. Open up. Let's go. Good morning. Morning. Morning. Day in the life of video.  What is this? Like, this is real. This is real. This is real. This is our lives.  I really don't know what the point of the video is other than to actually show what it's like. Are you talking to me? Kind of. Well, that was like what Surat said. He said, a day in the life video would have, like, not inspired, but like over his eyes so much to what Alfred was like, because like, he was like scared that we just work all the time. Right, yep. Okay. That's the point of the video. That's the point of the video. Okay. So we just had Suraj visit us in Bali.  Just work, work, work, work, work, work, work all day, do nothing else and not actually enjoy ourselves, but that is very, very, very far from the truth. Every day is pretty fun and awesome.  Wow, this is gonna actually gonna be cool. Yeah. And we're going to see all our friends and we do... Yeah, we don't just sit and work all day. Like, we recently came up with a video talking about the whole productivity thing.   Yeah, that's what you can do when you live this life. Look, so right now the time is 7, 7.26. We'll put a little, oh, my arm hurts, we'll put a little time thing in the corner of the video so you'll always know what time it is and then about eight o'clock I'm gonna go down there and we're gonna start grinding. Yeah. The day does start with the grind. Get the grind out the way in the morning.  Yeah, exactly, that's what I wanted to do. We'll film a video, which is gonna be really fun. This is how the day started. See you at the battle zone, baby.  If you don't feel that way, you need to do something about it. You need to do something about it because it's not, if you don't feel that way right now it's not gonna change if you just keep on living your life. Whatever it is, if it's working a job, going to school and it's just not fulfilling you, it's not making you happy, like genuine happiness and excitement. If you don't feel that way, it's not gonna change unless you actually do something about it. And a lot of people are scared to do something about it because you're told that you're not supposed to do something about it, that that's just the way life is.   Almost everyone thinks like, this is not what I want to be doing. There has to be more, I want to do something more, I'm not as happy as I want to be.  And we did something about it and we want to motivate other people to do something about it because there are other options.  And yeah, that was basically just what I wanted to say right here. Back into the video, yeah. Did it stop? Yeah. It stopped?  There was an earthquake. There was just an earthquake, so I had to turn on the camera. Didn't even have time to use the pro camera, I had to go back to the iPhone. That's twice in like two weeks. Yeah, that was very clear. I guess that's what it's like living in Bali. Yeah, they do always- It does not mean an everyday weekly thing. Just your weekly tsunami. Your weekly tsunami. Yeah, we just sat there like, dude, is that an earthquake? Yeah, I was like, yes. It wasn't like that crazy, but the whole ground was just shaking. That was weird. That was weird. But that's probably how this all ends. Is it with an earthquake? With an earthquake or a tsunami. That kills us. Let's say that. What? I'm being honest, that's probably what's going to happen. All is out. Okay. Well, now I might as well do an update for the video. So this is the working station. Let me do a quick 360. Wait. How do you? Wait. I didn't even see it. Unicorns. This is literally where we work every single day. I'm editing a video. Set this up. Try out the video I'm editing. I'm on Facebook, because that's all I do. Try out the video I'm editing. I mean, if you want to see this place in a tour, oh, we'll put a card for the video. Can you be our full-time video editor? Yes, sir. All right, so what time? Oh yeah, what time is it now? It's 9 o'clock. It's 9 o'clock. Stop for a sec. So it's 9 o'7 in the morning right now. I've been sitting here since 8, 15, something like that.  Emailed some accountants.  And yeah, we're going to sit here until 12 and work. Yeah. Well, actually, no. We're going to film a video. Yeah, well, that kind of stuff, yeah. But so from now until noon, it's just work.  And then after that, you'll see what's going to happen. OK. Cheers, mate. So for every one, we're going to do the whole whoop, whoop. So I'm going to do it with your cast, with your broken arm.  You want to see it in our lives.   Like, just with it. And this guy's small. This guy's small. And these, you know. But like, there's 1,000 lizards here.  Oh, but yesterday. The rest is the one we saw yesterday. It was a, I don't know if it actually was. No, it was a lizard this big. It literally deserved to be in a cage in a zoo. Yeah. No, it's not like a iguana. It looked like a Komodo dragon. Yeah. And I'll show you exactly where it was. I'll show you exactly where it was. It was crawling on this green thing. It was like, it was like. If we lived in a place where I knew Komodo dragons existed. That would have been one of them. That's Komodo dragon.  But only because I know that can't be is the only reason I'm saying it's not.  All right.  All right, Rassus. We got to film a video. Where should we go? We know the video topic. What's the video topic? Freck! Careful.  I just smashed my hand. That's fucking. All right, where should we film this video? This is the type of problems we have filming at this mansion. I want to do here. Here? Yeah. Just because like, oh, so what? So what? It looks cool. Should we go selfie mode or tripod mode? So, no, do you like selfie mode or tripod mode more? I prefer selfie mode. Like, I'm watching the video, but it's just hard. It's really hard to, oh, I'm getting tired. And it's a heavy camera. I have shitty front belts. It's like they're weak and it's already getting tired. Because this camera is heavy, man. It's like 15 kilos. Yeah, it's 15 kilo camera. So, let's do, I want to do selfie mode. I like selfie mode. All right, selfie mode.  But we just wanted to tell you that we're about to shoot a video. Oh yeah, what time is it? We're always going to have it running on the screen. We are? Yeah, it'll show. We'll know. But it's filming time. Let's go. Wait, wait, don't move. Wow. Day in the life of video update. It is 2.50 PM. We got back from eating food. We all had burritos. I had a protease shake as well. We're about to shoot another video, second video of the day, with Oliver El Gore. Ole. They didn't even get to see us at Frickin' Crate. I know, I know.  Why would not? We'll do some video. And this is a video from another day. This is our friend Laura. I'm zoomed right in on her face. At least I think I am. Why are you on our shoulder? Hold on. Hold on. Down, down, down. What does my shoulder look like? Hi. Hey. There we go. So I said to do a quick update. We're going to shoot a huge video. Because we're trying to get on that daily video grind. But look, so the point of this video, right, is to kind of see that you don't need to work 12 hours a day. No, no. Really achieve what you really want. But we are in a phase now where we want to level, like you were saying. So we're filming videos as much as we can. For us, that's the thing that I think we can do the most of to grow our business. Delegate what you don't have to do and what you don't want to do. And do yourself like the most important moves you can do for a business. And do those over and over and over and over again. And for us, it's creating videos.    We can't talk to people. We're not getting tired. It's not like that, you know? From the 40 kilo camera.  Even when we're working, we're having fun. Right? Yeah. Is your rent over? Rent's over. Let's film the video. Okay. Whoa. Rasmus! We need to go to the gym now. Are you ready? Are you ready? Okay. Oh, look who's here. Yeah.  I need my flexibility. I always needed to. Look who is here today. Hold on.  That was the most, that was the greatest greeting ever. Have you ever, have you ever seen a, was it scary movie? Oh, I do. That's exactly what it was. It's a day in the life, dude. What happened? Yeah. All right, so the workout's almost over now and I completely forgot to actually get footage of it. I'll do one set for the photo video. More than a fast motion something. Yeah, we're supposed to say what time it is. What time is it right now? Oh, it's a little bit there. 5.13. We're normally, it's a little late. Nah, no it's not. It's about when we go to the gym. You can't do two sets for the video? Well, I just did a set. I'm doing two more. Two more sets? Yeah, of another exercise. To the place we park and you guys just do a video walking to the place. Yeah. Yeah. But Rasmus, I was gonna catch you on the toilet. I was gonna.  Well, we're back from the gym now.  Right? That's what we're doing there. Yeah, only this will turn off. And we're wet here. But see, we don't just work all day. I wet my hair because people surprised. We worked in the morning, then we went out to eat. Then we worked a little bit more, filmed a video. Working a lot now is filming videos. Three videos in one day. We experienced an earthquake. We experienced an earthquake and then we went to the gym.  Right? And then we, now we're about to go to the beach, do yoga. Maybe we got to eat afterwards. It's like, this is our every day now. Fucking, this is a regular day. This is a completely regular day. Epic day, but a regular day. All right, peace time. Let's go. Do the thing. Do the thing. What's up, man? How was that? Life changing. No, like for real, for real. Super stressful leaving. All right, no, feels good. That was the first time trying yoga ever. In the life of all the other girls. Is yoga a good thing, what? Let's put it up on the screen. Let's find out. What do you think? What are you putting up? What are you showing? Keyword research. But that doesn't really, it's the best keyword. It's not bad. We can make money in it. What about a yoga brand? A world wide yoga brand and we're going to take over the world with it. The end of life update part. I don't know what part it is.  That's not what this is about. But I got to show what it is. Eating dinner. Ramen. Ramen for dinner. And actually we have the first audio book booster live streaming in an hour.  Very excited for that. Yeah. Well, yeah, it's eight o'clock. That thing's at nine. We go to shower and then do that. And then that's the day. All right, Rossies, we have to finish out. We have to finish out this video. Okay. Okay, is the car right now?  We're doing the whole day in the life. People are asking for it. Look. Because we actually have a following that cares about us.   They want to know. They want to see. So let's close it out. We just did the first booster live stream.  We learned so much from her. Yeah, yeah. We had a few Eureka moments.  And yeah, that is a day in our life. That's right. It's not a vlog. It's not what it is. This is way different than a vlog. Yeah. They didn't like it. No, there's a reason for it. It's different. Yeah, exactly.  Okay, finish it off. Yeah, so this video was inspired by Surage because he came here and saw, oh, you guys don't just work all day.  Like, yeah, we do have cool, fun lives.  What time? What time is it? Oh, it's supposed to be a YouTube video. Oh, I'm excited. It's 10, 22. What was the military video? All right. So yeah, that's the video. Give, what's the magic emoji? Yeah. A ramen, do a bowl of ramen. Bowl of ramen. A red ramen for dinner. Bowl of ramen.  That's the video. That's what happens when you join AuditBugging.com Academy. You live in a bonn mansion and you live days like this. Okay, sorry. Stop laughing, it's true. It is true. We just joined the Academy and then this happened. All right.


And I got to cheat, all right, and we're live. All right, so we're here with Mike Stay, another fantastic speaker for virtual DEF CON safe mode. He is covering how he recovered a six digit sum of worth of Bitcoin from an encrypted zip file. And I guess if you just wanna like quickly go into your talk, spend just like a minute or two, and then we'll start asking you some questions. Yeah, sure. So short summary is I used to work as a reverse engineer back in the late 90s. I broke the zip encryption that was used by InfoZip, which was the open source version. And so everybody except PKZip based their encryption on that particularly WinZip that had like 95% of market at the time. And yeah, so then 20 years later, somebody locked up their Bitcoin in a zip file that they made on their Linux box and forgot the password. So they came to me and said, hey, I found your paper. What's the current state of the art? Can you help me with this? And this is your first time talking at DEF CON, right? It is, yes. So we've given him fair warning, but there is a tradition for first time speakers of DEF CON. They get to take a shot with us on stage. QA session is the closest thing to a stage. So thank you, Mike, for providing DEF CON with some wonderful content. Cheers to you, man. Thank you for having me. Okay, so I was actually kind of surprised. So I have never thought about zip encryption as being something that would be difficult to get around. You did go into a couple of different types of encryption. I was also surprised that like, well, I wasn't surprised that early word was as difficult it was, but I later on, the 40-bit encryption that was just really difficult to brute force, that one kind of surprised me. Do you have any other, have you worked with any other type of encryptions that have been surprisingly difficult to get into for being such a legacy weird proprietary protocol? Let's see. There were a couple where they clearly knew enough to be dangerous, but then completely screwed it up. Like early word perfect, you know, the founder of the company had broken that one himself. And then when they released their new version saying, oh, now we're using strong crypto, nobody will be able to break this, went in and found that they took the password and then ran it through DES in the wrong way and got out some vector and then just X-word their file with it or something ridiculous like that. So they had DES, but they didn't use it right. It was so close. Just, just, just quite, quite it. There were ones like Microsoft Access 97, I think was one where they had RC4 encryption, but it was a fixed key. And so they would RC4 encrypt the file with this fixed key. And then you'd go to this offset in the file and look up the password. And it was just sitting there in plain text. Some of the details might be off. It's been 20 years. Yeah, fair. So we'll go ahead. Go ahead, Val. I want to ask a really, while we wait for people to come up with some really good technical questions to throw at you, I'm going to do one that, all right, so let's say that I don't know everything there is to know about encryption out there. Let's say I want you to do, I'm going to ask you to do a similar thing that you did in your talk. And I know that my password starts with a word and has some unknown thing after that. Are there things that I can provide you that I might know about the password that will help you get through this or does the encryption work in such a way that that doesn't work? A dictionary attack, right? The product you're using has strong crypto. The guys that built it knew what they were doing. Then pretty much a dictionary attack is the only option you've got left. And so there are specialized attack software that you can get, one of them is called Hashcat. It's built for running on GPU farms. That was what we were originally looking at is maybe writing a Hashcat module for this. But it's really designed for processing a key space. And so you can give it a dictionary, you can then say, take this and then do all alphanumeric strings up to length six after it or take this and try all different capitalizations, replace vowels with numbers, say an I goes to a one or an O to a zero and so on, E to a three. Whenever you do that sort of thing, you can, there are these rule sets that you can say, okay, Hashcat, this is what you're gonna start with and these are the rule sets that I want you to use when processing in it because this is the best in my memory, what the password looked like. On the other hand, if you're doing something like correct battery horse staple from XKCD, you've got too much entropy and that's really the way to protect your files if you're doing something is just make it longer, right? Because if you go from 26 characters, which is all lowercase letters to 97, you've roughly tripled, that's adding two bits per character to the entropy, right? So if you've got a length eight password, 26 to the eighth has all possible lowercase letters there, but if you go up to 97, all printable characters, that's only adding two bits per password, I'm sorry, two bits per character. So on a length eight password, that's, let's see, 26 is about five bits, that's 32 and two times eight is 16. So it's adding three characters to the length of your password, adding printable characters to a password of the same length, it's just adding a few more, but if you go and add a whole bunch more characters to your password, make it a long one, that'll make it really secure. And so- Use a passphrase instead of a short random string. Yeah, and so if you, even if you're using English words, right? If you make it a passphrase rather than password, that'll make it really vulnerable to a dictionary attack. There may be other attacks if the crypto's bad, but if the crypto's good, then it'll protect you. So just, this is entirely for my own curiosity. So after you broke through the zip file, you got the password that you could use to decrypt the zip file. No, we didn't recover the password. Oh, you did recover the password, okay. Yeah, so the way zip works is it derives a 96-bit key from the password. And it was the 96-bit key that we recovered. Now, if we wanted the password, we could take those 96 bits and then go launch a hashcat attack using dictionary and some other stuff that others have worked out to get a few of the initial characters. That's where it fits into the type of password cracking that many of us are familiar with, hashcat or John the Ripper. Okay, so if you've got the 96 bits, then there's something you can do with the dictionary attack that'll see whether the initialization process gives you those bits or not. That's great. Yeah, what I was gonna ask is if you got far enough to see if like a dictionary attack would actually work, like it's a zip file in less time than you spending all this time to brute force it. If you didn't... He suspected it was on the order of 20-something characters or more, so that would make it quite a while to brute force. With this technique that you went through, work for any encrypted zip file or... Yeah, yeah, this'll work on any zip file with... So my original attack back in the late 90s required five bytes, five files in the archive with the same password. This one we were able to get away with two because we also knew the timestamp. So if you've got the timestamp and you've got two files, then this will work on any of them. So how does the number of files affect the crackability of the zip file? When... Suppose you don't have the timestamp, okay? In InfoZip, it was meant to run on Unix machines as well as Windows machines. So in PKZip, they just allocated some memory and used whatever bytes were there, those random bytes. In InfoZip, on many Unix machines, it would initialize the bytes to zero, and so there would be no randomness there. So they'd used the process ID and the timestamp to get a little bit of entropy and then fed the XOR of those two into C's RAND function and generated a bunch of bytes, but they thought maybe that's too weak, right? There were some known plain text attacks and they're like, well, if they brute force the timestamp and the process ID, then they can derive the rest of these bytes. And so they took the password and encrypted those bytes once, and that's what they used as the random bytes when they encrypted that and the rest of the file. But when they encrypted it twice because of the way the zip cipher works, it produced the same stream byte twice at the beginning. So it encrypted it once and then it decrypted it for the first byte of each file. So when you say that, is it? Files in the archive, I have every 10th output of that C's RAND function and 40 bits were enough to figure out the 31-bit internal state of C's RAND function. So once I knew the internal state of C's RAND function, I could generate those first 10 bytes of each file.  And because of the way the cipher was designed, not all 96 bits were used when producing each output byte of the stream. So I guess like 40-something bits upfront. And then because I had five files there and I knew what those bytes had to be, I could filter all of those bits. I could say, I've gotta know which of these 40-bit guesses are correct before moving on to the next stage. Got it. And so by having five files, I could both derive the internal state of C's RAND function and filter my guesses and finish one stage before moving on to the next one. And so it was a parallel divide and conquer attack. In this case, I only had two files. So even though I was making a 40-something bit guess, I only had two bytes to filter it with. So that meant two to the 24th wrong key guesses went to the next stage and I had to guess more. And so it just kept getting bigger and bigger and bigger up to two to the 60-something before I could start pairing it down at the other end. So just for clarification, it's resetting the stream cipher every single time it encrypts a separate file and that's why you're able to do this? Yes, yeah. So it starts over again with the same password, resets it to the original state and starts from there. Because you want to be able to extract a single file from the zip file without having to extract all of them. That makes sense. I think you just answered one of the questions we got with the new attack, is there an acceleration in having more files in the archive? Absolutely, I mean, in the original attack, the more files you had, the faster it went. And so this is just a refinement of the original attack. But certainly having more files means more bits to filter with and getting rid of false positives earlier. And sort of closely associated with that, do you know if this kind of attack works with the other encrypted archives like 7-Zip and RAR? Most archival software now uses 8-ES, like RAR5 switched to the ES256. So this isn't going to work against anything except zip files. Going for best standards, I like to see that. Even WinZip switched to 8-ES a while ago, so. Fair enough. We had another question. Do you know if your client was the legit owner of the Bitcoin? I can't be certain, but we looked him up online. We knew his real name and we looked him up online and found that he had reason to be owning Bitcoin. Didn't seem too shady. It wasn't someone reaching out across the dark web from. It was part of his employment that he would be dealing with Bitcoin. Fair enough. No, that makes sense. So this is really interesting. Do you expect with putting this out here and providing this talk, do you expect to get more of these requests to crack more things if you do get more of these requests? Do you have an answer pre-built of how you might respond? As far as breaking into Bitcoin wallets, yeah, when I first wrote this up on my blog, we got a whole bunch of requests. And for most of them, I had to say, nope, sorry, the best you can do is a dictionary attack. Many of them said, I bought Bitcoin with a credit card ages ago, but now I can't find my wallet. Can you help me? I've got my credit card records. Oh, no, we need a little more than that. The one that was most interesting was a guy who claimed that his hard drive had crashed that had Bitcoin on it. And so we were working with him to get some data recovery. But after a while, it became clear that he was perhaps schizophrenic or delusional, that he believed that someone was cheating him out of his Bitcoin and had stolen. Anyway, it was interesting. But if you have, there are about four situations where we could potentially recover software. One of them is if you printed out or wrote down the seed phrase for generating the 128 bit key, right? When you generate it, the wallet software always says, keep this in a secure place, right? And it's this 30 odd word phrase that'll generate the 128 bit key. So if you've got that, you can recover the key, you can recover all your Bitcoin. The next case is if you have had damage to your hard drive, right? If the hard drive crashes, then the data in the sector is probably okay. And even if the data in the sector is bad, we only need eight bytes to be okay. That has the encrypted key in it, right? So if we can recover that data, then we can probably recover your wallet. If you have the wallet software, you don't have the original phrase, but you know you used a weak password, then we can try and do the dictionary attack approach. Right. And do that. And then the least probable, there have been wallets with security flaws that make them susceptible to breaking more easily. And if you happened to use one of those back when they were being used, most of them have been fixed since then. But if you happen to use one that had a flaw, then we could try to exploit that flaw. Yeah, so this was an attack on a zip file, but you're talking directly about Bitcoin wallets. Do they also use some zip-like structure? Have you attacked the Bitcoin wallets themselves? So the Bitcoin wallet takes the key, the private key information that you sign your transactions with and a password and generates a symmetric key from the password and some salt and then encrypts the private key. So that private key is really what gets you access to the Bitcoin. What we can do is try to either recover the private key by means of that really long phrase, regenerate that same private key, or we can attack the password if you've got the wallet so that we can decrypt the private key that you had stored or we can attack some flaw in the Cypher where for instance, when they were coming up with the symmetric key they didn't use the entropy properly. And so there's a much smaller key space that we would have to brute force. There are very few of those that were out there but there were some. So there's possibility we could do that. So I like asking this question of people who know this technology really well, feel free to tell me no, you're not gonna answer this question, but do you yourself hold any value in any cryptocurrencies because you seem to understand how it works?  So there is this built-in necessity to own dollars at some point. There is no built-in necessity to own Bitcoin or any other cryptocurrency, right? There's, and for Bitcoin and Ethereum, I think that proof of work has shown itself to be susceptible to attacks like civil attacks, 51% attacks like Bitcoin Cash and Ethereum Classic have both suffered 51% attacks. They were rebuffed eventually, but if Google wanted to deploy their whole infrastructure, they could completely own Bitcoin. There are existing companies that could do that, not to mention nation-states, right? If the US wanted to take it down, they've got this thing in Tawila here in Utah that they could deploy against taking down Bitcoin. So my personal take, and we designed a system to do this, is that you need to use a consensus algorithm with true finality, that proof of stake and bandwidth. And then after a certain point, when you have enough witnesses, you say this block is finalizing, it can't ever change. Ethereum is trying to move in that direction with their proof of stake algorithms, but I don't want any. Yeah, I've heard a proof of stake, but the finality piece is new to me. You've definitely given me a few pieces already that I'm going to need to go Google, I'm sure now. So we got another question. It's sort of a meta question. One of the people that watched your talk had a little bit of struggle following your math.  And they'd want to know, it's like, how do you juggle this? And are you aware that some people that follow your talk might have difficulty zooming in and out like that? Yeah, so I had some options when doing this talk. One was to go really deep and really hard on the technical stuff. Another one was to give enough background and the basic idea of how this attack played off and the challenges we faced. And so I chose to be less detailed for the sake of the story rather than go deep into it. If anyone has any technical questions, take them offline. I'll be happy to talk through them with you and point at lines of code and that sort of thing. That's great, that's awesome. Is there... As far as keeping it in my head, I would have to wake up and then come down and reload everything. I had stuff on whiteboards all over my office, pictures. It was a process, I would even have to remind myself about what was going on because I couldn't keep it all going at once. And it was a month's long process of trying to think through over and over again how things are going wrong and what I might be able to do to fix it. So if you don't get it from one short 45-minute talk, I certainly don't blame you. Makes sense. Did you discuss this at the end? I'm sorry, I missed this point. Did you actually get any compensation for this work? We did, yeah. So when he first talked to us, we said we'd like so much upfront. We estimate that the total cost will be about this much. We took longer than we said we would. We expected it to be done in three months. That was October, so November, December, January. It was April before we actually, late March, before we actually got the key back. But because of all of the extra crypt analytic work that I did, it took a 10th of the time on the hardware. So the hardware cost ended up being only roughly 10, 15 grand as opposed to the 100 grand that we thought it would take at the beginning. So it gave us a big bonus afterwards, which was nice. Yeah, I actually missed this. Another one of the speaker unions was mentioned that it was on AWS. And they wanna know if the 10 to 15 was about what you were expecting from compute cost. No, we were expecting it to take far more, right? The original estimate was around two to the 64th work, which is comparable to finding a collision in SHA-1, which is 100, sorry, SHA-1 was 160, Md5, it was a 64 bit thing. And there were some recent work where to find a collision they had to deploy an enormous amount of work to do it. I guess Md5 they were able to do because of flaws in the hash function. SHA-1 took roughly 100K of GPU time to break. And so we were estimating it would be comparable to do this. And this is what your company does, like data recovery or is it specific to- Not originally. Originally we were working on a distributed operating system we could get clients interested if we can get in the door but it was right at the time when cryptocurrency was taking off and we didn't have to talk to anybody to get an intro. We started doing some consulting work there, built up a team of about 20 scholar developers that were top of the cream the crop, top of their field. And then built the R chain cryptocurrency platform our chain started having some financial troubles so we allowed them to hire the devs early. We had a contract that we'd hold on to them for a while and then they could hire them after they'd worked for us for a year, but we let them hire them early. So they've taken over the dev team and then we started working on some other things and this particular consulting job came up at a nice time and was a whole lot of fun. So we took it. But right now we're looking for any interesting consulting work that people have. That was exactly what I wanted to segue into now that you've done this talk. What is, do you have another research item on your to-do list that you're trying to aim at? Sure, at the moment I'm doing some consulting work for the Ethereum Foundation. I've got some consensus algorithm research that I'm working on. We're working, we got access to GPT-3 so we're building an adventure game kind of like AI Dungeon but with more structure using GPT-3. We've got various ideas for voice assistants that will be able to call somebody at a restaurant rather than figure out every different restaurants online ordering system.  GPT-3 seems to be able to have conversations so maybe we can use that. Yeah, this is probably like a really small piece of what you're doing, but I used to be like incredibly into mods. So an adventure game that's generated by GPT-3 sounds interesting. Yeah, so we're working on the room generation. For quests we'll have things like you have to convince this character to give it to you. He's got desires and needs. So you'll have to be role playing while you're doing this game, interacting with these characters. There is a person that goes by the handle Evil Mog is running a DEF CON CTF mod right now. Just a shout out to him. We are really close to being out of time. There are a lot of questions over here about specific pieces, specific technologies. I think I'd like for people to bring those to you on a less moderated basis. So we'll let those go for now. Before I let you go, I want to know what is the thing that you would like us to take away from this if there is a final idea that we should walk away from your talk? That attacks on cryptography only get better. At the time MD-5 was proposed 128 bits for a 64-bit attack was inconceivable. And yet within five to 10 years, they were able to attack that one. And then Shah, there are attacks. AES with the by-click attack. They've now broken, I think seven or eight of the 10 rounds. If there is something that you need to keep secure, choose the best software and have a plan for upgrading your crypto and any product that you put crypto into. Because the attacks are going to get better. You'll need at some point to transition from the broken system to a new one. And so that will come up during the lifetime of your product. So be thinking about it. That's definitely good advice. Falville, you got any more questions you want to sneak in under the hood? No, I think I'm good. I really appreciate the work that you've done here. And thank you for coming to present and giving your time to do this Q&A session. There are some more people that have some more questions coming in if you're willing to do so. If you would put your contact information in the track one channel and Discord here, we will get that out there. Folks can look you up if you're willing to be available to that. I also recommend you put all of your company information if you're willing to do so because that's a good way for people to find you for those contracts you were talking about. Great, thank you very much. All right, take care.