Welcome back. I'm John MacArthur, President of Walden Technology Partners. We're here at IBM Storage Edge 2012. I'm joined with David Fleuer, co-founder of Wikibon here on SiliconANGLE TV. And our guest now for this segment is Tim Harvey. Tim, you are the CEO of Perimeter E Security. So tell us a little bit about Perimeter. Well, Perimeter is a leading provider of cloud-based security solutions and managed services to mid to large enterprises. We provide a complete set of services around secure email. So we actually will host your mailbox, a combination of either our own commercial messaging technology or hosted exchange. And we surround that mailbox with a complete set of security solutions from email hygiene, encrypted email solutions. We have a product that's one of the leading products in the market for compliance archival solution. And then on the other side of our business, we focus on really secure communications, providing that mail infrastructure in the cloud for customers that want to get out of their own infrastructure, move it to the cloud. Our value prop is pretty simple. We can offer a more secure, reliable email box and security around it at 50% less the cost of what a customer can do at in-house.  So these are mid to large enterprises, compliance oriented businesses. We have customers like United Airlines, Farmers Insurance, all the way down to retail customers like Chick-fil-A. The government, are you doing any government work? We do some state and local, not on the federal side. The state of Oregon is a large customer of ours, so we would manage up to 58,000 employees for the state of Oregon. And what brought you to IBM Edge? We really have made a big investment in IBM infrastructure technology, specifically on the storage side. We use a combination of the N series as well as the new store-wise V7000 product. In fact, I spoke yesterday in the main tent on some of the benefits that we're seeing as a result of that implementation. Yes, I was there in the presentation. Very good presentation, very interesting. So can you say the reasons, you did some of the work on compression in particular with the V7000. Can you say what you found for the audience with your implementation? Yes, so we when you look at our storage requirements, the mailbox and then the compliance archival associated, today we're over two petabytes of data that we're managing, and that's growing at a rate of almost two terabytes a day. And so us, the ability to offer that value proposition that I talked about earlier about being able to do this at 50% of the cost that a customer can do it, we're looking for something that would give us reliability and compliance, but do it at a cost and price point. We think that when we fully implement the V7000 store-wise, we're looking at almost 50% savings over any other technology out there because of things like the deduplication, the management capabilities, the replication facilities that we can go to as a result of that. So we're pretty excited about the technology. That's fantastic. So were you a beta customer of the technology? Well I think we're not necessarily a beta but we are certainly an early adopter when we look at some specific software around the management of the product line and how we're implementing it with an active passive orientation replicating data centers. We have our major data center which is in Denver, Colorado and then our backup facility is in Jersey City and so with some of the replication capabilities that we're implementing around the Tivoli product line, again the savings not just in the raw storage but in the operational overhead associated with managing what is a pretty complex environment. So this is an active active implementation? That's right. What's the topology there and how does that benefit your customers? So one of the things that our customers are counting on, we deliver one of the most mission critical applications that a customer has today. Man, it's got to be available 24 hours a day, 7 days a week, 365 days a year. The CEO is the first to know. Absolutely and he will. And so 100% reliability and 100% uptime is something that we actually have to guarantee to these customers and it's not only security but it's reliability and to be able to implement an active active or an active passive based on those requirements is critical to the success that we've had to date. And you use the SCC for that or you use the NetApp, how do you implement that? Yeah, so it's a fairly complex implementation of the environments that we're using. We have our compliance archival solution where we actually have the capability of archiving mail anywhere and being able to access that mail. So depending on a customer's implementation, we can do a combination NetApp with our archival and series stuff or we can use the active active with the V7000 and so we want to give our customers flexibility to offer both of those solutions. And what's the business benefit to your customers of the active active solution? Again it's an uptime guarantee, 100% failover type of thing. So regardless again we get the redundancy both from our MPLS network and actually being able to run mail active active with virtually no interruption. What are the performance implications of that for your customers? How does it turn out for them? Yeah, no, it's actually mail the 2010 environment in particular is a pretty stable environment today. So while there are always issues associated with that again having this active active implementation we virtually can guarantee 100% uptime. That's fantastic. So what were the main reasons that you've picked IBM as a partner in all of this? Well I think the first part was the infrastructure solution set. I think the second part was their services offering around that and again being able to work with us to basically in this topology and architecture and to be able to provide the flexibility of different options and utilization. How we implement the technology and giving us the opportunity to have a lot more flexibility than we think we can get with the other vendors that we looked at. So what are your future plans with IBM? What's the next challenge down the line that you're working on to reduce costs? Right, so we're looking at the pure systems implementation we think that really has a lot of opportunity for a customer like ours a rapidly growing managed cloud based security managed service provider and the ability to put bundled together hardware storage and software and be able to ship that that we could then move into our cloud and be able to provision very quickly has a lot of attractiveness to us. So we're going to follow that development very keenly. So can you talk a little bit more about the attractiveness? I think the combination of the ability to implement quickly is probably one of the things. So we're adding customers at a rate of we'll add 100,000 users this year so call it 10,000 a month. To be able to scale that as we go and provision those customers and to do it basically almost in real time. We can place an order and have it shipped to us in a week or two where all's we're doing at that port is loading our applications onto a completely preconfigured hardware, software storage environment. Again we think that is tremendous value. So where does that save you? We have yet to calculate that savings but it's certainly in terms of time it's certainly seems to be a big impact to us. We haven't gone down that path yet but again we think that's very attractive. We're following very closely the roll out of the pure systems. So you base the whole system on 2010 instead is another benefit that they can get to the latest version of the software? Yeah and again we're working closely with the pure systems group to look at what that configuration exactly would look like. The other opportunity that we're looking at is the IBM smart cloud and an implementation of that we think has a lot of opportunities for us potentially. And again not only do we leverage IBM infrastructure IBM actually also resells our solution set. It's a win-win type opportunity for us because obviously as IBM sells more of our stuff it requires to purchase more from IBM. It's funny how that works. That sounds like a tremendous business relationship Absolutely. So again looking ahead what are the things that you've learned from Edge and what are the things that you really would like IBM to be working on over the next couple of years to keep you competitive? Well I think this conference has been very good for us because it gives us an opportunity to talk to other customers first and foremost. It also gives us the opportunity to look at where IBM is going and quite frankly we've been able to work very closely with them and have some influence on that roadmap. So that's also important to us that they understand our requirements and again we view this as really a strategic partnership that offers us and our customers a competitive advantage in the marketplace. So I think this has been a great opportunity. Specific things that you would really like to see out there Well I think the pure systems opportunity this concept of bundling hardware, software and storage pre-configuring it. Again we think that is a home run for both IBM and for a company like ours. Could you see yourself as 100% in that type of scenario or won't it fit everything? You know again and certainly if we can look at things like operational overhead we do some floor density in our data centers and the price performance that we think it has it could be again a very attractive opportunity for us as we go forward. And again one of the things that's important to us is security and compliance because in addition to our customer base that we talked about earlier we also support about 1,800 banks and credit units and as a result we're actually supervised or regularly reviewed by the FFIC and so security compliance being able to document and adhere to strict processes and controls the more simplified that is it's easier for the auditors to come in and validate our environment so that also the pure system concept around simplicity that IBM talked a lot about over the last couple of days is very attractive to us. So who gets the compliance is that IBM or you the combination? So the environment that validated is our environment. Right. But by having a simplified easy to use single pane of glass configuration that we can validate it allows us to reduce our work load and as a result prove to our regulators that the environment is secure and the processes for updates patching are all in place in simple way. So today it is a multi-million dollar effort for us overhead associated with that regulatory supervision that if we could reduce that that also has value to us. Are there other application areas that just sort of look interesting to you places where you think you might be able to play? Yes. So the whole one of the if you look at the applications that are moving to the clouds the first one of the first applications has to be cloud-based and if you look at the biggest hindrance to people moving to the cloud especially as you go up into the enterprise stack security and then the tie in with mobile obviously is an important part. So how do you provide more security around these cloud-based concepts whether you be in a shared or public or private environment and then this whole communications infrastructure how do you secure it from the device discovery through device management all the way up to the mail. So and then the whole social media stuff. Again compliance is a big part of what we do. So how do you archive instant messaging? How do you archive your social media communications with your customer? We're doing a lot of work in that area as well. We had an interesting discussion yesterday about cleaning up from a data spillage. That's a great phrase. I love that phrase actually. I really like that. So I don't know if you have a practice area we do. In fact we're developing it's a great point. We're developing application taking a lot of our email security technology and adapting it into we call it data loss prevention. So everybody talks about data loss prevention that's sort of locking down the borders. But once that DLP misses how do you do the cleanup and that was the interesting angle for me. Do you see an opportunity for you there? We do and again without going too far down the pike we can talk more about that in the future but we're going to make some announcements over the next couple of months that again is going to extend how you think about DLP. So for those of you who haven't sort of heard that phrase before data spillage is when that leak of your data happens in an internet environment. How do you bring that? How do you, you'll probably never eliminate all of these spillage but you'll at least want to clean up to the 80% level at least to the BP standard. You'll want to at least do some nice press releases regarding how clean the Florida beaches are now. So we are here in Florida we're at IBM Edge 2012. I'm John MacArthur president of Walden Technology Partners. I'm here with David Floyer and our guest is Tim Harvey and we're talking about compliance and email and as a service and I appreciate you joining us today. Thank you very much. We're going to take a short break and we'll be right back. Great. Thank you. Thank you.


The next item of business is consideration of business motion 10339 in the name of Joe Fitzpatrick on behalf of the Parliamentary Bureau, setting out a revised business programme for today and tomorrow. I ask any member who wishes to speak against the motion to date or now, I call on Joe Fitzpatrick to move motion 10339. Formally moved. Thank you, and no one is asked to speak against the motion. The question therefore is that motion 10339 be agreed. Are we all agreed? We are agreed. The next item of business is topical questions. We start with question number one from Ian Gray. To ask the Scottish Government what its response is to UCAS recording a fall in university applications by 18-year-olds from the most deprived areas. Minister Shirley-Anne Somerville. UCAS figures published yesterday show that the number of applicants of all ages from our most deprived communities, particularly those in their 20s, are actually increasing, and that is welcome. However, we have also seen a small decrease of around 70 applicants from those who are aged 18, and that is of course a concern. In 2017, we saw a 13 per cent increase in the number of people from the most deprived communities getting places to study at university. If we are to see a similar increase in 2018, there is clearly much more work to do. The commission on wedding access made a clear recommendation for universities to try and maximise applications from disadvantaged learners by promoting access thresholds to pupils, parents and teachers. Universities must do all that they can to make learners aware where there are still opportunities to apply before 30 June, deadly. Ian Gray. It is indeed the case that the modest progress that has been made on closing this gap makes it all the more important that we examine the reasons why that progress appears to have stalled. The widening access commissioner late last year in his report pointed out that not only are students from more deprived areas less likely to apply, they are also less likely to be accepted and less likely to complete the course, so we should be concerned indeed. One factor Sir Peter identifies is support for living while studying. Will the minister not agree that a worthwhile response to those figures would be to restore the cuts to grants that her Government made in 2013? Mr Gray is absolutely correct to point to the commissioner's concern around not just who gets into university but who completes it. That is something that I have made clear to university principles and, indeed, to college principles since I became minister. It is something that we are intensifying through our outcome agreements with universities, so when they are looking at this and making good progress, we will encourage them to do so, and when we believe that we need to pick up the pace of change, not just on widening access for applications and the entrance but also completion rates, we will do so through the outcome agreement process. The commissioner pointed to a variety of different issues that may impact on application entrances and completion rates, student support being one of them. As he knows, the Government has recently increased the income threshold from £17,000 to £19,000, ensuring that an extra 3,000 students get a non-repayable bursary. We will increase the payment threshold and reduce the payment period for loans. The Government has taken action and will continue to take action to ensure that we support the poorest students at university. I think that the Government and the Minister do know that student support matters in this, that it is one of the factors that drives the gap in applications. If it did not, why would it have commissioned the independent review into student support, which it did? That review reported with some modest proposals to improve the circumstance for students in both HE and FE back in November. Will the minister please tell us when the Government will respond and, in due course, is not a good enough answer? The Government will respond in due course to the review. That is because I would disagree entirely with Mr Gray when he talks about the modest proposals. As I said to him in this chamber last week, the review is asking us to look at, in particular, an entitlement benefit for further education students. That has an implication for their ability to access social security. As I said to him last week, we may very much get into the situation in which the Government makes a rushed decision to ensure entitlement to make changes to FE bursaries and then see the DWP coming along and saying, that is great, thanks very much, and we will now take that money off the benefits from social security. We are continuing to ensure that we discuss our progress on this with the national union of students. We are ensuring that we are discussing progress with the DWP to see how the interaction between what the review has asked us to do and what the social security benefits system will do. However, I will not take that for the sake of an easy headline. If, actually, at the end of the day, we would see students losing out. Emma Harper Yesterday, I met the principal of Maxverton High School in Dumfries, and she told me that students from less privileged backgrounds often take time out of education before going on to university. For example, one student took a year out before enrolling into UWS for mental health nurse training, so she is now attending university, but the numbers do not recognise that. Does the minister agree that there are different routes for young people into higher education and that the figures quoted do not take account of that? Emma Harper It is very important that we bear in mind the different ways that people can get into university and, indeed, to higher education at our colleges. It is very important to recognise that it may not be the right track for a young person to leave school and directly go into university, and we should respect them and allow them the flexibility in the system to make that decision if it is right for them. That is entirely the point of us looking at this through the prism of what is right for the learner and not necessarily what is right for the statistics or, indeed, for institutions. It is an approach that we intend to continue to encourage. The figures from Ucast suggest that more people of all ages are applying to go to university. The number of Scottish domiciled applicants is 21 to 24, which is increased by 4 per cent, and the number of those who are 25 and over has increased by 7 per cent. That is welcome news. Liz Smith On the education committee, there are issues about careers guidance in school, and the real focus, if we are going to improve the situation, is to talk to youngsters who are perhaps much younger than the university application age. Does the minister agree that much more work has to be done about that careers guidance and to ensure that there is not the patchy advice that we have had and that the evidence shows from our committee? Liz Smith is very correct to point to the work that we need to do long before we get to a young person sitting with an application form. That is about encouraging young people to decide what is right for them, to recognise that success for that young person may be an apprenticeship, it may be going to college, it may be going to university. It is about what they want to achieve and the best way for them to achieve that. An important aspect of that is careers guidance, and there is a great deal of work continuing to ensure that we are getting better careers guidance out there. We are getting the message out not just to the young people but to teachers and to the parents, anyone who has an influence on those decisions, about the parity of esteem that we should hold for the different opportunities that are available to our young people, university being a very important one of them. Gillian Martin Can the minister advise how the numbers applying to the Scottish higher education institutions compared to the number of applicants in the rest of the UK? Does the increase in non-EU international applicants have an impact on the places that are available for students applying from Scotland? All applicants to Scottish higher education institutions have increased by 1 per cent to 114,160, including a 13 per cent increase in non-EU international applicants. It is something that we can be exceptionally proud of as a country, and our universities should take great pride in the fact that we have seen an increase in numbers from non-EU international applicants. The numbers for non-EU international applicants do not have any impact on the number of places that are available for Scottish students. Both the Scottish domiciled students, those from the rest of the UK, from the EU and international students all play an equally pivotal role in making our campuses the proud diverse campuses that they are today. Christine Grahame Thank you, Presiding Officer, for perhaps declaring an interest as convener of the cross-party group on animal welfare. To ask the Scottish Government for what reason it does not support a ban on the export of live animals. Fergus Ewing The Scottish Government is committed to the welfare of all animals during transport, whether within the UK or for export purposes. Animals should only be exported in line with strict welfare standards, ensuring freedom from harm and sufficient rest and nourishment to ensure that transport welfare rules are fully complied with. The current EU regulations and standards provide the rigorous framework to protect and promote the welfare of animals. Those have been adopted into our law through the welfare of animals transport regulations 2006. We have been clear since the outcome of the EU referendum that we wish to maintain adherence to current EU standards and regulations, particularly regulations on animal and plant health and food safety, because those are essential for our reputation and access to EU and other international markets. We will not therefore support any move that creates further challenges or difficulty for our livestock sector or places Scottish agriculture at a disadvantage. Christine Grahame I thank the cabinet secretary for his answer. I refer the cabinet secretary to an answer 10 years ago, albeit at S3W-08002 by Richard Lochhead. We would prefer to see a trade in meat rather than live export. That avoids long-distance travel of live animals, while ensuring better returns across the industry from added value product. Can the cabinet secretary advise why he thinks better returns for the industry are secured by live exports, which seems to depart from what he has previously said, quite apart from the not insignificant matter of animal welfare? Richard Lochhead No, I do not agree with that. I agree with Richard Lochhead when he made comments to the effect that animal exports for breeding are vital for pedigree livestock sector. When he expressed the sentiment that, ideally, we would want animals to be killed as close to their farm of origin as possible, the important thing that I wish to stress is that animal welfare is paramount and that the rules and regulations cover very detailed provisions in order to secure that objective. They do so by making provision for nourishment, making provision for rest and making provision for hydration. Those must be strictly complied with, and that is the approach that the Scottish Government believes should be taken. It is also one that is supported by the NFUS and other key stakeholders in the sector. Christine Grahame I thank the cabinet secretary for his answer. I think that some of the issues about animal welfare in these long transportations will be disputed and is disputed by many welfare organisations. Can I, at the very least, reconsider a consultation on banning live exports because we are exiting the EU and will not be tied to the regulations? I have to say to the cabinet secretary that I would hate, by default, to become a fan of Michael Gove. Michael Gove I am not really responsible for whose fan clubs the member is in, but I am responsible for agriculture. I can absolutely assure the member that those matters are taken with the utmost seriousness. The position down south is very confused. There is talk about a ban of live exports for slaughter, but there is no talk about it. Actually, there are very few or no animals that are exported for slaughter from Scotland. The export of live animals from Scotland is carried out for other reasons for breeding and production. The HMRC has indicated that the value of that totals £50 million a year. Unless one takes the view that that £50 million should be reduced to zero overnight, it would be better to concentrate on ensuring that we all support the high standards of animal welfare that are required by the regulations and rightly so. Mark Ruskell I declare an interest as an honorary member of the British Veterinary Association. What evidence does the cabinet secretary have that a UK-wide ban on live animal exports would damage the livestock sector specifically in Scotland? Does that mean that the cabinet secretary will be opposing the ban on the export of live animals from other UK countries, in fact that the Scottish Government is leading a race to the bottom in animal welfare standards? Mark Ruskell No, that is a complete nonsense. The proposals from Westminster are, first of all, not clear. However, I understand that the manifesto commitment of the Conservative Party was to restrict the ban to those animals that are exported for the purposes of slaughter. We have taken the view, and I think that the vast majority of members would take the view that most animals should be slaughtered as close to their farm as possible. That is why it is so important that we continue to see our abattoirs functioning properly. Of course, 95 per cent of the OVs who work in our abattoirs are EU nationals. Therefore, the greatest practical matter that she should be considering at the moment is to ensure that those EU nationals—many of whom are from Spain who come to work in Scotland—are able to continue to staff the abattoirs. Otherwise, the practical problems of ensuring slaughter of animals, if Mr Ruskell cares to litter rather than chatter incessantly behind me, will continue to be available locally, provided that there are people from the EU who are working there and are able to stay there to carry on their good work. I emphasise to Mr Ruskell that we are all concerned with animal welfare and the considerations about that remain paramount in consideration of those matters. Nevertheless, Mr Gove is reported as wanting to see a ban on the export of live animals from UK ports. On a very practical question, if that occurs, if that went ahead, what are the practical implications for exports from Scotland? The question is what is he proposing. I am afraid that I am not clear. I do not know if Mr Rumbles is clear what is in Mr Gove's mind, but I am not. That is because he has not set it out clearly. However, the manifesto commitment was restricted to a ban for the purposes of slaughter. No animals, as I understand it, are currently exported to other member states for the purposes of slaughter. Therefore, the impact of that would be at the moment zero. The impacts would result if the ban were to extend to export for the other purposes, namely pedigree, breeding or production. Those impacts would be felt by the poultry sector in particular, by pigs and other livestock. The value of that to Scotland has been estimated by the HMRC in 2015 as £50 million. If those figures are accurate—I have not had time to study them quite frankly because this is a topical question that was raised just yesterday—the answer to Mr Rumbles' question is that there would be a very considerable impact on farmers and farming, and especially in the islands of Scotland, where, by nature, transportation of animals, albeit at intra-state, is a fact of life. That is necessary. I thank you very much, and that concludes the topical questions. We will move on now to a debate on more—


Ladies and gentlemen, colleagues, I hope your deliberations have been going well and I hope you have some substantial inputs into how we might progress with this CRP in the Phase 2. As you know, the donors along with all of us in the centers and many partners beyond have developed a new strategic results framework for the CGIR. The main strategic level outputs of the programs will remain the same, but the donors have spent considerable time inputting what are the IDOs and sub-IDOs. So in some sense, we have a new document for which we are planning what the new portfolio of CRPs should be. As we do this, we are considering a portfolio approach rather than an open call. But as we interpret what might be a compelling portfolio to address this new SRF, we must also consider the current programs that we have on the ground. I know that you will be discussing two scenarios as to how we can go ahead developing a new CRP. One, and as is with a little bit more, and the second, a much redesigned larger livestock CRP. Given the fact that we are attempting a portfolio approach to Phase 2, and that the donors have asked for fewer numbers of CRP, I believe that the second option, a larger livestock all-encompassing CRP, would be the preferred option. We do not know that now for sure, but that is the track we are working on, not only Illry, but all the other centers, with the consortium board and with the donors as well. So how to manage a top-down and a bottom-up process? So at the end of it, we come up with the best compelling research portfolio that will guide our research over the next 10 years or so. I hope that we can develop a program for livestock and fish, or a program by some other name that will be compelling, that will truly address the global challenges for livestock and fish in the developing world.


While it's National Stroke Awareness Month in medical professionals at Cayuna Regional Medical Center are offering ways for you to be on top of your blood pressure. Free blood pressure screenings offered today at the Medical Center in Crosby from 10 a.m. until 6 p.m. Stroke occurs when a clot blocks a blood vessel which prevents the brain from receiving blood and oxygen. Reducing high blood pressure and weight can help reduce your chance of having a stroke. A lot of people, the people that have their first stroke are often not aware that they even have any high blood pressure so if you're screening it and people are aware sooner then they can help prevent strokes. Free blood pressure monitoring and education will be held again on Friday the 19th from 2 until 6 p.m. at Super 1 in Crosby. If you've enjoyed this segment of Lakeland news please consider making a tax deductible contribution to Lakeland Public Television.


Hello and welcome to my aerospace village talk on wireless privacy issues and aviation. I really, really appreciate the opportunity to share research in this area, even under these fairly unusual circumstances. And I also want to take the time to comment the organization around the village, which is a great initiative that brings together so many stakeholders in order to tackle security issues and aviation. If you don't know me, my name is Martin Schrömeyer. I am working at the cyber defense campus of analysis, science and technology in Switzerland. And I am also a junior research fellow at the University of Oxford. So let's dive in. When we speak about wireless privacy, what do we mean? The heart of the issue is that we cannot normally prevent access to wireless signals that are being sent on a wire channel. If we physically control all of the lines and nodes, the number of possible adversaries is normally limited. In contrast, the wireless channel is inherently broadcast. As you can see here, it is typically omnidirectional and there are no physical containment measures possible. So sending or receiving messages does not require you to physically tap into the network infrastructure. Based on this inherent broadcast property, I want to concentrate on two attack primitives today. The first one is eavesdropping. So a breach of the confidentiality of the transmitted data. This is a well established concept, of course, and can fundamentally be prevented through the use of encryption. Our phones, laptops do this fairly securely and hassle-free these days, despite the occasional breakdown. The second one is location privacy. Often we do not want to prevent the content of the communication data being exposed, but also the position of the participants. This gains additional importance in wireless networks. Users are often mobile and we can track their movements over time simply by estimating where the signals come from. Such tracking has many positive use cases. For example, if you're in a museum standing in front of a painting and a system can deliver matching information to you. However, tracking also facilitates many high-profile privacy breaches. So let's apply these concepts to aviation. Here we have to understand first that the threat model of aviation has changed drastically over the past decade or so. First, aviation is moving away from analog technologies such as voice or radar and increasingly using digital communication networks and automation. The second aspect is just as important, which is the widespread availability of cheap, hard and software, as well as knowledge about aviation protocols. These two developments combined lead to the fact that many more people are capable of affecting wireless atrophic communication systems than before. And practically anyone can listen to wireless aviation communications these days. In short, the threat model has moved from a purely nation-state actor model to a whole range of groups with different capabilities and motivations. In today's talk, it is actually sufficient to focus on the purely passive eavesdroppers as observing the communication is entirely sufficient to exploit many of the privacy issues in aviation. Now let's look at some real world examples of confidentiality and location privacy issues in different aviation protocols which were collected from our own research over the years. First, we will talk about the data link ACARS, which has been deployed for decades and is still in use by most larger aircraft around the world. Let me just say at this point that all of these examples now are of course anonymized. Still, you can intuitively see that this is not good. A lot of very critical data is absolutely sent in the clear, and neither Sally here nor Tom would be happy if they knew that their medical information is being broadcast, not only to ground staff, but also to anyone listening in the 300 mile radius of the aircraft. Further privacy issues in this area include information about personal belongings by crew that you could just go and collect. And of course, our favorite example that often serves to drive the point home, full credit card data for higher value transactions and onboard duty free shopping. This credit card thing is indeed still ongoing with some airlines in 2020, despite notifications provided years ago. Some people in the industry have actually acknowledged that there's an issue with this. And they came up with what you can see here. If you're watching this recording, you can maybe take an extended look at these messages and figure out quickly what is wrong here before I spoil it. But for now, let me tell you. As you may have guessed, this type of ACARS data link encryption is using a mono alphabetic substitution cipher that is broken in minutes. It is used by a wide range of private military and even government aircraft. And again, this has been going on for more than a decade now. Still, this data link issue, we could say it is fairly straightforward. And this could still be solved with better crypto solution that are standardized and verified. Honestly, some of them even exist in aviation, but operators of aircraft and airlines still believe they're too expensive. As a last point on this issue, if you believe that using satellite communication for your data link will avoid any of these issues with software defined radios, then think again. This year is an example of military aircraft using ACARS, which sent out detailed flight information in advance and regular updates about its movements, which can easily be received by any third party. This is also a good time to transition to a second topic, location privacy. We know that everybody is being tracked on the ground using your mobile phone. However, in the air, it is a bit different with aircraft broadcasting the position to other aircraft and air traffic control to safeguard themselves and the whole airspace. The communication is not supposed to be encrypted and anyone can listen to the same information. So tracking aircraft globally with ease is absolutely a thing. Here we can see that even the US president is being tracked, in this case, during the campaign of the 2016 election. So let's take a closer look at this problem. First, we need to talk about metadata. Maybe you're familiar with the MAC address of your network phones and laptops. Well, basically the same thing exists for aircraft. It is a unique 24-bit identifier, which is hard-coded into the transponder of any aircraft and provided by the International Civil Aviation Organization. This ID is practically never changed unless the aircraft is sold, making it perfect for any sustained tracking purposes. To make the connection between this identifier and the owner or operator, you can apply all sorts of different databases and websites available publicly on the internet, which is something that we did and you can see here. So this is a visual representation of all non-European government aircraft visiting Europe over a single year. You can clearly identify some hotspots, unsurprisingly in London or Paris, but also in Switzerland or Nice. From this, we were also able to identify dozens of high-profile multilateral meetings with five or more attendees during the considered time period. From the World Economic Forum to NATO summits. This is, for example, Davos, I think, one or two years ago, and you can clearly see all of the different government aircraft landing at Zurich Airport. One striking example of the impact of these issues for governments is provided by two investigative journalists who have set up a Twitter bot and is connected to a receiver based at Geneva Airport. It tweets out arrivals and departures by a set of aircraft used by authoritarian governments. And it is known that this is tracked by several organizations watching corruption on the world. And the public awareness has created formal investigations such as this one, where the vice president of Equatorial Guinea had some of their assets seized. However, the lack of privacy actually extends much beyond governments and also affects corporate activities as well. We took a look at the activities of different corporations in Europe during a single year by tracking the movements of corporate aircraft and relating them to stock market moving merchant acquisition activities. And indeed, in six out of the seven cases that we examined, we could find a decent to really really good signal with landings and the immediate surroundings of the target. In five cases, these visits came up to 25 days before and three even within a week. In many of these cases, exercising significant share price changes on the day of the announcement. Let's look at one case for illustration. Here we can see the flights of a large American medical company to the city of Basel in Switzerland with the headquarter of the takeover target activity and was this is a zoomed in version of the same image showing the actual dates and times of the landings at the airport. We can see several flights around the end of January, just before the acquisition was announced as you can see in this. We can even go further and look at some later with us to Basel highlighted here, which came a day before the acquisition was completed. This illustrates just how much we can learn about the activities of public corporations for watching their flight movements. In the last year, this was also picked up in the mainstream media, as you can see here, for example, in this Bloomberg article. So, is there anything that can be done about this surely many people are aware of these tracking issues by now and want to prevent them where possible. Why are we in this situation the first place anyway. Well, first I want to spell it out clearly why we don't have any proper security and privacy by design in these technologies. A good case study is the novel ADSB protocol, which has only been made mandatory in some advanced countries just this year, but was actually conceived in the mid 1990s with a much, much different threat model as discussed before. Why it takes this long is due to a host of reasons, including strict certification and testing requirements. And the wish for maximum interoperability across across the globe. If you look a bit closer, things get even worse. As ADSB is built on hard and software standards developed by Lincoln labs in the 1970s. Now it should be very obvious that wireless security has moved much faster outside aviation than inside during this time. But if you can have, if you cannot have privacy by design, what is being done. The first and most notable mitigation is to hide sensitive aircraft from public websites for brockless maintain maintained by flight authorities. The aircraft are either entirely hidden, or they are anonymized as shown here. Of course, this approach is entirely useless from security researchers point of view, as the data is still all available. It is simply not displayed anymore. So, while this certainly qualifies as security theater, it at least shows that some people do care about their privacy. The second mitigation approach would be to obscure the ownership within all of the publicly available records. Private aircraft are often registered via shell companies or bank trusts, sometimes the whole network of them, which makes it difficult to get all of the information that you need from the metadata. However, one single slip of the operational security and the information is out forever, or at least until you buy a new aircraft, which honestly even the richest of the rich do not do every other week. We can find the data on social media or dozens of dedicated plain spotting websites, which with a really large community of physical spotters is super quick and reliable. Of course, when your aircraft's delivery contain your company logo, there's certainly the question why you're trying to hide your ownership through a shell company in the first place. If you see your aircraft land at any given airport, we will immediately know who you are. A third interesting observation is that some military and government aircraft are clearly aware of the privacy issue of their broadcasts and switch them up, switch them off for takeoff and landings in order to conceal the origin and the destinations. Unfortunately, this also does not help against any reasonable competent observer. Because the aircraft are still required to send out their identity and the altitude, which in the end makes it fairly easy to localize them, for example, using multirateration or any really dense sensor network. That leaves us with one last option. You could simply not use your own private aircraft, but instead rely on commercial air transport options. Both government have been known to fly coach from time to time, but whatever their motives were, it can certainly not have been for privacy reasons, as we can see in this excellent example of the then British Prime Minister David Cameron eating Pringles on an easy jet. This was broadcast all over the internet before he had even landed. Finally, I want to address a real and effective fix. You could randomize the transponder ID of sensitive aircraft for each flight, which would stop the trivial tracking of the anonymized aircraft at least. This one is more or less straightforward in theory. However, the problem again is in the legacy system and the global compatibility. The fact that the flight authorities security security knowledge isn't necessarily the greatest. There was a first deployed attempt of this about 10 years ago, where researchers were still easily able to correlate the random identities with the original identity, making the whole thing absolutely useless. The FAA did recommend against using it at the time because of pretty strong safety considerations. And I think if your regulator recommends against using a system for safety reasons, that would probably make most people think twice. However, there might be light at the end of the tunnel, because there's a brand new attempt at dealing with aircraft tracking by the FAA. The so-called Privacy IKO Address Program. It addresses a few of the issues that we've seen here, but the jury is still out on the effectiveness of this one. We've actually now done a preliminary analysis, which I'm not going to spoil here. If you're interested, watch the dedicated talk by Guillaume Michel here in the Aerospace Village. So let me finish my talk with two takeaway lessons. These two lessons are especially for the aviation community and their direct results on our research. The first one will not come as news to any long-time DEF CON attendee, but please do not roll your own crypto. Trying to do that has resulted in spectacular fails across many industries and aviation is certainly no exception. The best example is the ACAS disaster, which leaves recent aircraft with weak proprietary ciphers and leaking their sensitive data, even though they're actively trying to avoid it. Get some help, use known secure standards, and then actually also use these systems, unlike ACAS message security, which has seen virtually no uptake in the wild. The second lesson is where I really, really hope the Aerospace Village will help to make some improvements by bringing together security researchers and aviation stakeholders. But please, if somebody responsibly discusses security issues in your systems with you, do not shoot them down by replying that there's nothing to see, like in this nice example. After contacting the manufacturer, we only received the reply that the malfunction in crypto was not there to protect anything in the first place, and that industry standards or regulations do not require them to build anything better at all. Indeed, they even went as far as to say that all of their users are security experts and would know that their crypto system does not protect anything, which I have a hard time believing to be honest, in particular when I take a look at the software option saying encrypt downlink as seen in this screenshot. So to conclude, first of all, we can say that modern software defined radio technologies have certainly changed the threat model for wireless aviation networks fundamentally. The integration of privacy by design, on the other hand, into legacy aviation systems after this technology step step change is super hard combined together. This means that it's trivially possible to track the movements and the communications of many aircraft, both globally and in real time. And most concerningly, all of the currently available mitigation options are absolutely insufficient and more work is needed to find any real fix in this direction. If you're really interested in our privacy research, you can also check out all of the references for talk on this slide, or you can shoot me some questions in discord later. Thanks a lot for listening and I'm really happy to be part of the aviation village this weekend.


Okay, I think we can begin. Thank you, Alain, to take the speech and talk as quick as that. I hope you enjoyed it. Thank you. Hello, everyone. My name is Alain Schnester. I do a lot of WordPress work and also more general Twitch work. I jumped in at last minute here to give a talk. The talk is targeting mostly plugin developers and people doing integrations into the WordPress packet. It is a bit more advanced, but not too deeply technical. It's more like a concept, not about the actual code. I just want to say that the talk was originally planned for 40 minutes, so I'll go through it a bit quicker, so please don't mind me speaking a bit faster. With Gutenberg, there will be a lot of changes that are ahead of us. If you already do integrations into the WordPress backend, you will need to be aware that there are some architectural changes coming. First of all, Gutenberg will change the admin backend to move it from a server-based interface to a client-based interface. What does that actually mean? If you look at this diagram, you see that we have the server that manages the current application state of where we're at on the screen and what we're completely trying to do. The server always sends the output to the client. On the client, you then see your admin backend, and when you click on the link, click on the button, that basically sends a request back to the server. The server adapts its date and then renders a new output for the client. The client in between these requests doesn't really exist. Inside of your browser, the page is just displayed, and as soon as you click something, that page is just gone, and your browser will wait for a new page to be loaded to be sent from the server. With Gutenberg, this will change. Basically, the server will send logic and data to your client, and your client is expected to manage the state of the application. The client here, as I said, is the browser. You can imagine this, that a JavaScript application will be sent to the browser, and the browser executes the JavaScript application. While you're clicking around on this application, it all just stays inside of the browser. The browser adapts the output, makes presents a nice animated user interface, and this all goes on inside of the browser without getting back to the server until whatever this application was meant to be is finished. In the case of Gutenberg, now it will replace the post-editing screen, so the application is this entire post-editing screen, so not only the editor, really the entire screen is one application, and you will be able to click around there and make changes. This all just stays inside of the browser, and only when you click on a new page, like if you move to the user's page or something, then this application will finish. In between, of course, there will be data being sent to the server. For example, if you hit the publish button, there will be a restive care request to actually store what you had in your editor inside of the database on the server level and set the status to publish, but the entire time the client application of the browser will still continue to run. This means that this is a fundamental different approach to going about building a user interface, so where you're now used to building templates on the server and working with URLs that get routed to new templates when you click on a link somewhere, you will now build the entire application, the entire logic in JavaScript and send it to the client. It is important to state that the way you work on the server is fundamentally different than the way you work on the client. So if you just try to replicate what you did on the server, exactly the same way on the client will probably have security issues and performance issues because these environments are totally different. So it's important to know that this environment that you will need to adapt the way the entire application state is managed. For example, on the client side, you cannot just do a quick request to the database to fetch one option from the options fields in the database because on the client side there is no database, it's as simple as that. So what you can do is on the client side you could do a request to the server to send you that option from the database, but if you do that for every single piece of information you need, all of a sudden you have hundreds of network requests. These network requests, they might be very slow, so that's not a very performant and scalable solution. So you should need to think about how do I set up my client so that once it runs, it has everything it needs to only get back to the server in very rare cases. The REST API integration is an important change. Every interaction between the client and the server runs through this REST API. REST API requests are expensive because it is always a network run trip. This might mean that your server is here in Switzerland and someone from Australia clicks somewhere and when he clicks the data gets requested from Switzerland and gets sent back, so it can be very expensive network run trips. Also, they are expensive in a different way because when you request unused data through the REST API, this might potentially be transferred over very costly mobile network connection, for example. In the third world, where it's very expensive to just be online when you send them all sorts of unused REST API data just in case you might need it, that can actually cost them real money. Also, REST conventions, they are limiting on purpose, so REST API is built on the HTTP verbs so that the HTTP protocol is like get, post, put, delete. Basically, the REST API is designed in such a way that you model resources and each resource can use one or more of these HTTP verbs. This means that when you build your API that the REST API should use for sending data, the modeling aspect can be pretty difficult because you need to map everything to these very simplistic resources. So you cannot just create a method, get all my active products from my store, you would have resource products and you need to think about how can I add filters and other qualifications to this request to get the active ones, for example. So the modeling aspect is also quite different than we used to on the server side. Then we have React components. So this single-page app that we'll now replace the host editing screen, it is a baseball React. It uses React components to build up the mock-up, basically build it with these encapsulated components where each component knows how to style itself and how to react to changes. So these components, they also are quite a change to how you might be used to do the mock-up when you're just sending an HTML out. It basically means that just like with object-oriented programming, you try to think about your building blocks of your page first and then build each building block in a separate, isolated and encapsulated manner and the mock-up then is just a hierarchy of these building blocks. So it's not just a random collection of mock-up that happens to look nice. It's much more structured, which is also more of a challenge to model properly, especially when this is new to you. There are many useful components that Gutenberg will provide out of the box. There's a reference in the Gutenberg Handbook where you can see these components and you can reuse the existing components and you can extend the existing components so that you don't always need to start from scratch. So if you want to build a call-to-action button, you can start with the button component and just add your customization. Then there's the Redux Dataflow. So state management is something that's actually a hard challenge to solve at scale and state management on the client side with the server not directly available is even more difficult. That's why in the React Keeper system they come up with Redux, which is a React-based flavor of the algorithm of the flux principles. So it starts with the basic premise that state is immutable. The easiest way to deal with state is when it doesn't change. When I have this data about my state, it will not change. It is immutable. This is a very powerful concept when you can just be sure you have a guarantee that there's no side effects when you just use this data. However, we are aware that while your page still needs to change in some way, state still needs to change. That's why there's this Redux Dataflow. It basically means that there's a cycle running all the time inside of the application where state data gets fed into the system and once it's in the system it is considered to be immutable. It cannot change. But if you want to make change to the state you can dispatch a change request so this change request will then get back to the cycle. The cycle Redux will process this change request to adapt the state and then feed the change state back into the cycle. But inside of your code you can always just assume that your state is immutable. You don't need to check the variable that I stored before is that still in the proper state? Did my value not go stale? And also you don't need to think about the ordering of your code. So if you load state and then pause and other code executes and might change that state it cannot have an effect on you because if it wants to change the state it will need to make a request and change state will be fed back in. So the order of execution all of a sudden is safe in any combination. You cannot mess up other people's code anymore by just changing something. So the vocabulary that's being used by Redux is that when you want to make a change it's called an action. Similar to WordPress actions in Dain but the concept is slightly different. An action is more like a command that you dispatch to make a change and Redux has a concept called reducers and it's basically like a handle of that command. So you create a command to do this and this change and the reducers they take this command and out of this command produce an adapted state that reflects the changes that we requested with this command. So once your state runs through all the reducers you have new state and it contains the result of the combination of all change requests basically for this state. This has all been abstracted away for Gutenberg in the WordPress slash data package so that you don't need to try yourself directly to Redux but more importantly to build an extension to this that works not only inside of your single application but that is modular so that for example the Gutenberg state can interact together with the state in plugins and themes because Redux is built traditionally for a single page app and in WordPress we don't have one single page app that makes up your system because each plugin is built in an isolated way so you don't compile your entire WordPress site as one application. WordPress core will be compiled and each plugin will be compiled in its JavaScript applications and then this WordPress data package is basically built to be able to have the Redux data flow across multiple of these applications. Yeah, that all sounds pretty interesting. The big issue that people normally face is if they have existing code if they have plugins or backend integrations this all sounds like you need to store completely from scratch because pretty much everything changes. So how can you avoid just rewriting everything from scratch only to find out one year later once you finish that was not really what I wanted. So there's a few methods you can use to gradually go from non Gutenberg code to Gutenberg code. The first one is the most simple one. It's basically it's considered to be a legacy approach. It's called server-side rendering and a server-side rendering basically means that you have a block but that block doesn't have a clue of how to render itself. It just has a callback to render its output on the server. So you can think of this as the block-based version of the shortcode.  There's also documentation for this of course. Here's a small example of how that would look. This is simplified of course. Basically you can see on the left side you have the arguments that you need to register your block and you can see that we have a render callback. So when we register this block by the way, as this talk was planned for Woodcam New York you will see references to New York everywhere. I didn't have the time to adapt it. So this render callback when the block is registered this is stored so that once the block wants to render itself it knows what callback to pass to the REST API endpoint that it needs for the server-side render. And on the server-side we can just build you can see that on the right side we can build PHP code that outputs HTML. Here in this case we're using a separate view as a PHP file and just include it with output buffering to reduce output but you can also use whatever other methods you use you can use moustache rendering or whatever else or just hard-code the HTML into the callback that's up to you. But the basic principle is that you can just provide a PHP function and that will be called over the REST API to reduce the HTML. So this, if you have for example a plug-in with a lot of short-codes this is a very easy method to just get it into the Gutenberg Editor where people then have blocks they can drag and drop it just looks like all the other blocks there's just, you notice that when every time it gets rendered there's a small animation to show you, please wait there's a server request going on but other than that it just works like normal short-code. It comes with a disadvantage though that like short-code it needs to be rendered dynamically every time the page is being displayed so keep this in mind all the other Gutenberg blocks they are usually rendered when the post is saved so the final markup is already inside of your HTML and for the dynamic blocks that's not the case so every time you display your HTML it will need to be re-rendered on the server side. So the next step let's say we have our plug-in we turn our short-codes into blocks so that's already nice but we have so much more stuff that's going on in our plug-in and if you also want to move that over to Gutenberg the second step I recommend is to think hard about whether you can abstract away your data model because very probably your plug-in will make direct requests to the database and as I said before on the client there is no database so all the code you've written that directly interacts with the database and it works by just porting it to the client side so when you build an abstraction of your data model first of all it allows it to decouple everything so you can change the individual pieces independently and you can provide an interface where you say ok from now on this is the contract that my server has the front-end and I will always ensure that this contract stays intact so as long as the front-end stays with the contract we put in place I can make whatever changes I want in the back-end as long as I fulfill this contract that's the role of the interface so this type of abstraction allows us to get some form of shield in front of our back-end code and we can make changes across the back-end code while the front-end still just uses this abstraction and never notices that we are currently making changes so this allows you to make more drastic changes behind the scenes without breaking too much what you're doing to give you a visual idea of how that would look so basically right now probably your code will directly communicate with your database and it's very difficult to then move your code over to use the REST API instead because the REST API is a requirement for using client-side code with data that's in your database so what we want to do is we put an abstraction layer in front of our data model this abstraction layer is the only thing that our code on our front-end code then sees or business logic then sees and from that moment on you can easily make changes behind that abstraction layer also this abstraction layer when these are smart objects they can contain additional logic to do routing so for example you can have your database and your REST API coexist happily while some requests are delivered by the database some requests are delivered by the REST API and the abstraction layer knows how to dispatch the individual requests the front-end code, the business logic they don't need to know where do I get to my data they just request the data and they get it and they know where it came from this would look a bit like this so for example let's say we have a collection of books in our database we want to show them on the front-end the interface book repository that just has a method FindAll to get all the books and then we can build an implementation that uses the WPDB database code to request these and this is now we're still using WPDB we're still using our database but now we have an abstraction in place and as long as the rest of our code only uses the interface the whole method then we can make whatever changes we want in the back-end I'll come back to this later so why use the REST API on the server side the REST API is basically the requirement to be able to bridge the network up so you have the back-end you have the front-end let's rephrase it you have your server code you have your client code so the PHP server API is the tool you use to bridge that gap and it is the first requirement for clean-board integration now basically what you can now do is as we had this interface book repository we could now build an alternative implementation that uses the REST API to fulfill this contract and here we're using the REST API directly from the server so we're not making a network request we're using the REST API to build the REST API objects because the REST API also comes with an object model that is directly usable in PHP so we can now already start using the REST API on the server while we still haven't moved everything over to the client this allows us to safely shape our REST API model the different endpoints we need while we still have the database then we can build reusable React components so there will be a transition phase with every big major change there's always a transition phase and you want to make sure that you're not stuck too much in a state where you need to maintain multiple versions of your code that is very costly, very error prone and you want to reuse this as much as possible so one way to use this is to immediately start using React components instead of the usual way you're building your interface and use these in such a way that you can use the inside of the Gutenberg interface once that update comes as well as in your other code without Gutenberg so that you can just use the same code in these two environments so there's an example that is currently being used in production it's the Yoast WordPress SEO plugin they are using this mechanism so if you look at this screenshot here you can see that we have the Gutenberg editor with the sidebar on the right and the sidebar contains Yoast SEO integration and if you look at the source code of the page you see that this is all React components it looks a bit cryptic but just believe me that these are React components that worked with React before and what they have done is they built a meta box container that mimics the Gutenberg sidebar so that this meta box container can accept the same React components the same Gutenberg components than the real Gutenberg editor uses so what they normally have in Gutenberg in the sidebar without Gutenberg it just ends up in a meta box because this meta box is not smart enough to accept React components so they can build the entire code just once and the only thing they need to maintain is this container to allow React components to running you can see that in the source code here at the bottom it's the same component it's the exact same code that's being used it's just that they had to provide their own container here's a bit of a simplified example of how that looks so they built a meta box that creates the right environment for React where we have a store provider a sidebar item etc and then the snippet editor that is this reusable piece of code that works within Gutenberg just as well as outside of Gutenberg without any changes finally in the long run first of all you should always control the fragmentation you should always make sure that whenever you don't need to maintain any legacy code get rid of it as soon as possible you should keep your code it's very flexible with Gutenberg there's probably still a lot of changes ahead of us some might be pretty unexpected depending on how you catch up to us so always keep your code base very flexible as with the abstractions that are showed and then finally also properly embrace Gutenberg once you've managed to make your existing code work in some way think hard about how you can make the best use of the new environment at Gutenberg of us because what you use now as interface in the old paradigm will not be the best use experience you could do within Gutenberg there might be other options and you could do much better with a different approach the key takeaways for this talk so for a gradual move to Gutenberg first you use existing code through the server-side render component move over your shortcodes and your widgets etc then abstract away your data models so that you are able to gradually move it over then optionally build React containers which can accept reusable React components so that you can manage to have most of your code be reusable with or without Gutenberg and then finalize a tight user interface and user experience integration while getting the most out of this new environment at Gutenberg of us and the most important one stay flexible and adapt to change because change is coming and just know that you need to deal with it in the future so you set yourself up as flexible as possible in the present time thank you very much I'm not sure how much time we have for questions two minutes is there a question a next two minute question I will also run around here later on I just want to know if we can find your slides yes I will tweet the link to the slides as soon as I leave the room here with the hashtag for we can present thank you I've originally had a few quotes saying that you didn't need to learn React and everything to build Gutenberg components is that still true or is it more than enough there is still work being done on allowing pure server side registrations so that allows you to even have very simplistic blocks without any JavaScript at all this is not completely finished but there is still work being done on it and you can also as long as you stick to the conventions that Gutenberg sets you can also use any other framework or no framework at all for building your blocks in the end it's just JavaScript but using React makes it faster and easier experience because you can just reuse what has already been built with Gutenberg and you can just assume that React once Gutenberg hits React will just be available so you don't need to deal with providing your dependencies and so forth you can just as well use Vue for example what do you mean though that you will have React and Vue loaded at the same time which is not necessarily your best interest if you want to create a barely inside I have questions so I have been asking in the core editor channel I wanted to register a block which renders a recent post and I think there is still no way to not create the HTML on JavaScript side and on PHP side so is there a way to do it but I don't need to duplicate the HTML I write you mean templates you can render on both clients my problem is that I would need to write it down in React obviously but it's a dynamic block so I would need to do it in PHP too so you just need to use the server side render for this component right? you can also for example on the server and on the client side you could fetch the output from the server side and then send it in some way depending on what you are planning to do you could also use you can for example render a JavaScript code on the server side as well if the server allows it JS for example on the server side can create isomorphic code that allows you to run the same JavaScript on both client and server so you can do the same rendering step on the server as well if you need it on the server but in general, especially in the WordPress this is still an unsolved problem because in the WordPress you don't usually have no JS running on the server or things like that so all the tools that are out there to solve this problem usually assume that your JavaScript available on the server that's not the case with the common WordPress server so you would also stick to the server side render for components to do this it really depends on the actual use case so you should really think hard about what your performance and scalability requirements are and then think about best approach and optimising for that because there's probably no approach that is best overall it's just depending on what your actual use case is you might optimise it in that direction because for example dynamic server side rendered code will need to render step every single time you're in that page so you need full caching etc. it depends on the exact use case this is true at the moment too so the WordPress template has changed right now even the there are some components that still use server side rendering because of that so thank you yes thank you very much thank you so much


Hello everyone, this is financial author Ahmed Dunn of Ahmed Dunn.com on this channel You'll find financial travel and more videos just like the one you're watching right now. If you like what you see Please give me the thumbs up and consider subscribing. Hello everyone. This is Ahmed Dunn of Ahmed Dunn.com Today, I'll talk about Canadian Tires Triangle Rehearsal World Elite MasterCard In the past I had a post about the Canadian Tires Triangle Rehears Program and I'll provide you a link in the description box below so you can check that out and today I'll talk about the Canadian Tire Triangle Rehearsal World Elite MasterCard So the Triangle MasterCard is actually a no-fee MasterCard and This is the third Canadian World Elite Series MasterCard without any a no-fee The first one was the President Choice World Elite MasterCard and the second one we heard about The Rogers World Elite MasterCard. I have a post about that as well And now the third one we are hearing about is the Triangle World Elite MasterCard without any a no-fee Now let's look at some of the features this card offer So you're going to be earning a 3% cash back on groceries up to $12,000 per year. However, if you're shopping at the Walmart or Costco That doesn't count as a grocery store so won't be earning 3% on those stores so 3% on groceries excluding Walmart and Costco and The other feature is you'll be earning 4% on qualified Qualified purchases made on online at Canadian Tire Store or other stores such as Mark's and Sport Check and Atmosphere So the earn rate is 4% which is pretty good for this category for these stores and then You're going to be getting 5% cash back per liter in Canadian Tire money on regular fuel and 7 cents per liter on premium fuel at any gas plus or a sense plus location So 5 cents per liter and 7 cents per liter on regular and premium fuel and then there's the 1% cash back on everything else if any purchases or transactions are They do not fall in the category the above categories. I've just mentioned Another interesting feature this card has is the roadside assistance gold program for free Which is provided by Canadian Tire So if you purchase the roadside assistance gold program it cost about $100 So just by having this card You're going to go get the free roadside assistance gold program Which basically lets you tow your car and it provides other benefits For example, this is very similar to CAA or other roadside assistance program and this card also comes with cost usage Now triangle world elite mastercard has another stripped down version, which is called just the regular triangle mastercard It has no annual fee and you're going to be getting the same 4% back on Canadian Tire and Mark sport check and atmosphere stores online or in physical stores and also you're going to be getting a 5 cents back per liter At gas bus or essence bus conditions, but there's no looks like there's no 7 cents per liter back on premium gasoline and then it has 0.08 percent or sorry 0.8 percent back on everything else Instead of 1% back on everything else like the world elite mastercard. So if you are able to get the World elite mastercard, then definitely that gives more value However, keep in mind that world elite series mastercard has $80,000 personal income and $150,000 household income card. So if you win those then it makes more sense to have a triangle world elite mastercard because of its parts and features, especially I like the free roadside assistance Membership so you're getting $100 without So that's all for today. I feel like what is safe. Let's give it a thumbs up and consider subscribing There will be more videos coming up and all this channel You'll find a Canadian financial credit card and lots of travel videos and other videos So thank you for watching and I'll see you shortly. Bye