Welcome to the Crimson Engine, my name is Rubidian. Today we are looking at a very interesting system from Teradek and kind of a big step forward for remote focus pulling. It's called the Teradek RT. So here I have my Canon C200, I have 15mm rails installed that hold a battery plate and a battery and in between the battery plate and the camera I have the Teradek Bolt XT. It takes the HDMI signal from the camera and broadcasts it to the receiver or any receiver that is tuned to the same channel. This goes to a unit on the side of the camera called the Latitude which is sort of a power hub for as many motors and control devices as you want to put onto the rails. So I've got it rigged up just for focus but you could have focus, iris and zoom potentially. It also has the ability to do some camera controls especially with red cameras. You could actually use it to start and stop the camera, change the settings and do all kinds of interesting things with that. But on the front is the Teradek RT unit that receives signals from your Teradek RT controller and will focus your lens for you. So that's set up on the camera On this side we have the Bolt 500 RX Small HD Focus 7. So this is a Focus 7 HDMI only monitor but it has the Bolt receiver built into the unit. You see the aerials on the top like instead of having a separate receiver that you have to power, that you have to cable then to the monitor this monitor has all of that stuff built in and it has a couple of really extra cool features. That then mounts on top of the Teradek RT wireless follow focus. So you see here as I turn the ring of the follow focus the controller on the lens turns. Now this is all pretty standard follow focus stuff. What gets really interesting is when I turn on the Teradek RT on the monitor now what happens is I can see the corresponding focal distance of the lens on the screen itself. So I no longer have to put marks on the focus ring and be looking between the focus ring and the monitor as I pull focus which is what every focus puller has always had to do. Now we have a nice big bright display on the screen itself and what's cool is this doesn't interfere with any other signals that the the Bolt 500 is sending out. So if you have you have the receiver for this that can be on the director's monitor or the video village or another Teradek small HD Focus 7 receiver. Up to four devices can pick up this one transmitter and only the focus puller needs these marks. To enable this you need an extra cable that connects the Teradek RT to the monitor and what you do is you go through and calibrate each lens that you're planning on using with its brand its focal distance. So how I do it is I go into the menu of the Teradek RT and I specify the brand and the focal length of the lens and then I can go through and designate all the different focus marks on the lens because if you see on this lens which is the Rokinon Cine85 it goes from six meters to infinity. So it goes it ends at 1.1 meter then two meters is quite a turn then six meters is the same amount and then between six and infinity is you know only like a quarter of a turn. With a proper rehoused cinema lens not a geared stills lens that rotation could be as much as 360 degrees but every lens is still unique and you still need to go into the Teradek RT and specify which lens and what the marks are but the good thing is is that you can save up to I think 50 lenses or 99 lenses in the Teradek RT so if most people are working on a film they may have like a set of six lenses you can just go in pre-define all of those and then you just have to once you change a lens go into the thing and specify which lens you're pulling focus on and your marks will show up on the screen. I've been playing with this system for a couple of days now and it's kind of game-changing you know to have such a nice skinny simple device that gives you both image the focus marks and the ability to pull focus wherever you are wirelessly you don't have to hover around the camera and get in the operator's way you don't have to be you know 50 feet where the director's monitor or the video village is trying to work out where things are and be hidden from set this way you can be out of the way of the camera but enough to see where the actors are and what their marks are and without looking down at the focus ring you can see exactly where you're pulling focus. This is made possible by the fact that SmallHD and Teradek are owned by the same company so they're able to integrate their devices into one another and share information and co-develop systems like this. The Vitek Group also makes tripods it owns a lot of other grip gear Vitek also own wooden camera company which is probably why a lot of the fittings of these are so high quality but you're going to see more and more of this of larger camera groups larger film accessory groups integrating the different brands into the same products to give us more functionality more ease of use and just generally a more integrated camera system that is my look at the Teradek RT and SmallHD Bolt 500 receiver focus puller directors monitor system. Thanks very much for watching links to all of these will be in the description please leave your questions in the comments and I will see you next time


greetings today i want to pick some low-hanging fruit and comment upon the recent rather inglorious pictures of the french president Emmanuel Macron and you can avert your gaze now but here are the pictures boom so as you can see not particularly something a president of any country should appear in and definitely not a president over one of the most powerful nations on earth now of course my main criticism against Emmanuel is not that he has appeared in some pictures that might not be the most appealing but rather that he is a great enemy of the native population of europe he is a great enemy of the free peoples of europe and what i mean with that is that he is in france a great proponent of the great replacement of the french population and is also very pro-eu which means that he is very much against the freedom of the peoples of europe so for me i am on the side of the free peoples of europe i am on the side of the peoples the native population of europe so he is not my friend so to speak so i'm not lamenting the fact that he is embarrassing himself i'm rather delighted that people can see that this man is not someone who can represent himself in a good way he does not represent the liberal leftist establishment of the west in a good way and i hope that more people can see this and say you know what is this a good look and then they can maybe delve deeper so that is also the point in highlighting these sort of things so the point here is not that he has committed the gravest error in taking these pictures yes it is definitely untasteful but the main key is that highlight these things to normies and they might start questing further what kind of individual this is now of course he has a dubious taste in women as well now i am very much not the kind of individual who analyzes peoples personal relations but in this case i definitely think that there is cause to do it and also it's not like these people are playing fair either so it can definitely be an idea to to point out this sort of things to people in general so that they can see and ask themselves is this a worthy leadership of the formerly very glorious nation of france and they say no probably not this is not a good look this is not the quorum worthy of a president of the of a main player of the european union so to conclude these pictures if it had been 20 years ago he had taken some questionable pictures that is one thing but a french president going taking these pictures with a convicted robber and another guy who does an anesthetic gesture towards the camera that is absolutely not worthy of the leadership and make sure to tell your liberal friends that xoxo


Good afternoon, so Firstly I wanted to thank Finn and others at wider for organizing such a wonderful meeting and Special thanks to those of you who are in the audience It's been a long couple days in a positive way, but if like if you're like me your minds are already kind of filled with ideas and great thoughts and Have learned more than your carrying capacity, so I will try to At least end on a good note and talk about a paper by my colleague Stephen Younger and and and myself that we've been working on over the past couple months and The title is a bit is about as bad as the Terms that we use that we made up at the very last minute in the course of writing the paper but it's the incidence of recent health improvements and Let me begin by talking about the Motivation for the paper and let's see if I can I'll just do it this way. Okay So Broadly speaking, I think there's a general consensus, especially in Africa where growth has lagged or had lagged quite seriously in the last millennia or last Prior to The past ten years that growth has finally picked up and that's the case of course in many poor regions of the world But as this conference is motivated by the fact that Still there's a great deal of concern that the fruits of this growth are not equivalent equitably distributed and this has led to a Kind of burgeoning literature on not just inequality per se but issues of poor growth or sometimes called inclusive growth But the vast majority of that literature Almost all of that literature Focuses on one fruit as we call it income or expenditures some money metric of well-being and In this paper We're going to look at a at something else. We're want to look at a different measure of well-being child health and Thus the paper is kind of motivated or tries to bring together two broad literatures That both Steve and I have worked on quite a bit over the years together One is the literature on broadly speaking on improving living standards and poverty reduction, but In the context of thinking about that in terms of distribution of growth but the other is the literature on multi-dimensional poverty and And in this case the dimension that will focus on is Health although this could be done for other dimensions or be done in a multi-dimensional framework in a way that Steve Joan Eve DuClo and I have done in some other work so The purpose or the question that we are trying to Answer is a simple one and it's whether and to what extent improvements in children's health Have been distributionally progressive or pro-poor however you want to Whatever terminology you want to use and Thus we kind of address three questions In that regard the first is We ask whether there are Inter-temporal changes or whether the inter-temporal changes in health status and in terms of the distribution of health status are similar or Do they look like the inter-temporal changes in expenditure distributions? and In order to answer that question we take two Approaches one is to ask the question of whether the health improvements Look at health improvements across the income distribution basically the analogy is kind of the Gradient approach to looking at health inequalities and the second approach that we take to looking at this question is We look at how or the extent to which health improvements are Distributed across the health distribution where instead of ordering well-being along The dimension of income we actually order melt well being across the dimension of health And that's kind of analogous to what's referred to as the univariate Measures of health inequality, okay So how do we go about doing that? Well, let me start off with just talking a little about the data. We're going to use here So the health indicators that we're using in this data all come from the demographic health surveys The reason that we rely on the demographic health surveys is are to the first is that they Span a long period of time. We're really not interested in short spells of two or three years Primarily because like income there's a large stochastic element to health status and You know whether there's some An epidemic of diarrhea high rates of prevalence of malaria or whatever the issue is in a community will result in very Small but important changes from one year to the next so our interest is covering a long span of time and The only data sets out there for the most part that are comparable and that collect health data in a rigorous fashion Are the demographic and health surveys demographic health surveys? Okay, and for many of the countries that we're talking about here This spans a 20-year period of time or so we have looked at shorter spells in this paper We're just going to present the longest spells of each country and a Second reason for focusing on the Demographic well, let me say the second reason focusing on demographic health surveys as I started to intimate is that while there are other Surveys that collect health data The quality of that data, especially when people do things like impute infant mortality rates or look at even Anthropometric data and most of the LSMS type surveys the quality of that data is is very variable to put it nicely Some surveys do a really good job But for the most part the training and the effort to collect that data was of secondary Import and I can tell you that for sure having spent 10 years in the LSMS unit in its early years So the DHS data really does focus in on that But one of the problems is the DHS data do not have expenditure data or income data So how do we solve that problem? Well, we really don't fully solve it but basically what we do is for every demographic health survey we find a comparable household expenditure survey in that country for usually within a two or three year range and Simply what we do is we predict or a level of household per capita expenditures Based on a it's a projection based on a set of household characteristics that are both available in the LSMS type of survey or a household consumption expenditure survey and the DHS survey So this works out pretty well I can talk more about it at some point if people have questions about it how we verify and Look at the robustness of that, but it actually works out pretty well so the other thing to mention at the beginning before we start looking at results is that The inequality measures we're looking at here are for samples of kids samples of children They're not for households, but they're for individuals. So this has certain obvious disadvantages It's for a select group of the population, right old people or Households without children are not represented here. So the upside of a course is that Most or all household based levels inequality measures assume that there's equal well-being within a household and So when we look at income inequality Everybody in the household is ascribed the same income and assumed to have the same level of well-being now Steve and I have done some earlier work of earlier papers There's also been a paper by I think when Robbie Combour was at wider I only know of our paper and his paper that actually try to get at the issue of within household inequality And decompose within versus between household inequality and we found actually that within household inequality is Greater than between household inequality. So if you believe that Your kind of would be motivated to say yeah, this is a really great idea to look at inequality at the individual level So there's an upside to it, but as I say, there's a downside to it. Okay so So much for the data actually I'm gonna skip this slide because of time but just to say that in fact If we look at health indicators broadly over the past 20 years They've increased quite dramatically and in fact more so than income, but let me go right to the methods and Go through this relatively quickly so I Presume that most of you if not everybody in this room is acquainted with kind of the rebellion and Chen Tools that they've developed for looking at growth incidents Okay, these growth instance curves that they have measured and It's basically a simple tool where they take to you can use to cross-sectional data sets Comparable data sets for examining whether economic growth is pro-poor or not and Basically the tool or the technique Generates a set of curves that ask or show How much income growth has taken place at various quantiles along? The income ordering so these curves Kind of look like this and this is one that we generated using the Methods I talked about where we map on the income expenditure data is from the income expenditure data onto the DHS data and You can come up with these growth incidents curves Okay, and this one is actually quite typical of the ones in the paper and the ones that we find and it's typical along two dimensions one is that as I said for both countries in Africa as well as the rest of the world now We see that growth has increased so this is the difference in log per capita expenditures And this is just the percentiles of household expenditures across this axis and Then we draw this growth incidence curve following The methods of a value than dot and others we estimate standard errors around it and we can say that Yes household expenditures per capita have increased throughout the expenditure Decisal across these two decades between 1988 and 2011 But the important point here for those of you who are interested in distribution is The increase in growth is much greater amongst households at the upper end of the income distribution Okay, this comes as no surprise to many of you out there, and that's not what this paper is about Now of course some people in the audience will say yeah, this is pro-poor growth because the poor witness growth Okay, others of you are going to take a Relative definition of pro-poor growth and say no this is not poor pro growth Because the growth amongst the poor is slower than the growth amongst the rich I'm not going to debate that point But the clear message here is that when we look at most growth incidence curves Not only when we do but when others do they generally tend to look like this Where there's more growth at the upper end of the distribution? I'll leave it to you to just determine whether that's good bad or otherwise And here's some other examples from our mapping exercises using the DHS And again that allows us to look at these long periods that we couldn't do with just household expenditure surveys But I'm not going to talk much more about these so I'm just going to flip through them and get to what I want to talk about Which is what I call first the gradient health improvement incidence curve and there should be a G in front of that H But this is an example of terrible nomenclature So if somebody can come up with a better name for these curves, please let us know We're not terribly creative in that regard at least So so what are these gradient health incidence curves health improvement incidence curves? Okay, so basically what we're asking here is what we want to know about is the distribution of health Across the income distribution. That's what these curves do these gradient health improvement incidence curves and The basic question is simply whether health improvement is Larger for children in income poor households or larger for rich richer households and we can answer that question Basically by relying on this term which is either the height of children or the predicted infant mortality probabilities associated with the With a with a specific quantity of the income distribution Okay, so I'm going to And as I started to mention we have to do this this requires relying on a regression which we do non-parametrically using local linear regression techniques and One advantage of this approach actually is that allows us to handle the screen indicators like infant mortality Which the next set of curves will not be able to do Because we can look at predicted probabilities using this technique. Okay, so what do these curves look like? again, I'm going to rush through this stuff in Deference to the time that we have allocated But if just think about the curves that we saw or that one example that I put up in the big screen of Uganda Where the curves kind of were going in this direction? So here's the growth incidence of infant survival For Ghana actually, this is Uganda Like I left the label off But look at this curve. So what this curve basically says is Is that in this case? the probability of surviving to one's first birthday of a child surviving to their first birthday or in this case being taller, which is a good measure of health is First increased across the entire distribution, right and it increased quite dramatically Three centimeters of standard or two centimeters of standardized height or one centimeter standardized height Equals about 1.5 standard deviations of children's height at that level. That's a big increase now to you one centimeter sounds small But at the population level it can take countries decades to do that So in both cases infant mortality rates decline because it's above the zero mark and Heights increased all that's great, but the big story here is unlike the income data. We looked at Notice that the distribution of benefits is at the lower end of the income distribution and again We're ordering household or individuals here according to the household income distribution so the bottom line is that the largest gains in health are Concentrated at the lowest end of the income distribution and that seems to be a general finding across All almost every country we looked at what button Okay, I'm sorry. This is the Uganda case. I guess I didn't get to label them all But the only cases that you do not see that happen Is and I'm sorry some of the labels didn't come out our countries like Actually, I Like Cameroon or and I forgot which country this is my apologies For some reason it didn't come through. I think that's yeah, this is these are both Cameroon where there's been little improvement So when there's virtually no improvement the curves tend to be flat But where there is any substantial improvement The curves tend to always slope downward increasing the improvement is concentrated at the lower end of the income distribution Okay, so now there's one other type of curve that we can look at and That is simply the health improvement incident curve So what's the difference between the gradient health improvement incident curve and the simple health Improvement incident curve. Well in this case, this is analogous to the univariate approach looking at health inequality Where the ordering along the Y the X axis is Actually not in terms of income, but in terms of health status per se okay, so Basically again, we're looking at two minutes Okay, so let me just instead of trying to clarify it just show you the results These results tend to be more mixed where we order individuals across the distribution based on their health status We find that indeed in certain countries for example Peru and Bangladesh Again, the benefits are concentrated at the lower end of this the distribution in some other countries However, this is a little more ambiguous These let me find one okay Cameroon and Ghana are good examples where the benefits tend to be In the case of Ghana where there were benefits more Concentrated in the upper end of the income distribution so in the terms of the growth incidence The health improvement incidence curves where we order well being across the high distribution the results are are a little bit more mixed So let me go to the overall results of of the study of what we know so far okay, so basically The experience for more work, but mostly more important from the vast literature on this in this area suggests that Traditional expenditure-based growth incidence curve tend to be regressive or at best Distributionally neutral and that's generally what one finds in the literature in our case it applied to all the countries that we've looked at except for Peru Okay, but what we've also found is that the distribution of benefits associated with health improvements Differs dramatically from income and almost is always pro-poor meaning pro-poor in absolute terms but also pro-poor in relative terms and they're pro-poor in a relatively dramatic way and the other thing is That the countries that have that observed or witnessed the most substantial health improvements a country like Uganda or a country like Ghana are also the countries that Tend to have the most pro-poor improvements in their health status, okay So it's countries like Cameroon that hardly grew in terms of its income and which hardly Improved in terms of its health status that these growth that these health incidence curves tend to be flat but every country that witnessed a large or dramatic improvement in health also in The very progressive change in health over the time period, okay, and then The so again just skipping to the these health improvement incident curves They tend to be more mixed than where we order well-being by income and We find that in non-African countries particularly in the three or four non-African countries We've looked at less less healthy kids grow more for example Columbia and Peru were examples of that, but there are some cases for example Madagascar We're actually the healthier kids. We're growing more across the spells that we looked at So what is the bottom line of all this? It's that we cannot predict what the gradient health improvement incidence curves look like or the health incidence curves will look Like based on the traditional growth incidence curves that are used income or expenditures so basically the incidence of income growth and health improvements are not the same in a country and while we are Rightfully, I think or correctly somewhat agitated or worried about the lack of relative progressivity in terms of income growth The good news is that when we're looking at improvements in another measure of well-being particularly children's health Not only do we see quite large improvements Overall, but those improvements tend to be far more concentrated at the lower end of the income distribution scale So thanks very much


Hi there Welcome to my talk mind the gap the risks in managing enterprise IoT My name is Cheryl Bissboss. I also go by encrypted. I work as a threat Intel analyst with a bank here in Canada I am a founding member of the Diana initiative. We just had a terrific conference this year Thank you. If you're able to attend or support us in any way Where we support the diversity and inclusion in tech I'm also a member of the C3x college student cyber simulation and Annual event where we run a simulation and help college students get some real good hands-on training Okay, let's get started of course the obligatory disclaimer The views expressed here are mine mine alone and not those of my employer This talk is about taking a bigger picture view of the threats and risks to our enterprise attack surface See what we're missing and then identify the gaps based on existing regulations and security frameworks I hope to give you some takeaways to better understand IoT and enterprise environments in terms of definition threats and attacks and also to give you some Recommendations so that you can better secure what you've got in place and enhance your security policies All right Let's start here Points of ingress that lead to further access We all know what IOT is well Welcome to the EOT the enterprise of things Essentially, it's what happens when we bring all the things that connect IOT into organizational networks So just think about that for a sec because we've really got a handle on this IOT thing, right? That's why I'm here because there's a lot we need to talk about Now I first gave this talk in 2019 surprise Not much has changed Except there's a lot more things that got connected and aren't really protected According to Gartner all the things that connected doubled between 2018 and 2020 as the older tech was replaced with new The enterprise and automotive IOT market grew to 5.8 billion endpoints in 2020 from 4.8 in 2019 Building automation grew the most by 42% in 2020. Thanks to Connected lighting devices smart bulbs anybody There's a lot of talk about the benefits how equipping enterprises with smart connected devices will improve efficiency Innovation and collaboration, of course, we want that but as the saying goes Be careful what you wish for like the sorcerer's apprentice When it comes to EOT, we don't really understand what we're doing and yet here we are Bringing IOT devices in without actually having a plan or security in place The biggest industries are manufacturing transportation and utilities So let's take a moment and consider this Over 90% of the data in the world has been created in the past two years Current output exceeds 2.5 quintillion. Yes, that's a number bites a day and we just keep making more of it When IOT becomes EOT that surface increases and so does our liability So what does it look like? It's better known as OT or operational tech in many places and it's tied to achieving the goals and outcomes of a line of business In manufacturing of automation sensors and scanners There are robots on the manufacturing floor Healthcare uses it to cut costs and improve the quality of care for patients There's remote patient monitoring and telemedicine pumps MRI machines Patient monitors There have been some excellent talks about IOT and medical devices and security risks and it all continues to grow There can be up to 15 connected devices per bed So just shout out and thanks to the great work done By the I am the cavalry people Business and corporations are using smart TVs and digital conferencing and don't forget the printers and scanners Retail uses it everywhere that it can Beacons are pushed out with messages at points of sale Automated checkout kiosks are showing up more and more. There's inventory management done via smart shelves tracking and monitoring for theft digital displays Transportation and logistics use sensors for warehouse management and on vehicles to track locations for fuel consumption delivery times and to reroute vehicles And how about wearables that enable workers to communicate with their colleagues? Buildings and facility management use security and webcams walks lighting and HVAC systems That is a lot of vulnerability just waiting to happen and then COVID-19 happened A new study by zscaler looked at iot devices left on corporate networks during the pandemic 575 million device transactions and 300 000 iot specific malware attacks Were blocked over a two-week period in december of 2020 Now that measured as an increase of 700 from pre-pandemic levels The attacks targeted 553 different types of devices all connected to and communicating with corporate IT networks While the workforce was remote Now 76 of these devices were communication on unencrypted plain text channels Let that sink in And that is the majority of iot transactions which poses a significant risk to any organization The highest traffic came from manufacturing and retail industries With 59 of the measured transactions Enterprise was second with 28 and healthcare was third with 8 Always expect the unexpected there were smart fridges on there and oh Musical lamps sending traffic through corporate networks Do you know what's on your network? The greatest projected sources for endpoint electronics revenue in 2020 Were consumer connected cars And networkable printing and photocopying We are so hacked In order to understand iot We need to understand iot So i'll start here They do say a picture is worth a thousand words Here you go Simply put iot devices are typically non-internet items that have been enabled to connect So that they can communicate with other devices iot comes in different flavors There's enterprise iot Industrial iot The internet of health things This is tech that communicates machine to machine or mobile to mobile An iot in any flavor means extending internet connectivity to physical devices Ordinary objects So what we are doing here is expanding beyond our defined security and monitoring Permiters to connect physical devices that were not originally designed to connect We're adding digital intelligence to enable communications and then taking us the humans out of the equation Now in that sense We're handing over our control to the machines Let me just leave that with you Many iot devices are unmanaged systems Which can communicate with other devices and systems in your organization They process and transmit information They have an operating system, no matter how simple that is But they cannot be managed via traditional security tools They don't let us configure them to be better We're stuck with what we get These unmanaged endpoints don't really have any built-in security that we can manage Things like plug and play Convenience my friends has become the root of all evil Think refrigeration on trucks The temperature control fails The sensor does not alert Valuable cargo spoils That's money lost And let's talk about something bigger You can think HVAC systems anywhere that we work live or stay What about an outbreak of an airborne contagion like Legionnaires disease Think quality control that regulates the safety of what we eat or what we use If those are tampered with Would we know? If somebody changes the settings just enough How would we know? Call me paranoid We rely on these devices to be reliable to notify us We trust them So let's talk about how these things are put together How they're designed We can think of it in terms of three layers First there's the physical layer Their sensors, actuators, smart devices, the things And they are at the edge of the IoT network Edge nodes They interface and communicate to the cloud Using either wire or localized radio frequency networks And those are done through gateways Some come internet ready out of the box and they require little to no configuration There are others Those are older and legacy items And they use conventional methods Like analog or serial connections The conventional devices can get connected to things like microcontrollers Systems on modules Or single board computers Think Arduinos Or Raspberry Pis Next we have the IoT gateways These work as the middlemen Their messenger and translator between cloud and smart device clusters Physical devices or software programs run from the field in close proximity to the edge sensors and other devices Now these mostly normalize Connect and transfer data between the physical device layer and the cloud But they can also support additional computing and peripheral functions So you have telemetry or multiple protocol translation You can have artificial intelligence These can do provisioning Even device management You can put data encryption and even security monitoring On here And last is the application layer also known as the cloud It communicates with the gateway by the internet Using either a wired or cellular connection There is a ton of raw data being collected by all of those sensors And you are going to need a lot of processing power and space for it Now these are the four communication architectures used There's device to device So the devices within the same network connect using wireless pan protocols Those could be Bluetooth or ZigBee Device to cloud Let's the IoT devices connect directly to the cloud And they use long range communication networks such as cellular In device to gateway Well they transfer information from sensors to the cloud Via a gateway device which collects the data And then it communicates it to the cloud Through additional network connectivity such as Wi-Fi or cellular And then cloud to cloud which is known as backend data sharing It enables third parties to access uploaded data from IoT devices For example smart buildings that receive data from Smart thermostats or smart light bulbs can send that data to the cloud via Wi-Fi Wireless sensors and actuators provide the connection between the digital and physical worlds And they work together to produce and collect vast amounts of user data For example as an illustration consider your cell phone The camera and micro sensors The speaker and screen are actuators Billions of IoT based sensors are predicted over the next year And the average home creates enough data to fill more than 332 gigabyte iPhones Now much of this is unneeded and it has to be filtered out All of those sensors how much data actually gets used At a gas rig managers claim to use just one percent From a ship's 30,000 sensors for maintenance planning On average companies use maybe 10% of the information they gather Actuators can produce physical changes based on the data that they get from the sensors So that they can shut off a device or move equipment I want you to think back to how we were talking about handing over control to the machines And what could go wrong and that brings us here We have to integrate all the fast-moving progression into established constraints Think of enterprise architecture or EA as urban planning for systems networks integration Because all the things have to live somewhere So systems engineering that's for one component like a building But EA it's for all the things And the challenge comes from trying to incorporate all of this new technology Into the existing and legacy systems They are not designed for the speed or agility of the newer technology Which leverages machine learning algorithms key to IoT This is where innovation is valued and hence the challenge IoT is constantly developing which is the desired state because Innovation right So EA principles need to not interfere with that But to still provide enough in terms of oversight and control Combining principles of EA with IoT strategies not so easy If business context business value competitive advantage Impact customers partners employees in terms of experience You can see how security got left off this list It kind of looks like this Again, there's a lot of moving pieces and integration is complex even complicated From a security standpoint we're monitoring data flow across three networks Physical devices with firmware issues to logical layers and third-party APIs So to recap three layers of architecture Billions of physical devices Monitoring data flow across three networks and integration issues What's on your network, let's be clear very clear We'll talk about hyper connectivity That consumer driven need for all the things to connect which has made its way right into enterprise environments There's the rush to market and no security in the software defined lifecycle Supply chain risk and don't we know about that? The possibility for the liability Devices get shipped that can't be updated or with limited capacity to be updated And risk gets pushed along the supply chain Whoever buys it owns it Which leaves customers to bear the security maturity for EOT You can consider it an open invitation to shadow IT through increasing unmonitored unsanctioned BYOD In a survey of IT leaders 78 percent reported that over a thousand shadow devices connected to enterprise networks daily That included things like fitness trackers digital assistants smart TVs gaming consoles bring your console to work smart kitchen appliances, etc As IOT moves into a range of enterprise environments driven by consumer demand and BYOD desire Shadow IT becomes shadow ET And it brings new challenges and risks that our existing compliance and security Don't address or regulate So let me ask you this Does your security policy manage the IOT of your third parties? Most organizations still don't inventory IOT devices because They don't have centralized control over what IOT devices and apps are in their workplace How are you inventorying the personal devices used by your staff? BYO IOT hello shadow In an article from CSO from 2018 97 of risk professionals admitted a data breach or cyber attack caused by unsecure IOT devices Could be catastrophic to their organization Mori Sarani the CTO of cyber mdx had this to say That 61 of all medical devices on a hospital network Are at cyber risk and they could be compromised by malicious attackers seeking to steal the data harm the patients or do ransomware The truth is IT teams in hospitals don't have the visibility to see how many or what types of medical devices are connected to the network They don't have the critical insight into the threats and vulnerabilities of these devices So they don't understand them in terms of risk to attack And what's more according to sarani anyway most hospitals don't have the visibility to see if their medical devices have been hacked But these devices are getting attacked for their access to data personal health financial on patients and employees And they can get pulled into botnets or be used for ransomware Breaches are caused by unsecured IOT devices and that increased to 26 percent by 2020 from 15 percent in 2017 Now these devices can collect very sensitive data Connected devices are always communicating with other devices on the network 98 percent of enterprise IOT communications Are in plain text and unsecured that's from a study done by paulo alto in 2020 IOT devices are low-hanging fruit 57 percent are vulnerable to medium or even high severity attacks 83 percent of medical imaging devices run on unsupported Operating systems and that is up by 56 percent since 2018 Have we learned nothing? We do face serious capability gaps and issues integrating IOT into business Companies are not taking a holistic or big picture view, but they're just focusing on one enterprise IOT program Which leaves out organizational capabilities Change management programs that are required when you roll out large-scale initiatives We know now that IOT and ET are different in terms of the standard equipment we connect There's an ongoing increasing risk of shadow I.T. becoming shadow ET and we need to go look for it So let's talk about how IOT attacks are different We're used to attacks or breaches that are primarily focused on data exfiltration for identity theft and credit card fraud, etc Great examples from the rash of ransomware attacks and name and shame sites Business email compromise is just increasing exponentially as well, but in the IOT world There might be some of that but connected devices have more riding on them in terms of running the things that we need and rely on And that's about availability Attackers can turn devices against the company and that's about integrity So it's more about disruption or destruction and impact is measured in damage that becomes dollars This presents the challenge of securing Beyond our cia triangle Attackers can carry out man in the middle attacks spoofing cloning Their software attacks to steal credentials and encryption attacks target key algorithm implementations In a study that was done from the ordedo global report in may of 2019 They surveyed 700 enterprises across five countries The respondents stated a distinct lack of optimism about the future security of IOT devices in their organizations I wonder why an 82 percent of organizations that manufacture IOT devices Were concerned that the devices they developed were not adequately secured from a cyber attack That gives me so much confidence Or there's this in the u.k. Germany and china 100 percent of IOT device users Believe that the cyber security of the devices they use could be improved Either to a great extent or to some extent Again very concerning considering the rate at which these are proliferating through organizations This is from a forest or survey Peer to peer is notoriously hard to secure What are the firmware update policies for devices? How about default configurations Do you look for undocumented backdoor accounts? And then there's misconfiguration. What's turned on by default that exposes you and could be turned off Things like universal plug-and-play or open ports And what are the consequences of an action In april 2019 microsoft threat intelligence center discovered a targeted attack by apt-28 or strontium Against iot devices This involved a voip phone a printer and a video decoder They hit multiple locations and they used the devices as access points into the wider corporate networks Two of the three devices Still had factory security settings And the software and the third one it hadn't been updated So let's talk about this a little bit more Because I work in threat intel. So we follow the game's nation states play Now they have the means and motivation to target critical infrastructure We've seen destructive targeted malware like shamun Triton not pecha And international economic sanctions provoke retaliation With iran and north korea both demonstrating their capabilities here Thanks to the release of the mirai botnet source code We've got a plethora of weaponized botnets out there that can do a whole lot more than just ddos attacks This is all about power and control So unmanaged and iot et are far more valuable far more vulnerable To attack than conventional managed devices And we can't apply the same attack scenarios and threat models as we do for enterprise it Why we need to evaluate what we have in place? Well attackers can leverage and pivot and each of those end points becomes a point of ingress for further access Let's look at some attacks Who remembers this one millions Of first generation amazon echo devices and eighth generation amazon kindle devices Were vulnerable to something known as key Reinstallation attack or crack a four-way handshake vulnerability a series of them actually disclosed in october of 2017 Now these could be exploited by attackers to conduct man in the middle attacks Against wpa to protected networks And then they could steal information from the targeted devices by decrypting packets that were sent By clients But it also let attackers replay the old packets and then perform a denial of service attack Disrupt network communications or replay attacks Decrypt data and information transmitted by victims Forge data packets etc But we've moved on from here Here's another thing Because what enterprise organization doesn't have polycoms or teleconferencing? There are a lot of end points in these systems and they each have their own security and risk factors to consider More importantly every single endpoint represents an opportunity to get into the network Who actually implements these very likely it's the good folks in av But I don't think they're thinking about security when they're setting it all up This is an attack on the polycom hdx videoconferencing systems omni discovered it back in august of 2018 Thousands were exposed externally and many more were deployed internally Polycom systems are linked to each other across different corporate offices globally A trio of iot botnets bushido hades and yaoi that were based on mirai were used in the attacks They spread by telnet and brute force was used for access Then things like busybox and wget and other binaries on the linux operating systems were compromised Just one One exposed and misconfigured system Infected the entire network The risk of unified communications devices with default passwords or pins And there you go But now there have been a series of massive attacks Not just one several Over 2019 to now and these Well, we're going to get into them Identification is hard, but taking action to remediate them is even harder Device vendors would need to take the updated tcp ip stacks And integrate them as firmware updates into their products And you're going to see an interesting Connection or theme revolving around tcp ip stacks in these The thing is Many vulnerable devices don't even ship with the ability to update the firmware and that means that some of that equipment Will likely remain vulnerable for the rest of its life Let's start with this urgent 11 July of 2019 This was a set of 11 vulnerabilities which affected the vxworks tcp ip stack and ip net It's perhaps the most widely used operating system you've never heard of Six of these were critical vulnerabilities that could enable remote code execution There's a wide range of affected versions spanning across 13 years And how many manufacturers use vxworks? Countless There were over 2 billion devices impacted Now the attackers can circumvent net and firewalls to control devices remotely via the tcp ip stack Undetected With no user interaction required Yeah The vulnerabilities have a low level position in the stack and so the attacks are viewed as legitimate network activity And because the vulnerabilities Don't require any adaptations for the various devices that are using the network stack It spreads really easily This is what's impacted Real-time operating systems that are used in critical infrastructure And manufacturing the stuff that we rely on More than just running our day to day lives, but actually helping us stay alive In an example of an attack This one Attacks the vxworks devices at the perimeter of the network such as firewalls now you expect these devices to be designed To fight off incoming attacks and that they should be secure However, an attacker can take over the sonic wall firewall on the perimeter via urgent 11 and an internet connection It uses a specially crafted tcp packet and then it takes over all of the firewalls to build a botnet Urgent 11 enables attackers to take over the devices with No user interaction required so that it can bypass perimeter security devices like the firewall and that solutions And these vulnerabilities are essentially warmable So they can be used to propagate malware into and within networks So an attack It can resemble that of the eternal blue vulnerability the one used to spread want to cry malware This impacts Literally any vxworks device with an external network connection And the attacks can take control regardless of the firewall or NAT solution like I said On the perimeter of the network to fend it off Moreover the attack can remain invisible to security measures because like we said earlier the vulnerabilities are low level So they're seen as benign TLS doesn't even matter But then we got to 2020 And in june ripple 20 was discovered Those were 19 vulnerabilities that impact a tcp ip library developed back in 1997 and it's the base of many iot products It enables the devices or software on them to connect to the internet using of course tcp ip connections What's the impact hundreds of millions of things from Smart home devices routers communications equipment that's used in mobile and satellites data center equipment It affects health care systems transportation systems power grids It can steal information from a printer. It can mess with an infusion pump. It can impair industrial control device functions essentially Quote an attacker could hide malicious code within embedded devices within embedded devices for years And one of the vulnerabilities could enable entry from outside Into the network boundaries and this is only a small taste of the potential risks December of 2020 brought us amnesia 33 The affected libraries were added to device firmware to allow products to support You got a tcp ip which is as you've guessed by now Currently the most widely used networking communications protocol This creates a greater risk when you're working from home Because all those unmanaged home routers can compromise vpn protected corporate networks And then they gain access to your offices and plants And if exploited an attacker Could among other things perform Remote code execution to take control of the targeted device Or do denial of service to impair the functionality and impact your business operations There could be information leakage and you could acquire as an attacker potentially sensitive information Or there could be dns case poisoning attacks and point devices to a malicious website But here we are in 2021 and in february for scout found vulnerabilities in Multiple you got it tcp ip stacks where initial sequence numbers or isns We're being improperly generated The thing to know about these isns are that they have to be randomly generated To ensure that the tcp connections between the devices are unique And these are used in establishing new sessions within tcp connections Otherwise there are collisions And with collisions You could get an attacker or a third party interfering with the connection in progress And if an attacker can guess an isn well, they can potentially hijack an ongoing connection Or spoof a new one The attacker jack added seven more vulnerable tcp ip stacks to the four open tcp ip stacks that were identified in amnesia 33 Increasing the vulnerable devices by millions This stuff is all ongoing Nothing's been completely fixed The popularity and some use cases of the vulnerable is stacks. Well, that's extensive Because it's used by millions of devices and includes everything from file servers to embedded components This makes identification a challenge because You don't always know what stack a device is running You may not even know at all It may not be Made apparent to you may not be enclosed in the literature when you get it And these embedded devices are very difficult to manage an update What can you do about it? Well, you need to discover and inventory the devices you've got that run on vulnerable tcp ip stacks and keep track of that patch when possible segment networks And you can use ip sec And that brings us here To april of 2021 and namerick now This affects The dns Implementation these are the vulnerabilities and they can cause either Denial of service or remote code execution It affects four More popular tcp ip stacks. We've probably mentioned these before so free free bsd That's one of the most popular operating systems in the bsd family ip net you've heard me mention this earlier because that's the one with vx works There's net x And this is part of thread x's real-time operating systems and it is currently an open source project maintained by microsoft Under the name of azure rtos net x and then there's nucleus net This is another real-time operating system. It's meant. It's uh under mentor graphics, which is a semen's business. So yeah, you're thinking medical industrial consumer aerospace In an attack threat actors could exploit name wreck vulnerabilities to cause some serious damage to government or enterprise servers health care facilities Retailers or companies in the manufacturing business And attacks can involve stealing sensitive data or modify and take equipment offline for sabotage They can also tamper with critical building functions in either residential or commercial locations Can control the heating the ventilation? disabled security systems so Now you have a good idea of how these attacks work and polycoms Just takes one to infect an entire network But now we're looking at a whole host of massive vulnerabilities leveraging the tcpip stacks the problems of identification and of mitigating embedded devices Please make it better When you're talking about iot architecture, these are some of the essential requirements The good news is that some progress has been made in terms of legislation In january of 2020. We had the california iot cyber security improvement act an oregon followed on those heels Manufactures of iot devices are required to equip any iot device that they make with reasonable security features appropriate to the device The information that it may collect hold or send and protect that device and the information on it from unauthorized access destruction use modification or disclosure In december of 2020 president trump signed into law the iot cyber security improvement act and this provides the first federal standards for this area And nist was charged to develop minimum cyber security standards for any internet connected device sold by vendors to the u.s. government And iot vendors to create vulnerability disclosure policies to inform promptly We're getting there a little bit but We need to put some rules in place Businesses need to be clear on why they are using what they are using and understand the path of the data flows and how it will be handled They need to design with security from the beginning Because it and ot need to work together on this with clear roles to manage applications system infrastructure and data We need to leverage the power of the bomb Bill of materials for all the things software hardware firmware Know you're normal so that you can monitor for anomalies and you need to automate to get the visibility and to stay current And this please Because you don't know what you've got till it's pwned This whole section has been a takeaway so finally spend some money and some time We need to do a culture shift and break down the silos within and between it security and other departments to ensure visibility as well as understanding Our shared goal needs to be to build a cyber security strategy Across departments and functions. I know that sounds like role piece But I'm going to end here Who has seen the movie iRobot? It was good until it wasn't good, right? And which about sums up what it's like when iot infiltrates enterprises These devices are not the obedient little soldiers that computers and laptops are They interact differently with the existing network and they behave differently They operate with little to no human intervention Automating convenience with inadequate supervision is going to end badly Just saying Thank you so much for your time. I hope you enjoyed this talk and got something to take back with you Those are my details there Bye


This is probably pre, I believe in Steven Boat. I'd have to imagine, because it's pretty early on in your Oakland career. And if people don't know what I'm talking about, hopefully Kyle, you can clip in some of that chant here. It's incredible when you came up to play in Oakland. What are they called out there? It's not the Bleacher Creatures. I don't know, I don't think they have a name for themselves, but the right field Bleacher fans and the left field Bleacher fans, those are some of the best fans, most dedicated in baseball. There were nights at the Coliseum where we had 10,000 people, but the entire sections in left field, right field were full every night. It didn't matter what the record was, didn't matter what was going on. They were going to be there, they were going to be yelling, chanting. When they started the I Believe in Steven Boat chant in 2014, obviously that was one of the most special times of my career because I loved Oakland. I had become a ball player there. I made my debut in Tampa, but never got a hit as a ray. And so Oakland fans just embraced me. And I think that whole chant that I believe in Steven Boat, it became this such a deep meaning more than just fans cheering for you. It was one of those things. And it stuck with me now. And here we are in 2020 and during spring training, I heard people yell and I believe from the random ballparks that we go playing. So it's they started it and it's it's been falling here on ever since. And I absolutely love it.  Yeah, the loudest ovation I got in Oakland was when they released me and brought Chapman up. I think this is the best way to go. Travis did something for us.


I remember having an exploratory call with a potential client and I asked this person, well, tell me about your goals. And what they said back was, well, I want a business beyond my wildest dreams. Doesn't everybody. And, you know, I always remember that because that energy of chasing wild success is the same energy I had when I started my business. And I'll say when I was maybe less sophisticated about the truth of the entrepreneurial journey. Not that we can't achieve wild success. I feel today, I mean looking at where I was back in 2009 when I started and today I would say, if I looked at my business today my that's that's pretty successful. But the chasing is what I want to talk about. And what I'm doing differently over the years with that chasing. And I guess maybe what we're talking about is the definition of success. I think it's really important to continually return to how we consider ourselves successful, or not successful. Because a lot of us are unknowingly defining success based on some kind of meeting of our parents expectation, perhaps, or some other family members expectation, or to try to compete with our friends, our colleagues to say, Well, look, they're, you know, maybe it's high school friends college friends or, or, or just people we've met, you know, in our, in our adult years, and say, Well, that person can do that well I can, I can do that I should be able to I should be, it's either well I can do that too. Or, well look at them I should I should be farther along by now. If you ever have these thoughts. I want to encourage you to let them go when you when you catch them, let them go and replace them with something that is more uplifting for you, something that is more encouraging, because any of those thoughts of competing with others or chasing after an external metric. Because you should be further along. It's eroding this authentic power that you have to actually create with your unique genius. And so, so basically, I burned out when when I started my business in that way, learning from the six figure seven figure eight figure gurus who are putting those thoughts in my head of success means a certain lifestyle.   And, you know, just, they look successful, whatever that means in the maybe Hollywood or media sense of things. And I burned out after three or four years of chasing that so 2009 to 2012 13 I kind of burned out in that time. And I restarted my business over because I said you know I, I'm doing business in a way that doesn't feel true to me, because I'm chasing after those metrics. And I started off back in 2014, trying to be find my humility find humility again in the face of, you know, my, my divine source, and believing and remembering that in some mysterious magical way. And I believe we're all taken care of our souls at least are all taken care of for eternity. And number two, I believe we're here in this life, not to experience. Well, sure, experience pleasure that's fine and to experience success or ambitions that's fine but I feel like the something deeper for this life is something more along the lines of spiritual growth. You know, expressing our souls purpose, loving one another, loving ourselves, all these deeper metrics, you might say, is what I recommitted to when I restarted my business in 2014. So I made a decision that I'm going to be. I'm happy being average in the external metrics, but to lead from the internal metrics. I'll say that again. When it comes to the external metrics of followers, how many followers I have on the different platforms, how much money I'm making the external things that humans measure success I just want to be average. I just want to aim to be average. Truthfully, I think the amount of money I'm making is actually above average for people in my industry right now, but it's not seven figures. It's low, you know, low ish six figures. 200, 300 K a year, it's, but it's so I guess depends on you compare it with I think based on the kinds of success metrics in my industry, I am average at best. Okay, and definitely based on the followers of my industry, I am below average. Maybe if you wanted to say what is a successful business mentor a business coach, I would be below average in the in terms of followers. But here's what I'm happy about is that the stability of my business is above average. I just heard today from a client of mine who said that she had worked previously with another business coach who made big promises, and you know, ran a pretty good program but their business went under that the business coaches business went under, and they couldn't keep their promises and their guarantees, even meet the guarantee. It is so common in my industry that people just have these blips. They look really successful but you don't realize that, you know, they're their businesses not stable they like are not able to fulfill the promises to their customers and their students and their groups and their clients, whereas I have been stable in my business since since 2015. I started in 2014 I kind of started my group programs again in 2015, and I've been stably growing since then, both in my money but also in in my ability to serve my clients in my audience. And it's that's really hard to it's surprisingly hard to come by. There are a handful of people in my industry whose businesses have been stable for more than you know three four or five years. So, the key, in my opinion that the people who are able to be stable and not flaunt their wealth and success and show we'll look like their life is always on vacation. I think the key is to prioritize the internal metrics. That's the secret of success in a sustainable and authentic way. So prioritize the internal metrics and just be happy with being average in the external metrics. Now average of course depends on who you compare it with but just to be as happy as possible with whatever our external metrics are, but to prioritize the internal ones let me go ahead and share with you well what are the internal metrics that I am prioritizing and that you might want to consider how this aligns with your own chasing after success or your own prioritizing every for your annual goals for your monthly goals and your weekly goals and your daily sense of whether you're going to progress or not so let me let me share this with you there are basically three major areas that I prioritize, and I kind of let the externals take care of themselves. The external metrics will take care of themselves they take care of these three internal ones so number one is to become ever more masterful at my craft.  So for what I deliver to clients is the ability to teach better to coach better, particularly in specific areas like, you know, advertising and productivity and how to how to frame our message wrangle all of our ideas into a framework and to launch courses to self publish books and to to do net caring. So I that's sort of like my sort of quote quote technical skills that I'm continually working to improve to become better at based on what I know this works with my clients and myself and learning from other people other mentors and noticing, you know, my clients what they're trying what's working out am I like gathering all this stuff to continually refine my body of work, essentially. And if I get better at my craft. All of my students benefit right all of my clients benefit. And when they benefit. It encourages me to, to get even better at my craft. So there's this virtuous cycle. So rather than the typical vicious cycle of chasing success, finding that it doesn't really fulfill so you got chase the higher numbers after that. So that's not really fulfilling either chase higher numbers of money and followers and status. No, it's like with with the internal metrics, instead of a vicious cycle it's a virtuous cycle because the more we grow on the inside. The more the people we we touch in our lives grow as well and are aided and benefited by our growth. And that encourages us to grow even more on the inside. So to mastery of our craft is the first internal metric that I continually work to improve. The metric that I use, you might wonder well how do you measure that the mastery of your craft well, I'm getting better about that too right the learning how to measure the internal. So the way I measure it is like, at the start of my courses that I've been teaching this year, particularly. I have a startup, start of course assessment to say, Okay, tell me how you how confident you are about these different sub areas in this course. I have my students score themselves. At the end of the course I had them score themselves again, and I see the improvement or lack of improvement in certain areas. Okay, that's where I'm doing. Okay, this is where I can improve my my ability to teach in these areas and. And so I measure the level of growth of my students and my clients as a way of measuring whether I'm mastering my craft so that's, that's area number one is the mastery of our craft area number two is the. The awareness of our inner qualities in terms of how our personal growth, the areas of our personal growth that touch our business growth. So, for me I believe that all business is really a stage for spiritual development that's that's really my. My secret intention is to bring more spiritual or personal growth into business. You think I'm teaching you LinkedIn ads or how to launch a course but secretly and hoping I also infuse into you. The desire to grow in awareness or in compassion or in courage or in perseverance and all that stuff. It's because I think that's really what's what life's about the launching the course making enough money making more money that's just, that's all just a stage to practice or or a tool to practice awareness, our ability to see the blessings of our life and to find compassion ABC ABC, I actually have. I've been writing about my spiritual alphabet ABCDF G hi to 26 letters each representing a particular virtue or value that I'm practicing, you can find that over at my soul gym Facebook page if you want to. You'll find my posts there about my spiritual alphabet. I'm publishing a book soon about that too but anyway, that's my second major area is my spiritual alphabet. Every week I focus on one more letter one more virtual value. Every week is happens to be the letter X represents exhale, exhale, so it's like being aware of my breath throughout the day and how you know when I am, you know, working intensely on a project I'm, I find that I'm like sometimes like stop as I go focus on the breath again breathing joy and gratitude into the task at hand, you know, practices like this that I focus on one practice each week and it's just one it's wonderful it makes my. Well, this is why I'm able to be stable in my business, calmly stable and growing year after year is because business isn't about the ups and downs for me. It's not about Oh my God successful launch all sad bad launch all successful all sad bad launch. I did that already first couple years of my business and I just I burned out doing chasing those externals and focusing so much on that now I'm like, doesn't matter it's up or down I'm focusing on the practice my spiritual practices week in my business and I feel like if we each do that, whatever your spiritual practices and we focus on that and business can be joyful can be, it's just to stay whatever the numbers are we show up consistently day after day, whatever days you work, and just focus on the spiritual practice within sending this email or fixing the problem or prepping a client or doing our bookkeeping or planning our business or writing our content or making showing up on video or overcoming the fear showing up on video or whatever it is we're doing it's just spiritual practice just showing up for it. It's not about whether it's successful or failing success. The numbers tend to take care of themselves if you show up consistently practicing courage, practicing graciousness with others practicing compassion toward yourself and towards others as well right. So that's the second major area that I really prioritize focus on is the spiritual practices and the inner life continually every single week focusing on something. And then the third major area focus on third internal internal aspect that I want to become a leader on to really lead others to really compete. You know, these these three. Let me say this again. This is where I'm competitive. I don't care about competing on the how much money I'm making and the followers that I don't care about that. But I want to compete with all of you, and with my peers, and whether we are really focusing on the internal growth. I want to compete there compete in the good sense that I let others who are who who are infusing that kind of presence into their content and their offers and the way of doing this is I want to I want to be inspired by what's possible and try to increase that level as well. Just as I am hoping to inspire you with my internal leadership and and inspire you to continue rising up to a higher level that that I know you can. So the third area. Okay, as I said the first area was mastery of my craft. Second area is to practice my personal spiritual growth every day my business and third area is to practice balance is to continually optimize the balance between work. Rest. And hobbies. And by the way family life kind of leaves into all that sometimes family life is part of rest and part of hobbies part of work as well anyway, but work rest and hobbies these three kind of core areas that most of us have. Always continually needing to be balanced right have you noticed, because work always change keeps changing, and your need for rest keeps changing and you keep forgetting to rest enough. All of us do. All of us keep forgetting to take enough breaks throughout the day to be aware of recovering ourselves and our spirits and our bodies and our minds and our hearts and our emotions. And regulating them also to to work on our hobbies because hobbies, whatever hobbies you do brings more creativity and fun into your life, which of course spills into your work as well. It allows you to be to think new thoughts and to see in a new way. I work rest and hobbies I'm always like working on, you know, and the practicality of that is working on my schedule to make sure my schedule incorporates enough of these different areas. So I hope that this is inspiring, or at least reminds you again to bring the daily focus back to internal metrics of success, which are, which all of us can grow forever whereas the external metrics. We all bump up against each other it's like, if you're growing in followers that means someone else. It's like, attention is limited money is also limited right people can only spend money on certain number of things so like as someone makes more money that people spending money on their stuff, there's less money to spend on someone else's thing right so like the external stuff truly is limited and it's like competing there's it's like it's a scarcity game whereas the internal is abundance game. You can't get more and more without competing without taking away from anybody else. So I hope this is helpful and I look forward to your thoughts and your comments below. Thank you so much for joining me.


Hey everybody, this is Brian. Welcome to the third ye tutorial. Today we'll be discussing MySQL, GEE, and CRUD. A lot of acronyms. All right, so open up your main PHP. You should know where that is. If not, it's under your web root protected config main.php. And if you've been following along, you should have uncommented out the GEE section in the modules part of the array. Give it a password and give it an IP filter. That's important. That just means people from outside that IP address can't hit it. And also scroll down to databases. We've commented out the MySQL, or I'm sorry the SQLite, and we've uncommented the MySQL. We're going to be using a database named test with the username of test and a password. All right, so now that that's all in main.php, how do we actually set that up? Well, I'm going to be using something called MySQL work branch. You can use whatever you want. Some people use command lines. I wanted to use a GUI interface because I realized that some of you databases may be new. So just log in. Users and privileges, we're going to actually create a new account. Week password. Who would have thought that password was weak? Anyways, account limits. We're going to give it unlimited. We want to, for these tutorials, just give it DBA access, which is basically God mode. You can do everything. In a production system, you would want to follow industry best practices and lock this down as much as possible. But for these tutorials, I'm just going to do everything because why not? All right, now that we've got our user account, we need to actually create the schema. Schema, which is also called a database. We're going to call it, you guessed it, test. Hit apply. And the thing I love about MySQL work branch, especially for new people, is if you have no idea what's going on, it actually shows you the query it's going to run. So we're just going to create a schema named test. There it is. Now I have to actually put some thought. What do we want to do? Let's do the school problem.  One of them is, how would you design a database for a school? If you think about that, it's actually a very complex question because, well, you have classes that have students and teachers. So how do you link all that together? We're going to create a table. We're going to call student. And notice how it creates this primary key for you. We want the primary key not null, unique, and we want it to auto increment. That's actually very important. I'll discuss that in a second. We want to first name and last name. And we'll flush these out a little bit later. This is, like I said, just for these tutorials. Not going to be doing a whole lot of data access here. This is going to be for ye. And if you're new and you have no idea why I'm changing 45 to 255, let me explain. VeryCare is an array. It's just an array of characters. The default was 45. I'm changing 255. So the size of that array is 255 characters. Believe it or not, there are people with names that will hit or exceed 255 characters. That's rare, but it happens. 45 is kind of small for a name. So we're going to go ahead and hit apply. Once again, you'll see the query that it's going to pump out to the database. And you'll see whether it executed or it failed and will give you an error message if it fails. And you can see down here, I have to apologize if you can hear my cat whining in the background. I'm the invisible man in this house until I start doing a tutorial. And then the cats just want my attention. So we're going to plug on here and do teachers. Oh, how the f***ing kitty go away. Kitty, I'm teaching people. This cat, I love her to death. I've had her for 20 years, but she's going blind and she's deaf, which is why she meows so loud. First name, go to sleep kitty. Very sorry. All right. 255. Hold on a second, guys. Kitty, go bye-bye. Go do something else. Go. All right. So once again, primary key, not null, unique, auto increment, apply. We're going to save those changes. Oh my gosh, she must have just woken up for a nap. She's very chatty. All right. So now we're going to create the classes table. This is going to be a little different. Once again, primary key, not null, unique, auto increment, but we're going to add what are called foreign keys. So we're going to say student kitty go away. Cats like swiping at my hand here. And we're going to set that type to int. And we're going to say int. Now if you're using a larger database, you can use big int instead of int. The only difference is big int is a massive number where int is a smaller number. You can go ahead and change that if you want, but we're going to hit apply. Now we're going to add the foreign key. To do that, you just click, select students, select student ID. And you notice how it automatically says ID students. I'm going to stop right here and say if you messed up, it will not automatically select that field. It won't even let you select it. And typically when you do that, jump into students, is because you didn't set it to primary key, not null, unique auto increment. Auto increment really isn't needed, but it's good business practice. If you don't have a minimum of those, it will not let you create a foreign key. So what is a foreign key? What we're saying is that the ID students field, this column right here, this points to a student in the student's table. It's literally the primary key of that student. It's a foreign key. Get it? All right. So we're going to create another foreign key called teacher. And we're just going to, oops, we don't want that. Derp. All right. Sorry about that. Cat's playing with my mouse. So the student foreign key points to the student record that teacher foreign key points to the teacher record. Now there's some other things like you can do operations or options. So what you can say here is the student on update, you can restrict cascade set null or no action. We're going to say no action because if we do something with that student record, we don't want it to impact the class table. Example on delete. If you delete that student record, that student no longer is there. You could say cascade, meaning it deleted the whole class. Well, the class doesn't stop just because the student decided not to go to school anymore. So we're going to leave it to no action. Just wanted you to be aware of that. It's kind of an advanced feature of some of the database functionality. Hit apply. Boom. So now we have our class with students and teachers. Pretty nifty, huh? Well, we're going to keep it that simple for these tutorials. I don't want to really cloud these with high end database tutorials. Those are a totally separate topic. The reason why we're using these foreign keys is because you will actually when you're building the models, remember model is a representation of the data, it will actually build in the relationships. So let's actually jump back to our web browser here and you see where it says index PHP question mark are equals. Well, that are equals is a route that tells index PHP where to route you within the system. We're going to actually select the slight the site slash contact type in G G I hit enter and it says please enter your password. Now this is the password that we set in main dot PHP. If you're confused, just jump back in and you'll see under the modules array, we've uncommitted key and we've set a password. So we're just going to key in a password and it says welcome to the code generator. That's actually what he is is the code generator. Notice how you can generate a controller crud form model and module. Well, high level overview will go into more detail in future tutorials. A controller controls the flow of information through the website. Notice how you can give it an ID. So you could say like class. That's a class controller or you can say pets a pets controller and then actions are actions within that controller. Typical actions would be like the index to read to write delete. That's actually what crud stands for create read update delete, which is by the way our next one create read update delete. This is how you would modify information out of a database. So you can actually generate the cloud using a model and using a controller. Now form is simply a form is just a web form. That's all it is. You can do the same thing. You can select a model and select a view and select a scenario. Scenarios are a special case like login or registration. And this is all template based. You can actually modify the code that this is going to generate. Model generator. This is actually what we're going to play with right now. This is where it reads out of the database. So you want to key in the database name like you notice how it autocompletes classes. That's how you can tell that really it's reading your database and your database access is working. Now you should know if you want to generate the models for everything, you can just type in star. Make sure build relations is checked. This will build the relations between the models for your foreign keys. Remember we have a class. That class has teachers and students. They have foreign keys pointing to these students and teachers. That will build the relationships. And you can actually use the column comments as the attribute labels. Attribute labels would be the labels of the attribute, a definition of what it is. When we do star, we're just doing a wild card saying do all the tables. It says you may also enter star or schema name dot star for everything. When you click on preview, you see what it's going to generate. And you can actually click on the link and see exactly what it's going to generate. This is kind of your last chance of, hey, do I really want to do this? And you can check and uncheck and say, well, I only want that one or I want them all. Now a module, we're going to click generate here in a second. But real quick, a module is like a site within a site or a sub site. So you have your normal website. And let's say you want like an administrative section. You'd make an administrative module. So let's actually go into modules. And you can just give it a name like administrator of doom. And it would make an administrator of doom module. And it actually puts it under the module sub folder in your site. So for this, the first thing we want to do is create our models. And we're going to just do all of the tables. Oops, not student, all of the tables. Base class is C active record. It's very important that you know that C active record is the super class, if you will, or the inherited class that we're going to use. Basically that access is the database for us and hides all that functionality in the background. So we're going to do that. And then we're going to just generate. If you get this error message, there were some errors generating unable to write. Basically what that means is, wow, yeah, we have right permission issues on that folder. The reason why I left that in is because, well, we need to fix that. And a lot of you are going to get to this point and go, what, how do I fix that? What is this? And you're going to just panic. So let's actually, we're going to open up our shell here. Kitty, seriously, go away. We're going to say CH mod. Actually, we're going to say CH own. We want to, sorry, cat is like totally distracting me. Enter your name. Mine just happens to be root shell. It's like my gamer handle. And then the group is dub, dub, dub data. And we're going to say fair, dub, dub, dub HTML. And this is test. And we want to recursively do that. And what we've done is we've changed the owner of that folder now. And then we want to sudo chmod user group other plus read write. And that's pretty bad practice. You don't really want to do that in a productive system. But once again, this is my dev box. I'm just showing you very quickly how to fix this. And we're going to recursively set that. And what we're doing now is we're changing the mode to user group and other read write. So we're basically saying everybody can read write to that bad practice. Once again, don't ever do that in production. All right. Now we're just going to preview it again, try to generate, and voila, we've generated. So that is how you fix a permission issue. Common pitfall for new beginners. Typically, you'd want to actually set it correctly rather than what I just did. I'm just showing you, hey, that's the quick and dirty way of doing it. Now that you've generated them, well, what has it really done? It's generated the models. I like models. Models are pretty. But anyways, when we go into the models folder, you'll see we now have students, PHP, teacher, PHP, and classes. So let's just crack one of these open. And we're going to go over this in-depth in a future tutorial. But some of this should look pretty familiar. You've got your primary key and your foreign keys. So let's actually go back into our database here. Maybe. And here's our classes. And here's our classes. I'm just going to revert that way. We have any changes. And let's say we made an oopsie. And we're like, oh, we need a name of the class, right? Because class is going to have a name. And then you hit apply. And you see that's going to just alter table. Well, when we go back in here, notice how it hasn't automatically updated. So we've got to fix that. So you just go back into models. And just for the sake of argument, you could do classes or you could just do star. Maybe if my keyboard quit freaking out. Preview. And you notice how unchanged, unchanged. So it's smart enough to know that there's no real changes needed. And it can overwrite. Meaning, oops, this one's going to have differences. And you can click diff. And it will show you the differences of name has been added. Pretty sweet. So you can see what it's going to do. It's going to delete that. It's going to add it here. It's going to move it there, et cetera, et cetera. Just wanted you to really be aware that's a very powerful feature that a lot of frameworks just do not have. And you go ahead and generate it. Jump back in that beans. And you see, there it is. And we're going to go over models in depth in a future tutorial. But you should just be aware of that's how it is really done. All right. So let's actually jump back up here. Now we're going to create our crud. Our create, read, update and delete is crud. Here you have to actually give it a model class. What does that mean? We're going to give it a name of one of those that we just generated. So we got students. Make sure that name actually matches up. Well, through the magic of copy and paste. And you'll see this is what it's going to generate. Now, crud, create, read, update and delete generator. So this is creating the web pages that will allow you to create, read, update and delete. And you can see them here. It's going to create a controller, which we'll talk about in a future tutorial. Some forms and then various web pages. So we're just going to go ahead and generate those. And it says the controller has been generated successfully. You may try it now. Interesting, huh? Wasn't exactly what I wanted. So we're going to say, Now you may be stuck at this part like I get sometimes. And it says, hint, you may log in with demo, demo or admin, admin. So we're just going to say demo, demo. Now you're logged in. What we've done is we've just demonstrated that just right out of the box with any modifications, this has already got security baked into it.  So I looked at a lot of the frameworks and I wanted security baked in from the ground up. And that actually has it with you. But anyways, so here's our students. You can create and manage. So let's, we can create a student or we can manage the students. Now we're going to go over those in a second. But we want to go back here and we want to actually say, all right, let's do the classes and teachers. Whoops. Teachers doesn't exist, huh? Teacher. Ooh, did I boo boo? I did boo boo. Ah, yeah, there's no S there. That's why. All right, well, it is what it is. We're going to go back here and you can generate it.  But for these tutorials, I think it's just fine. Notice how when you hit try it now on teacher, it just logs you in. It's because you're cached as login because you're logged in as demo. So we've got our stuff in there. Notice how it says our question mark equals teacher. That's the route. We're going to talk about that in our next tutorial. That's all for this tutorial. This is Brian. Thank you for watching. I hope you found this educational and entertaining.