Thank you all very much for your attendance. I'm Alex White. I'm delighted to have been asked to chair this session, this presentation, and to welcome Mansour Hamarion, who is our guest speaker this afternoon. I think we're all familiar with the sustainable development goals. In fact, Mary Robinson spoke here last week, and we're very interested in the presentation she gave, and I think it was an opportunity for us to reflect on the, and as indeed is today's talk, to reflect on the sustainable development goals, particularly goal 7, with which we're all familiar, which commits countries to, quote, ensure access to affordable, reliable, sustainable and modern energy for all, and you'll be familiar with the fact also that the UN in its 2017 report, or its assessment, pointed out that in 2014, 14.7%, just under 15% of the global population, has no access to electricity. Well over a billion people, predominantly rural dwellers, have no such access, and half of these people live in Sub-Saharan Africa. So that more than 3 billion people, mainly in Asia and in Sub-Saharan Africa, still cook without clean fuels or efficient technologies. The World Bank has identified that emerging and innovative energy service delivery models offer unprecedented opportunities for private sector driven off-grid electrification and for accelerating universal electricity access. So the urgent necessity for progress and for increased and enhanced progress is clear. The close relationship between access to clean electricity, on the one hand, and material, basic material well-being on the other is, I think, clear. The opportunities that exist are manifest, especially given the extraordinary evolution that we've seen of data technology. So who's going to lead this? Who's going to do the work? Will it be governments? Will it be private sector? Will it be people in the academic institutions developing new products, new ideas, and bringing them to market? Who and how will we take up the enormous opportunities and challenges that are there? Bee Box was founded in 2010 by three students at Imperial College London. The organisation today deploys off-grid solar appliances combined with its smart solar platform to bring machine learning and customer experience optimization throughout rural Africa. They have over 100,000 systems deployed so far and 450 staff across five offices in China, the UK, and East Africa. Bee Box is one of the words, literally one of the words, leading off-grid solar companies. We have with us today co-founder and chief executive of Bee Box. We're delighted to welcome Mansur. I'm not going to go through his extraordinary biog, which is incredibly impressive. He's born in Pakistan, raised in Sweden, I think, studied electrical engineering at Imperial College London. He was the founder and leader of a student charity E-Quinox, which brought electricity to six villages in Rwanda. That was just when he was still a student. Following university, Mansur worked as a manager for Rose Royce, civil aviation side, and on corporate cost reduction in the Asian region service and the overhaul business. An incredible stellar biog, CV, already for a very young man. We're, I think, all very much looking forward to your presentation this afternoon. Will you welcome, please, Mansur? Thank you so much for the kind introduction and for setting the tone as well for this presentation and for the invitation here. Great to be in Dublin after 10 years. Very different context. Last time I came here, I was a student. So a lot more professional this time around. So what I'm trying to tell you guys about is not just what we do because that's going to turn, that's going to become very boring. What I want to really tell about is the big opportunity that we are facing as well. The problem that we have, the opportunity that we have, and how to look at energy in a slightly different way. Obviously, I'm going to give some examples of the sort of customers that we have, but I think the themes that I'm trying to tell you about has a relevance in the overall energy economics of the future and data plays a very big role. So let me tell you first about the problem that we picked. The big problem that we picked was that over a billion people around the world have zero electricity, none whatsoever. Further, two billion people have unreliable electricity. So they can't trust the supply of the electricity that they have. And that's something that Bebox, when we started with my two co-founders, Chris and Laurent, we found that to be an unacceptable reality, that in 2010, 2011, when we got serious about it, that how can half the world be digitally excluded and one part of the world having smartphones and all sorts of modernities, another half of the world doesn't even have an opportunity to engage with that. That was the social or the moral conviction for setting up the company. And what we focused on really was why don't people have electricity? Is it policy? Is it technology? Is it what is it? But fundamental to that, what we really wanted to do for us was to understand the customer. And that approach of trying to understand the customer actually resulted in that data-driven business model. I'd also like to be honest today is that when we started the business, we didn't see the data as the core part of our business. The data was just a means of trying to understand the customer. But it transformed itself to become the core part of our business. So with that, let me try to explain the type of customers that we are talking about. These are customers, 600 million of them in sub-Saharan Africa, that already spend money on energy. But they spend it on really inefficient, really unhealthy, really polluting sort of energy.  They spend it on a phone charging. The mobile phone part was one of those things that actually grew an explosive way over the last decade. Actually, there's over a billion SIM cards in Africa, but there's only 600 million people without electricity. Actually, majority of the populations have some sort of remote access to electricity where they can send their phone for charging or buy a disposable battery. But the fact is that they don't have it in their own homes. They end up spending a lot of money on trying to get the basic charge. Just in terms of math, what does that mean? I would say that the 95% confidence interval on this data that we have is that they spend somewhere between $5 and $20 a month on kerosene, candle, battery and phone charging. That's the sort of consumption profile. And then we have some more extremes as well. But the most terrifying part is that the majority of customers are spending more than 60% of the truly disposable income on energy. So these are people that are living in extreme energy poverty. The majority of the world in the developing world, their main expenditure is energy. And that's a terrifying fact, but also an opportunity. So, if I click this through, all right, there you go. So the other thing we wanted to do was we just don't want to solve electricity. We want to be able to give people in the rural world access to a modern lifestyle. So what we realized quite early on, and that was the foundations of the business, but actually electricity is a Trojan horse towards many other value-added services. It's the start of having a TV, a fridge, a business, employment, jobs, et cetera, a shaver. There's tons of things happening. And then another thing happened over the last 10 years, or two things happened over the last 10 years that made our business model possible. One was growth of mobile money. I don't know if people are familiar with mobile money, but just to explain what it is, it's a very African phenomenon. It started in Kenya. It was a company in Kenya called Safaricom, the big mobile operator there, that started realizing that customers were sending their air credit to each other, not to top up another person's phone or the relative's phone, but as a means of payment. And now that's been branded as EMPESA, and now nearly a third of the Kenyan economy flows through EMPESA. So mobile money became huge, and this has become an African phenomenon. The second thing was the growth of phones. Cell towers and cell signal became quite accessible in many parts of Africa. So our ability to actually have an IoT device, remote monitoring, remote control suddenly became possible too. So that means that we actually were able to not only offer appliances that are becoming more and more efficient as we all know, your TV, your light bulb, et cetera, but we're able to actually combine that with remote monitoring, remote control, and IoT solutions to switch them on and switch them on to be able to actually create an economic proposition for them to start with electricity, then to be able to actually provide them a TV, a small fridge, a fan, whatever they might need. And that's a sort of value proposition that wasn't possible to do a few years ago. And I'm going to go through a few distinct examples about that. But what does this all result in? So this is the future that we imagine. We actually have installed now 160,000 households with solar power, so individual solar, battery, and a range of appliances. Each of the households is remotely monitored and remotely controlled.  It becomes an easy financing mechanism for that. So we estimate around each household, each system impacts around eight people. So actually tonight around a million people have access to electricity, which is the cool part. And every day we are installing 200 to 300 new homes per day. So we've been accelerating quite a bit. The byproduct of this is the data. So this was the way to actually offer a customer, hey, take this product, we will install it for you when you pay, you're going to switch off, when you don't pay, it's going to switch off. The resulting fact of this is that we have these customers who are not just energy poor, but no one knows them. Their average is on the World Bank data, they are unknown to the government, and suddenly we have this super data-rich business model where we're seeing all sorts of data for the first time to actually understand the customer and to be able to see what their ambitions are beyond and above a KYC or an ID document. And that was the big opportunity that we personally did not see when we started a business many years ago, which was like who is our customer, why don't they have electricity, let's build tools for us to be able to gather this data, and let's build tools to be able to offer value proposition to the customer where you can understand. But the resulting fact of that was we actually collect, which might not mean much to you guys, but it's five billion data points per day from the most underserved people on the planet. And I'm going to show you some of that data. So this is consumption data. What was the consumption? Is it behavioral data? How does the load profile look like? Is credit data? What does payment profiles look like? It's also staff management data. So all of this data gets transformed into actions. And the resulting future is this virtual utility where people have their own self-generation, they have their consumption, but they still have a relationship with the central body that's managing them, that's financing them, handling their problem. And I actually think this is the future that the entire energy of the world will move towards, where the cost of cables will outweigh the cost of batteries, the cost of cell generation will become independent. So the interesting thing is in the same way that mobile payments started first in Africa, and now we can do it here. And that's the same sort of thing that LeapFrog that Africa is doing with the modern generation will happen in the western, in the whole world as well. Obviously it's going to be a translation process, but the big themes are going to take place. But the exciting part is we already can demonstrate some of the characteristics of this future. So what do we actually do from a product perspective? Just to let everyone visualize, we install a solar panel, whatever the right size is. We install a battery, whatever the right size is. So that means that they have electricity both during daytime and nighttime. And we then install a range of appliances starting from light bulbs to TVs, to radios, to shavers, and we finance those appliances too. So if you just go and provide electricity to people who've never had it, they're not going to have the appliances to run it. They're not going to have the money to be able to go and buy a TV. So it's important that we play a role in the appliance side as well. And if appliance breaks, they have nowhere to go and service it. So that's why we need to also provide the servicing to the appliance side as well. So what we do is actually, in a sense, the modern, the European utility model is that the appliance is a separate story from the generation and a customer is dealing with a ton of different providers. In this sort of virtual utility, you are actually responsible for end user experience. And that, I think, is not only an African phenomena, but something that's going to, that behind the major sort of activities is going to happen more and more around the world. Where does our data side fit in? So we actually now have crossed, it was cool when we said we have crossed a hundred employees. That was really exciting. A hundred. We felt mature. Now every time I see the data how many employees I have, part of me I'm like, oh no, it's too many people. More people to manage. We just crossed 600 people now in the company. And we have 50 people just dedicated towards software and data science, all based in London. What we're doing is basically a big data play. We have each of our devices, so 160,000 devices that are sending us data every four hours of what's happening. We're seeing all this payment trends happening. So it's in large amounts of data where we can actually generate insights from. So let me show you some of them. So this is an actual customer, a not named customer with the GDPR rules, things are even more strict. So what we, on the green side below, this is the days he, his major was positive. And the moment it turns red, does it have a laser thing? Well it does. All right, great. So here you can see it was on until the third of September. His system got turned off. He made an immediate payment and it got turned on again for a few days, right? So he was positive. Then actually we sent him a warning signal again so that the orange side is like, we are going to turn you off if you don't pay us. Now in the beginning you can see it's a very small one and he reacted immediately and he paid. Here it is a very long and now until at least end of October he hadn't paid. It's an example. The key question that we're trying to answer in the business is what happened here? Could it have predicted this? All right. And what exactly could we do to be able to extend his temporary loss of income? Is this temporary loss of income? Is this sustained loss of income? And what is a sort of business model one can develop to be able to do that? Maybe we financed him too many, like he might have like one TV and too many light bulbs. Maybe we should take back one TV and a light bulb so he actually can get back into a basic need. He might have too many things, right? So that's sort of like capacity to pay issue in an individualized basis we're becoming really good at. We can look at any customer we have in our portfolio or any new potential customer and to a fear to statistically relevant accuracy tell anyone how likely are they able to pay and how much are they likely to pay. And those are two very important questions regardless of the underlying energy economics that unlocks financing, unlocks our scalability, allows us to manage risk. And this is the way it works is that if people familiar with machine learning techniques, it's a big black box. Don't really know how it works. If we throw in all this data into it, runs a few statistical models, every day gets trained it becomes better and better and it retrains based on historical data. So the more that we collect, the more different types of customers that we get, we become better at doing this. And with some of the modern techniques coming on board, it becomes faster to do this learning as well. The second thing is a connectivity. So this is an example from our dashboard. There we go. So this is in Rwanda. You can see the concentration of customers that we get. So we open up a shop and we start to like install each customer. And each customer has a GPS location on the product. So we know exactly where the system is, what's happening and each system sends back data. The data is of this sort of profile which we can see exactly with the current, the voltage on several different components. What's really exciting about this and this is something that the utilities of the future, regardless of the geography, have to prepare themselves for. Which is that something again, we learned from our mistakes, not proactive planning. I want to be very clear about this. A lot of this stuff is not because we sat down seven years ago, hey, this is how it's going to look like. And this we know all the variables and we went and did it. A lot of this from mistakes that we learned. One of the big mistakes we learned is that in a distributed generation world, all your problems are distributed, right? You can't send your best engineer to your centralized power plant to fix it, right? And you can't send a person with all possible tools to fix it. All possible parts to fix it. You have to send the person with the right tool, with the right part of the right location in rural Africa to manage it. So how do you solve that question? It took us years to solve this one. Which was that we have to turn all of the problems proactive. We have to live in the future. So every single system that we have has a twin in the cloud, if you can imagine that. Where we look at this current technical performance, the state of its battery, the state of its electronic, and we simulate things into the future, and we look at what's going to break and when is it going to break, right? So that means each system, we can see exactly what the risk is on each system. So that means at a national level, we can do appropriate spare-level, spare-part provisioning. Whether it's like components of a resistor or a fuse and things like that, or a battery or a solar panel. So the country itself has enough spare parts. Then when things fail, the system can diagnose itself, 70% of the time, to tell us what actually failed and what part needs to be replaced. Or if it's a customer-induced problem. One of the earlier problems that we had from our customers who liked our system very much was they used to throw a bucket of water over it on a daily basis. That's how you wash things, right? And our systems was not designed for a bucket of water. Second issue that on a daily basis, sometimes it's okay, but like over a course of actual, a course of period, things happen. Other issue we didn't really take into account was mice and rats. I like to think there's no mouse in my house or rats in my house. In London, apparently, we're not 10 meters away from any mouse or rat so far hasn't seen any. But in Africa, in rural parts, wildlife is much more closer than we expect. Cables that become slightly warm are attractive to creatures of that sort. So those are sort of things that we started learning like, hey, something we can design out and become better at or teach people about how to do. Other things we have to become more predictable. So, and this is basically the translation process. So, hey, we have one system, all the current voltage, et cetera. Using the modern techniques that we have, we'll be able to say that, hey, this system actually needs a battery to be replaced. Ask the customer if he has any problem. So this is as proactive as you possibly can get. The customer does not even know he has a problem. We are going to proactively call him, tell him he has a problem, and I'm going to organise a replacement date four or five months into the future. So this is a sort of level of things that are possible. So that means that suddenly we can manage a distributed workforce. Our super intelligent engineer is no longer a human. It's this black box that no one really knows how it works that actually can look at all systems at all times and all seeing algorithm that actually can tell us what the system is going to go wrong. And then we have another black box that tells us which order we should do things. So the scheduling for when you have, we have 600 full-time staff, over 2,000 Uber drivers, in the lack of a better word. They have our apps so they can sell, sign up customers, they can install customers, they get paid on a per action basis. So we basically do all the scheduling for them using the system as well. So this was the technical backside of it. And it was not something that, if I knew that we had to do this in 2010 when we started the business, I would not have started it. So ignorance often is a bliss for sure. I had known through about half of the things that I'm telling you that we've done right now when we started, which is, which I always tell my investors is a good thing. So in terms of, in terms of, this is one of those things which I find really, really exciting. So I'm a bit of an emotional character. So in the beginning when a customer used to pay, I could see his phone number, I could use his user profile and I nearly wanted to call the customer and thank him for using us, right? Now we have a lot more, so it's a bit more difficult to do that. But this is one day's consumption profile on a group of customers that we know live below the poverty line. So this is a group of customers in East Africa. We define the poverty line as $1.6 per day. There's slightly different definitions of it, but poor people, regardless of how you're going to put it. These are people that are definitely below $2 a day, but we define as $1.6. And it's an aggregated customer, so they have no TV. They won't be able to qualify for TV. They're too poor. But I just wanted to show how, one of the hopes I had with this data is that we come with this magical insight that the behaviors of the rural poor is of a certain sort. The really boring fact is they're exactly like us. Like there's very little differences, if any. You can see that around six o'clock people start using the system the most, right? Lights, et cetera. Most people go to bed around 10 o'clock. They wake up much earlier than I do. Some of them are awake around four o'clock period. And then you can look at how the profile actually looks like. And that means actually what we're trying to design for, and I think that's been one of the big, big, big problems in development is that we often put the sort of customers that we've had as beneficiaries, as not customers, that their needs are somehow different than the needs of ourselves, us and them thing. The data has shown us, it's exactly like me. Like, I don't wake up at four, admittedly, but otherwise it's very, very similar, right? And that makes it quite exciting, even more exciting because the sort of solutions that we're developing, the sort of things we're developing, actually has an application far broader than the geographies and the demographics that we're targeting. And then I think that's a very interesting point for us internally. The other thing is the role of data and the responsibility of data, right? So this is one of the things that we've been talking a lot about. So this is a live view of each agent. So if they have a phone, the phone which they sign up customers, do the credit check, et cetera, we can see exactly where they are, how they move, what's happening. So actually that means that we can break down a country into good parts, bad parts, more difficult parts, right? Where we want to find customers, what's the right spot. The best current sales location in an entire business is a university in Kisumus cafeteria. That's where we sell the more systems, right? And we found that not because we knew the cafeteria in Kisumus university is great, is because we have agents clocking in sales there. The student group is a big group that we sell to, right? But the fact that we have all of this information, one is great, but how do we make that actionable? So what each of the agents can see as we process all of this data is exactly what's the next thing you should be doing. So that means that an agent has a to-do list. So we turn this three or four or five billion data points that we have to around 20,000 actions, actual actions per day, and we distribute that to around 2,000 people. You do this, you do that, you do this, you do that, all right? And we're becoming also about to release a feature that we even can do when to do it and where to do it, right? Now we say like sell or upgrade, go to this customer to upgrade, for example. But now we can tell him to go to this location, do this type of thing. But that means that we have a lot of data on people and how to be responsible about this, right? And we use gamification techniques and we see as people know if they rank the highest in the country today, highest in the region today, et cetera. And that's one of the things that we've been battling a lot on. Just from a regulation perspective with GDPR, et cetera, but how do we actually collect data that's meaningful to actions and to development, right? And how to be able to actually hide some of this from our need to know basis within the company as well. The biggest challenge that we have, and I tell this, we're back by some of the larger investors in the world. We have money from the Silicon Valley, from the likes of Costula Ventures, which is the founder of Sun Microsystems. We have big investors like NG, the French utility giant. We work closely with Orange Telecom in Africa and EDF. So we have big sort of capital pool that we invest and we finance our customers at a large scale, obviously. So the good news is that we don't need trillions of dollars to be able to electrify the developing world and transition into a clean future, but we still need billions of dollars to do so, right? And that's maybe the more sad news, right? And that means that we need to find, although we have around a million people tonight that have access to electricity, there's still billions that don't or have unreliable. So it's partial success, a grand pilot that we have demonstrated so far. But for us to be meaningful, important and big, we can't do it alone firstly, right? We need many, many parties to get involved, really like transition ourselves to the new future, but we also need to be able to find mechanisms by which we can actually fund countries, fund people, fund places that have not been common to do. And this is where I think the role of the data plays the biggest role, the perceived risk and the real risk, the perceived need of the customer and the real need of the customer, the perceived opportunity and the real opportunity. And I think that data for me has the potential to bridge that, to be able to actually result in not like preconceived judgmental view of investment or where capital should go, but actually a data different decision. So with that, I'll end it there, but hopefully you guys have any more stuff you can ask me questions, I'm sure, but hopefully they give you a view about what we do, how we do it and how it could be relevant beyond the shores where we work today. Thank you so much.


The study examined the effects of upstream open reading frames, UORFs, on gene expression in yeast cells. It found that while nearly all August-initiated UORFs were strong represses, most non-org UORFs had only weak effects on expression. The study also identified features associated with translational repression and nonsense-mediated decay, NMD, such as UORF sequences and positions within transcript leaders. Furthermore, it suggested that the location of UORFs in transcript leaders was nearly as predictive as UORF sequences. This study provides insight into the scope of natural UORF activity, identifies features associated with translational repression and NMD, and suggests that the locations of UORFs in transcript leaders are nearly as predictive as UORF sequences. This article was authored by Gemma E. May, Christina Akitova, Matthew A. Garjonsen, and others.


Hello everyone. Today I will talk about how to tag desktop uh desktop applications use web security skills. Uh this may sound weird but of this talk, you can see how we can pop up a calculator without reversing our binary explorer team's knowledge. Uh I'm sort, I'm from Tencent's security show lab and I'm a member of the CDF team and I have spoken at zero nice and hit B. And my friend here man, he also from show lab and he's a speaker of Asia's Quest. And another friend uh he's from Tencent's show lab too. He's a member of C clover security and he's spoken at zero nice and hit B too. And fortunately these two guys doesn't come here. Okay uh when people are talking about attacking desktop applications, you may think about Pongtong. Yeah. Hacker said Pongtong may uh may use memory corruption box to get a calculator. I dream about that one day I can pop up calculators just like them. But there's some difference between me and them. I know just know something about web security. I can do little reversing. I know nothing about punning. Can I pop up a calculator like people in the Pongtong? Hmm that sounds a good question. Yeah. And we notice more and more applications use hybrid technologies. Uh uh people write applications use their, use frameworks like Electron or NW.js. So their applications can run at all the platforms. And web techniques are used in these frameworks and they may use web techniques to develop their applications. So that's a good news for our web security researchers. Yeah. We can use web security tricks to pun them reliably. Oh let's see how to pop up a calculator. Use web security knowledge. Let's keep web security great. So let's start off from the attack surfaces. So today in this talk we all talk about three sections. One is open pause. The second one is UR schemes. And the third one is some features of the applications. Yeah. So we start from uh when uh application opens up port. So why do they open a port? Maybe they open a port for a web server because they want to expose some API calls. And maybe they use the port for debugging and not many other purposes. And the application may bind the port on all the interfaces or on the local host. Yeah. On all the interfaces you can access them really remotely. But how to, how do we access the ports on local host? And the browser is our good friend. If the port, the service running on the port accepts HTTP protocol or it has a tolerance of illegal commands and then we can use browser to attack this local host port. And before we come to the exploding uh let's see some basics. The same origin policy. Yeah. We say that two pages have the same protocol host and port and these two pages are in the same origin. So for pages in the same origin they can send simple HTTP requests or send requests with custom headers and get the response. If they are not in the same origin they can only send the HTTP requests and cannot get the response. So how this uh, this is a basic restriction in the process. There is there a way to bypass this. There comes DNS rebinding. So uh the process is as follows. Uh we first access the rebinder.com. It will resolve to uh attack this IP and pull all the pillows from the attack server. And uh in the browser just you just wait with a few uh with a uh with a few minutes and you request rebinder.com again. And then this domain will resolve to the target IP uh such as local host. And in the uh and uh uh the port, the protocol and the host are not changed in this process. So the browser believes they are in the same origin. So we can attack it just uh bypass the IP. Yeah. So we need the uh there are some prerequisites. The swap service should not check the host name. Because we need the, we need a domain name that we control. And the weak team should wait until the DNS has changed. Because there is a catch in the browser. And there is a uh another attack method called CFRF. And there is some difference about uh CFRF and DNS rebinding. We can use DNS rebinding to bypass, bypass that OP. But if there is a host name check, it will field. And if the client cannot wait uh with a few seconds and this may be not work. But for CFRF uh it is restricted by SOP. But uh it doesn't uh the host check doesn't matter. And it will be effective immediately. Yeah. So let's just go to a key. And it is uh popular for popular third party plugin for WeChat. Uh it is uh popular chat software in China. Yeah. And it is called this WeChat plugin uh Michael S. Uh using this third party plugin, we can keep the record message. We can auto reply a message. And it has many users. You see many stars and many folks. But it just stopped maintenance months ago. And it has it finds a port, a fixed port on local host. And expose some APIs. For these APIs you can get all the, all the user's friends, all the chat logs. And you can send any message to any user. And we can use DNS rebinding to attack this plugin. So we reported this issue to the author and the author fixed with checking the host. Yeah. The host cannot be uh local host. Because of this host check we cannot use DNS rebinding to attack them. But it is still affected by a CFRF attack. If, if we know a user name we can then use CFRF to send a message to that user. Yeah. So it is not enough to just check the host. Because check the host it just can just uh keep DNS rebinding away. You should also use some unpret, unpredictable data or path to prevent CFRF attack. Also most importantly, you should avoid using third party plugins. And there's another case called Xdebug. Xdebug is for PHP debugging. It's a PHP extension. So how does it work? First you should send a request with uh this um in parameters Xdebug session start. Just like that URL in the bot uh the URL below. And then the Xdebug will connect to a server. And the server can interact with Xdebug. So which server to connect? Xdebug will check the following things in a full back order. The first one in uh in the Xdebug's configuration file. The Xdebug remote host. If not set, then it will check X44 header in the HTTP request. And if not uh Xdebug will use remote address. So if we have these three configurations in the Xdebug, Xdebug remote connect back set to true. Uh Xdebug remote enable set to true. And the remote host is not set. And this is always met for most of the PHP developers. Then we can attack it using DL3 bind. We can set up a URL server waiting for Xdebug to connect. And then use DL3 binding to send a custom X44 header. And points to the URL server. So the event server will connect uh will uh interact with Xdebug. And finally we can get a real real shell. And I have reported this to the PHP. So if you are a PHP developer, if you use Xdebug and you stays on the on a URL page for 40 or 50 seconds and then you may be hacked. So how do the Xdebug officially think about this attack? And its response with, it thinks this is just a rumor. And for developers, himself should take care of this. Yeah. So anyway. And for Node.js debugging port or Java debugging port uh or Java RMI port, they may also be affected by death rebinding attack or set up attack. So if you find a port opened by an application, you can check it by some or interfaces or by some local host. So you can choose to attack them remotely or using a death rebinding or set up to attack them. And next part, your schemes. This is a short part. Yeah. Uh people use URL schemes to launch applications.  Uh we can see the following picture. We can use web code URL schemes to launch web code. Yes. And on Windows, in Windows, uh it is registered in the registry and has an item for the UI protocol name and the command it will exude. Windows will use shell exude W, this API to call that command. So call the web code command and launch it. But there is a well known bug in this API. We can use a code to close the former code. And we can inject other parameters. So there comes a famous exploit last year for Electron. We can use a chromium parameter injection to exude any command. Just like that. And we found all frameworks based on chromium may have the same issue. So the nw.jf framework. We found a famous application for not taking uh use nw.jf and it has two hundred millions of users. So we can just inject chromium parameters to exude uh any command. So we can just inject the nw.jf framework. Just like the Electron bug. So here comes the demo. Uh we set our web server local on the local host. And this is a explore page. Yeah. If we clicked that we all get a calculator. Okay. This is the first calculator. And this bug is fixed. Already fixed. And uh in this years, in this May, uh Microsoft released a patch called kb4497935. If you applied this patch, you will find the UI scheme is now URL encoded. So in this case we cannot inject parameters. Because the code, our URL encoded, we cannot close the former code. So maybe your scheme is dead. Or there is some bypass. Who knows? Yeah. So if you found, if you want to find your game box, you should check the your schemes that the application has. Also the framework has. Don't forget the framework. Yes. And the main part, we attack the features of the application. And this section we have three parts. First one is cross-site scraping in the desktop applications. And the second part, section is for pre-privileged APIs. And the last one is for improper protocol handler. And the cross-site scraping story begins from McDonn editors. And in the year 2016, we found many McDonn editors just renders the JavaScript in the preview window. Such as MOU, McDonn, or even Weth code. So um many of the McDonn editors just uh previews the page in the file domain. So we can use the JavaScript excuse on the file domain to steal files on the local disk. And we can steal some credentials from the local code and we may clone his account and lock it in another machine. And also if it's used, uh it has some pre-privileged APIs or it has a, it uses a outdated browser. We can, we maybe get remote code execution. Yeah, let's see a case for McDonn. It has thousands of stars and manifolds. And this is also uh this exploit can also be used in the latest version. So we can see the location is uh in a file domain. And we can use XML HTTP request to get the ETC password. And we can also send that uh the response uh uh that the container of the ETC password to the remote server. So we can steal local files. Yeah. I reported this in the year 2016 and it is still not fixed. Um but things are always getting harder. There's little cross-site scripting in McDonn editors nowadays. And some editors use content side, content security policy to limit JavaScript execution. And some editors use sandbox to run the JavaScript in the in a uh isolated context and there without node modules. So the pro uh the issues are harder to find and harder to exploit. But we should think that we can use the uh about the libraries that used by McDonn editors. Um the first one, mermaid. Uh it is used for charts or diagrams. It has uh it on the on the GitHub. It has thousands of used products. And many stars and many folks. Uh we have found three cross-site scriptings. In the latest word when I uh make this slice. But now in the latest latest word it has fixed. Okay. Uh latest word here is when I make this slice. It is fixed days ago. Just days ago. Yeah. Uh we can see the type row uh the HACMD, the error nodes and GitLab. And we can see the use mermaid. And there is the cross-site scripting. And the first two just renders the HTML. And the last one need a click. It is yeah it is click cross-site scripting. And here is demo page. The official demo page we can alert. And next to catax and magics. Uh these two libraries for math type setting. And uh in their old versions it has a click click cross-site scripting too. And these two is reported by other guys. Okay. And the last library, flow test.js. It has a click cross-site scripting too. In the latest version. And the last this has not fixed yet. So if you use mermaid please upgrade it to the latest word. Yeah. And the older version of math jacks and catax has cross-site scripting issues. And the latest word of flowchart has a click cross-site scripting. As these issues lies in the library so these issues may affect more applications than we can find. So here comes a keys for hack comedy. Uh it uses mermaid. It is a online macdown editor. And it has many many users. Uh we just used the payload before for mermaid. But the payload is blocked by csp. Yeah we cannot see the a large box here. Because the csp just blocks it. And then we check the csp. We found an interesting site. There. The Google analytics. There is no way for using Google analytics to bypass csp by cata. Yeah. So we can use Google tech manager. And then set a set a variable there. And set a malicious function. We can define or a malicious code there. And the code will be shown in the Google analytics. And we you can check the details in the following link. So then we can get a large box. Yeah. And we found there is also a desktop application for hack comedy. It uses uh there are two different types of uh two elements. One is a script element for renderer.js in uh uh excuse in a privileged context. And uh WebView tag renders the user page. There is no no integration. So how to turn our cross-out scripting in the WebView tag to RCE in the desktop application. So let's check the renderer.js first. We can see from the code. It's uh even listener for DOM ready. And when DOM ready, it will get the title from the WebView and set it to the inner HTML. To the privileged context. So if we can control the title, we can exude any JavaScript code in a privileged context. So we can use our Crizzat scripting to redirect the page to our email page. Which can trigger the DOM ready event. And then our page have a special header, a special title. And we can use this to uh to call the node modules uh process and uh the chart process and exude any command. And then we can see the calculator. Just click the malicious markdown and pop up the calculator. Okay. I have reported this to the hack handy and it has already fixed. So um there's uh some in some cases, we may not exude JavaScript. We can only inject some HTML code. So we can also use this, uh use HTML code for phishing or just advertising. Yeah. Uh anyway. So the next section, the next part, uh for privileged APIs. Uh privileged APIs comes from uh about to with, why is the node modules another maybe some uh from the custom APIs. The program just added these APIs. Uh programs usually use a JS bridge with some weapon to provide custom APIs. And these usually has a public documentation. So let's see a case. It is a case for a popular chat application. It has billions of users. In this application, it has a, has an embedded browser with some custom APIs. So if you render a, when you render your page on the embedded browser, you can call the custom APIs because there is no domain restriction. And these APIs are well documented for developers. And how to open UILs in the embedded browsers? There are two ways. One is send a spiral type message which is called feed card message. Just like uh that. And also we can use a in, in the app application UIL scheme. We can use a spiral scheme to open a, open the embedded browser. And in the custom APIs, there's two interesting APIs. Why is download a file? If you call this a API, you can uh you can pass a UIL to it. And it will download a file from that UIL. But uh it will pop up uh box for the user to choose a location to save that file. Yeah, this needs some user interactions. And another API called open local file. It just opens the file you just downloaded without confirmation. Yeah, this API is without user interaction. But only works on macOS. Uh so we can think, we can make it download uh ELF to exit but field because it has no X mode of downloaded. Yeah, we can, we may, we think we can use a bash or a pattern script but it is usually open, open by a text editor. Hmm. So how to exploit this? Java is a good friend. Yeah. We can just make it download a JAR file and use that API just open the JAR. It will exude our Java code. So if you have Java and you click a feed card message, from a hacker, and a dialog will ask you to seal a file. Ah, seal a file.  So let's see the demo. Yeah, maybe some conversations for surrounding nearing. And come the feed card message.  And this is already fixed in the latest word, yeah. And it is fixed by, oh, just open the folder instead of the file. And the last part, uh, let's go to the part for protocol handler. Uh, when developing desktop, desktop allocations, you should pay pretend to these three protocols. HTTP, JavaScript, or file protocol. For HTTP protocol, you should avoid you render pages in a, in an untrusted context. Because if you have a outdated browser call, you may be affected by the browser one day. Or if you exude JavaScript, you, the JavaScript may exude in a file domain, you can steal files. And for the file protocol, you can use it to launch programs in, in your, in your computer. Or the file protocol may leak anti-M credentials. So just be care, be careful of ATAC. So, uh, we find a library and it is used in Chinese applications and it is widely used. It has, uh, many stars and many folks. And uh, it supports HTML like tags. If you set show HTML to true. And there are some tags for, such as ATAC for hyperlink, an ITAC for image, and a C-Tag for a text color, change the text color. And in a chat application, it's show, it, it says show HTML to true. And it renders the tags in the chat group name or your personal status. We can use C-Tag here to change the text colors. Yeah, we change it to the red. And change the color may be harmful. We can use ITAC to do some anti-M relay attacks. So we can use ITAC to insert a file protocol. Uh, an SMB protocol. And it will, uh, in Windows, it will send the Windows credentials automatically once the tags are rendered. And usually, and these tags are in the status, personal status on a group name. So usually this can be done without user interaction. And the attacker can get the credentials. They can just do some offline brute force works. Or the attacker can relay the credentials to other services, such as to the exchange server. So we can log in into the exchange server on behalf of the victim and get all the emails. Or if the victim have another machine, have the same, share the same password, we can relay to that machine. And get remote code execution. And there is another case for Gidra. And Gidra is developed based on Java. And it use HTML to describe a project. So there is a XSE in the Gidra project description file. It is found by this guy. Yeah, we can use XSE to steal files or use XSE to send HTTP request. But can we turn the XSE to RCE? Uh, based on our previous research, this can be done. Uh, we found that Java will send credentials when it encounters a NTL, NTLM based for O1 HTTP response. Not the basic authentication. It is a, it is a NTLM based for O1 HTTP response. Yeah. The attacker can set up a malicious HTTP server to response, uh, that. And the Java will send the credentials to the attacker. And the attacker can just reflect the credentials to the C machine, just the C machine. So if you just opens a malicious project and you have opened your FNB service and then you may be hacked. So here's demo. Uh, we set up a malicious server. And here is our Gidra. And we are, and it will open some malicious project. And then the XSE triggers. We can dump the hushies. Just get the hushies out of that machine. And then we can use the pass, pass the hush to execute any commands on the victim. We just use that hush. There's a mistake. Uh, there's a mistake. And we fix the command. Yeah. We can see the calculator. So there's many features in desktop applications. So we can find cross art scripting. And we can find if there are some privileged APIs. We can find how it handles the protocol. We can find that and check how, how we can attack these applications. So here's come to the end. If you are a developer, just be careful while debugging PHP, Node.js or some older version of Java. You may be, you may be, be popular of a calculator on your desktop. And also you are a developer, you should be careful while using these libraries. Uh, some older version of Mermaid. And older version of MathJax, Cortex. And the latest version of FlowChess. And if you use dual-lib, you should not set the show HTML to true. And if you're, if you use nw, nw.js, you'll be careful while doing this. You'll be careful while registering a UIL scheme. And thanks for these guys. And thank you all. So maybe any questions? Oh, yeah. Okay. Thank you guys.


oh my god there's so many people here chasing me right it's going to the 12 though when that fits the most because the other ones hold less so let's make it fair so more people can join dude we're so cramped up in here man what is up you guys real estate game here today we're gonna be playing a siren head game I forgot the name of the game I always tend to forget the names of the games before I start playing but it's called like something cryptid tales I don't know the the exact name of it but it's somewhere in between there or cult of the cryptid there you go siren head reincarnated wow that sounds like a pretty awesome game already like the title itself sounds pretty amazing okay this is a work in progress we recommend headphones and high graphic settings for the best experience all right so it's just still work in progress there still might be bugs to the game or whatsoever but I mean it looks amazing as we start can we got a little cutting here my volume up this is a work in progress looks like the game is already like mastered okay so I guess we're taking a trip to the forest from what it seems like siren head reincarnated you know this is dope I'd like this all right oh and we have arrived to our destination and I did buy the binoculars so I can look around in the distance hello noob the buster what is this avatar all right so what do we do we said okay it says story endings so there's multiple story endings this items while repair the sheriff's car okay so we're supposed to repair a car from where it seems like yo what's up real what's up guys all right we got sand here oh so there's a broken car right here so we're supposed to find the parts to this there's a hammer and a crowbar all right dude there's blood my god so it seems like someone got those guts I think those are guts on the floor something okay someone following the car keys all right man to shave and we're in the world are we gonna find car parts oh there's a house over here can just head on over there there might be some fun parts of the car that we can use I see something over there but I'm not sure if it's anything useful okay he found a tool kit my god wait okay you can wait you can sprint here nice what is that just some trash okay we can't go in here oh can we fish looks like the sheriff was a shipper a fisherman too oh well cool okay so can we go in the house dude open the door I see you in there man do the doors lock come on my god we're having like no luck finding anything for the car everybody else is finding everything it was a blazer it was our mushrooms click to enter the house okay so now we are inside the house okay there's nothing here nothing there what is that a hanger oh look the radio I set the world on fire I know that song man right let's go over here there's a computer a camera oh books and mistful creatures oh yeah and I did see that if you find like mythical statues around the map you can turn into siren head so we better look out for that man because it would be awesome if I can be siren head in the video okay it says booked and papers are okay oh okay dude that guy's finding everything he must have played this before man since he's finding everything man okay oh look milk he needs some milk right there oh like SpongeBob what is SpongeBob doing here there's a sponge there hey blazer what are you doing back there man okay we can't go in here you know what let's get out of here so we got four out of five items to repair the whole car now we need the tire right I'm gonna help you find the tire man I'll try my best guys look for the tire and this guy found the tire dude props to a Raphael log he found everything man okay you can now oh now we can repair the car sweet leaving it everybody get in the car let's go before siren head decides to come out hurry up Naruto they guys doing the Naruto run dude get in the car why are you standing outside of it all right so I did it also buy the sheriff pass I don't think my character looks like a sheriff or anything I don't even know what that even means but we I guess we were supposed to be the sheriff over not right go go go three seconds but like I see a siren head symbol no what that means take collectibles oh look these are all the collectibles and then there's pets of course they would have better what a pet have to do with siren head all right whatever and off we go the sounds of sirens in the distance become more and more clear there's something watching us we shrug it off after tireless hours of driving we arrived at a big field with a large hill within the center dude maybe something in there can help us or maybe we can find a phone or something to contact the authorities to get some help that thing was switching out so fast maybe I was really too slow right look out for siren heading might be out there welcome to seven devils enjoy your stay did you expect me to enjoy my stay with a place name like that oh all right so there's a watch tower there all right so we have arrived to seven devils my god what's up with the music oh we have a gun already oh did I just hear a gunshot go to the watch go to the fire watch tower to get some help and rest all right here we go man let's go climb up that bad boy flashlights and weapons can be found in the watch tower all right so let's go up there maybe we can find a flashlight dude what is that is that like a painting I don't know but it's like bloody it's kind of hard to tell what it is all right let's go up here my god so many stairs I like this view like how you can see the sunset and everything and then moon on the other side you know that's pretty dope alright let's climb up here hey what's up up I eat but is that a radio or that's a generator okay so we got some power that's good oh no why can I climb on this right there you go it doesn't look like there's a way to contact anyone around here all powers out what about the generator down there I mean what's power in this watch tower maybe we fix this tower generator it'll work oh so it's busted find a way to find the watch towers generator the generator was found looks like it's missing some parts let's fix it in the morning all right yeah because I don't think it would be a great idea to wander around this force oh my god yo what is happening something is knocking down the watch tower it must be siren had the one in only it's the 5g tower guys he has come to get us oh no dude the power went out okay siren head how well we're gonna have to fight him now oh this is awesome and right show yourself where is he at it's too dark you can't see a thing huh let me look around with my binoculars my god never mind it's too dark there's nothing oh I think they see them let's go all the way down oh okay good thing I you don't die from fall damage is he shooting siren head oh he's getting closer oh there he is shoot up oh he's grabbing onto that guy oh my god no run all right everybody shoot point is shoot at siren head oh no okay he can't get us in here right dude my like field of view is getting blurry oh my god I guess that was like the siren head like the now the loud noises from his siren it blurs out your vision what is he doing he's pumping a spot like he's farting okay we got him like half ways we're doing pretty good if you ask me oh my god no can you please stop farting bro oh my god all right what are you doing I don't even think he's doing anything oh oh never mind I take that back I just took some damage look when they run back oh yo he even crawls on here that is so freaky that he's leaving where's it going oh never mind he's coming back run oh my god yo that is so dude and he got hops oh my god it might seem like he's a little too OP he was trying to get me there huh joke's on you man oh my god it's turning red okay let's back off because I can't see a thing let's shoot him from up here yo he just pretty high got knocked off look at this dude oh oh siren it has been killed temp ending wait so that's it that's the answer siren head I mean he still has some house yo wake up what are you doing I think it's broken or something okay story endings hold on let's see what the story endings are doesn't even show anything but okay oh it says fuses wires wait so we're still supposed to fix a generator right guys but this dude on the floor he's passed out right you know what I'm gonna go try to find some parts for the generator oh we can go in here oh my god it's an asylum let's go in the asylum why can I go in there you go yo we're going into this asylum what if it's like a roses Easter egg it is a roses Easter egg oh my god yo there's a statue that's a girl from roses oh there's more cryptids right here click the elevator carry man come on yo we can find out like all the siren head parts right here click it why is it not collected your backpack is full oh I have four wires oh okay I have four wires I'm gonna go play some on the generator now let's go to the generator place these wires all right and I finally found my way back to the generator wait why is there harvests oh dude he's still passed out right there my god somebody call the ambulance for that boy man that boy been knocked out for like the past five minutes poor siren head right up so how do I place these wires okay nice so I got the wires connected to this and now let's go back and find the rest of the lights and the fuses and I found the last piece we need guys I found this tunnel like I just turned and it looks so dark and I kept going I mean I didn't know it would be here but apparently we have to come in here there's an exit right here what if we just leave through there oh no it's a dead end down here and there's a lot of they never stopped they never stopped this is a lot of siren head paintings kind of creepy alright can we leave though we can alright so now we have to go back to the generator and I have to put this fuse and this light and we should fix the generator and call for some help and I believe we just have to go straight this way because it does get a little confusing with all these trees but the guy have lost somebody get my mommy okay no wait oh wait this is a new place dude I just keep finding places left and right can we go in here oh it's locked yeah we can't go in here this binoculars hey I heard footsteps show yourself dude what is this place it's like I keep finding places after places okay you know what this is not important what is important right now is that I need to go back to the squad and I need I need to go to the watchtower place these last remaining items did I'm getting freaked out I keep thinking that I keep hearing oh I see them floating there nice hello floating people that was weird hey stop making noises man I think it's my own footsteps and I keep hearing don't worry guys I have come back with the remaining parts and guys siren head is still knocked down right there you see posee alright guys I have made it this savior is here with the light bulb and the last fuse that we need okay excuse me pardon me thank you coming through all right so we place this right here and then we place the last fuse and while I'm repairing all parts has been found now we can contact the police so they can get us out of here alright let's go man when you guys waiting for somebody call the police man wait where's the radio at okay this is not this is a computer okay how we can we call the cops the police have been contacted and now are underway yes we might get saved guys okay so we got two endings we killed siren head and then the escape ending we actually escaped it's daytime now this game is so well made man like the music the graphics everything pretty amazing and there they go two cops my god three cops it looks like this sent a whole battalion of cops to find us call to the cryptids chapter ending a safe road home play again to unlock all four endings dude this four endings to this what all right you guys well we got two out of four endings and I believe the other two endings are the ones that you could remember that tunnel I was in that door I saw I believe you click on that door and then it like it says that you stumbled across a room or something and then it shows that ending and then the other ending was to not fix the sheriff car so yeah those were two other endings that we missed so yeah if you guys want to get those two endings you guys know what to do now well thank you guys for watching thank you guys for the mating support if you guys enjoyed the video make sure to slap the like button if you're new to the channel make sure to subscribe and turn that notification bell on and I will see you guys in the next one


A warm welcome to the tenth session of the fourth module in signals and systems. We are now slowly getting familiar with the properties of the Laplace transform the z transform. And the most important property I think which we are now reasonably familiar with at least in the continuous independent variable case of the Laplace transform is the convolution property. Let us now state that property formula. So, let us say property 4. It says that convolution in the natural domain leads to multiplication in the Laplace domain. All that we can say is that the region of convergence of the product of the two Laplace transforms includes the intersection of the regions of convergence of the original two Laplace transform. We cannot really say more in general. Let us first establish the same property for the z transform and then we will elaborate little bit more about this business of intersection. So, what is the convolution property for the z transform? It takes of n as usual have the z transform given by capital X of z with the region of convergence r sub x and the same holds for h of n. What is the region of convergence and what is the z transform of the convolution? What would it be by expression? Let us give this convolution a name. Essentially, it would be summation n going from minus to plus infinity x. Well, you know you want to use a different variable. So, you can call it m going from minus to plus infinity x m h n minus m and this is y of n. This needs to be z transformed. So, you need to take summation n going from minus to plus infinity and put a z to the power minus n there and sum over n. Let us expand this now. As usual, we need to make a transformation of variable. So, we keep m as it is, but we put n minus m equal to l. Thereby, n becomes m plus l and for fixed m, if n goes from minus to plus infinity, so does l.  We can now separate this into a product and once again, it is very clear that if a particular z belongs to the intersection. So, if a particular z belongs to the intersection r x intersection r h, this product definitely converges for that z. So, therefore, if you look carefully what we have here is the z transform capital H of z. What we have here is the z transform capital X of z and we are sure now that we have at least the intersection in the region of convergence. So, we can now state property 4 for the z transform. When two sequences are convolved, their z transforms are multiplied. What about the region of convergence? The region of convergence of the product of the two z transforms is at least the intersection, if not more. Now, here again, we need to see a little more. See, for example, if there is a non-null region of intersection, at least we are assured there is something. The product will have some region of convergence, we are assured of that. Suppose there is a null region of intersection in the original product. That means x z has a region of convergence r sub x, h z has a region of convergence r sub h and r sub x and r sub h have a null intersection. Then what do we do? Of course, the statement is correct that the product would still have a region of convergence at least equal to the intersection, so at least a null set. But that says nothing. Is it really the null set? What do you mean by having a null set as the region of convergence? Let us see. Let us take the example of just 2 raised to the power of n, not 2 raised to the power of n u n. Consider x n is 2 raised to the power of n for all n. Now, we can write this down as 2 raised to the power of n u n plus 2 raised to the power of n u minus n minus 1. So, essentially what we are saying is separate out the points n from minus infinity towards minus 1. So, take all this together and put it here and then take n equal to 0 onwards and put it here. So, you know in principle when you take the sum, if you use linearity, you should be able to write down the individual z transforms. So, I have 1 by 1 minus 2 z inverse which corresponds to 2 to the power of n u n with mod z greater than 2 and here I would have 2 raised to the power of n u minus n minus 1 which would have minus 1 by 1 minus 2 z inverse, but mod z would be less than 2 and if I just blindly add them, I would get a 0. But remember this intersection is also null. So, the problem is if a z transform has a null region of convergence, it means there is no z transform. So, for example, here x of n equal to 2 to the power of n for all n has no z transform in the traditional sense. If I bring in impulses, the story is different, but it has no z transform in the traditional sense. Now, what could happen at times is that this business of expansion can actually take you to a bigger region of convergence. Again, I am not elaborating fully upon this at this stage, but I am just pointing you to that possibility. Although when you multiply x z and h z, they may as such have a null region of convergence, but their multiplication brings you a region of convergence which is not null, the convolution process. And of course, one thing is definitely there. The region of convergence can always expand beyond the intersection. Let me now take a case as an example where the region of convergence expands. So, let us take x of n again to be our traditional 2 raised to the power of n u n. And let me convolve it with h of n given by the finite length sequence 1 minus 2. So, you know how to read this finite length sequence. This means that h of 0 is 1, h of 1 is minus 2 and h of n is 0 except for these 2 cases. Let me use the train platform analogy to convolve. So, you have the platform on which starting from n equal to 0, you have 1, 2, 2 square and so on sitting and you have the train and the train moves. And you can see that the beginning of any output of the convolution will only be here at n equal to 0 before that it is going to be 0. You can see the output is going to be 0 all this while up to here. At this point it will be 1 into 2 minus 2 into 1 which is 0. At this point it will again be 1 into 2 square minus 2 into 2 which is 0 and you can see that you will get a 0 all afterwards. So, the output is simply delta n and therefore, x of z is 1 by 1 minus 2 z inverse with mod z greater than 2. Here h of z is 1 minus 2 z inverse and the only thing you have to exclude is the 0 point mod z greater than 0 otherwise everything else is all right. Whereas, if you consider the output y convolved is x convolved with h then y of z is 1 and the region of convergence is all z it is the impulse can you see that. So, here the region of the intersection was essentially mod z greater than 2, but the output convolution had a region of convergence all over the z plane. The region of convergence expanded beyond the intersection. Now, I leave it to you as an exercise construct a similar example in the continuous independent variable domain. Can you could be a little tricky a bit of a challenge I leave it to you as a challenge. Anyway, we will see more in the next session about convolution and system functions. Thank you.


Oh, hi there, I am Alexei and today we will be talking about Dutch health care. Health care in Netherlands might be quite different from the one from your home country. If you are an EU student and you have a European health card, probably you don't need another insurance. But make sure you are familiar with what is being covered by your insurer and when do you need to renew it. If for some reason you don't have such a card, then contact the International Office and they will make you a private health insurance. If you are a non-EU student, then the International Office will arrange the health insurance for you for the first year. After that you can choose your own if you want to. And after all the arrangements are done, you will need to find yourself a general practitioner. If you are based in Enschede, then you can register for the UT campus doctor. The links will be down below the video. If you have gone through any sort of treatment you will get a receipt. After that you can submit a claim to the website of your health insurance provider and you will get your money back. But it will depend on your package. It doesn't matter if you are an EU or non-EU student. If you have a part-time job or you earn a salary that is higher than the minimum wage, then you will still need to have a basic health insurance. However, the cases of internships are highly exceptional. There is a chance that you might get a mail from CAK or SVB and you always have to respond, otherwise you might get a fine. If you have a basic health insurance you can also apply for care allowance, which in that is called Zorktoislach. For more information you can go to myinsachsion.nl. Additionally, if something is not clear you can go to this website where there is also a chat function if you have more questions. Thank you for watching. If you found this video useful be sure to check our other videos. Bye and stay healthy.


Hello, and welcome back to the craft box. My name is Brent and today we're on Pirate 101 creating a new character This is gonna be a brand new series In which we do things and stuff So, yeah You're gonna find out in just a bit what class I'm gonna choose and what's gonna happen Andrew Okay, oh I didn't actually We're gonna go that that and a what are we gonna do this time? Let's go for a Lost sure Here do I usually go for I'm not sure I quite like this one. It's quite cool What else is kind of cool? Yeah, I think that one I'm kind of into this one at the moment Let's go brown like that. That's orangey go blue. Maybe Yeah, like that Haven't done this for so long What colors are we gonna go? Let's go blue and That's black blue and And black Little orange kind of cool. No blue and yellow, maybe I Don't know. Maybe Green and blue is always quite a nice one, but I don't know if I want to do that because I always go that Yeah, we'll go green and blue What boots let's go these booties Okay Um, do I want to go original or unoriginal hmm So many choices man I think they've added way more choices since when I decided to um When I did my musketeer that case kind of cool even more. I didn't think there's a lot of things. That's cool That's what we have in our musketeer. I believe Privateer what was kind of private area? Do no, no, no, no, no Um, you go with this I suppose this is kind of private area. Um, let's go Gold and blue probably Next now choose how the field behind the icon is arranged Use the color buttons to choose the base and trim of your flags feel this one This one looks more navel Green and blue Yeah, we'll go back Change this to a Reading gold with green and blue. Yeah, sounds good. The colors you pick for your flag will also be used But now let's get you out of this confounded cell Okay, so um, obviously I Finally tell you what this series is about Yes, we're going to skip the tutorial basically this is a Walkthrough of pirate 101 except not really a walkthrough. We Thank you basically just gonna be skipping all of the dialogue because um, Obviously, you've already heard it. In fact, what we're gonna do Is we are going to turn off the dialogue Um, because we don't need it because we've already um Obviously have nearly completed walkthrough two episodes left of the musketeer walkthrough coming soon um Of the musketeer walkthrough so we don't need all the dialogue. So we're just gonna be Basically leveling up a privateer because it was requested. Um And I don't particularly i'm changing realm. It's too laggy too laggy too many people too many things to load um Let's go to one eye jack favorite realm um Yeah So yeah, basically just Basically just going through the game Doing as much as we can um Yeah, I won't be listening to the dialogue because why use dialogue when you've already done it, you know um, so yeah musketeer privateer was kind of well Kind of yeah, it was quite It was quite popular recently. Um, so I thought why not? Um, I could probably try and find the um the I think it was like number two or three of the original like Um, choose my class for the full walkthrough um But yeah, I've played privateer briefly before um It's quite fun. I will admit um So yeah, I'm looking forward to playing the full game through with this. I need to turn off auto attack Um, because that is annoying We will do that now in fact It is I always forget like where it is. We'll make companions. Okay This is really loud Okay, um So yeah, let us try and find Where it was Placed that's nice. There we go already done. Um Bum-ba-dum-ba-dum smaller I should have got a mount out of my house. Oh well, we'll do that later We'll just go through a bit of this without a mount. That's cool Yay, Bonnie Ann. Hello Bum-ba-dum-ba-dum, yeah And next up bum-ba-dum-ba-dum Two training points. Yay We're gonna be doing the same thing except this time. I'm actually gonna keep up with um promotion quests Uh for companions, so I don't get stuck with the Bonnie Ann that is can't be promoted like last time, which is really weird um, obviously because I'm assuming that everybody who's watching this knows how the full game goes. Um You um need to Talk to Catbeard who is no longer there once you've completed the one of the quests um, and if you try and upgrade your Bonnie Ann afterwards then he's not there and you can't talk to him Um, so yeah, I'm gonna try and I'm trying to oh god. That was bad Good job. Good job Good job Boop Okay Oh, I need to know fast combat as well Slow combat so boring Slow combat and like 2017 what? Okay, thank you There we go. Yay treasure more treasure. Yay. Okay cool You thank you now. Let's go back to small it. Thank goodness for that What's this Bonnie Ann spiral cast way Okay Small it hello Boop boop boop boop boop and we need to go and find live z now Who is oh god getting stuck on things I'm in fact going to where we can go and get a mount. I hope I've already got one in the bank Hopefully I think I did that a couple of days ago Um in preparation Should bank moment of truth Yes, I have the mystic skiff Move to backpack That is my mount of choice 13 12 11 10 9 8 7 6 5 Okay, here we go. Let us put on the mystic ski which will be probably our mount for a wee while Um, I do quite like it. Let's say Nice mount It's like the og boat mount before like boat mounts were cool because obviously The new mounts in the crown shop are the boat mounts And the halloween stuff, but og og boat mount ye Before boat mounts were cool Okay 82 health privateers are Basically gained the most companions. So that's going to be really cool um really excited to Get lots of companions. Um, it does mean that I will be training them up quite a lot And we'll have to use a lot of training points to keep them well leveled Um, but yeah should be fun a bit different from What I'm used to with musketeer Because obviously most of this is it's more of a melee class and kind of relies very heavily on your companions um, so yeah Okay Yeah Okay, um, we will do you and you good Really that dodge though. Whoa Oh man. Whoa I love dodging Um, okay Let's see if we can get it at this time. Can we yes we can finally thank god Yay, okay And Okay, that did quite a lot actually Okay Do the doom Okay, there we go. Fantastic. Let us collect the treasure chests Boop and bloop And we're going to free livesy because I know that's like 100 drop chance. I've never not gotten that. Yay level up level three fantastic And Now we go into pick up throats. We're actually really powering through this Um, which is good It's the whole point of this to try and like path through as much as possible. Um, I'm hoping to kind of um, most of the I'm trying to probably do like I think what would be cool is if I could try and do like A book an episode like 15 episodes, but I don't think that's going to happen um But you never know you never know don't count your chickens before they hatch. I know I know the first book is quite long because it goes right up until um Joan in town, I believe Um, so that won't be one episode. I'm not having that long of an episode. Um, most of them will be around like Probably 20 minutes hopefully um Yeah, and who knows I might chop them down a bit because really It's not like solid Dialogue you have to include everything. Um, so I might chop them up a bit. We'll see how the how it kind of pans out as we go Well, actually Let's go like that done That was cool. Okay Um, so yes, um privateers mainly focus on will which is quite quite good because um, it's very different to like agility and strength But you can also use strength as well. It depends on your weapon, obviously. Um, but most of the privateer only weapons are um Most of the privateer only weapons are um will um, but of course In pirate 101 really any weapon could be whatever you want. You can use whatever weapon you want Um, it's just your gear may not be the best for it. I know we have to go up here Whoa, look a chest. I wonder what's in it. Whoa, we're gonna get a robe. Whoa. I wonder what one it is. Whoa Great coat Let's equip that Yeah, look at that blue and gold. Yeah, boy Here behind the waterfall I could be Bonnie N's voice. I think I think I'll suit that role hire me Kings Isle Okay, um, there's a way back to the fort. Oh, look at that. Oh My god, I would have never guessed that one coming. I've done the introduction too many times Okay, been such a long time since I've been in here It's amazing. It's bringing back so many memories. Oh The tunnels are crawling with pocket gators, but we can sneak past them if we stick to the walls Oh my god, I would have never guessed that Bonnie N. Thank you Okay I'm actually really excited to Do this on my privateer on my new privateer I'm really excited. I'm like, yeah, really really excited um Yeah, the only other class that I haven't really played at all is buccaneer And I would really like to do that so possible future series. Maybe who knows who knows Definitely privateer is fun From the much I've played which is like the starting bit so Don't know much more than that. Actually, no, I think I had one on my old old account that Got up to cool ranch But then soon got stuck and I decided not not not doing privateer got too too angry Boop just move you up done fantastic The the best thing about privateer, I think is that like you get free heals I think that's the best part for me personally Free heals and like your starting thing is like a aoe, which is pretty cool Um, which doctors have the like most the best I think starting aoe or buccaneer I think she would do that and you can go on her. Um, which doctors is really good for when you're fighting fin Um, because you can literally just one shot him To shot him really um Because yeah, you can literally do it from wherever so yeah, I mean my um, hello Um, my my witch doctor is probably my most proudest Thing that I've ever made in the game One health really okay. I see how it is. Oh the block Oh the double block. Oh, man Oh, I've got a sheer why can't I just like block cheese Okay Fantastic, there we go. Perfect Lego Yeah, my witch doctor is probably my most valued Game item. It sounds really weird, but um That is what it is, you know I'm really proud of him I yeah spend a lot of time working on him. Um, probably about Three four months Which is fantastic. It's also the like first character that in a game in any game that I actually um like leveled up to Like op like next level, which is Which also kind of goes in with uh, I'm very proud sort of thing. So Yeah, I'm proud man. I'm proud very very proud Okay, so hopefully um We'll just do all of this today. We'll defeat Finn as well. Um, because that shouldn't be too hard Oh, we're gonna use Bonnie and for the first time. That's right. We need to do these So what I'm gonna do is I'm gonna run down here. You can go up there and so can you Um, yeah The easiest one to get is usually this one on this side over here where my cursor is this one here Um, because you usually spawn like quite close to it Um, yeah, these guys make funny noises. I like it. I usually send to this way to do the other two Oh, hello. I got a message. That's cute. Um, yeah, I usually send to this way Um, and always see my part this way just because he usually has the most range Um, but yeah, you never know. Sometimes it's it can be weird sometimes What I really hate the most about this is like you're meant to like unplug it, but like the plug goes in Okay, please stop Oh resisted. Hello Bumper dumper dum Blocked fantastic Bonnie and you're amazing already. These guys actually have really low accuracy and like damage and stuff Which is really good. I think they like nerf them a lot Since um, yeah Which is very good um, like seriously Because I mean the you're not meant to like kill them really They're only there just to annoy you Um, because basically you just need to activate all three shines and the plug goes down instead of about Um, and then it gets out somehow when it goes down too far and even know how that works, you know Serious like literally doing nothing Okay, two damage congrats first strike one, okay They did a lot Just hope they don't crit on you. Hey, oh, they're blocking out. They're like, oh, yeah, I know where you're going That's the only one annoying thing about them is they just so many of them that sometimes they do block you there We go fantastic done Okay Perfect there we go And the plug goes in fully and all the water rushes out Yay There we go the longest animation in the world Bumpa bumpa. Um, there we go Boop boop Okay, polio walker. What a nice wee badge Um, it should have probably left a mark with sergeant shepherd, but that's cool. Um I don't mind rowing all the way back. It's not too far Um, yeah, just down the end of the thing Don't want to get pulled by these crocs. I've only got pulled by these crocs once surprisingly I'm usually like the best or like I always get pulled Don't know whether you'll call that like the best at getting pulled or the worst But like whatever you call it.  I got you. Um, we're gonna get this chest. I always like getting this chest because it's sneaky um, and Let's um, just find a team that should probably go real quick.  We get it bro. We get it. We get it. We get it. We get it. We get it Thank you. Okay find also. Um, luckily we can do boom Can move you up and you up. Oh, I need two people in here. That's unfortunate. That's weird Um, but we should be fine. She's a buck in here. What level are you? Level three. Oh, they're like my level. Hmm. Okay That's cool Yum fantastic, okay Jackie Hawking Hawkins No, she's got slow combat on I think she's got slow combat on Yep, she does that's unfortunate. Good job Good job. You're obviously a noob Obviously a noob not to um Be mean but obviously Bump bum bum Okay, this is gonna take a while Oh, I didn't realize these guys would have slow combat on Ha ha ha honestly Bump bum bum bum bum bum bum bum I'm gonna move up here. We are going to Move up here.  There we go Yeah Okay, cheap shot. That's cute. That's cute. You think you're cool, right? Oh you do as well. That's cute Egg shin doesn't die easily Okay, that was good that's pretty good Okay, okay block. I'm lucky. He's nearly dead as well. So that's unfortunate This is why witch doctor is so good because you can get so much damage on him um Through ghost whale Which is why I love witch doctor so much that and also I love witch doctor. I love it Um, but yeah, this is probably the hardest bit trying to get through too thin because he always keeps himself at the back Yeah, it's kind of hard Oh another message. Oh, I'm so popular yas I need help.  We'll get a double tap. That's cool Bump Bump Bump No, don't go for her. No, don't do that go for him Let's see if she realizes what marking does Probably not What was I immobilized or something probably Maybe I was must have been because I didn't have it Okay Why would you do that?  Oh Jackie could have done this so much quicker by myself. Good job Good jube Good jube At least Finn's near us now. So that's always good. Um, jk I can't get to him now Unlucky Bump Bump Bump Okay, and here we go Boop and uh, boop And uh, I'll just do mark you so they know to hit you Done. Okay Let's wait and see what happens boop boop boop boop Unlucky. Oh, hello Bump Bump Bump Bump Okay, you're dead as well If we focused all of our attack on Finn, he would have been dead by now just saying Salty. Yes. Definitely. Um, can you hear wing? Thank you. Done Wing is dying and that is not good. We're not losing companions already Um, that is bad. Can you hurry up please honey? Why are you? Oh, Jesus Christ just here with Bonnie Ann Oh, damn it man. Oh block. Unlucky Okay, cool The more you run the more you get hit. So I just suggest not honey Okay All blocked look at that dodge cheeky Okay No, didn't block that one that's unfortunate.   You don't need to run. Jesus Christ. You're already far enough away. They won't get you Okay, let's go Let's go. Come on. Come on, egg. You can do it You're lucky The problem with finnish is so much block Like it's actually annoying. So hopefully with that minus dodge We can try and get some and Some good hits in Um, yeah, I also found out that he like caps damage as well, which is kind of weird Yeah, so that's interesting Hurry up. Thank you. Thank you Thank you Thank you Thank you finally Last one surviving.  Oh, we got a new set of weapons. What does it say? slash you Um, okay, we are going to collect the jade amla. I nearly forgot to do that one time. It was embarrassing. Um, what's this that? Yeah, we're gonna equip these brand new weapon fantastic and we're gonna go to We're just gonna get this cane first Just because why the hell not, you know It doesn't Do much anyway. It's just a simple quest that we can hand in Um, so yeah, let us talk to Avery and then probably end off the episode there Um Yeah, just because it's been probably about 30 minutes by now. I think which is quite long, but that battle was quite long Unintentionally long um So, yeah, we'll just quickly hand this in and I think we get a level do we get a level now or isn't the next part I don't know. I don't think it's now. Maybe it isn't Please load come on. Thank you Bump a bump bump bump bump bump. Yes level level four fantastic Um, we'll just quickly get this quest to go down to the boat probably yep a good ship Anyway, thank you for watching. Um next time we will be completing Probably most of skull island going into blood blood shawls Um So, yeah, thank you for watching room to leave a like and subscribe and if you've ever subscribed press the little bell So you know exactly when I post another video and remember craft outside the box