Hi there, it's DJB and in this video I'm going to give you guys a little bit of a studio tour. It's interesting to see how people situate their workspace and you may find some interesting tools in here. This room is the spare bedroom in our house so my parents have graciously lended me this space and the bulk of my studio work resides at my desk and it's dark right now because it's evening but I do have a window up there that lets in natural light. I have this swivel chair that I usually have towels. I use these towels to hold my models while I paint. I have my trash can down there and my tripod usually resides here. It's how I film from that angle because I'm right-handed. I have to film from the left side. Down on the bottom I have my two Iwata airbrushes so I have the Iwata Eclipse and the Iwata Micron. They're on a quick release adapter so that I only need one airbrush hose. Then I have my airbrush cleaning pot. I have airbrush cleaner down there and I have my air compressor so that all kind of fits well on this computer stand for this desk and everything is connected to a power bar down there because I run a lot of electronic devices and then this box actually is really useful. I use this box as a painting lift so I prop the model up on this box so that I'm not hunching over so much and it just happens to be a horse box. Then I keep all of my Vallejo paints in my custom Micron box. I have one cup that contains random supplies so I have some random knives, toothbrushes, my silicone paintbrush, an X-Acto knife, so just different tools that are random. In another container I have really crappy cheap dollar store brushes and I use these for epoxy, smoothing it out so I just buy really crappy cheap ones that are easy to throw away when they get too too bad. Then I have one jar that's just my silicone sculpting tools because these are my favorite. Then I just have a container of water because sometimes I need just normal water and I have a couple other paints here that don't really fit so we have some airbrush flow improver. I have my super glue here, all of my golden high flow acrylic paints. This is a masking fluid that I haven't actually tried yet and I keep some of my just cheap acrylic paints here. Then I have my giant stack of PanPastels oops and I've labeled them all so that they're really easy to use. Then I just have some other types of paints back here including my golden and Winsor and Newton and then I have a box of other random paints so some Joe Sanja, some other acrylics and then actually this contains all of my oil colors in the back. The light I'm using is a daylight and it's supposed to emulate the sun and make you feel not depressed. I went through a time in the city but now it's just my studio light because it actually works really well. It's really bright and it illuminates this whole room. Or this is a Lazy Susan and I actually got this at the Dollar Star, it was like $4 so I use that for airbrushing. Then I just have a thumbtack board full of reference images that I have flipped and pinned as well as some projects that I'm working on at the moment and I have a full color swatch of all of my Vallejo paint. I tucked away behind this paper are just some watercolor pencils. I have some fan brushes and just miscellaneous stuff, a pencil, so just like random stuff. I think my Sharpie's usually in there. Then I have some decent acrylic brushes that aren't great. Then I keep my makeup brushes separate for pastelling and I put my Winsor and Newton detail brushes in here as well just so that they're easy to find. And then I've started actually buying nicer paint brushes for acrylic and oil so these ones are just kind of the nicer ones and I also have that palette knife in there. A good old roll of paper towel and a good old roll of blue shop towels. And then I keep a jar of paint water and a jar of epoxy water. I keep them separate because epoxy builds up like residue in the bottom and then paint is normal so you definitely want to keep those waters separate so that you don't get weird build up and I keep a separate paper towel for both things as well. Then I have my containers of epoxy sculpt and my two little containers of magic sculpt and I have a notepad just for jotting down thing color codes or video ideas I have. Of course everybody needs chapstick in their studio and then I have my Bose speaker because I generally listen to music or podcasts or videos while I'm painting and then this always just lives here this is just my needed eraser it chills on the side of my desk it's always there I always know that it's there. Then this pulls out and I have a few more supplies I have some like fancy pastels I have a pink pastel that I bought specifically for pinking. I have my pencil sharpener sharpener and sheenings. Then these are all my good clean paint palettes I just use like cottage cheese, sour cream, butter, lids so that way I can have a lot of them. I have some of these micro fuzz brushes here and some nail teas as well as just normal q-tips and these kind of half pointy q-tips. Then I have my trusty bin and this can look like a nightmare but it's actually pretty organized. I keep most of my major stuff in this one so I have some wires I have scissors, pliers, bondo, tape, these are my glass pieces. My baking soda that you guys have seen me use a lot of times my cern relief. I have a hacksaw in here some dead bits a toothbrush for dusting toothpicks so it's like all the things that like I generally find myself using quite a bit and then I actually have this container which is really awesome it holds all of my special stuff so like little things. I have my awada lube in there I have some mini magnets I actually have some little horseshoes so just general stuff but mostly airbrush repair and little spare parts and that's really good to have in the little containers so that you don't lose anything. So this looks like mayhem but like it's all stuff that I use pretty frequently. Then this one is the sandpaper one so I have like one of these fancy cutting mats in there and then I just keep little bits of sandpaper in this so like when they're still good to use but they're they've been used they go there I have some extra sheets here and some extra paper plates for painting in here I just have some extra gloves and tin foil socks for buffing things for holding the models towels that I can use to hold them and I have some of these cheapy respirator masks so and then in the very bottom this is generally the bigger stuff so my heat gun does live in here usually so anything like large I can just throw in here so I have a hot glue gun a hair dryer and some manuals just some black bags so there really isn't much in there. Then tucked away on the side I do have some extra sandpaper sheets as well as this cutting board thing that works really well for putting things on to prime sometimes and then I have a box for my paint palettes that are ready to be cleaned. Then I have this green stool and this works good I put my vise on it so that I can saw horses there instead of over there and it's a nice little place to kind of put my models on and take pictures of them with that wood background and then this is all is literally the biggest box ever and it's all full of bubble wrap I save a lot of it because I feel like I need to. Underneath there is my Dremel box and I have some Dremel bits that live over here these are the ones that I use the most and then I have like the whole kit and everything with extra over there on a little stool and this little side table is where I do most of my Dremel work and my heat gun is here as well as my Dremel it's like it's on a stand and then it has a flex shaft and that works really well and then I have my newer ring light which illuminates there and I can move that around I usually move it over to the main desk when I'm painting I have all my live show pony poaches there these two bins are actually full of briar stuff so they're genuinely full of like my childhood briar things so like blankets and hay and there's a wood barn in one of them so they're kind of they're just here in the house I don't really know why and I do have my live show bag back there as well as a vacuum to vacuum everything this is just another little table I have set up just good to have another workstation somewhere to put things and I have a little tray that I like to use to carry things if I want to like work outside or work upstairs and so I have my filters here my gloves my safety glasses and my respirator just hanging out another power bar my second camera battery always going and I have a space heater because it gets pretty cold down here so I generally have it like facing me while I paint and on this side I do have another chair that's just in here in the light and this is my double stacked bed this is my parents guest bed and then the bed that I brought with me from the city and then I have my amazing art easel this art easel is my favorite this is a $200 easel the box was damaged it was for sale at the store for $15 I love it over here is the great studio supply shelving I have recycling here because I save the environment so I just have some more towels and paint stuff because this is a combination of model horse stuff and just general art stuff I do a lot of painting so I have an actual like painting sheet and that's actually what I've put behind my whole studio is a whole paint sheet so that the paint can't get everywhere and they're really good they're waxy on one side and then kind of absorbent cotton on the other side so that they work really well then I have some boxes of stuff I believe there's acrylic paint in one don't know what's in that and then my Iwata airbrush things just extra little bits so they don't go missing and I have a couple project horses just hanging out here one with no head and then in these boxes this box is all my spares so this is a thing of extra everything extra q-tips extra clay dremel parts q-tips popsicle sticks like anything I can think of it's just extra stuff that I buy so that I have backups so I can just use backups and not have to go to the store I've started sculpting things so I chopped heads and tails off now and I'm keeping them and eventually I'll probably sell them and then these lids to my containers that will eventually be recycled and I have some extra tinfoil here I have my rubber gloves and some just white paper that's good to have on hand so this is my commission horse that's waiting for paint have a couple little stalemates that were in the works and my aero medallion and my aero medallion's artist proofs as well as these plexiglass rods these are my beauty blender artist sponges I have those in a box I have yet to try those fully and then this is just a bin of my silicone casts and some medallions that I have sculpted it's kind of like a project box up here is my most common area for work in progress so we have a hamilton up there otheo kroy and my long bean fjord as well as this moody mare that's in the progress and then I have this shelf which is slightly smaller and it's for my you know little little things that are happening here I keep my camera equipment so I have my camera lenses as well as my camera bag I have this fan I have some wood bases that I may use one day and my huge things of magic sculpt that I bought this is like a base thing all of my primer and sealers my problem is I have like a couple different kinds of primer and sealer I've switched so I have a lot of old ones I need to list them on like Facebook and sell them to someone local when I open them I write open on the lids or I just take the lids completely off and that's how I know that the thing is in use so that I don't use them all and they all go bad then I have this shelf which contains my big art brushes for large-scale painting I have two things of isopropyl alcohol one is 91% and one is 70% I have some gesso I have some gal kit this is all my oil painting stuff so oil painting things and my oil painting cleaning jar and these are for little containers for my isopropyl alcohol while I use it these are all my stable mate bodies I keep quite a few on hand some are in progress I don't know it's like a buffet of whatever I'm feeling I have a medallion in here I have this marabella that never got to anything I have some soli choices in here just like random projects down here I have my mold making stuff so a huge thing of airbrush cleaner back there my easy off for stripping and my ease release for mold making I have some containers some garbage bags for things I have my monster clay here a medallion I was working on and a thing of lego for mold making and then my mold making box just contains my silicone and resin a lighter some topical sticks plexiglass cups different things so everything for molding and casting and then this is just the buffet of literally everything else so I have a binder of reference images I have cups and stuff and an extra roll of paper towel and then some like older acrylic paints so like I said it's kind of a jumble of like just artsy things in general and like back here I do have all of my like canvases and there's some actual finished finished paintings in there wrapped in plastic an old drawing of mine different things and then we have the body box it's just a buffet of different things I can work on that's pretty much it I like to keep all my things in one place I like to keep backups of things and it's good to have an area like when I'm finished painting or when things are drying it's easy to put them here the studio space itself is good because there's actually a door to outside in my basement as well it's easy for me to go outside to spray things I'll be very excited when I can have a big room with like desk that goes all the way around and I can keep everything contained but for right now it's okay and hopefully you got some insight into what I have in my studio and how I make it work it's been over two years now so this is a collection of things that you slowly grow and organize and you find what works for you what products you use what products you don't use it's very hard to move houses when you live like this so thank you so much for watching and happy customizing


Gang let's do a comic book haul. I got, I got three graded comics at a ridiculous price. One of them was fair value, but two of them were just insanely, insanely cheap. They were local buys. Okay. They were local buys, so there was no shipping involved and And So I didn't even, I didn't have to pay taxes on shipping. So I saved on shipping as well. Three CGC graded comics. Here's the first one. Let me take it out of the bag. New Avengers number seven from 2005. Okay, first appearance of the Illuminati. Century, Wrecker and Mary Hill appearance. Paul Jenkins cameo on last page. New Avengers number seven. Ended up paying $9.50 US for this. And remember, local pickup, so there's no shipping, shipping costs. Let me make sure I got that price right. Yeah, $9.50 US for this. Okay. Just shipping this out to get it graded and having it come back would probably cost like $40 US in Canada, if not more. Okay, so if you want to build yourself a CGC comic book collection, if you want to build yourself a CGC comic book collection, and here's the back, you could build yourself a super cheap, like inexpensive CGC comic book collection by going for stuff that isn't hot right now. Okay, that isn't hot right now. And I think this guy was selling this for $100. So, fantastic deal, fantastic deal. Here's another one. This one, the guy was selling it for $125, right? We ended up getting this one for $10.50 US. Right? Stray dogs number four. Okay. From 2021, the Demons Movie poster homage cover graded at 9.8 for $10.50. And the Demons Movie, it's a 1980s B horror movie. I don't know if what do you call it? Any of you guys have seen it? I don't know. I haven't seen it, it's weird. I saw a lot of the horror movies, B horror movies, and I've seen them multiple times from 1980s, but I haven't seen Demons. And it's about these people that go into a movie theater, I believe, and zombify, people become zombified, eating each other, killing each other, and stuff like this. So, super cool. $10.50. Great deal, great deal. And I was picking up this series, by the way, until I stopped going to my comic book shop. Right? So, fantastic series. What's this? Kieran Gillan. Here's a review. Kieran Gillan. That's a horror series. I didn't read any. I just picked it up. Right? Stray dog manages to somehow be a convincing collision between 101 Dalmatians and criminal, noir, charming, and a really great take on quasi-real-dog psychology. Great cover. Demons. Stray dogs. Number four. $10.50. So, that's one thing if you're on budget, which I am. Right? I'm just looking for really, really amazing deals that their books are not hot, and you can pick up the stuff super cheap. Okay. Here's another CGC great comic. And the guy was selling this one for $100. Right? I like the usage of the word unleashed. That's right. For dogs. Sometimes a wicket has been unleashed at the top. Right? Something wicket has been unleashed. Nice cat's rumble. And this one was fair value, in my opinion, anyway. That's what it's going for. It is still a great deal. This is Spider-Man number one Marvel Comics group, okay, from 2012. And this is the first, this one I paid $28 US. Okay. So, that's a going price. So, it's fair value. It's still a great deal. Right? Cheap. It's the first appearance of Peter Parker and what do you call it? The Miles Morales. Right? So, it's their first appearance. And for future value and stuff like this is a good place to at least get a copy. Right? So, $28 US for this. Not a bad deal. And again, no shipping involved, which makes it a better deal. Right? But still taxes that I had to pay on this. So, all four of these are now costing $50 something. Yeah, almost $50 US plus just taxes on it. Right? You have this issue. Nice. And check this out. We've got a little package. We've got a little package. And this one is trading cards. Right? You've seen this one before. We're actually doing a reading on it right now. And I only had one copy of this. I wanted another copy because once we start reading, we've only read the first 12 cards of this. We've got to do the rest. The assassination of JFK. So, this is my second copy of this. And we do have this, you know, reading of the first 12 cards done. And we're going to read the rest this fall anyway. Right? And again, I'll say this. There's more knowledge in these cards than in all of high school history classes that you can take. Right? Here's card number one. We've looked at all these. Well, we're going to look at all these. We've looked at the first 12 and ended up getting this one at a good price if it was a local pick-up. So, it was $15. Let me check this out. Let's see. I ended up paying... I won this for $15.50 Canadian. Okay. The shipping ended up costing... What was the shipping on this? The shipping ended up costing $18 and it's from Canada. Okay. And taxes ended up being $4 something on this. So, on a $15 item, I paid $4 in taxes. Right? Because they charge taxes on shipping as well.  Right? But still, a good deal for this set of cards because they're going for a higher price. A couple of years ago, they were cheaper. Right now, that was the cheapest I could find it. So, it ended up costing like $37.50 or something Canadian. Okay. Oh, my God. I'm obsessed with first appearances. If I see it on a comic, I simply have to buy it. Yes, first appearances, first encounters, first reveals, first anything, really. First of a series starting, prices on them, it's incredible. I know a lot of... Over the last few years, I've seen a lot of resellers, a lot of people that were blowing out a lot of comics and they used to list hundreds of comics. Right? They've ran out. Like, they don't have any more. Right? There's some warehouse sellers out there that have hundreds of thousands, if not millions of copies of comics. So, they're constantly selling up. But there were minor resellers that had a few thousand feedback that used to be listing a lot of comic books. And I've bought a lot of stuff from them over the last 10 years or so. Right? But they're no longer around. Like, they ran out of comics to sell. And you know a seller is slowly getting to the end of their inventory is when they reduce the number of auctions they do and they just put buy it now. And some of the buyers that they're buying from, they're doing way less auctions now and they're doing the buy it now because they're running low on inventory. And once they blow those out, that's it. They got no more. Right? Rendo. When are those printed? These ones were printed. We looked at these. These ones were printed late 80s, I think. Late 80s, I believe. Let's check it out. Kudeta assassination. It's not on the info card. Where is it? Start data on the info card. Nope. There is on the back of the things. Early 90s, the text, Revised Second. Kudeta trading cards, Revised Second edition, text copyright, 1990, 1992, Paul Branco, art copyright, 1990, 1992. So second edition. I didn't realize there was a first and second edition. So this is the second printing on these things. I don't know. Crazy. So 1990 and then 1992. I have to cross reference this with the other set that I have. See if the other set is first edition or second edition. So 1990, 1992. These would be 1992. I'm not sure what the other ones were. I'll have to take a look at them. When we do the next reading, I'll try to bring these to see if there's any difference between those. Those are the original print on them. Super cool. And I was buying comics from the comic book store. At the time, I had a pull list on a comic book store, and I don't remember these cards in the comic book store. At the time, I wasn't collecting cards, so maybe it just didn't register with me. But I don't remember seeing Eclipse Comics comic book cards. This one, or coup d'etat, or rotten to the core, trading cards, or drug war trading cards, or any of those. Oh my god. You got the first appearance of Teenage Mutant Ninja Turtles. Wow. Keep that well. Keep that safe. That thing is only going to go up in value. Famous last word, but I think it's only going to go up in value. That's a major key. A few years ago, you could have bought it for a thousand bucks. Low copy for 500 maybe. Now, I don't even know what it's going for. A high grade copy would be going for easily 10, 15, 20 grand. Artwork differs from the edition. Yeah, I wonder too. We'll have to put them together, see. As long as that one is the first edition. Kebabs, how are you doing? Cheers, brother. Good to do a live stream. I haven't been doing too many of these. Still in recoup mode. And school season is starting. So this summer was, we planned on doing a lot of work this summer, but live streams and stuff like this, but I got taken out. I got taken out. Gang? That's our comic book haul. Nice haul. Nice haul. On the down low. On a budget. And amazing bias.


Welcome to Authorization in Software, the podcast that explores everything you need to know about Authorization. I'm your host, Damian Schenkelman, and in each episode we dive deep into Authorization with industry experts, as I share their experiences and insights with you. If you're a software developer, or just someone that's interested in the world of Authorization in Software in general, you are in the right place. Let's get started. My name is Damian Schenkelman, and today I'm chatting about Authorization and Macaroons with Neil Madden. Founder at Eliminated Security and author of API Security in Action. Hey Neil, it's great to have you here. Hi Damian, it's great to be here. Could you give our listeners a brief overview of your background and what are you up to today? Yeah, of course. So as you said, I'm Neil Madden, and I'm currently running a startup called Eliminated Security. I'm providing kind of application security training on things like JSON web tokens and things like that, and a bit of consultancy. Before that though, I was the security architect for 4DROC, which I worked for a bit over nine years, off and on. I'm also the author of the book, API Security in Action, which was published by Manning a few years ago. And in my spare time, I also a kind of bit of a security researcher. I took kind of a look for vulnerabilities in software. So some of your listeners may know me from a major vulnerability I found in Java's Elliptic Curve Cincture software last year. It's called Psychic Signatures. I'm also quite a long time regular contributor to the OAuth Working Group at the ITS. So I've kind of helped shape some of the more recent standards that have come out of that group. And pretty, pretty active there. That's neat. It seems you've been thinking about cryptography and how to use it to secure the APIs for quite a while, which is a big reason I'm really excited about covering you here. I've been thinking about doing a Macaroon episode since I started the podcast. And when I started thinking about it, I was like, who can I invite? And your name came up in conversations without folks. I'd read your post. So I was like, yeah, and it needs the person to have on here. Could you maybe share with folks what a Macaroon is and why we're talking about it in the context of authorization? Yeah, of course. So Macaroons were invented by Google. They produced a research paper, I think almost 10 years ago now, where they described this new approach to authorization tokens. So they're really, in some ways, they're similar to a JSON Web token or CHOT, but they're much more constrained. They only have one algorithm, and it's a very simple algorithm, but they have some interesting new properties that CHOTs don't have. So in particular, you can add these things called caveats to a token after it's been issued. So with a CHOT, you issue it, issues a token, and then it's kind of fixed for the life of that token. Whereas with a Macaroon, after it's been issued, anyone can add these things called caveats to it, which restrict how that token can be used. So there's kind of this nice thing you can do where you can change the token after it's issued. So we introduced a few concepts there. We talked about JSON Web tokens, and we also talked about algorithms. Can we maybe share what's a JSON Web token? People might not be familiar with it, and also what's an algorithm when we think of the JSON Web token? What's the algorithm? What is it used for? So a few people are familiar with cookies and things like that. So when you go and log into a website, you get a cookie set in your web browser, which kind of remembers who you are. And the traditional way those were done was, you know, you logged in and then details about the user were stored in some kind of backend database and some kind of random ID was generated that was then became the cookie. And then every time you send the cookie back, you go and look it up in the database and find the information. And so JSON Web tokens and things like that are a way to do that without having the database, basically. So you can encode all of the information into JSON or some of the format like that. And then you sign it cryptographically with a secret key to protect it against temporary fortress and things like that.  And then you don't need the database. And so when that token is presented, you can verify the signature check out it been tampered with and then extract the details from the token. So JSON Web tokens support lots of different algorithms. So the simplest one they support is something called a HMAC which sends for hash-based messenger authentication code. We're talking about algorithm for signing the domain you mean, right? Right. So you can sign it either with a single HMAC which, as I said, is a message authentication code where you have a secret key and both the person signing, issuing the token and the person verifying it have to have access to that shared secret key. But then JSON Web tokens also support public key algorithms where there's a private key that signs the token and then there's a public key which could only verify the tokens and then you can distribute the public key to the PI servers and they can verify the tokens with that bit. So Macaroons just use HMAC basically. So it's always based on a shared secret. So this is a protocol for Macaroons but that's the one algorithm they support. And so the issue in the verifier of tokens and Macaroons have to have the shared secret key. On the plus side, you get these nice properties of being able to append these caveats and HMAC is really fast and it's a lot faster than most like public key signature algorithms. Okay. So to recap and let me know if I got this right back in the day, we started storing some big, large string in a cookie and that was a reference to something in the database that represented data about your authentication and your session. At some point we said, hey, can we make this stateless? Stateless is easier to scale because you don't require stating the database. We can just horizontally scale adding more servers. Yes, we can. We can use cryptography instead. So we started storing JSON sign and again, that could be signed with a typical kind of like secret share key or it could be signed using a public private key cryptography. At some point and then you said, okay, that's a JSON web token. The thing about the JSON web token is that once it's been signed by what we refer to typically as a signer or the issuer, it doesn't change and this is where kind of like macaroons come in. You can add these things called caveats that allow you to kind of change the macaroon and in exchange for that you need to rely on using shared secrets. You can't go with the public key format. What's a caveat and how can I use it? What are the use cases for it? Right, so there's a couple of different types of caveats. The simplest ones are what's called first party caveats and then there's another thing called third party caveats which we'll maybe talk about later on. So first party caveats are, they're just a restriction on how the token is used and they are just, in macaroons they're just a string which describes some kind of condition that has to be true when the token is used. In terms of things like cookies or access tokens and things like that that people will be familiar with you could think of it as like a caveat as being so for example like the fiery time on the token. When it's get issued it will have some expiry time which may be like two hours in the future or 24 hours or whatever and you could add a caveat that says actually now the expiry time is only five seconds in the future. So why is that useful you might think if I've got this token why do I want to limit myself to it only expiring a lot sooner than it was to it? Well the reason for this is when you're going to send that token somewhere where you don't fully trust where it's going like you don't trust the network or you don't trust the recipient on the other side so if you're about to make a network request to go to access some API then you've got a cookie or something that's valid for 24 hours if that cookie gets stolen on that request then the attacker can use it for 24 hours until it expires which has come a long period of time but what you can do with macaroons is you can create a copy of that token, that cookie and you can add this caveat saying actually it only expires in five seconds and then send that version over the network and then if somebody steals it it's only good for five seconds and you can add different types of caveats in the original paper they call these contextual caveats you're restricting the token based on the context of the request you're just about to do like if you were doing some kind of transaction you had some kind of unique ID in that request then you could maybe add that as a caveat and then it's only valid but you've still got the original macaroon without those caveats attached to it so you can still use it for 24 hours or whatever and every time you make a request you create a copy of it and you add some more restrictions related to the request you were just about to make and then that means that if those copies get stolen either on the network or because of some institutional coding on the server or, you know, leasing in server logs or all the other ways that these things can happen then what's been stolen is a much more restricted token than the one originally issued It seems using macaroons and some of the use cases becomes interesting and you take advantage of them when we have different parties in the system and the one holding kind of like an original macaroon doesn't have, I'm going to use quotes although people cannot see them high level of trust of other parties in the system but we use you and like, hey, who can issue it and who can kind of like add caveats to a macaroon maybe we can kind of like go a step before and think about an example so what's the story of a macaroon? How does a macaroon get issued and what's a typical party that would issue it and who would it issue it to? Right, so there's lots of different ways and scenarios so they could be used kind of in the same way that JSON web tokens are used, you know for all kinds of different situations so to issue the macaroon you just need to have this secret key that you use to create it and then they have this identifier which is just an arbitrary kind of string that you can put stuff in so that could be something like you could still have a traditional database token and have a 90D that's like opaque and first about or you could put in some structured JSON or something like a jock plain set and then you kind of sign it with your secret key using HVAC and then you issue it and so if you think about the examples so you can use them as a kind of better cookie which was how Google pitched them so you go inside your website your website could use as a macaroon as a cookie and send it to the server which will then send it back you'd have to have some JavaScript on the web client which is then looking and appending these caveats to be nice to think maybe in the future Google could change Chrome's sort of automatically add caveats when cookies were sent in but I don't see them doing that anytime soon and then there's also one of the things we were looking at at Fordrock was using it within the OAuth system so having access tokens issued by an authorization server as macaroons which would then be verified by a resource server so APIs were there was a couple of ways we were kind of looking at doing so as I said before because these are based on shared secret keys you can either trust all your APIs and give them access to that secret key to verify stuff but then they also then have the capability to mint their own access tokens which is more trust than you typically want to give them right and particularly then if any of those servers gets compromised and that key gets compromised then you've lost the keys to your old authorization kingdom really so a different way you can do it is to issue these macaroons as tokens but then still have your API servers call back into the authorization server to validate using something like token introspection which is the standard OAuth API for validating an access token so that was typically used with database backed kind of stateful tokens but you can use it with macaroons as well I mean it's kind of obviously then you've got the latency of these kind of network overheads when you want to validate tokens but you get things like you know these sort of revoking tokens then you can still horizontally scale your authorization server or all the other states that's neat there's a bunch of concepts here and I'm going to try to unpack them really when digging deep in with a few questions so it seems that there are a few scenarios where you might start kind of like issuing a macaroon you talked about too you said you're an app or a server someone starts a session with you you issue a macaroon to the client and then the client sends it back to you with a kind of way using it as part of the cookie they're an API called to the same server and because you issued it you naturally can sign these which means you have the secret to verify them now that's one scenario in that case so let's go that one in particular who is the party that gets the macaroon and who would add caveats like where do you see okay like I'm getting a macaroon from let's say a website that kind of like has authentication they are not delegating with OAuth or anything who would get that macaroon and essentially add a caveat to it attenuate it to share it with another party and what would that party or what could that party be so there's a bunch of different things here so one example is just the client is something like a web app and there's challenge script running in your browser or it could be something like a mobile app things like that and it's taking this token and then it's just doing what we said before so it's adding these contextual caveats before it makes API calls so that as a pure security mechanism just you know if that token gets intercepted somehow or leaked somehow in that request the what gets stolen is less it's less of an impact than this thing you achieved so in that case it essentially it's attenuating or adding a caveat and then it sells for itself so it has kind of like the updated macaroon with some restriction and then that's what's sent over the wire and what you're trying to limit there is if someone can steal that over the wire what they steal is no longer maybe going to be valuable in five seconds or next time is that kind of like one use case yeah that's one use case so it's kind of it keeps the unrestricted version to itself and then it can send this more restricted version over the network or you know because you might as well like a client might get an access token which is valid to add a whole bunch of different APIs right which are sitting in different servers and maybe one different people and so on and so if one of those servers is compromised then when it gets your access token it can use that access token to access all the other servers as well whereas one of the things you can do with caveats is you can add an audience restriction to a token after the fact so the original token might be valid for these five different servers but before I call this one an audience restriction that makes it just valid for them so for instance if you look at like Google cloud for an example they have you know you get an access token from them and you can access like hundreds of different APIs cloud with this token and so you might have a token that can access all kinds of back end services there and that's useful for your app because it needs to access these at different times but when you make the actual calls you can append this caveats thing right now on this call that's only valid so this one API and if somebody steals it they can only access that one API with it in that case you're making the client an issuer let's say the server but let's say the issuer of the macaroon and the client it's a less chatty relationship right they just get the macaroon and it attenuates it when calling the API and server rather than having to go get I would say a more restrictive version each time they want to call one particular API so that you're gaining security by putting the owners on the client to restrict things while at the same time reducing load on your servers in terms of like not having to issue these kind of like attenuated specific versions of the tokens yeah exactly exactly there's also some things you can do when we some more advanced cases when you start looking at these third-party caveats which we haven't talked about yet before we get into third-party caveats which I know are a thing in and of themselves I wanted to chat a little bit about kind of like the OAuth case you mentioned we explored issuing an access token that is a macaroon and you talked about well but you get into the problem with symmetric keys maybe we can talk about typical parties in the macaroon system and typical parties in the OAuth system how could these be the same and what does it mean you also hinted at some of these things like hey if I use macaroons I need to share the secret between the authorization server and the resource server compared for example with the json web tokens is that even possible what are the trade-offs here right so as you said with this shared secret thing I mean when people use json web tokens OAuth what they normally want to do is they have the authorization server has the private key it signs the token and then they distribute the public key to all of their API servers resource servers and they can then validate the token without having to coordinate or talk to the authorization server at all with macaroons at least with the version of macaroons that's been kind of used and deployed everywhere that's you can't really do that pattern because you have to share this secret key so you'd be putting way too much trust in your resource servers then really and so a typical way to use them is you'd use token inspection which is an OAuth standard which is why this is part of the reason why I think macaroons and OAuth work quite nicely together which is that macaroons lack there's no standard for macaroons and there's no standing for kind of these interactions and things whereas OAuth provides this nice framework for how these interactions happen but it doesn't specify what the tokens look like so you can kind of plug in and get the bursts of both of these so what you can do is you can have your secret key is just in your authorization server and the clients talk to it to get an access token and that will be a macaroon and then when your resource servers want to validate that access token they call the token introspection which is a standard OAuth API to validate an access token so they call into it and say hey here's I want to validate it and one of the nice things we were able to do at 4Drop when we implemented this is that the response to that token introspection API is a JSON document that sort of says you know is this access token valid when does it expire what's the audience that it's intended for scopes and things like that and with macaroons what we allowed is people to add caveats that can restrict any of those things so they can restrict the expiry time, restrict the scope and all those kind of things and the authorization server would look at this macaroon that came in it would validate the scope, the signature then it would look at all of these caveats and it would automatically incorporate into the introspection response so as far as the resource server is concerned it just looks like an ordinary introspection response for any other kind of access token but if you've appended a caveat that says this expires in five seconds then the expiry time on the response will reflect that, if you've appended if the original access token had five scopes that it was validated, valid for and you appended a caveat that reduced that to two then the token introspection response will just show those two scopes as being the scopes of the access token that makes sense I can imagine there are some trade-offs there, particularly if we think about how we started the conversation we said we went from cookies with opaque strings that were references to a database to we want to use crypto so that we can scale this and if we go with an approach like this the resource server has to call the authorization server to do introspection which means that there's added latency in that call and depending on where your resource servers APIs are deployed, they might be around the globe they have to call maybe a centralized location, if you have a centralized authorization server it also means that your authorization server becomes kind of like a point of failure for your API how do you think about this trade-offs in the design and maybe what other trade-offs are there when using such at the time those are all really good points that people need to consider so all of those things are true there is some extra latency in the authorization server there is then becomes a single failure where I think it's different from the database approach is that you can still horizontally scale your authorization server so a database is really hard to horizontally scale anything that has state that you have to kind of synchronize and look it up and here you can distribute that secret key to all your kind of cluster of authorization servers and you can scale those so even though you're calling back into this authorization server all it has to do is validate the signature right so it doesn't have to look repetitive so there is still the opportunity for more horizontal scalability and in return for that you get some nice features so it's easily generally to do checking whether the token is being revoked and things like that there's also something I think which is not talked about often in OWAS is the kind of traditional software engineering idea of encapsulation which is you know the idea that you should hide the details of things that you might want to change later one of the things you might want to change later is what kind of access to it what kind of format so if you say access tokens are Jots and all of my API servers know that and they will validate them then it's really hardly wrong to ever change to something other than Jots whereas if you're calling back to the authorization server to interest your tokens then what format those tokens are is kind of encapsulated by the authorization server and is hidden from those things and so you can make a database back token change it to some like a Macaroon maybe later on each side actually Macarons were wrong I would change it to Jots and your API servers don't have to change because the authorization server is handling so is these trade-offs and the trade-off for that is that you have this added latency and potentially and those kind of things yeah I really like how you not only kind of like added to the trade-offs but also explain kind of like this notion of encapsulation at the end of the day I think you have to make choices that are formed for what you think your application needs for example if you think about like if you're doing authorization for V2E application well your employees are rightly going to continue using whatever you're doing because first of all they're stuck there and also it's not latency sensitive at the same time if you think about like maybe e-commerce where it's well known that latency affects the conversion and how much people buy that you might go with another approach and yeah trade-off and encapsulation but you gain performance that's very interesting I want to kind of like now double down on some of the capabilities of Macarons because we've talked about the caveats and the first party we've talked about how you can use them for verification and particularly in the odd flow but you mentioned this thing about third party caveats and we talked about it a couple of times and now I think it's kind of like time to open up that box what is a third party caveats and how does it kind of like come to a table right so third party caveats are really kind of amazing and also a bit scary at the same time so with first party caveats we had it as like they're just a a condition they're just kind of some string that you have to check time with a third party caveat the idea is that you're adding a condition to a token that requires the client to go to some third party service and get a proof that it satisfies some condition so it's not something that the resource server or the verifier can check themselves locally it requires some other service so a classic example that's kind of used a lot which I think helps illustrated but perhaps it's not that real world is the idea of like proving that you're over 18 or over 21 so you're going to use this this macaroon to go and buy some alcohol from an online store and that wants some kind of proof that you are old enough to buy this based on local you know or whatever so the idea is it can issue this token and it has this third party caveat that points at some sort of government age verification service and so you as a client then have to go to this service and get this proof which is known as a discharge macaroon that proves that you are you know over 18 or 21 or whatever it is and then you present both your original macaroon and this discharge macaroon when you want to buy your alcohol and it can tie the two together there's some clever kind of cryptography that's used for that well so another use case where Baldire was kind of working on that's Fordrock which this was when there was a lot talk around sort of open banking and things and you know PST2 and these kind of financial APIs that wanted to fine grained authorization of transactions and so there was a demo I came up with which was around that kind of thing so the idea is that you would have you'd install like a banking app on your phone and then you do a normal OOS too slow for that app to say yeah I want to be able to issue you know transactions from your bank account and so you'd approve that as a normal OOS too slow and you'd get a macaroon access token but you don't want to just let that app just initiate whatever transactions it wants you want to be able to actually approve everything it does for individually and so you can attach a third party caveat to that access token that requires it to go to a separate transaction authorization service every time it wants to perform a transaction on that transaction authorization service would go and actually you know communicate with the user say you know this app is trying to transfer $2,000 or whatever to this thing is that okay and you know you'd approve it on your phone or whatever and then once that was all approved this transaction authorization service would issue this discharge macaroon which authorizes just that one specific transaction and then the app can then present these two tokens together to then go and actually to the bank to actually go and initiate this transaction and so you get this kind of long lived access token that authorizes the app to even start initiating a transaction to even ask for a transaction and then you get these short live discharge tokens that approve the individual ones I get it, so the client seems to have kind of like an incomplete puzzle that the server will then verify and it needs to figure out how to put this puzzle together and you mentioned a couple of cases the decovernment age verification service the financial transaction approval how does the client put the puzzle together right, so the way these third-party caveats work is that the caveat when whoever creates the caveat adds it to the original macaroon they create a new secret key and that secret key gets encrypted and added into the caveat in a way that the verifier of that macaroon will be able to recover it and nobody else can and then when the client sees this caveat on the token it knows it's going to have to go and fulfill this requirement but it can't access that secret key so what it has to do, there's a location hint which tells it where to go and get this track route and there's no actual standard in macarons for how this happens so there's a bit of some missing gaps here you have to come and invent your own conventions for this at the moment but basically the client will go to this URL and it will present this caveat to the URL and that service, that third-party service of that and that URL will then check does this client satisfy this caveat and it will be able to understand what the caveat is that service will also be able to well there's a couple of ways this happened but often it will be able to decrypt something to get this secret key so if it's satisfied, the client satisfies the condition that's in that caveat then it can recover that secret key and it uses that secret key to create a new macaroon which is called the discharge macaroon and then it issues that discharge macaroon to the client and that's its proof that these things happen in the original macaroon in this discharge macaroon to the API which then verifies it and as part of its verification and from the original macaroon it will decrypt this secret key and then it can go hey look I've got this discharge macaroon to respond to this and I'll use the secret key to verify that discharge with it that's kind of mind-blowing itself where it gets even more mind-blowing so if you want to decrypt yourself a macaroon and you can add more caveats to that macaroon so including new third-party caveats so in general you might have this tree of caveats that have to be verified you might end up with a tree with a very long chain of things to verify and ultimately it seems that there is no end to it you could keep adding macaroons to it you also mentioned that there is no standard on how to agree on a location and essentially how to get a discharge macaroon for a third-party macaroon to be able to fulfill the caveats show that you are proving that it's successful what other things do you kind of need to informally agree on a system to make macaroons work right so this is in my opinion the biggest weakness with macaroons at the moment is that when you go and look at something like this web tokens is an RFC that defines stress web tokens and then there's like four other RFCs that it builds on that define all the cryptographic algorithms and things like that there is nothing like that for macaroons there is the original research paper and then there was a kind of de facto standard implementation that was done called nib macaroons that's been kind of ported to different languages but a lot of these details are just left blank so things like even for first-party caveats they're just strings and what those strings are is not specified anymore so it's not like with joc planes where you have like an XP fame that's an expiry time and things like that so that all has to be agreed so in 4DROP when we did our implementation for OAuth we base those things on existing things around Jocs and so on so if you want to restrict the expiry time of 4DROP access token macaroon you add a caveat which is a little jason object with an XP thing which is going to be an expiry time likewise you order if you want to AUD if you want to restrict your audience scope if you want to restrict scope things like that so we kind of based it on that as a standard but that makes us non-standard with other macaroon implementations which use other ways of doing this and the same with these third-party caveats there's a format for how you kind of encode the caveat and you can have this little encrypted key and some little identifier that gets given to the third-party service and you can put a location hint in there which kind of tells the client where it has to go but what it does when it gets to that URL is completely unspecified you know does it do a post though does it send something jason how does it communicate this caveat to it so all of those details and even in 4DROP we never really got around to formalizing what those details would look like third-party caveats sort of left except none of a work in progress I think I don't know whether they've looked at more work on things so yeah there's a lot of kind of grey areas here where at the moment they work better in kind of closed ecosystems where you can control all of the parties and you can nail down these details yourself I'd like to think if macaroons catch on that there'd be more standardization effort around this and they'd mature and these connotations would get sorted out let's hope for the future but at the moment yeah you need to be aware of these what implementations of macaroons in the wild are you aware of yeah so there's there's a few I'm aware of there's not that many at the moment again this is flex the kind of maturity level that they're at at the moment so you know Google came up with them and I'm not aware of Google actually using themselves anyway so 4DROP obviously we added them I know some customers were looking at them all the time I left I don't think any customers had gone live with macaring implementation but certainly some were interested there's a few things I'm aware of so the Lightning network lightweight transactions on top of bitcoin that uses macaroons and it uses the party caveats for like micro payments so you can have like invoices as a party caveat attached to a token and then when you pay the invoice you get the discharge macaroon that cashes it out and then you can use that so that's kind of a nice thing I know Ubuntu Linux they have their Ubuntu one service which is like their cloud service that's like their single sign-all service behind there was all dealt with macaroons in the background this kind of we don't find any mention of it in their documentation but if you go and look on Stack Overflow for like developers saying oh I got this error message from the service you can see mention of macaroons all over the stack that's all built on macaroons as far as they understand or at least was there's a version of macaroons a newer version called biscuit which we haven't really talked about yet so some people got you know disappointed with these restrictions of macaroons to only be the shared secret and they came up with this thing called biscuits which is like a public key version macaroons so it uses public key signatures it's a bit more expensive to do things you know public key crypto is more expensive than things in some different trade-offs they've done some interesting things around there they have like a they define a really interesting format for caveats based on this thing called Datalog which is and if anyone's ever kind of done prolog logic programming at university and things like that so Datalog is like a simplified version of prolog so you can encode some really complicated and interesting authorization rules in biscuits so there's biscuit then and that so there's a company called Clevercat Cloud who were involved in biscuit and they use biscuit then in a lot of their services as well as they share their class services so yes and those are the main things I think I'm aware of maybe others that I don't know of yeah I think biscuit kind of like opens up a whole new path to go down towards and that might be a very very good topic for a future episode the last thing I want to ask is kind of like the flip side of that question well should a developer or a team use macaroons what problems should scream macaroons at them and what production recommendations would you give them to basically get a system working and not have issues so I think maybe one of the things I think that works really well for macaroons is when you want to kind of harden the security of the system but you don't want to deploy something more complicated so by that I mean there's a lot of work now looking at things going beyond bearer tokens so all the stuff until so far they're bearer tokens if you they're like cash you know if you have them you can use it and so if somebody steals it they can use it as well and so there's a bunch of standards around this so tying access to things like TLS certificates or the standard depop now dynamic proof and possession and things like this which you try to harden these tokens and add more security by tying them to some kind of private key to it so you can't just use the token you also have to have this private key that you sign something or you set up a TLS session or something like that but the problem with these kind of solutions is that they're really hard to deploy after the fact because you have to kind of upgrade everything it wants your authorization server has to issue these kind of bound access tokens which are bound to keys your clients have to know how to address these access tokens how to manage all the keys how to then prove possession of the private key when they're doing stuff and all your resource servers need to know how to verify those things if you're using the token inspection we were talking about before where your servers are calling back into the authorization server then you can switch to something like macaroons and it's kind of transparent to most of your software so your authorization server can start issuing access tokens macaroons and nothing else needs to change initially so your resource servers that are updating the tokens they're still just only token inspection it just looks like another opaque access token to them the clients can treat it like an opaque access token but then you can harden things slowly so you can change your client form at the time to start adding contextual caveats before what I'm saying before they make requests and so you get some of the benefits then that these are kind of hardened tokens that if they're stolen they're harder to use they're kind of induced skunk and things like that so that's kind of one of the nice things I think using them and then some of the things around these kind of fine grained authorization things but before we search caveats and things like that in terms of like production sorry to interrupt like how should a dev that maybe is not an expert in identity and security think about this because on the one hand macaroons offer these capabilities in an implementation matter that's probably simpler but if you look at standards if you look at the open ID working group and so on you get guidance for like the D-POP stuff so there's also some things to balance there maybe yeah definitely I think that is there's a trade-off I think at the moment so where macaroons are on their kind of level of maturity I would say I would recommend that they be used only in kind of clones ecosystem internal deployments at the moment hopefully over time we'd see them mature more and some of these standardization gaps kind of filled in and then they might be more suitable for you know deployments externally facing deployments where you have more different actors involved in different parties involved so at the moment at the moment yeah I would definitely recommend with the level of maturity the technologies that you try and deploy them if you're looking at deploying them in an environment where you control all the kind of moving parts make it a bit easier so I think there's also like in terms of technical things that there are some recommendations so the fact that it's all based on this shared secret key means that these keys have to be really protected and so you know you need to look at key storage and key rotation really important things to look at and making sure you're not using the same key for everything in your entire state you're kind of setting the keys and you know I use this one key for signing macaroons for these APIs and use another one for these other ones and there's also there's a really great talk from a few years ago one of the few kind of real in the trenches reduction deployments of macaroons it's by tests renecened I hope they pronounce their name correctly a few years ago and that was on a kind of it's like a real it's a failure case really of wearing macaroons but there's some really good lessons yeah yeah I saw that one I'm going to add the video to show notes here so one of the things they did there was they kind of they made a mistake with third party carriers basically and this is kind of really instructive I think in that they they had this kind of production or service that was all you know designed to handle a lot of scale and handle a traffic for their systems but then they added a third party caveat that required clients to go to what was basically a toy kind of I don't know it was a toy but it was a small scale kind of Ruby on Rails app that just hadn't been sized appropriately to deal with the amount traffic it was then going to do and what you've basically done then is create like a production dependency of your auth service on this tiny little app that is not scaled appropriately for it and so every time that app came down you basically took out auth for everything really yeah I think it was exactly what you said they had they were validating macaroons on their API but they had a third party sort of caveat on the dashboard and the reliability capabilities of those components were fairly different which is common for almost all products and that kind of like was a big issue that they had yeah so yeah I think generally my advice would be to I feel first party caveats are a lot easier to understand and a lot easier to want to deploy and read about third party caveats are kind of like you read about them you go wow these are amazing and you think of all these ideas things I can use them for but actually they're also a good way to kind of shoot yourself in the foot so you know maybe it should be something that you get some experience with the technology first then gradually introducing yeah typical with the great power comes great responsibility yeah it's been amazing to chat with you about these topics you know a lot and you can clearly explain them in detail in layman terms so I really appreciate it I'm really happy we got to chat about this and maybe in the future we can do another episode with biscuits yeah yeah well yeah it's also I'll betray a bit I'm going to be presenting something hopefully at the old security workshop in London which is kind of my own take on some of these things yeah definitely and we can add that to the show notes once that becomes public and we make the show this episode of a load great it's been great having you Nin I really appreciate you taking the time for this and hopefully every listener here had a good time learning about macaroons and how you can use authorization thanks a lot brilliant it's been great staying on thanks for telling me that's it for today's episode of authorization in software thanks for tuning in and listening to us if you enjoy the show be sure to subscribe to the podcast on your preferred platform so you never miss an episode and if you have any feedback or suggestions for future episodes feel free to reach out to us on social media we love hearing from our listeners keep building secure software and we'll catch you on the next episode of authorization in software


And then last is the legends. We are applying legends to the tables and this is not new, but the previous format was displaying the color assigned to the legend to cover all the background of the cell. So that sometimes looked good and sometimes didn't based on the selection of the user and yes we can play with contrast, but it's not always useful and we were also not taking or making yeah using the whole space of the screen. So this is how the legends look in 2.6 and the way they look in 2.7 in this version that we are releasing is this. So we are keeping here the true color that the system admin has assigned to this legend section, but for the background we are always applying a light version of it. So we don't have problems with displaying the text color and the background color.


Hello friends, I am Mr. P. P. Mitra Guthri, Associate Professor in Department of Mechanical Engineering at Vulture Institute of Technology, Sholapur. In today's session, we are going to understand design of drawing die for a given component and in that also we are going to study only up to decision of number of draws required for a given component, because our drawing die design procedure will be lengthy which cannot be completed in one session, outcome for this session will be, students will be able to design a proper die set for a given component. Now next is, first of all we will understand what is a drawing and what is a drawing die. Drawing operation is carried out for manufacture of cup shaped components which are cylindrical or if we have to carry out a tapered cup, we can also suggest drawing operation. In drawing operation we are using a tensile force and we are using a punch and die set by which we can carry out forming operation and in this drawing operation you can observe that our sheet thickness is not an alter, not altered. We are only carrying out drawing into we are only carrying out physical change or change in the change in component in two dimensions that is very essential and for this particular component having 50 mm diameter and 45 mm height and corner radius of 1.6 mm we have to design a drawing die and this component is to be drawn in a material EMS having sheet thickness of 1 mm and yield stress given is 500 Newton per meter square. Now next part of design will be calculation of blank diameter for calculation of blank diameter we require to know the diameter of cup, height of cup to be drawn and corner radius and blank diameter capital D is decided by small d that is diameter of cup to be drawn divided by corner radius R. Now in our case diameter of cup to be drawn is 50 mm corner radius is 1.6 mm and 50 divided by 1.6 this ratio is much much greater than 20 as a result of which we are able to use the formula blank diameter is equal to square root of small d square plus 4 into small d into h where d is diameter of cup to be drawn h is height of cup to be drawn therefore blank diameter d is 50 square plus 4 into 50 into 45 mu that is square root of 11500 which comes out approximately to be 107 mm this is a theoretical blank diameter. Now the blank drawn has the edges to smoothen the edges and for that we have to carry out trimming operation that is cutting operation of the edges after drawing it is absolutely necessary otherwise our edges will be very sharp therefore every 3 mm per 3 mm per every 25 mm diameter of cup has to be added in theoretical blank diameter. Now our cup diameter is 50 mm therefore we have to add 107 mm plus 6 mm therefore our actual blank diameter has to be 113 mm that is 113 mm and we will refer actual blank diameter as a capital d now next step is calculation of percentage reduction required for drawing a cup no doubt we are drawing a cup from circular blank and this circular blank is to be transformed into cylindrical shell now our circular blank diameter is 113 mm and cup or shell diameter is 50 mm and this shell diameter outer diameter of the shell is 50 mm and inner diameter of shell is 50 mm minus 2 times the sheet thickness that is 48 mm so our percentage reduction calculation depends upon blank diameter cup diameter and we have to calculate it by the formula blank diameter minus cup diameter divided by blank diameter into 100 that is into percentage now blank diameter is 113 mm cup diameter is 50 mm therefore our percentage reduction required will be 113 minus 50 divided by 113 into 100 which will come out to be 63 divided by 113 into 100 which comes out to be 56 percent generally 45 percent reduction is permitted in the first draw not more than that 40 to 45 and in second draw around 30 to 35 percent reduction is possible or permitted in the second draw and our percentage reduction required is 56 percent it means that it clearly implies that to draw this cup in single draw is not at all possible because our percentage reduction is 50 is required is 56 percent therefore it is all confirmed that more than one number of draws are required to draw a cup in a given sketch in a given problem I think you are getting it next now I will pose you one question that is will you please tell me why percentage reduction in consecutive draws is reduced now we will calculate actual number of draws this required for that we have to decide a draw ratio draw ratio is h by d that is high top cup divided by diabetrop cup now there is empirical relation between number of draws and draw ratio if our draw ratio that is h by d ratio is up to 0.7 one draw is required if our draw ratio or h by d ratio is between 0.7 to 1.5 more than one draw and that is two draws are required and if our h by d ratio that is draw ratio is between 1.5 to 2 to 3 that is three draws are required and if our h by d ratio is 3 to 5 number of draws required will be 4 in our case height is 45 mm diameter is 50 mm so h by d ratio that is draw ratio is 0.9 so number of draws required for drawing the cup in our problem is confirmed to 2 that has been completely decided now references for further references for further reading I will ask you to read a book a textbook of production engineering by PC Sharma a book by Donaldson tool design named tool design and press tool design by indo german tool room avrangabad thank you