Hello everyone, thanks for joining this talk, especially so early in the morning. My name is Emmanuel Bouillon, and I'm going to discuss with you today some security issues that you might have to cope with when dealing with federated identity. And more precisely, I'm going to discuss a specific type of federated identity which is a SAML-based federated identity. So first, I'm an infosec guy, and more importantly, everything that I'm going to say today expresses only my own view, my own views, and especially do not involve any of my previous, current, and future employers. And everything is provided for educational purpose only. Ok, so that being said here is the outline of this presentation. It's made of six parts. First, an introduction, what is it about and why should we care. In the second part, I'm going to discuss what is the problem we are trying to solve and how have we been doing it up to now. And then in the third part, I'm going to introduce some, not all, but some of the standards and specifications around the federated identity area. I'm just going to give the minimum material so that everybody will have in mind what is needed to take the most of the rest of the presentation. And the rest of the presentation is going to be made of two parts. One is how can we adapt classical web application scanner in order to have them to better cope with the SAML-based, SAML-protected web application, web applications. And in this part, I'm going to illustrate how the type of results that these kind of tools can provide. And in the last part, I'm going to present and to discuss some security considerations and issues that we need to have in mind prior considering joining or creating such a federation. And finally a conclusion. So let's get started. So SAML stands for Security Accession Market Language. And this talk is about SAML token and claims-based identity and access management. So I'm going to take a radically low-level approach of this protocol. That means I'm not going to discuss the API provided to developers in order to implement this kind of protocol. Maybe you're familiar with Windows Identity Foundation API, which is the .NET API that allows developers to somehow transparently integrate SAML protocols in their applications. So I'm not going to use this kind of level of abstraction, but I'm just going to look at the lowest level of those protocols. And also this presentation is not about a consistent and formal study of every involved standard. I'm just going to cursorily introduce two of them, but you'll see that that's enough to get some interesting results. So basically the approach I've been using is some sort of standards reverse engineering. Basically find vulnerabilities and then go back into the specification and see why something got wrong. So what are going to be the takeaways of this presentation? First tools, adaptive tools in order to have a classical web application scanner to better cope with SAML protected web applications. Then I'm going to demonstrate an assumption which is that involved standards can be read as an attempt to circumvent the same origin policy. I'm going to show a demonstration about that. And finally some important security considerations that you might have in mind before joining or creating such a federation. So why should you care? The thing is that the protocol and specification I'm going to discuss in this presentation are getting more and more prevalent. Actually many influential major industrial players are currently pursuing the development of SAML-based protocol to achieve federated identity management. And also it's support of the federation that makes SAML particularly suitable for cloud deployment as to why it's getting ubiquitous. So whether you like it or not, it's coming your way. And the last point is that depending on the context of deployment you're considering being business to business, banking, government for tax payment for instance. This kind of deployment and associated security issues might entail some very thorny contractual, legal and even privacy issues. That's why it's important to take care of that. So now where do we come from? What is the main problem that this kind of standard tries to solve? Let's say that the single sign-on solution or issue within a single domain has been solved now for a while. So initial solution for this single sign-on problem in a single domain were very efficient from an administrator point of view but maybe not that satisfactory from a security point of view. Maybe some of you still have in mind some yellow page solutions and NIS systems for instance. So that was very interesting from an administrator point of view but maybe not that interesting from a security point of view. But today this problem has been solved by more robust protocols like Kerberos for instance. Kerberos is a protocol you use very commonly to solve a single sign-on issue within a single domain. Typically that's what you're using if you're using active directory environment. The thing is that now we need to solve this single sign-on solution but between organizations, between different domains and that's typically what SAML tries to solve. So the goal is to have a user and administrator friendly cross-organization boundaries single sign-on. So here I'm going to focus on web applications. So that needs to be secure, scalable, easy to manage and ideally taking care of privacy and anonymity issues. So this problem is not new and of course previous solutions have already been deployed. Usually these solutions rely either on duplicating user accounts, user accounts more or less intelligently or by establishing trust relationships between security domains, typically Kerberos trust relationships between active directory domains be it unilateral or bidirectional trust relationships. And of course these type of solutions come up with some drawbacks and that's this kind of drawbacks that SAML tries to solve and to tackle. And also regarding the problem of privacy and anonymity some previous standards have been defined but never really been deployed nor widely adopted. So what do we need to know about federated identity standards? So in this part I'm just going to give a very, very high level view of some of the involved standards around federated identity. So here you have a diagram that shows the complete ecosystems of specification around federated identity. As you can see there are quite numerous and most of them are supported by an organization called OASIS, the OASIS Consortium which stands for Organization for the Advancement of Structured Information Standards. So I'm not going to discuss all of them but just to introduce two of them. So first the SAML specification which in fact it's a set of specification itself and secondly the WS Federation specification which basically describes how to orchestrate flows in order to achieve this multi-domain single sign-on solution. So let's start with SAML. SAML stands for Security Assertion Markup Language and basically it consists of of building stone components which once put together allow a given number of use cases to be supported and these components primarily allow the transfer of identity information like authorization, attributes and so forth between autonomous organizations that have an established trust relationship that's the primary goal of SAML. And there is also something you need to know if you start looking at this kind of specification and document that's the fact that there is there are some terms which have a specific definition in this context so it's better to know their definition. So basically you have SAML assertions, SAML protocol, bindings and profile. So SAML assertions, I'm going to go back to that later but typically it's a signed XML document which contains statements about principle, a user for instance, that given a certain party claims to be true. SAML protocol are basically the description of requests and response that are needed in order to obtain or to submit a SAML assertion. And SAML bindings are the mapping between SAML protocols and other layer of transport protocol like typically you have bindings for SAML and SOAP, you have the HTTP redirect binding and the HTTP post binding. And finally you have what they called SAML profiles which basically is the combination of assertions, protocol and bindings in order to support a given number of use case of federated scenarios. So within the standard there are several profiles defined like the web browser SSO profile or the single logout profile. I'm just going to mention two of them during this talk. First the web browser SSO profile because that's really the most common use case, the most widely used use case regarding SAML specification. And the second one is identity provider discovery profile. I'm going to mention this one because actually it is prone to some security issue. So what are SAML assertions? So as I said, SAML assertion is a signed XML document containing claims or attributes about a user. And it's a set of claims contained in SAML assertions that define the identity in regard to what we call the reliant parties, that means let's say the web application. So what you need to have in mind also is that these claims do not need to be distinctive for this user. It doesn't have to be a login name for something like that. It can just be a statement like yes this user has paid his monthly fee for the public library or yes this user is over 21. So here is how it looks like. So it's a, with no surprise, it's a signed XML document which follows the XML digital signature standard. So you get information regarding the issuer, regarding the signature, how it has been computed, etc. You get information about the subject. And more interestingly, you get information about the attributes contained within this SAML assertion. And typically in the enterprise use case, these attributes are obtained from an enterprise directory that can be a group membership, yes this user has this role in my organization or yes this user has this email address in my organization. And as you can see above, there is also some specific attributes that can be of interest, like the audience attribute. So the audience attribute is basically a statement that says for which reliant party this SAML assertion has been made of. So that's interesting because that allows to prevent some SAML reuse attack. But for this to be effective, it needs to be taken into account by the reliant party side of the implementation. And as we'll see later, it's not always the case. So implementation do not verify that. And that's obviously a security issue. So how is SAML used? SAML is standard based, so widely supported and supposedly interoperable part include xml encryption, xml digital signatures and x509 certificate. It heavily relies on HTTP for conveying the SAML assertion through the network that easily goes through firewall. There are several ways or types of deployment. It can be deployed in a local network. It doesn't have to be in a federated environment. It supports branch offices deployment. It supports users to access the corporate network. But also, and more importantly, it supports federation and the federated scenario. And I'm going to discuss that more into detail later. Into more detail later. So basically the idea is to have a nice, neat, cross domain single-signal solution so that our beloved users are happy with their experience. So how does it work here? I'm going to focus on the web browser SSO profile. Basically it's a four steps process. First you have your user who request access to claim the web application and at this request do not contain any SAML assertion. The web application is going to redirect the web browser to the user's identity provider using the HTTP ROCCORD 302. And at this point the user's identity provider is going to authenticate the user one way or another. We don't have to know the type of authentication that is going to be used at that point. It can be providing a login password or just using the corporate single-signal solution, typically Kerberos-based. So once the identity provider has authenticated the user then the identity provider is going to build a claim with appropriate attributes inside and sign it and send it back to the user's browser with an HTTP post form with an auto-submit request to the web application. So that's how it's going to be transparently, this SAML assertion is going to be transparently sent back to the web application and as this web application is claims aware it's going to grant access to this user according to the SAML assertion. And that's how you achieve the single-signal solution so that our user are happy with that. And that's really interesting from an administrator and developer point of view because in fact from the web application side you don't have to know and to deal with what kind of authentication mechanism has been used. So the corporate environment can completely change the way authenticated the code so that the web application still remains the same. That's what makes it really interesting from a developer point of view. So now you could say so what because indeed ok we have a single-signal solution for web applications but actually there are other ways to achieve that. Typically you can use espinigo over GSS API with either Kerberos or NTLM as a security underlying so the main actually the main idea for that is that it supports federation that is the sharing of identity between domains what they call in the specifications the multi-domain SSO issue. It also supports delegation that's the maintenance of identity to backend services and also it provides an enhanced access control which we call role-based access control. It provides a finer granularity regarding how you can provide access control to your web application. So that's it for SAML so the second standard I wanted to introduce here is the WS federation standard. WS federation is an approved OSD specification that defines mechanism to allow different securityism to federate. So what does it mean? Basically access to resources managed in one realm can be provided to users or principles whose identities and attributes are managed in other realms. So that's how you guarantee the fact that users management stays on the side of their own authoritative domain. You don't have to bother about users management of other domain. So that's why it's really interesting and also it includes mechanism for brockering of identity, attribute and authentication between realms et le développement. En termes de la specification la dernière chapter est sur la considération de sécurité. C'est une petite chapter, c'est une page. Et la dernière boulette de cette chapter est sur les services compromis. Je vais vous dire que je vais revenir à ça et voir comment cette considération peut être une issue selon la manière dont vous considérez. Donc ici c'est ce qui commence par avoir votre web browser, votre client connecté à l'application web. Comme vous n'aurez pas à propos d'une claim de cette application, elle va vous redirecter à sa propre identité de provider. À ce point, le domaine de l'antide de l'antide de l'antide sera redirecté à l'antide de l'antide de l'antide de l'antide de l'antide. À ce point, l'antide de l'antide de l'antide de l'antide sera redirecté à la même dramatik de l'antide de l'antide dans un site de service de l'antide de l'antide. Et si ce soit authentiqué, l'identité de provider sera redirectée sur des attributes d'une entreprise directrice planif, signé et senté chez l'adjecteur en utilisant un direct poste pour être redirecté à l'identité de l'antide de l'antide attributes within the claim, sign it back, sign it and send it back to the web, to the web browser with a post redirect to the web application. At that point, the web application which is going to receive this signed claim, this claim, this claim is signed by its own identity provider, so it's going to be trusted and according to attributes contained in this claim it's going to grant access to its resources. So that's basically how this multi-domain solution at the very high level is achieved. And just to be complete, just be aware that they are, okay, I've just introduced a very simplest use case, but there are more complex architecture supported by the standard and the specification. And like typically what they call the procured federation model which basically is when you have a centralized identity provider which is destructed by many others. And also please be aware that users can be, can have several identity providers depending on its context. And that's in some sort, the user can have several identity and doesn't only have to trust one identity provider. So that's it about the introduction of the standards. Just to be complete, I've just added a list of what I consider as important security study, preview security study on that domain. So some security issue has already been discovered in regarding SAML. So either regarding SAML standards themselves or regarding some of their, of SAML implementations. So now that's where things are getting interesting. When you look at the complete, within the complete documentation of OASIS regarding SAML, there is one document called SAML technical overview. So it's still a draft, but basically that's in the document where they explain all the rational behind SAML. And what is really interesting at that point is that the really main driver, and that's how it is written in the document. The main driver for SAML is the limitations of browser cookies. And it's written like that. Typically browser cookies are never transmitted over DNS domain. And basically, when you read that, you have the things that they consider that's quite sad. And SAML solves this problem. So of course, the multi-domain signal solution is relevant and a legitimate issue to be solved. But on the other end, if browser cookies do not fly between DNS domain, there are good reasons for that. And basically it's part of the same origin policy. So from a security point of view, what I mean here is that we could read that as, okay, soaps sucks, let's build a workaround. So from a security point of view, these kinds of considerations of rational has a great potential for security issues. So the question is, is it a fail or not? Typically, can a bad guy steal cookies? So I'm going to provide the response later, so you need to be patient. To conclude with this part, just a few words regarding implementation security. Typically, for implementations I've been looking at, like a DFS, Schiboleth, or simple SAML PHP, there are some good aspects, like the fact that by default, tokens are encrypted. And by default, also replay attacks are properly addressed. So you might also meet some problems regarding the compliance with the standards, like the fact that unsigned logout request gets accepted, or the fact that the targeted ODN attribute is not verified. And finally, you also have some implementations which have some vulnerability. And I'm going to demonstrate to two of them an open redirection vulnerability and a cookie leak or cookie theft within one implementation. So before that, I'm just going to explain how to adapt our classical web application scanners in order to have them to properly cope with SAML protected web applications. So regarding our tool set, I think that these considerations have already been mentioned this morning by the presentation of related to SOAP and how to adapt web application scanners to better access web service based on SOAP. So, but typically, web application scanner tool set is made of several kinds of combinations of different tools chosen by more or less objective criteria. So typically, it can be made of professional or community edition of commercial tools, like web inspect, analytics, and others. You can use free and open source software for web application scanning, skipfish, Necto, and typically some Firefox plugins also. And also, very often, when you discuss with people doing that for a living, they very often use their own homemade custom scripts that they have been developing throughout their experience. Regarding methodology, it's a little bit of the same. Suppositely, some more or less formal procedures are supposed to be followed. You can rely on some generally accepted best practices, like the OWASP testing guide or the OSSTMM framework. But finally, it's always heavily relies on habits and personal preferences. And also, still many manuals ad hoc and improvised steps are needed. So that's why I think we still need to adapt our tool set. Even though if some great presentation regarding how to do web application assessment states that we should not be a tool, the only tool we need is our brain, I still think that properly using the right tool often makes a difference, especially because usually it's a time constraint exercise. And regarding SAML, there are two reasons to adapt our tool set, the fact that it allows a traditional assessment of web application scanner to cope with SAML tokens, to assemble protected web applications. And also, these kind of applications and their security, they often relies on very complex configuration settings. So these configurations are prone to error and we need tools to assess that the good configuration settings are effectively in place. So the thing is that there are already some existing tools that can help the web application scanner, the web application pentester when they have to cope with SAML. So I've listed some of them here, at least all those I know of. So you've got the Uninet SAML tracer, which actually is a Firefox plugin, which allows you to see decoded SAML tokens that your browser is receiving and sending. You have the SAML debugger, the Finder SAML debugger, it's an online application that allows you to submit tokens, either encoded or decoded, and then you receive the answer, which is either decoded or encoded. And the last one is a really interesting one. It is provided by the Un3 Identity Federation, part of their initiative called Federation Lab. Basically, it's an online automated checks of service provider implementation. So if you have a SAML implementation of the service provider side, you can trust the Federated Lab STS, and then online ask a scan of your implementation, and then you're going to get a result of how compliant is your implementation regarding the standard. So I'm going to show you the result of this kind of scan just later. And of course, you can always use a manual approach to encode and decode SAML tokens. So here, you can see an example of a report from a Federation Lab service provider tester. So I've just installed an out of the book Hello World application using Sybil-Sable PHP, which is one implementation of SAML standards. So the good news is that you have many success, so that means somehow some compliances with the protocol, but you also get some errors regarding these compliances, like the fact that, indeed, single logout, unsigned single logout requests are accepted, and that the targeted audience attribute is not checked by the service provider side, which is, in fact, a security issue. So we still need to adapt our tool set, and there is one area where this application is proved to be very, very useful. It's when encoding and decoding SAML tokens, and the gain of this encoding and decoding touches several parts of the assessment of the efficiency of the web application scanner. First, having access to, clear to this SAML token, or having access to the SAML token decoded, allows you to really, more accurately understand the meaning of all these requests and what these tokens are made for, what are the attributes involved, for which redine parties, so that helps understanding what is going on.  So, here is the approach I've been using. So, it's not a new approach, because typically it has already been used by people from JDS Security when they have been assessing the Microsoft proprietary binary encoding of SOP request for WCF. So, the idea is to chain proxies. So, first you have a preprocessing proxy whose role is to decode requests and encode responses. The middle proxy is actually your real scanner when you do your real assessment and when your intelligence takes place, and then you have the post-proxies which encode the request back and decode the response back. So, this way the application still receives the request in the proper expected format so it can work properly. So, to implement that, I've been using BERT ProSuit, so I guess most of you know this web assessment tool. It has a very, very good cost-benefit ratio. And what is really interesting with this tool is that it provides a Java API to extend BERT ProSuit functionalities and it's particularly suitable for pre and post-processing. And also, there exist some bindings both for Python and Ruby. So, I've been using the Ruby framework to extend BERT ProSuit which is called Ruby. The complete tutorial has been presented and is available on the net. And for this kind of tool, you only need to hook either even proxy message or even HTTP message. So, the proof of concept I've been developing is freely available at this URL and you can use and test it basically to retrieve all the results I'm going to present now. So, I'm not going to discuss the code itself. I'm just going to show you how it looks like. So, here is a pre-processing proxy which receives the initial browser request so as you can see or maybe you can just guess that you see a sampled token a non-coded sampled token so very difficult to understand. And this pre-processing proxy is going to edit this request and decode the sampled token. So, now you have in the edited request the complete decoded sampled token which is sent to your real proxy which is actually your real web application scanner. So, typically, if you're using Burp as a middle proxy then you can send this request to Burp intruder for instance to have specific parameters to be mongled with. And at that point the middle proxy is going to send this request like that and to the post-processing proxy which will receive the decoded token in clear if you want and then post-processing proxy is going to encode the sampled token back to the appropriate format so that it's going to be sent to the application as it expects to be sent. So, that's basically how it works. So, I'm just going to illustrate some results you can obtain using this approach. So, I've chosen two results to illustrate these tools. And I've chosen these two because actually these results and these vulnerabilities are more standard related to standard and specifications themselves than related to implementation. So, that was more interesting and more fun to discuss these two vulnerabilities. So, the first one is an open redirection. So, an open redirection is just the fact that you can craft a request so that the target is going to respond with a redirection to another site which is controlled by the attacker. Right? So, it's not critical and as you're going to see, it's somehow built-in in the sampled standards. And then I'm going to illustrate how this can lead to a cookie theft that means that we are going to be able to make cookies fly between DNS domain using these kind of vulnerabilities. And secondly, if you visit this site a bad guy can inconspicuously discover your identity provider that means what is your originating organization. So, that's at least a privacy issue. So, to demonstrate that I've been leveraging an existing live open to everyone test environment which is provided by the user domain account. And the cookie I'm going to steal actually is htpsopenidp.fighter.no So, what you're going to see is a complete four-step sampled authentication. And then you'll see how a bad guy can just steal this cookie. So, it's a three-steps process. First, the victim accesses un site contains a craft get request to the service provider which will actually leverage open or redirection to get back to send back the cookie to its own control website. So, to make it more visual this redirection will not go to the bad guy website but I've crafted Google search request using as an argument the cookie so that you can see that indeed the Google search request. So, let's see. So, at the beginning you're going to see that this is the only just the open redirection vulnerability. So, I don't know if you see anything but basically here you see that it's a get request that goes to openidp.fighter.no and when you click on this link you're going to be automatically redirected either to Google or to DevCon website. So, that's Google redirection then you have the same thing with this request goes to openidp and gets redirected to DevCon. So, that's just the open redirection vulnerability, so nothing very critical but then, let's imagine that your user is connecting to a service provider that use a SAML and openidp it's identity provider. So, here this is a service relying party on id.net I choose my identity provider then automatically I get redirected to my identity provider I need to authenticate, so here by using a login password and then you'll see that this identity provider is going to craft a SAML request and send back to the application so that I get authenticated so that's the four step process you know, you have been describing and now I choose a link you'll see that the redirection end up with the theft of the cookie right? So, that's the demonstration I hope that's clear so that's how you can steal a cookie and make cookie flies between DNSDOM using this kind of vulnerability so the thing is that actually if you go back to the standard implementation issue but more specification issue because it comes from the identity provider discovery service profile and actually it's built in the open redirection, when you look at the standard it's written like that the open redirection is in the specification and actually when they wrote this specification they somehow felt that there was a kind of issue this is a quotation of the standard this protocol has the potential opportunity for phishing so at least they were aware that it was dangerous and they propose the worker round based on the service provider metadata but it's only should worker round and there's no way they don't explain how we could exchange between the service provider and the discovery service so basically the developer have just implemented properly the standard and they get vulnerable so that's what I wanted to show you about this part and the last part is about question regarding the design of consideration about the deployment and trust apologies so as you remember this is the simplest use case of federation scenario so you have two organizations with a trust relationship but of course you there are more complex there are more complex deployment scenario does it really does this kind of deployment implement new risk it's a contentious issue but basically other solutions are not that more secure so that's to be simple that's what we can say about that so here is a very simple deployment scenario you have one organization which try to access another organization application and the access control is based for instance on the user's email address so and typically what happens in real life is that you have several domain organization B as several customers accessing its application so now the question is what if one of the organization gets either malicious or compromised typically what if organization C sign claim for a user of organization B the thing is by default if you installed everything by default that means that your application is going to grant access regarding the attribute which is in the claim because from a signature point of view everything is fine so you need to implement yourself all the business checks at that point that will prevent this kind of attack to be working but that's not you need to do that that's not implemented by default but at least in this simple scenario you can do it and more realistic scenarios where it's getting more complicated typically when you have an indirect trust relationship where you have a central trust broker that convey trust between organization so at that point, so here is how it works you've got one organization which trust organization D which then is trusted by organization B so and then you have this single sign-on solution that's worked perfectly will find the same way flowing between these three organizations organization C sign the claim for a user which is not part of its organization let's say, what if organization C gets either my issues or compromised the thing is in this case if organization D do not do his job by checking everything that needs to be checked and which is not done by default then organization B has no way to see the trick and to see that things got wrong so if the STSD sign the token then STSD has no way to see that something went wrong so that means that in fact organization B fully relies on organization D to properly check some claims but so that means then what is the policy for that do we have a way to verify is auditing permitted etc and how to prove other parties compliance with relevant requirement so that typically the questions that are usually answered so the bottom line is what about the mal issues or compromised ADP in a federation and can a mal issues ADP impersonate another domain users that's really the main bottom line issue is there any safeguards in place business set that prevent that and who own this safeguard do you as an organization own this safeguard or do you use this kind of safeguard so that's in fact because when you look at implementation by default these safeguards are not implemented and if you get back to the standard then fail actually this kind of consideration has just been cursorily mentioned in the bullet I mentioned previously which is the compromise services and indeed they recognize that this is really a very major issue but on the other hand in practice it works by default and there are no proposed solutions on how to prevent that so in the case of a third party broker trust you need to control the loss of controls who's availability is involved etc what are other parties obligations and that's the concept I've called some old claims laundering so all relies on a teacher level this must be done since default settings are permissive so typically ways to do that is to have key attributes which are kept adding to avoid the turning situation into a blind trust to this organization part and the thing is also on main federations when you join a federation usually you don't have access to this policy you don't know exactly what checks are in place and that's an issue so that ends up this presentation so the main takeaways of this presentation are first knowledge and tools to keep on properly assessing SAML protective web application how to adapt the tool sets classical web applications tester a tool set to cope with SAML protective web application then proven assumption the fact that standard can be read as an attempt to circumvent the same origin policy so you've got the tools and process to go there and also important security design consideration the thing is that without taking care insecurity by design is possible and typically when you have cross domain trust relationship with active directory for instance if one domain gets compromised the domain cannot impersonate other domain users whereas with SAML indirect trust implementation it's possible by default so we need to take care of that with SAML cross domain by default this kind of situation will occur of course this approach applies to other form of delegation of a federation these field developers and marketers are ahead of security guys yet default security thing are not secure so the make it working approach might lead to insecure deployment and that's why we need to keep up with this kind of protocol to avoid big deployment security failure and post mortemly discover that there has been an issue so we need to get acquainted with the involved protocol to assess the design and the deployment of such a federation and also adapt our tool set because probably bad guys will and very probably also that would be helpful to have better guidance or improve standards on how to protect to avoid this kind of issue because today it's really relies on diligent administrators and developers to implement these checks if we had a common way to solve this kind of issue then even in term of assessing it could be far more easier I guess that's all I have for today so I'd like also to thank one of my great colleague which is called Rui Fisk for his great help and extensive knowledge ensemble and if you have any question I can try answering them now or I will be in room 2 Q&A thanks a lot for your attention


J-E-L-L-O. The Jell-O program coming to you from Hollywood, California, starring Jack Benny with Mary Livingston, Phil Harris, Dennis Day, and yours truly, Don Wilson. The orchestra opens a program with goodbye Broadway, hello Figaroas 3. Today, ladies and gentlemen, those big red letters on the box mean twice as much as they ever did before. For today, the name Jell-O not only means America's favorite gelatin dessert, it also stands for those rich, creamy Jell-O puddings. Jell-O puddings are so downright delicious and so quick and easy to make, they're winning new friends every day. With Jell-O puddings, all you have to do is add milk, bring to a boil, and pour into sherbet glasses to cool. And there, almost before you know it, you've made the family a smooth, creamy pudding with a mellow flavor so grand that it outrivals any other pudding you ever tasted. So the next time you ask your grocer for Jell-O, ask him for Jell-O puddings too. In all three flavors, chocolate, vanilla, and butterscotch. And when you buy, be sure the name Jell-O is on the package. Jell-O is a trademark, the property of general foods. And it identifies two of the finest desserts that ever graced the dinner table, Jell-O and Jell-O's creamy puddings. Street play by the orchestra. And now, ladies and gentlemen, it is with great pleasure that I bring you a man with whom I have been associated for many years. A man whose friendship and thought- Hold it, Don, hold it. We've got a long play to do tonight, so you needn't bother with the introduction. But Jack, I had a very special reason for wanting to- But Jell-O again, this is Jack Benny talking. And, Don, I'm sorry I had to rush you like that, but as I said, we're doing a very important play tonight, Tobacco Rose. And I'm anxious to get into it. Did the rest of the gang get here yet? Don, did the rest of the gang get here yet? Who cares? What's the matter with you? I simply asked if the gang got here yet. Well, if they mean more to you than I do, I'd like to tender my resignation. What are you talking about? Well, just this. The reason I wanted to introduce you tonight was because I wanted to tie it in with my eighth anniversary. Your eighth anniversary? Yes, I've been on this program eight years tonight, and the least you could have done was to acknowledge it. Oh, so that's it. Well, gee whiz, congratulations, Don, and many happy returns of the day. Thanks. Well, what do you know? It's your anniversary. I'm sorry it slipped my mind. Say, I wonder what happened to the rest of the gang. It slipped his mind. What? That's fine treatment. After I've worked and slaved and given you the best years of my life. The best years of your life? For heaven's sake, Don, we're not married. Jeepers, you think I was the husband and you were the little woman?  I don't think it's unreasonable to talk about my anniversary. All right, let's talk about it.  Well, if you hate me, come right out and say so.  Now, put your lips in and behave. And stop laughing when you're supposed to be mad. Now, the reason, now the reason I asked about the gang getting here is because I want to start casting tobacco roles. I think we've got a swell play for tonight. It happens that my writers are very illiterate, and this hillbilly, this hillbilly stuff is right up their alley. Yes, sir. Don't expect me to laugh, brother. Who asked you to laugh? I merely said my writers are a couple of hillbillies, and that's the truth. Oh, why don't you get writers that are educated? Don, if they were educated, they could read and if they could read, they would never have signed their contract. I got Phil Harris the same way. Oh, hello, Mary. Hello, Jack. Oh, hello, Don. Congratulations on your eighth anniversary. Thanks, Mary. I'm glad you remembered. Might it be nice to find out who your friends are? Don, I'm your friend, believe me.  That's all. Oh, yeah? Yeah. Now, look, there are only two ways out of this, Don. You can either accept my apology and I'll buy you a lovely present, or I can kill myself. Now, which do you want? Which is easier for you? Well... I'll be darned. He's thinking it over. Just thinking how silly you are, and Wilson too. Well, I don't blame Don. He never forgets your birthday, does he? Nobody forgets it. How can you? Every year I send each one of you a telegram. Don't forget Jack's birthday, a friend. It's lucky that I'm sentimental or I wouldn't get a thing. Why, Jack, you even send us telegrams two weeks before Christmas. Well, certainly those are just holiday greetings. Some greetings. Merry Christmas. All the stores know my sizes. I don't remember sending anything like that, and if I had, it would have been funnier. Anyway, I'd be much more subtle than that. Oh, you're about as subtle as a two-dollar toupee. Now, let's analyze that little remark with the anniversary. In the first place, you can't get a toupee for two dollars. They cost a lot of money.  Never mind. Remember that windy day? Now, wait a minute. That thing I grabbed that was rolling down the street was not a toupee. It was a bird's nest. Well, let's see if y'all must have made it. It had a wave in it. All right, forget it. Now, Mary, I asked you to be here early tonight because I want to get going with tobacco rolls. Of course, I'm going to play the leading role, Jeter Lester. Why can't I be Jeter Lester? It's my anniversary. Don, you can't be a hillbilly. If you ever took your shoes off, your feet would spread out clear across the stage. Now, Mary, you're going to be my wife, and we have 18 children. 18 children? What are you laughing at? You can write anything. That's the play, and that's the story. Now, let's see. Hi, you Jackson. Here I am, Brighton Early. Well, I might know you've been on time tonight, Phil, as hillbilly-stuff as you're me. Yeah, you know my mammy and Pappy down in Tennessee are listening in tonight. I just sent them a radio. Thought you'd send your folks a radio over a year ago. Well, I did, but Pappy spilled a drink on it and it ate the dial off. Well, there's an ape that Wilson can't tie into. Say, where's Dennis? I told him to get here. What'd you say? I said, where's Dennis? Thanks, Phil. I said, where's Dennis? I told him, I told him to get here early tonight. Oh, I've seen the kid. He's across the street shooting pool. Shooting pool? Why doesn't he get over here? Well, he was making a tough shot, and he got his foot caught in the side pocket. What? Imagine he's paying 60 cents an hour just to lay him there. Well, that's the case. You might as well play your band number, Phil.  I'm tired of that place. I've been sitting up pinned there all morning. You have not.  All right, hit it, Phil. Hold on a minute. Come in. We're here again. We're very upset. Well, what do you say? Are we going to be fired or not? Yes. We've been waiting for a long time. Benning, get the money right away. Well, I told you last week. Tomorrow. Tomorrow. Play, Phil. All right, boys. Adios, William Machacho. Adios. My goodness. Well, that was Frafula's reference. Played, played by Phil Harris and his lovely orchestra. Lovely being as close as we could get to the word that was blue pencil at rehearsal. And now, ladies and gentlemen. Now, wait a minute, Jackson. Now, we should lay off on my boys. They're high-class artists and they're commencing to resent it. High-class artists? Yes. Phil, I'd like to throw a cigar away just once. Without having one of those high-class artists grab it on the first bounce. They're all down there on their hands and knees. Not my first violinist. No, he's proud. He's got a nail on the end of his bowl. Seriously, Phil, I wish you'd speak to your boys about that habit. It embarrasses me. Well, I will, Jackson. Hey, fellas, no more smoking cigars unless it's their maiden boys. Well, at last, we're on the right track. All right, Don. At last, we're on the right track. Sorry, Jack, I'm not going to do that. What? Don, at last, we're on the right track.  I'm not going to read the commercial unless it ties in with my eighth anniversary. Don, I'm not going to argue with you.  At last, we're on the right track. Oh, keep your old track. All right, then I'll read it. Mary, give me the lead. Okay. At last, we're on the right track. Ladies and gentlemen, you are always on the right track when you ask your grocer for a package of tempting and appetizing jello. But even though you are on the track, don't let him switch you to another brand. Boy, is that obvious. Quiet. So remember, folks, always insist on genuine jello. And look for the big red letters on the box. Yeah. No matter how awful, Don, I'd kick you right in the pants if you could feel it. Personally, I think that was a very clever commercial. And now, folks. Hello, Mr. Benny. I'm sorry I'm late. Well, I wanted to hear early tonight, Dennis. Are you all set for Tobacco Road? This ain't sense, then, I'm chewing. Dennis. Boy, am I sick. You ought to be ashamed of yourself, the idea of chewing tobacco just because we're doing a play called Tobacco Road. Well, I'm such a lousy actor, I figured anything would help. Dennis, we don't use that word on this program.  L-O-U-S-Y. Lovely. Then I ought to get more money. Look, bud, make off like I didn't correct you. Anyway, Dennis, in our play, you're going to be Dude Lester, my son.  Well, oh, her. That must be the actress I hired to play the part of Ellie May, my daughter. Are you looking for me, Miss? I sure am, kid. Well, look, Miss, uh... Noodleman. Heather Noodleman. Oh, yes, I saw you in your latest picture. Puppets of passion. Wasn't I lovely in that? You certainly were. Now, look, Miss Noodleman. Just call me Heather. That's Heather. Heather. It's Heather from where I'm standing. Never mind. Now, look, Miss Noodleman, you're not exactly the type I had in mind for our play.  Now, what do you weigh? I beg your pardon? I said, what do you weigh? I don't know. Every time I put a penny in the machine, a little card comes out that says, if you don't get off, I'll scream. That's, uh, that's what I'm getting at. Frankly, Miss Noodleman, you're much too fat. Be careful, young man. I'm a high-class artist. You are? But don't clap your cigar. I will. Well, Miss Noodleman, it's too late, uh... It's too late to make any changes, so we'll let you handle the part. Thanks, kid. However, try and look as hungry as possible. And now that we're all here, ladies and gentlemen, our version of Tobacco Road will go on immediately after Harris and the boys get us in the mood. Go ahead, Phil. Nice going, boys. Now, there's a number they can play. No music. And now, ladies and gentlemen, without further ado, we bring you our feature attraction of the evening, Tobacco Road. All right, fellas, let's get in the spirit of this.  Good. Hey, Jackson, you only took one shoe off. Well, I got a little hole in my other sock, so I better leave it on.  You made us do it. Oh, all right. Mmm, darn it. Oh, boys! Get away from there, Ollie. It's mine. See, our shoes are off.  Must up your hair. I'd rather die first. All right, if you won't cooperate. Well, let's go. Ladies and gentlemen, our version of Daryl Evzanic's 20th Century Fox production, Tobacco Road, set the scene, Mr. Wilson. I won't do it unless it ties in with my eighth anniversary. It does tie in with your eighth anniversary. Look, Don, Tobacco Road is in its eighth year on Broadway. Erskine Caldwell wrote the novel, Caldwell has eight letters. Jack Kirkland wrote the play. There are eight letters in Kirkland. John Ford directed the picture. There are eight letters in John Ford. Not only Johnson wrote the screenplay, there are eight letters in Johnson. There are only seven letters in Johnson. Eight, I borrowed an extra end from Xanix. John... Son! Now set the scene, will you, Don? Please. Oh, all right. Gosh, what a hassle. Music, boys. Tobacco Road a hundred years ago was the scene of the richest cotton and tobacco plantations in the entire South. But today it is a famished and desolate land. The opening scene is the tunnel down shack of the Jeter Lester's. It's a hot summer's day and Jeter is lying on the front porch asleep in the...  Wake up. Stop, I say. Hit me with something. Okay. Thanks, Moles. What do you want?  We ain't ate for a month. Don't worry, Moles. We'll get some food one of these days. I hope so. I'd like to burp just once more before I die. We ain't gonna get that much. Well, there's about time for my nap. But dream of turnips, I'll save you one. Now, Jeter Lester, you get up and go find Elly May and Dude. I ain't seen him since this morning. Elly May and Dude, them's our hogs, they say. No, them's our kids. The hogs move out on us. Oh, that's right.  And besides that, she's a half-wit. Yeah, she sure is smart. You know, Pa, I was wondering, if Elly May is a half-wit, what does that make Dude? I don't know. I never was no good at fraction. He's very happy, though, giggles all the time. Yes, sir. Hello, Jeter. Hi, yes, Jeter. Where's Jeter? He went into Leder. Oh. So long, Jeter. So long, Jeter. Hmm. Who is that, Pa?  Hey, Mo, ain't that our son's dude coming down the road on his hands and knees? That's him, 18 years old. And he never learned to walk. Well, give the kid a chance. Maybe he never thought of it. Hello, son. Hello, Jeter. That's Jeter. The way you shake. A bike, gum, and bike jello. That's a fine way to talk to your poor old pa. Where you been?  What'd you get for it? A dollar and a half, including the car. True deal, son. A hand over the money. I ain't got it. I bought gasoline with it. Bought gasoline? What good is gasoline after you sold the car?  Why you... Leave me alone, Pa. At least we got a can of gasoline. Yep. Now, if we just had a lemon, we could have a cocktail party. Yes, sir. You know, Pa, I saw Banker Wilson down in the village and he said if you ain't got a hundred dollars by tonight, he'll send us all to the poor house. The poor house? What's wrong with that? Go there. He gotta take a bath. Not me. I've had three baths this year already. Get in caught in the rain. Don't count. Does too. I was chewing soap at the time. Anyway, where am I going to get a hundred dollars? See, I got an idea, Ma. Hello, Skeeter. Where you going, Skeeter? Going to buy a heater. Well, you can get one up the streeter. Street here. I had a reach for that one. Oh! I got an idea, Ma. If we can only get our daughter, Ellie May, married to some rich fella, our troubles is over. Oh, I'll be glad to marry a rich fella.  Ma, haven't you never told him what he is? I didn't know.  He's got long pants. Hey, boy! Now go over to that barrel, son, and help yourself with some ice cream. Thanks. Listen, Skeeter, I wish you'd stop feeding our kids cotton. Oh. They know it ain't ice cream. Their gums don't get cold. What's the difference, God Vitamine? Say, what's that coming down the road? That's our daughter. Hello, Ellie. Hello, Ma. Boy, is she thin. Sit down, Ellie. I want to talk to you. Okay. Well, there goes the chair. The only one in this county, too. Too bad. Now listen here, Ellie May. We're up again. The only way out is for you to get married in a hurry. I'm Will and Paul. I chased a man ten miles today. Nice work. I'd have got him, but he took a shot at me. They always do. Say, how about you get married to tWitch Harris? He works at the Wilshire Bowl, and he'd be a good catch for you. Tell me, Paul, do you think I'm his type? His type? Ellie May, that is a general classification if I ever heard of it. Hear that more? Ellie May want to know if she was tWitch Harris's type. I'm his type, and I got a muck cash. There you are. I'll tell your daughter if you play your cards right. Hi, you cheater. Well, howdy, folks. Buy gum and buy jello. Here's tWitch now. Hello, sweetheart. You're looking good, tWitch. I see you've got your banjo with you. That ain't my banjo. I just put strings on the jug to fool them revenues. Well, I'll be dog-gone. Say, tWitch, have you ever thought of getting married and settling down? I do, a lot of times, but a little boom on the morning takes care of that. Well, tWitch, you ought to have a wife. Some of the drag you in off the road at night. You'll likely get run over. Well, maybe I ought to get married. What girl have you got in mind, jeet? Well, there's a few of them around here. First is my daughter, Ellie May. I said Ellie May. Keep it talkin', brother. Now, hold on, tWitch. Ellie May's a fine gal. She's holier than a mud-pen, but she's a wonderful cook. Who cares if I marry her or couldn't eat? Now, wait a minute, tWitch. Ellie May is very affectionate. Give him a kiss, daughter. OK. You come near me and I'll straighten your teeth. Wait a minute. Her teeth don't stick out so far. My hat's hangin' on them, ain't it? Well, that's just plain rudeness. Now, listen here, tWitch. The reason I want- Hello, cheater! Hi, yes, cheater. Did you get the heater? Yep, and you can't beat her. That's good. So long, cheater. So long, cheater!  What you worried about? You got most of it on ya. Well, that's the last straw. tWitch, here, as you get off my property. Get it. Well, what's keepin' ya? Make Ellie May open her mouth. I want my hat back. Yeah, don't, daughter. Dark Vaughn is here already for his money. We better hide. Yeah, let's all get behind Ellie May. Oh, take no use. You might as well face it. Hello, Banker Wilson. Nice day, ain't it? Now, listen here, cheater Lester. I came here for that money and I'm gonna get it. Well, I'll tell you- Tell me nothing. You give me that eight dollars or I'll throw ya out. Eight dollars? I owe ya a hundred. Make it eight. I want to tie it in with my anniversary. We ain't got eight dollars, Banker Wilson. We ain't got seven dollars. And a six. Shucks. We ain't even got five dollars. Have we more? Gosh, no. We ain't been to seros for weeks. That's right. Then get going, cheater.  We're going, Wilson. Come on, Moore. Come on, Ellie May. Hey, dude. Yes, Pa? Get down on your hands and knees. We're a walk into the poor house. I sure hate to leave the old place, though. Hello, cheater. Hello. Have you got eight dollars? You don't need her? Can I marry your cheater? Cheater, she'll be better than that cheater. Here, Banker Wilson. Here's eight dollars. And we're a stand on this land. Thanks, cheater. You're welcome, cheater. Follow on. Version of Tobacco Rule, play twist. In a few months now, along about the end of May or the first of June, cherries will be on the market again. And once more, we'll be able to enjoy their sweet summary goodness. But why wait until June? When all the rich, delightful refreshment of juicy ripe cherries can be yours right now in a big, red, shimmering mold of fruited cherry jello. This grand dessert is an eye-filling, taste-teasing treat that your family will ask for time and time again. And you'll always be glad to make it, too, because it's so easy to prepare. Just dissolve one package of cherry jello in one pint of hot water and chill until slightly thickened. Fold in three-fourths of a cup each of diced orange sections and diced grapefruit sections. Then mold, and there's our mighty swell dessert, a brilliant blend of sweet, juicy oranges, golden grapefruit, and bright crimson cherry jello. So get a package of cherry jello tomorrow and make up this luscious dessert. Cherry jello, like strawberry and raspberry jello, now has a new improved flavor obtained by using a natural flavor base artificially enhanced. And today you'll find it better than ever, even more distinctive, even more delicious. Try a glistening mold of rich, colorful jello real soon. Last number of the 25th program in the current jello series, and we will be with you again next Sunday night at the same time. Say, Jack. What I said, same time. You certainly did. Same. With you next Sunday night at the same time. Say, Jack. What? You know that that Alan did tobacco the last one. You think he did? Well... You don't have to be so... You don't have to be jealous, Jack.  Oh, I knew I was a better actor. And now, folks, at this time I want to wish a lot of success to Sam Schlepperman, Hearn, who opens at the Palomar Theater in Seattle, Washington tomorrow. Good luck, Schlepper. Good night, folks. J.P. Countdown.


You do not want to deny children the opportunity to a better life. Education is that basic right that every individual deserves. In India, we have an electricity rate of 74%. You have close to 250 to 300 million people who are not educated. If you look at the enrollment data, it's really very high, 95%. But if you look at the learning outcomes, it's really low. That means a lot of the students are going, but they are not learning anything. Even if the teacher is motivated and the teachers do turn up, they do not have good content available. You know, I don't want to sound an alarm, but really every day we waste. Some child is dropping out of school, then becoming adults. They are getting married, having children, and the vicious cycle of poverty continues. We needed to make sure that we bring a sense of urgency of development to solve the global learning crisis. It's our moral duty to contribute back to the society. And this project was an opportunity for us to give back to the society. As a company and personally I have been focused on a lot of the education related efforts. So when I heard about global learning XPRIZE, I was obviously intrigued. We were trying to come up with different alternatives to see how we can help society. But we were limited by the small solutions that we had. I've been working with two of the largest nonprofits that work in the early foundational learning space. The first one is Pratham, the second one is Ekal. And when I was working with them, I realized that really the problem they're trying to solve is beyond any nonprofits or for-profits' ability to solve. It became obvious to me that by using technology that is released by Global Learning XPRIZE, we could accelerate some of their efforts. The reason that we went with Global Learning XPRIZE is we know that it is from the best team members across the globe and it has proven results. The goal was that this software should be made freely available so that any independent developer can extend it to their communities. So there were two primary challenges that we were trying to solve. One was making it accessible to as many people as possible and maintaining the quality of these applications. The model that Global Learning XPRIZE followed was that the teams would publish this software. It was available in a local storage device. And then in Tanzania, these applications would be used or picked up from that storage device. But that model would not be scalable in a country like India. We thought we'll publish these applications onto Google Play Store and in order to make these applications compliant with Google Play Store, there are several tweaks that we had to do. For example, these applications are very huge. It has a lot of media content, videos, stories, audio files. So we started compressing some of these files so that the size is reduced. We evaluated these applications to remove unused files. Some of these applications had multiple independent applications. Now that is not an easy user experience. As a parent who's not very educated will not be comfortable installing multiple applications. So we bundled all these applications as one. We've considerably simplified the process of making these applications available in different languages. So localization is easy. Localization, what it mainly focuses on is how to get the concept into the local culture. We wanted to localize in four different languages. We started with Hindi as the first language. Then we went on to Urdu, then we went on to Bangla. So we were able to quickly move around with different languages. So I was really excited when I received this opportunity to translate the English content into Bengali content. And while translating the content, we really kept in mind these few points in terms of native usage. Easy to understand for the child and really intuitive. It took me back to my childhood and Bengali is such a sweet language. I really miss interacting in Bengali now that I'm based out of Mumbai. But really going back to the roots, listening to the words, thinking about those words, framing those sentences. And also looking at it from a child's eye. Really what is it that they liked? I also went back home to my friends' neighbors and spoke with their children to understand what is it that excites them. How do they use the language? Language has changed since we were children and tried to bring in those elements here. We reached out to our employees and we asked them that if they can install these applications with their extended family, in their communities, with their children. And we got a lot of feedback from them. So one of the examples could be something like this word is too complicated. My child does not understand that. Can you simplify that? Or for my child, a pancake does not make sense. Can you use a dosa instead? Or a roti instead? So contextualizing or localizing to our context. When you localize content especially, it cannot be a literal translation. We have to keep in mind the nuances of that language, the beauty of that language. Each language has a melody. Each language has a tone to it. So if we can keep those simple things in mind, I think that will help in terms of translation and what connects with the hearts of the audience. We also tweaked certain words based on how it sounded so that it was more intuitive to them and the entire experience from just seeing it in the app and understanding the user experience of a child was really exciting. I was one of the developers who worked on localizing the applications into different languages. So we identified all those assets which need to be converted into the local languages. Then we used artificial intelligence and machine learning services so that we can automate the process to convert the audio files or the video files into the local language. We converted all the audio files into text files. Anyone who is trying to localize it into their own language, they can just use some translation services and some ML services to translate the transcripts into their local language and then convert them into audio files. So this would make the process very easy for the future developers or the community members. Once people start exploring or understanding the code to localize the software, they'll understand that it's not really that complicated. Most of the application should work with minimal changes. If you're still facing issues, you always have the community forum. The students that we are trying to target, they really don't have access to quality hardware. So we work with some of these nonprofits to source the tablets that could be deployed in the field. So now we have several thousand tablets that are deployed to students in rural parts of India. The biggest barrier we have seen was availability of electricity and internet. In the last few years, both of these infrastructure-related resources are now far more easily available as compared to previous years. Now with internet, we are able to update the content, update the applications and make all of these resources available to the children at far more remote places. The response, the engagement from our students is very high and to our surprise, really they keep coming back to it because they find it engaging. They have more free-form learning. It covers the whole lot of areas all the way from reading to basically arithmetic as well as playing games. So by using some of these tools, we think that we can move the needle. This is the cost-effective way for us to reach the children our teachers are not able to reach. Every child should have right to education. Without education, we see that they will be handicapped and when we talk about the future of the society, getting access to all these resources at an early age is very important. Education is a great equalizer. That is how I got to where I am. If it wasn't for my education or the opportunities I got to educate myself, I wouldn't be where I am. And I want to make sure that every child has access to quality education and this is one way of reaching them. There is a lot of apprehension around how and where technology is going and I think Global Learning Express software is showing us what is really possible with some of these technologies. Not everyone in this world is really fortunate to have the means to get an education. Education takes the society forward. I truly, truly believe in that. That is the light that will change the mindset of people. So giving children that opportunity where they can learn on their own, where schools are scarce and teachers may not be available, give them the right means and they will learn it. Making that difference, being a small part of this entire big vision, I'm grateful for it. I would like to invite developers, development teams, leaders, philanthropists in other countries, other communities to take the great software platform that XPRI's team has released to the world funding by the large benefactors including Mr. Elon Musk and take it to their communities. Within MQ software, we have worked really hard to make sure that the source code is easily available to all developers. It's on GitHub. They can take it, they can download it, they can customize it. I would strongly encourage that these applications are localized to as many languages as possible and give each and every child an opportunity to learn. So I urge all of you, I appeal to all of you to take this forward and really make a difference in the lives of children.


Alright boys, you guys ask me this question all the time. How do you juke? I catch so many bodies in the open field It's really takes your offense to the next level because when they blitz there's not that many people you make one man miss Baha, everybody asked me on my youtube videos when they watch me play live on twitch all these links are below TikTok asked me all the time. So here's the video what I do is I go into practice mode offense only Make sure you guys know about offense only practice mode right here. There's no defense So you can just practice moves so you can practice what move is good What move is that now? There's two juke's that I do the single juke is with the left trigger The single juke is with the left trigger boom just that's all boom Just left trigger and right on the stick whichever way you want to go The second one is the double juke and that's pretty much the same thing Except no left trigger and then you're just going to go opposite. You're gonna go right left Left right, and then you always want your left stick to finish Whichever way you're going so if you're going left right you want your left stick when you're jukein to point that left stick Where you want to go it gets really obnoxious so you can almost like Go all the way Really far like you can bounce all the way across the map the map Yeah, this is the field depending on how far you move that left stick from where you juke But I would tell you that's how you do the two juke's But what I will tell you is that you have to know how to set up your ops, right? If you're running straight on to somebody that's time to lower the shoulder unless you have a Tyree kill or somebody small like that But if you run a straight up on somebody mono we mono, that's a truck, right?  This would might be a 90 right here So this would be 90 straight might be 180 or you know who knows right? But 45 is that direct line going through the triangle or whatever it may be So just remember that you know pylon to pylon That's where you want to end up left right and you're at the pylon left right You're at the other pylon with your left stick. So just remember that when you plan Go to practice only mode. This is where I learned a lot of moves and get better at what move can I do? How can I you know operate look? We're going to the left left right my right stick is all the way back to other pylon now We're going to the right right left my left stick is back to the other pylon pylon to pylon with your juke's Even with the miniature juke to that you hold the left trigger on It's the same thing. I'm going to this pylon Same thing boom Same thing. It doesn't look that good here, but the single juke I do use a lot hard cut Maybe maybe I don't have to use left trigger for that. I don't know. Let's try it without the left trigger Yeah, maybe it works. I don't know But I think I do lose left trigger for that now you're gonna lose stamina fast That's the thing man You guys see me get a lot of returns and I don't crib them because you lose your stamina really fast But that's how I juke people ask me so many times they asked me about my jerseys That's about juke'ing that's about my passing settings. So the best way to do is give you guys a little video little tutorial Hopefully I get this was a sub tip of mine if you are subbed to me on Twitch This was a sub tip since the beginning of year Those are the type of tips you get if you subbed to my channel on twitch those links are below Make sure you guys send me on every social media.