Hello, good morning afternoon or evening everyone on behalf of the National Human Genome Research Institute I'd like to welcome you to the 14th roughly annual genomic medicine meeting this time on genomic learning healthcare systems. I'm Mary Manolio of the Division of Genomic Medicine here at NHGRI and we're showing on the screen the first day's agenda and then thank you. And then if you could go on to the objectives, the goal and objectives for the meeting. These are all in the meeting booklet and there's actually a wealth of information in there, including short bios of all the speakers. In the interest of time we'll just ask our moderators to introduce the presenters and panelists by name, as shown in the agenda, but you can click on the agenda and it will take you right to the bio. There's also some background information in there which hopefully you've you've taken a look at before we get started there's a list of attendees. And you'll note and includes registrants from Europe, Africa, the Middle East, the Far East. So welcome to you all. We're looking forward to an exciting two days. To start by extending our sincere thanks to six of the many people who are actually making this whole thing work. Teji Rapra Burris and Pamela Williams from Duke University. Johnna be Nerola and Ellis summer from my group, who are our rapporteurs for the session, and Alvaro and Senus and Gerald Samani along with their colleagues from our IT group, who make all the IT and recording magic happen. So at this point I'll turn it over to our co-chair Pat DeVerco senior vice president at very next solutions to get us started. Pat. Terry. Let me just go ahead and share my screen here. So, as it as Terry mentioned, and in the very clear objectives for this meeting and what we thought was important was that we track progress that we've made since a meeting that was held in 2015 about genomics enable learning healthcare systems. I was sponsored by the round table and translating genomic based research for health. And at that time the co-chairs of this round table were Sharon Terry and Jeff Ginsburg. And I know Jeff is going to be participating here later in the program. So I thought it'd be good to ground our work and sort of what what were the thoughts then, and let's see if we can track progress instead. So these were the workshop objectives. It was to really explore how key pieces of genetic or genomic information to be effectively and efficiently delivered to patients and clinicians for improving care. And how both the healthcare system and genomic data can be used for evidence generation in research and patient care, and to assess best practices in for using knowledge generating learning healthcare system and which models could provide an opportunity for genomics to be used in the rapid learning process. So very ambitious goals and clearly directly related to the goals that we have as well for this meeting. They had a series of questions to facilitate the workshop discussion, and it was really how can health systems engage individuals to achieve health using genomic and other technologies, and how can systems providers and patients learn from failed efforts, so that we can continuously improve health and treatments, and how can genomic data be used to support patient centered care, and how can health systems help research and care teams have access to all of the data. So again very comprehensive very broad thinking about the genomics learning healthcare system. So what were the themes from the meeting and so this, you know, there's a very nice summary was provided to you in the booklet, you also were provided the link to the full report so this is a very sort of high level. Sort of what did what did the groups determine, and they thought that genomic learning healthcare systems definitely have the potential to improve population health, solve care management problems and develop effective implementation practices. So clearly focus on clinical care and care delivery, but also could be used to support discovery research looking for associations between genotype and phenotype. But all of the the positive benefits of a genomic learning healthcare system were really impeded by the lack of high quality accessible interoperable genomic data in the EHR. And clearly there was a need for that problem to be overcome there was a need to develop data standards and as well as scalable clinical decision support systems. It was also recognized it was really important to engage patients to understand their preferences regarding data uses and how the genomic learning healthcare system broadly would be communicated to the public, because it was discussed that we clearly needed processes to ensure a trustworthy system. And so topics such as informed consent confidentiality data security were all topics that were touched upon. And then this is a little bit of editorializing on my part I work deeply in the area of trying to develop evidence of clinical utility for genomic interventions meaning specifically that use of a genomic intervention would lead to a change and provider and patient behavior, and that behavior change would lead to an improvement in health outcomes. And so there was a recognition that that sort of chain of evidence that is ideal was lacking and because of that I mean it's obviously important for clinical practice but it's also very important to get payer reimbursement as clinical utility is a an evidence threshold that payers looked to book in order to provide coverage for the genomic intervention. And there was some but I would say a much more limited mention of things like health disparities and the need for social science and behavioral research as part of next steps in terms of implementation. And then it's just worth pointing out that the really the whole conversation is was very US focused. And so they proposed his next steps and I think this is kind of a launch pad for us. All the steps to improve the IT infrastructure are really critical I've touched upon things like data standards, and how you need to be able to support clinical decision support systems so such that we you have confidence that the algorithms being used or valid, and that these tools could be shared. There was a series of next steps around encouraging or incentivizing data sharing, and a real emphasis on the role of the patients and patient provided data, and how we could integrate that patient provided data into the information technology systems as well as the typical clinical data, and then obviously a need to measure health outcomes and do it by engaging stakeholders who all have a vested interest in the results so getting their perspective and developing studies that would be relevant for clinical decision making, and that there was a mention that it was important going forward to track health and health care disparities, and to be able to try to understand the priorities and values of patients and providers by using social science and behavioral research methods. So I'll just close and this was the last quotation, quoting Jeff Ginsburg about how things were left. The close is that we should really be thinking about how we can begin to build the system that's going to support genomics enabled health care. So in 2015, we were thinking of beginning to build it and I think what you're going to be hearing for the next two days is how much progress has been made. There's quite a very excited to see the presentations and hear the discussion, because I think there has been quite a bit of progress, but this 2015 meeting was a great first step. Okay. So I think I am also going to be introducing, you're going to go through the goals and objectives. Yes, I am. So let me actually I pulled them down, but I'll do them at the end. So great. And let me just this and this and you should be seeing a full presenter view does that look about right that. Yeah. Okay, super. Great and thank you very much Pat for for bringing us, you know, kind of up to date with the 2015 meeting and what the goals were there. I saw a comment from Sharon Terry, who's who's in the attendees and so perhaps during the discussion we can ask her. And Jeff, who chaired that team to make some make some comments about it. I just wanted to talk a little bit about these meetings in general as I mentioned before this is our 14th. These are organized by the genomic medicine working group of our National Advisory Council on human genome research. And these members of the group, many of them are current or former measures members of our advisory council and you can see the list of them here. And then there are several of us from NHG or I who follow their lead. And just showing you here the plethora of meetings that this group has organized and led several of them leading to publish papers and this was my sort of ran out of room. I'm going to talk a little bit more. The most recent one was in February of 2021 you'll hear a little bit about that from Ken Wiley a little later today. And then of course this one on genomic learning healthcare systems. Just to give you a feel for the kinds of outcomes from these meetings are very first meeting was in Chicago in 2011. We basically just identified as many people as we knew who were doing what we would consider to be implementation of broader scale genomics, you know, beyond just one or two genes and that in clinical care. And from that came up a subsequent meeting we called clean action, looking at developing agreement on how to interpret and apply variance that led to the clinical genome resource which is one of our largest and most broadly spanning programs involving over a thousand years around the world. And they've most recently published a paper on the gene curation coalition which is a bringing together of 12 major groups that are doing this kind of curation. So, so lots of things to come as well as have already come from from that also from the first meeting in our electronic medical records and genomics program, we implemented a pharmacogenetics testing platform and returned those results. Now, we held a second meeting on recognizing that we needed to develop collaborations from that came the implementing genomics and practice program or ignite. I can't show you all of them but just a few selected ones from the fourth meeting on educating healthcare practitioners. We developed the inter society coordinating committee on practitioner education in genomics or is CC. One was on global leaders in genomic medicine so basically the same kind of format that we had done for our very first meeting which was purely domestic us, except we invited folks from all around the world, several of whom are registered for the meeting and that's great. That then led to starting the genomic global genomic medicine collaborative and its subsequent program the international 100,000 cohorts consortium, which is consortium as you might imagine of 100,000 plus individuals, you know, per cohort although some many of the cohorts are smaller focusing on genetics but also addressing a number of different things. The eighth meeting was an overview of our major programs that led to a series of efforts in developing modules in genomic medicine that are being made available to the scientific and clinical communities for use in education of providers. Our ninth meeting on sort of linking basic scientists and clinicians led to a very successful program announcement led primarily by our sister division, the division of genomic sciences on variance function and disease. Our 10th meeting on pharmacogenetics led the ignite program in its next iteration to begin a large scale trial of pharmacogenetics called adopt, which is looking at three different interventions. Our 12th meeting on implementation led to a discussion among employers on how to use genomics in their health systems, which is something that's still sort of incubating as it were. The meeting on polygenic risk led to incorporation of genomic risk assessment into the electronic medical records and genomics network of the emerge network, as well as a new program started by my colleague, Lucia hindorf and now led by by Ken Wiley in our division called the prime to consortium primarily at polygenic risk methods development in diverse populations. And our 13th meeting which as I mentioned you'll hear more about was led to a notice for requesting applications basically in patient centered informatics tools. So, lots of things come out of this meeting and we're expecting these meetings and expecting this one to be no exception. The structure of these meetings is typically what you see we've in the past have done them in person that we were a little bit shaky about whether we'd be able to do this one in person given changing rates and that sort of thing so we, we sort of punted and went virtual and hopefully our next ones will be able to be in person great. We focus on on really trying to build a community around genomic medicine research and implementation, as well as collaborations in that. And I would note just during this meeting, you know one of the nice things about meeting in person she can lead over the person next to you or you know that coffee or whatever and and make a comment. To allow that we've enabled the chat function, but however, however, we really ask that if you have a point that you want to raise for discussion please try to put it in the q amp a box rather than the chat, because we'll be watching closely the q amp a box will try to watch the chat but if we don't get to it we will have those stored and if we can get back to you we will try to do that. Another goal of this this meeting which I'll go over in a second is is to identify research directions not just for an HDRI but for the scientific community at large. And we and others can then potentially consider and fund programs that might be initiated by a single investigator or group of investigators or or by our institute or other institutes. We try in these meetings to emphasize discussion, because we really, you know if we all we wanted to do was just to have people talking at each other. We wouldn't need to bring you all together at the same time. So we're trying to arrive at the at the end of a session at the end of a day at what we all know together, rather than what each of us knows individually. I find a member of the general medicine working group is a co moderator for each session and they are paired with experts from the scientific community for moderating. And for all of these meetings if it's warranted if there's enough new information, we produce a white paper for peer reviewed publication, both the findings and the future directions of the research in that particular area we would hope to do that. If it's warranted and typically the authors of those are the moderators and presenters and panelists. So that you're aware of that and then as Pat mentioned, these again are the goals and objectives of the program to discuss progress and identify solutions and really emphasize the solutions. And we'll talk very briefly after Peter Q looks talk about their barriers but honestly, you know having been doing this for the past 10 or 11 years or so. We hear a lot about barriers so and they're pretty much the same barriers, you know some of them have been resolved but but many of them have not or not fully. So let's try to get away from, you know, worrying about the barriers and really try to focus on what are the solutions that people have come up with. How can those be shared and what collaborations can be formed about them. So, we'll be exploring some real world examples of how genomic learning healthcare systems apply the virtuous cycle is that you can see on the left here of implementation evaluation adjustment and updated implementation across various delivery systems. And we'll look at a few barriers to mention them and identify potential solutions with a focus on the lessons learned from effective genomic learning healthcare systems, and especially their potential transport ability and into other settings, and then determine some ways that solutions can be developed and shared, and importantly collaborations can be formed to facilitate research on implementation of genomic learning healthcare system so with that I will stop sharing. And with that, I turn it back over to you now to introduce our moderators for session one.


Good evening and welcome to ongoing election coverage by town meeting television. This is one of many forums we are bringing you in advance of local elections and town meeting on the first Tuesday in March, March 2nd 2022. Town meeting is traditionally where voters weigh in on local government, local government representation, municipal budgets, school budgets and local ballot items. All candidates on the ballot are invited to participate in town meeting TV election forums. Town meeting TV election forums introduce you to community decision makers and connect you with the issues that shape your local community. My name is Emily Brewer and I will be moderating tonight's Winooski school board forum. With us we have the current school board president, Tori Cleveland, who is running unopposed for a two-year seat on the board. We also have Allison Burlock with us tonight who is running unopposed to serve the remainder of a three-year term on the board. Excuse me. Now if you are watching this live we welcome your questions at<PHONE_NUMBER>. You can watch town meeting TV on Comcast channel 1087, Burlington telecoms channel 17 and 217 as well as online at town meeting TV's YouTube page. With that said let's get started with opening statements. Each candidate has about a minute to introduce themselves. Tori we will start with you. Can you please tell us why you are running and what will be different for Winooski if you are reelected and as a follow-up to that why do you think you are running unopposed? Hi I'm Tori Cleveland and I've been serving on the Winooski school board since 2011. The reason I serve on the school board is I believe strongly in democratic societies and communities and even more so I believe in children and youth and I believe that their life in public education matters so much and there's so much promise that students this is where they begin their growth and becoming of who they are meant to be with their gifts and their brilliance and bringing it to communities. I also understand that public education while is a promise for our youth it is also ultimately an oppressive system an institution and I'll get more into that later but that is why I'm running to continue running and serving on the school board. Thank you very much Tori we will move over to Allison can you please tell us why you're running and what will be different for Winooski if you are elected and why do you think you're running up unopposed? Sure so I'm Allison I've been a resident of Winooski for almost five years now I grew up in Addison County. I am running because I think that the school is the center of the community and I really I desire a high level of service to Winooski and I find that the school board is one way I can do that and as far as why I'm running unopposed I think there's a continuum right now of people who are maybe feeling satisfied with the leadership of the school that feel like things are going well and so they don't need to run and then on the other hand people are really exhausted right now we're two years into a pandemic and people are tired so I'm looking to bring my energy there. Great thank you very much Allison and we will now move on to the question portion of our forum tonight we will stick with Allison and the question is do you support this year's school budget? Yeah so I've been a little bit of background I've been on the school board since July so I've been actively involved in the development of this budget. I personally think that this budget brings forth what's best for the school district in Winooski and the community bringing forth things like funding for transportation for students more than three quarters of a mile from the school year round and also supporting pre-k education that early learning and some very necessary operational staff for the school district in my opinion. So yeah I was involved in the development of this budget and I think that it's very much supported I think that it's important that we pass. Thank you very much Allison. All right Tori do you support this year's school budget? I do I'm excited about the investment in pre-k as I think most of us understand that early education is foundational for students to be together and to be learning together as early as possible with pre-k. I also am super excited that we are now going to be running full-year busing that is not something that has ever happened in Winooski and it is equitable to have all students and their families feel safe that children are getting to school dry warm and on time to school and that's the first thing we can do is get everyone in the door at the same time. I also support this budget because right now Winooski housing is selling over the appraisal and so our CLA has caused a lot more cost to our educational budget and also through our administration and particularly Nicole Mace we are we have been involved in the USDA loan a USDA loan that's going to save our taxpayers 34 million dollars over the course of the bond for the capital project. Our community approved a $58 million budget and the the loans that we were able to receive from USDA at a super low rate is going to save our community millions literally 34 million dollars over the course of the loan. Thank you very much Tori and we will stick with you and we will head on to the next question which is Winooski has been having conversations around racial justice and education what have you learned from these conversations? Well it's not just conversations we do have racial justice conversations happening within the school building but we've also been having robust conversations and more importantly action around anti-racism and our students a former alumni and students brought to us in August 2020 six to eight demands that can help us move Winooski to becoming an anti-racist district and we have six action teams that are functioning right now that are filled with community members, students, administrators, teachers to help our district move forward and being intentional and having an impact on race in our schools how we all learn and grow together in this and move what our former alumni believe to be true about how we can move forward in intentional ways with concrete actions in becoming an anti-racist school district. I was muted thank you Tori and we will head on over to Allison now. Sure so what I've learned from the conversations we've had is that there's so much there are so many unique experiences in our community that are really important to bring to the table when we're making decisions and so I've learned about the importance of that. It has also really reinforced for me that every human being every child in our school district deserves to be treated with dignity and respect regardless of who they are and I think that these conversations have really brought that forward to me and also some of the work we've done with youth and adult partnerships the learnings we've had there just with up for learning I found that very interesting and it's really challenged my sort of training in the workforce on how youth and adults interact so that has been really great and I can see how that will help with anti-racism work in the future. Thank you very much Allison and before we move on to the next question I would just like to remind folks that are watching out there in the community that you can call in and we will answer your questions live on the air at if you call in at<PHONE_NUMBER>. All right and we will move on to the next question. Sticking with Allison and along those same lines do you support the passage of H.584 which would require standards in education designed to promote anti-racism in schools? Why do you or do you not support this bill? So I looked at this bill because I had not heard of it before recently and what I read in the short the short form of the bill was that this is not this is to designate schools as certified in anti-racism. I didn't read it as requiring anti-racism curriculum for example but the short answer is that because I could only find the short form of the bill I would really need to get some more information on the implications of the bill for our school district. However it was introduced among other people by our own Taylor Small and Hal Fulston who represent Manuski in Montpelier. So without understanding all of the implications of the balancing the full text I absolutely support moving schools towards being anti-racist. So I can make a pretty good guess that I would be in support of this bill. Great thank you very much Allison and Tori do you why do you support or not support this bill? Well I appreciate Allison you starting because that's I looked it up as well because I had not heard about it. I absolutely support Taylor Small and Hal Fulston and the work they've been doing for Manuski and the whole state of Vermont in the legislature. So I I too looked it up and I agree with a lot what you were saying Allison of it is important that we recognize the public education is an institution that was designed for haves and have-nots and they're designed on some anti-racist ideas and having having support for move us towards more anti-racist ideas and creating equitable places and learning and supports and interactions is incredibly important as we're all moving forward to dismantle some of the the oppression that has been inherently in the foundation of public education. Thank you very much Tori. Okay we will move on to our next question and Tori you will answer this one first. The question is what impacts has the pandemic had on learning for students in the Manuski school system and what would you do in your role on the school board to address or work with these impacts? I think broadly the pandemic has had an incredible impact on the learning of students across our nature and then so in Manuski this our sphere of influence is the stress and the stress on families the stress on students the being separated out being isolated coming back in missing like two years of sort of the the regular pace of education has had an impact on like there's been a drift away from regular norms of who we are together and us figuring it out we are we are in schools together as especially with adolescents building their own identity and they've been doing it online there's so many impacts I think what's most important about this is validating and acknowledging the stress and the sort of collective trauma that everyone's experience in the in this pandemic and moving towards more wellness and nourishment and pacing that honors what we're all going through so just shoving high academic rigor without allowing being together and and restorativeness of who we are together that that's going to be equal measure with academics also so that we can we can move through this all together. Thank you Tori and we will head over to Allison to answer this question. I really agree with all of what Tori has said and she says it so well but when I think about this this topic I think about the uncertainty that we've been in in the last two years people are worried about about their safety we're dealing with needing to flex what we're doing at work I'm thinking of staff faculty and staff at the school they're needing to flex what they do and take on new responsibilities amid shortages of staff and faculty they're implementing new technology on the like like over a weekend probably to go remote two years ago and so those are definitely challenges we've experienced and I've heard sound bites about test scores and similar to what Tori said I think okay test scores yeah but are our students safe and happy and healthy we need to worry about that first right and and that this is an unprecedented situation that's not just in musky it's worldwide which may fundamentally change how we live life going forward so we need to give ourselves some grace for things like standardized testing if our students are warm and fed and and happy and thriving then I think that is there like a baseline or a couple of the baselines of needs right so we just really need to give ourselves grace and time to to fully heal from what what we've experienced what we've gone through thank you Allison and we have a couple more oh yes say that again Tori that was beautifully spoken Allison thank you all right now we have a couple more questions left to go here I would just like to remind the community if you have a question for either of our candidates we would love to hear it um call us at<PHONE_NUMBER> and with that said we will head on to the next question and we will start with Allison and the question is what educational uh what educational reforms are most important to you and your constituents over the next five to ten years so the first thing that comes to mind for me is equitable funding to properly support the work that our faculty and staff are doing for the students in the community um for those following along at home what we've been talking about the um the weighting study for the last several years which is how pupils are calculated for the school district and how that factors into the budget and the legislature is currently working on a solution that that may or may not be good for runuski in the long run and I think that um working towards an equitable solution that so I'm going to say that we're equitable a lot but that equitably funds runuski school district is probably my main priority in addition to coupling that with smart spending like making sure that what we are spending our money on is the right thing um and and I think that that is not um not suggesting that's been an issue I think we've done a good job with that we just need to continue doing that thank you very much all right Tori um what educational reforms are most important to you and your constituents over the next five to ten years well I think everything that Allison just said about the people weighted study is huge around equitable funding for all students um which will benefit runuski community um and I mean I also wrap back around to the prior conversation around test scores what we're talking about coming out of a pandemic and how test scores seem to be most important to some people I just want to be clear that the amount of testing that we've done on students for over way over 50 years has never disrupted the inequitable outcomes of for students so if your if your life has been then touched by poverty disability and race you are more likely to go to prison than you are to get a good job and have a good career and that is across our nation and it impacts vermont in the same way so the educational initiative is to continue to redesign public education with students at the center with teachers at the center as we also know from decades of research that the biggest impact on students their learning and their well-being are teachers and so well-being and nourishment and pacing to thrive has got to become something that's important in educational initiatives and reform and runuski's gone through an educational reform phase where when we had this nely may grant for about seven years we had it in partnership with uh burlington and there was an intentional restructuring of the way we do education based on tons of educational research that students need to be in the center of their learning in collaboration with teachers in collaboration with administrators and superintendents it needs to be shared leadership and collective understanding about how do well we say this way humans are designed to learn we we learn when we're in a thriving environment and so that's going to need to be incredibly important in the upcoming years as we as we come off this pandemic hopefully it goes away right and we start to heal together thank you very much tori all right one more time i'm going to remind folks that uh we would love to hear your um questions thoughts opinions call in at<PHONE_NUMBER> we're getting close to the end we're getting close to the end here we've got about 11 minutes left we will for the next question we will stick with tori and the question is and there's two big questions here so feel free to answer it how you'd like but the question is what do you see as the biggest challenges facing the school and how would you use your how would you continue using your seat on the school board to address these issues and then as a final question what is your vision for winewski's education future which you already sort of just said but love to hear it some more yeah so all the vision part was what i was uh yeah speaking to around public education the high school redesign education redesign um my true vision is that people feel like they know they belong that there is wholehearted belonging in schools that is from which we all learn and grow um when we are seen and heard um you might need to repeat some of that other the part of other parts of that question yeah sure i'll uh the first part of that question was what do you see as the biggest challenges facing the school and how would you to continue to use your seat to address these issues probably one of the biggest challenges right now is getting through the capital project we took on a 58 million dollar bond that the community was incredibly behind us to redesign a building that the last time it was touched was like 1960s and we did it during a pandemic so we are hopefully the teachers and the students and families have been incredibly patient and tolerant of the disruptions of the capital projects as it's being built um we're moving into new spaces and out of new spaces as it happens hopefully it will be completed in the fall of 2020 um and then and then i guess the other big challenges are to continue um with our anti-racism work um with our restorative justice work with um connecting with community and families and making sure everyone feels that they are a part of and belong to this community and our school which is the heart of this community great thank you so much Tori and Allison for this final question um what do you see as the biggest challenges facing the school and how would you use your seat on the school board to address these issues and then as a follow-up uh what's your vision for Winooski's education future sure so as far as challenges i agree with what Tori has said and her answer i would add a couple things that i thought about um in the short run um staff shortages and the relationship between the pandemic and burnout of staff um teaching and working education is a caring profession i would say and burnout among caring professionals is just um also at a pandemic level right now so that's one thing i'm concerned about um how i would use my seat to help with these challenges is a little bit like higher level what i would say is that i want to encourage this the school district to fail fast which means take up on take up an initiative and properly monitor it so that if there's indication that it's not going to work we stop and we don't continue down a road of something that's not working so that's called failing fast um and and then it works the other way too where if we can we start down a road and we see like oh wow this is working we can keep doing it and so i think that's a higher level of way of approaching all of these of these challenges and my vision for runuski schools is really one where like tori says everybody feels like they belong everybody feels like um they we recognize the dignity within all of the students and all of the people in the community that are related to the school great thank you so much allison and that about wraps up all of the questions that we have for both of you and we have plenty of time for um both alice to hear closing statements from both allison and tori before we wrap up so um for that we will start with allison sure so i'll just talk a little bit more about who i am um we didn't want to do that too much at the beginning so i am a almost a five-year resident of runuski i did grow up in adison county um i am a product of public school education in vermont and i really appreciated what it gave to me and i would like to perpetuate that to other students particularly in vermont um i i am a quality and process improvement professional in healthcare which allows me to think about systems and see how things are connected and i'm also a statistician so i'm also good with numbers um and and i think that the group that we have on the school board right now is really collegial we work very well together we're making progress on on issues that come to us and i i just i really like the group we have and i hope we can keep it moving forward thank you very much allison and tori your closing statement i'm very hopeful um moving forward um into these new years um i've been a resident of runuski for 18 years i am from the south i was born in alabama and i was raised in georgia and um coming from the south has certainly influenced my perspective on um racism and equity and belonging and collective shared collective work to really see and hear each other for our inherent dignity and worth i have a vision for the school that um again around everyone belongs and everyone is valued and seen and heard for the gifts and the the brilliance that each and every one of us have to offer and i'm i'm i'm excited for the future there's a lot of work to be done and the work of the board is to make sure that we are monitoring our in statement which is the driver of all of our governance which is that all students will graduate college and career ready at a cost supported by our community they will go on to lead healthy productive successful lives and be engaged in their local and global communities and we have some work to do to make sure we are measuring that we are we are fulfilling our promise to this community um that our youth will thrive and grow and and contribute in their futures thank you very much tori and thank you very much to both of our candidates for participating in our forum tonight and thank you to our viewers for tuning in to town meeting tv's ongoing coverage of local community candidates candidates budget and ballot items you can find this forum and more at www.ch17.tv and don't forget to vote on or before the first tuesday in march town meeting day um march i have the wrong date here but town meeting day in march um early voting by mail is available and you can contact your town clerk's office to find out how your community is handling vote by mail and polls will be open from 7 a.m to 7 p.m and let me just get the correct date on that so our folks can be informed and can get out and vote the first tuesday in march this year is march 1st 2022 so thank you for participating in this forum and thank you all for watching


Well, hello there beautiful. So before I was a fabulous youtuber Before I was who I am now Which I don't know what that is I was broke. Okay. I did not have money. I It was a lot. I have very expensive tastes and I had no money, which doesn't really work out very well So when I was Balling on a budget as the kids say I still had a love for nice wigs. Okay. I love wigs I just love the fact that you can transform your entire look like that maximum outcome with minimal energy, which is how I like to run my life and I couldn't afford those expensive wigs that were pre-plucked and pre-laid and pre-sewn and full lace and you know the wigs that I use now Which I'm very fortunate to be given them by companies. Thank you to all of you guys So today I bought this wig. All right with my own money This wig right here is from Amazon. It was 38 doll hairs and She's seen better days. So when I was balling on a budget. I learned how to transform these things into works of art. All right, I laid them flat. I Styled them. I did so many things to them and today I'm taking a trip down memory lane and I'm gonna show you guys how I can transform this kind of hideous wig But good for the money into a magical just gorgeous natural nearly natural looking fabulous It's it's cute for the price, but we can make it a thousand times better and with a very minimal effort So here's a little overview of it girl Nobody's hair is this long and this thick all the way towards the ends and like honey We all wish but no it doesn't happen without hair extensions this hairline So unrealistic. Nobody's hairline looks like that honey. I'm sorry. We all wish our hairlines looked like this She doesn't even have a part. I mean we're gonna fix her the f up So it's time for me to ruin my good hair day and put this wig on my head for you guys to see What I'm working with here. Hi, my name is Whitney I'm from Delaware. I moved to New York City last year and I'm working in pr That's what this wig is telling me. So Whitney needs a makeover, but as you guys can see it's kind of cute like it's not the worst thing in the entire world It's workable clearly. I haven't cut the lace off yet. So I'm gonna show you guys all the hacks that I have to transform this drabby unrealistic looking wig into A gorgeous Let's do it So firstly, I'm gonna take some clothing pins and just pin this lace down Don't pin it too close to the edge because you don't want to ruin the lace It will stretch the lace out a bit put down There we go. All right step one So the first hack to making your wig look a little more realistic kind of doesn't apply to this wig I'm sorry. Kind of a lame first tip But usually I would pluck the hairline But in this case this is synthetic hair if you were using real hair it would pluck but synthetic hair Which is basically just plastic doesn't really pluck out that easily and usually rips the lace because it's a very tough material So typically I would go in and fix this hairline to make it look a little less full and thick and crazy Like it does now, but it'll work once I cut the lace off. It'll look much better But that's the first step if you don't know how to do that There's plenty of videos on youtube on how to do that. So just look them up real quick You'll figure it out. But the next hack that I have to share does apply to this wig. Yes, you're welcome I am actually going to take a steamer. It looks like this I bought this on amazon very inexpensive and also like the best steamer ever This is like a bit one big amazon ad today. We're gonna brush her hair out I usually like to use a brush with natural bristles in it that are very bendy because otherwise It's just gonna pull up the hair way too much.  So Even like a full plastic Detangling brush those don't usually work very well for this either So we're gonna part it where our desired part is which Hair hack number three don't part in the center It's just not gonna look as realistic as it possibly can I would part it slightly off to the side That way the eye is kind of tricked because when it is symmetrical on the top your eyes go right towards it And if it's not perfectly symmetrical, you're gonna clock that wig in two seconds So that's why I like to do a little off-center. That way your eye isn't attracted to it right away Brush it back. Make sure this is nice and even This wig is only laced for the first two inches and don't make the part too perfect That's not really how natural hair work and now We're going to take our steamer and just gently steam this part into her hair with the plastic fibers I mean, you know how plastic works. It melts under heat, right? So we're kind of just melting it a tiny bit so we can reform it into the position we want it to be in It's pretty fun Hold it down with your hand for a second just to get it set in there See now even if you try and part to the side it still has a part in there. You can also go like this Lay it flat. Our goal here is to really get this as flat as possible That way when you put this on your head if you do already have hair underneath your wig That already adds a lot of volume to your hair So you're trying to make your wigs as flat as possible That way when you put it on top of those braids or whatever you have you're not getting like a bulky wig situation Which is never ever cute ever. So you want it to be extremely extremely flat You can even part it and get the underneath first Give yourself a little facial By the way, a lot of the things I'm using in today's video will be linked below for you So check it out All right, so now we're going to finish straightening the rest of the hair the heat will straighten the hair So you're just going to brush it out and then apply this steam You don't need to be perfectly straight Just getting a little bit of that wave out will help you Bam she is laid flat As can be perfect So this next part you guys might be a little bit scared about but I promise you it's not hard and also It's gonna be a razor. This will also be linked below if you would like to buy it But we're gonna do a little razor in here and razors are very friendly.  So good a little texture up there. Let's do another side again Again below the chin and then just work your way down Super easy with the razor the realisticness of real hair. It's always a little shorter in the front Oh, it already looks so much better.  So it's not extremely thick by doing this You're adding layers to the hair. So that way when you push it up, it stays see all that texture you're adding Beautiful and don't be scared to get rid of a lot of hair if your wig is super bulky And just really go in on that underneath layer and just get rid of all of that hair Just because you don't need it there and it's only going to add to the bulk The reason why we don't do on the top of the head is because you don't want a bunch of short pieces sticking out on the top That's not cute. I've made that mistake before.  So I will do that and I'll be right back Okay, so I just got rid of a lot a lot of hair on her head It's still really long but as you can see so much more realistic and this length is so pretty I can't wait to put on my head. So now this is the step that people abuse a lot. All right, and that is the baby hair moment Listen people took this trend this baby hair wig trend and really really overdid it Just like the whole instagram makeup trend. So we're gonna part less than a half an inch No, you know what like centimeter of hair in the front tiniest bit of hair just like that Comb this forward. Let's leave like an inch long. Just get rid of it. I don't need you anymore You can even skip this stuff. You don't like baby hairs This is just nice for when you glue it down And you just want to like make the seam from where your skin is to where the lace starts seamless I don't always do it, but why not today?  Okay done with that stuff. That is probably one of the most important steps all of that cutting now We have her lane. We had the baby hair snatched. We have the cut We got rid of the bulkiness now. We're gonna curl the hair I'm gonna do very very loose beach wave skin. I keep saying natural thousand times But we're gonna give her that natural beach wave look you can leave it straight But I wouldn't really recommend it if you're worried about your hair looking unrealistic when it's synthetic I'm gonna add a little bit of texture in her hair just because I feel like that looks more natural I'm gonna set this iron to around 300 degrees, which is a little hot But you'll see I'm not gonna leave the heat on her hair for too long. It's gonna be very very very quick Let's do it. We're gonna add a tiny touch of hairspray. I'm using Orbe Superfine Which is very expensive. You don't need to use this But you can just use like a cheap hairspray and just lightly coat the hair just to give it something to hold on to Let me curl Boom bang boom bang boom and let it just sit Don't touch the curls because what's happening is the plastic is heating up So you want to let the plastic cool down before you move it around too much that way the curl Sets in the hair and again, we're not trying to get a like an actual curl in the hair We're just trying to get texture. You're gonna see it's gonna look kind of like a little bend I'm really just trying to like mess up the hair a little bit So it doesn't look as perfect. You can then twist it with your hand and then let that sit Heat it up heat it up heat it up Twist it and let it sit Awesome now you can rake your hands through and you're gonna get that little bit of added texture See the difference between the two sides a little more textured over here and Definitely straight over here and you can just keep going with this until you have the desired outcome you're looking for I'm gonna keep going off camera and I'll be right back All right. We have that side finished spray with hairspray Get those waves to set in Take my dry shampoo. This is a lifesaver with synthetic wigs It's gonna get rid of the shine and add that little bit of texture. We're looking for Like that looks perfect beautiful Do not overdo the hairspray though because then the wig will get tangled very easily I recommend light hold rather than strong hold or else they will get tangled on you Don't say I didn't warn you. All right. And now this last and final step It's probably one of the most fun because it kind of ties in everything together It gives it that really really natural touch and that is the root color Not many people have this color growing out of their heads So we're gonna give her a bit of a brown cool colored root moment with eyeshadow and an eyeshadow brush All right, so i'm gonna use this old morphe palette that I have It's just I think it's like three pibo palette any brown color will work Just make sure it's dark enough for whatever your hair you're putting it on obviously So i'm gonna dip into this like cool brown color over here And i'm using this kind of like blending packer brush. I don't know We're gonna do that and we're gonna go right in this is pretty self-explanatory and just give her that root And if it's not dark enough go and use a different color This is also gonna be really nice because it's gonna get rid of that shine That's right at the root and this looks absolutely amazing Just try and not get it too much on the part, which I just did otherwise you're gonna have like a really dark part It's not pretty So that's once I done I hope you can see it on camera that made a huge difference It got rid of that shine and it gave her that natural looking root moment that we're looking for Now i'm gonna go over on this side and do the same thing You can also get creative with this and leave the pieces in the front out and have like a face frame moment Right around the face and then darker around the rest of the head But I am not a huge fan of that look so I'm gonna make it all dark up here and it is gonna look fabulous I think I said that the last step was the last step, but this is actually the last step I'm gonna take a concealer that's in my color put it on my hand here And we're gonna paint that part very very lightly with brush like this Don't put too much because it looks really obvious when you put too much of this on here Just tapping it I'm rubbing it in All right I'm just gonna cut the lace off real quick and then I'm gonna apply it to my head Some people like to cut the lace with a little bit of extra room up here But I like to cut it as close as possible to the hairline So here you guys have it. This is the finished look. I mean 38 dollars Where where sweetie? I realize that this still doesn't look like a totally unbelievably Realistic wig, but I think I can say that I slayed this challenge I mean it looks pretty damn good for what it came from and how much it cost it Listen, I would wear this out. It looks good and I'd be proud to rock it We did a haircut. We did a baby hair number We did a root number. I lightly waved it. I styled it We did everything and I think that this looks a whole lot better and the color looks fabulous I'm obsessed with it and I did not glue down this wig. I did not glue down the baby hairs This is just the wig popped on my head in two seconds. That's pretty good. It's pretty impressive I hope you guys learned a thing or two about how to snatch your cheap wigs because girl I know what it's like to be in a budge and want to look fabulous at the same time. All right Thank you guys so much for watching today. Follow me on instagram and twitter App right under nyc. Don't forget to live your extra life and I will see you all next time. Peace


Hello and welcome to the session. In this session, we will discuss the following question and the question says, a shark keeper buys a microwave oven for $760 at a discount of 5% on the printed price. He marks up the printed price by 10% and sells it for $902, which includes sales tax on the marked price. Find 1, rate of sales tax, 2, his profit. Let's start the solution now. First, we will do an assumption. Suppose the printed price of the oven is equal to X dollars. It is given that there is a discount of 5% on the printed price. So, a discount is equal to 5% of the printed price, which is X dollars. This is equal to 5 upon 100 into X dollars, which is equal to 5X upon 100 dollars. Therefore, cost price of the shopkeeper is equal to the printed price, which is X dollars minus the discount, which is 5X upon 100 dollars. This is equal to 95X upon 100 dollars. It is given that the shopkeeper buys the microwave oven for $760. So, this implies 95X upon 100 is equal to 760. This implies X is equal to 760 into 100 upon 95. Now, 519 times is 95 and 20 times is 100 and 930 times is 760. This implies X is equal to 40 into 20, which is equal to 800. Therefore, printed price is equal to 800 dollars. We will now find the marked up price, which is equal to the printed price, which is 800 plus 10% of the printed price, that is 10% of 800 dollars. This is equal to 800 dollars plus 10 upon 100 into 800 dollars. Zeroes get cancelled. So, this is equal to 800 80 dollars. Therefore, marked up price is equal to 880 dollars. It is also given that the selling price is 902 dollars. So, selling price is equal to 902 dollars. Now, we have to find in part 1 the weight of sales tax. So, we will start part 1 now. Total sales tax charged is equal to selling price minus marked up price. This is equal to selling price, which is 902 dollars minus marked up price, which is 880 dollars. This is equal to 22 dollars. Now, the rate of sales tax is equal to sales tax upon marked up price into 100. This is equal to sales tax, which is 22 dollars upon marked up price, which is 880 dollars into 100. Now, the zero gets cancelled and 22, 4 times is 88 and 2, 2 times is 4 and 5 times is 10. So, this is equal to 5 upon 2, which is equal to 2.5%. So, therefore, rate of sales tax is equal to 2.5%. This is the answer for part 1. In part 2, we have to find profit of the shopkeeper. So, for part 2, profit of the shopkeeper is equal to selling price minus cost price. Now, sales tax is not included in the profit. So, we will subtract the sales tax from the selling price. This implies profit is equal to selling price, which is given to be 902 dollars. So, we write 902 dollars minus the sales tax, which is 22 dollars, the whole minus the cost price, which is also given as 760 dollars. So, we write 760 dollars. This is equal to 880 dollars minus 760 dollars and this is equal to 120 dollars. So, therefore, profit is equal to 120 dollars. This is the answer for part 2. With this, we end our session. Hope you enjoyed the session.


So we are all set. Let's learn about HTTP. Let's give our uh rather nervous speaker a uh big round of applause and make him feel comfortable. Okay so we should add some demo but maybe it won't work. Uh no demo. Mike. Mike. Like this. Okay. So it's Sunday morning. I hope you are all well. Enough. So this would be about HTTP. So why Wookie's? Um Wookie's because this is about smuggling and Wookie's are smugglers. And uh also because the Wookie language is a thing uh quite hard to understand. Um easy to misinterpret. So this was the nice thing for HTTP or so. So what are we gonna talk about? Um something about the HTTP that you need to know. Uh what is HTTP injection? Uh some recent some some recent attack vectors. HTTP 0.9 which is an old versions. Uh maybe not the demo you would get to trust me. And uh maybe we talk about the tool I wrote which is called HTTP Wookie. So who am I? Uh Regilereau because it's French. Um French. Um yes it's not Wookie but maybe sometimes you won't understand my words. Uh I would I work on the very small French uh free software web company which is called Mike and I Corpus. Uh 50 people. I'm a DevOps. I've always been a DevOps. So it means I'm a sysadmin and I'm a developer. Um web security is just a very small part of my job and it's part of my spare time also. And this is important because if I can do it on my spare time uh some other people might be doing it uh better than me. So why did I start testing my tools? Uh I work every day with open source HTTP servers. And I like these tools a lot. Um I use to trust these tools a lot. But I found two very interesting papers. The first one is HTTP Hostile real world attacks. And this is about uh very old stuff in HTTP which is the absolute jury in location. Um there are some tricks with this so you can attack the host header on HTTP. And there are real uh threats with these sorts of attacks. Um 2015 for example. The other one is a studio from 10 years ago, 11 years ago which is HTTP smuggling. And everything is inside. Most of the things I can tell you today are already inside. But it's like everyone forgot it. So what is HTTP smuggling? Uh it's protocol level attack. So it's injection. And everything always is injection. Here we are gonna inject HTTP in HTTP. So we're gonna have more requests or more responses than we should. Um to do this we craft low level HTTP messages. By definition you cannot do this with a browser on or an HTTP library. Because um they do not make mistakes. So the goal is to make mistakes. Um when you make mistakes usually you get errors. But not always. So before we start the first things on HTTP is the very old version of HTTP was one TCPP connection for each resource. Like you want a file, you want an image, you want a CSS file, you need one new TCPP IP connection for each resource. Then you do the since in act, act thing. You make your request, you get your response. And then you try to close the TCPP connection on their problems when you try to close because we are not sure you get the answer. Um this is a big performance killer of course because you may need a lot of TCPP IP connection. So they may keep live on HTTP one on one. That is you reuse the same connection. Um when you get your response you can make another request. You get a new response and you make another request. And you can in fact you can usually your browser will use 60 TCPP IP connection and do this. And unless you're using HTTP 2 it's what you are. Um there's also something that most people doesn't know that's pipelines. So instead of waiting for each response before doing the next query you can send every query and wait for the every responses. On the example you can see that I made four queries and I get three response only which is a load. But the important thing is the other of the responses. So if one of the response is huge you get to wait for this response before having the next one. So this is called out of line blocking and this is also a performance problem. And this is one of the reasons of HTTP 2. And the other reason of HTTP 2 is smuggling. Because you depend only on the order of the messages. Um in HTTP 2 you've got a real binary multiplexing thing where each response can be associated with the request and it's better. So you can see that if you get a reverse proxy like an SSL terminator or reverse proxy cache the things if you make a pipeline to the reverse proxy the reverse proxy will talk to the back end without the pipeline. It will make just a simple um HTTP 1.0 or 1.1 keep a live connection but it will not use a pipeline when it talk to the back end. The problem is the back end doesn't know that there's no pipeline. So if you can make the reverse proxy play something which looks like a pipeline the back end may see several requests. And send several response but the reverse proxy doesn't want several responses. This is smuggling. Um you've got one example here where I send something which should be only one query. The final um step as a splitting issue so no you've got two queries and you've got one extra response and the problem is on the question mark. What do you do when you've got one extra response? And you've got two type of things which are the transmitter which transmit the bad syntax. And you've got the splitter which splits on these bad syntax. And the two are problem problems but the splitter is a real problem. So why do you do HTTP smuggling? Maybe just because you want to hide a query. So maybe the reverse proxy would like to prevent this sort of query to happen but it doesn't see the query. Uh you can make crash. You can crash a lot of things when bad syntax are used. You can try to shift the response stream like um if you insert one extra response on the pipeline. You may really shift the stream and do cache poisoning. And you may also try to attack another user credentials on HTTP by using incomplete queries. Um this is uh the thing on the on the demonstration. All these things are described in 2005 already. So we also need exploits. Oh. Mm hmm. It's not me. It's the Mac. It's my day. So the exploits, it's all about size because we are in the pipeline. We have got, we've got several messages in the pipeline. Each one has its own size. So the goal is to alter, alter the size. You can make double content length errors so people doesn't know which one is the right one. And this is strictly forbidden. You can play with content length and chunked transmission and you should not play with both. Um on chunked transmission you do not have a length for your message. You say I will send things and when you see the end of chunk marker it's the end of the message. Uh you could use invalid errors or invalid values like the content length with the space is not a valid error. Uh you could use also invalid end of lines. Like the first one the real end of line is CRLF. You could try to use LF or so it's almost valid. But CR is not valid as an end of line. Um you could also try to use very old features of HTTP which are still there. Like HTTP 0.9, like multi line errors which are in the RFC. So the first demo um at least you can read the thing. Um yeah this should make an adjacking credential exploit. So here you've got some real world uh exploitation. Like this was working on Node before the version 5.6. It's a splitting issue. Um you should always have CRLF for for end of line. But for Node if you have the CR they fault that. They do not need to read the next character because it's always LF. But if it's not you've got a problem. So on on the example you've got the dummy error and then you've got the CR on a Z character which is not on LF on any other thing. So for everybody this is just one error which is dummy error. CRZ transparent calling chunked. It means nothing. But for Node there are two errors. The first one is dummy error which means nothing. And then there's a transparent calling error. So for everybody this request is one request and in blue you've got the body of the request. And you can make a get request with a body. It's allowed. So this is just one request with a binary body that nobody reads. But for Node you've got transparent calling chunked. Um there's a priority and chunked always has the priority on content length. So it doesn't it does not read content length. It reads chunked. And the first bytes of the body is the end of chunk marker. So after the end of chunk marker you've got a new request in a pipeline. You've got a post request. And this post request is please delete user 2. Um there's another thing on the second request. There's a partial error at the end. So um it's an untaminated post request. Node is still waiting for the end of this request. So what could happen? If you've got a reverse proxy in front of Node with a couple of connections with Node. Um the first proxy get the first response like you think is thinking this is one query. I need one response. So you get one response. Then Node is just waiting for a second query. And another user like the admin user is there. Sends a query, any query. And the query gets appended to the untaminated one. With the new user credentials like the cookie like an HTTP authentication credential. And then the admin user is doing a post user delete 2. Without requesting it. So uh I cannot show you because there are problems with the screens. But at least I can show you uh what happens. Um I'm the attacker. Uh I send a request to varnish which is a reverse proxy cache. And this request is the request you just saw. Like in fact two requests but it's just one. Um the request goes to Node. Node has a splitting issue. So it's in no things. There are two requests. And it sends back one response. Then another user came for uh new request which is request C. Varnish re-users a couple of connections with the back end. So send the request C which is appended to the untaminated request. And then it gets response B. Which was my hidden request. Um the user 2 is deleted. Uh only if you do not have um CSRF protection on the post request. So this is a way to run this attack. It's just a request I run it. So it's uh on Linux with a printf and netcat. Just to put the contents in a TCP IP connection. And I do it uh 150 times just to feed every varnish um TCP IP connection. Uh in the pull off back end connection with uh Node. And it works. Believe me. You can try. You've got everything on the CD if you want to try. It worked um before it was fixed on Node. Um there was a second demo. Um on this one is about HTTP 0.9. So HTTP 0.9 is something awful which should not exist. Uh it was the very very first version of HTTP. Where you do not have any errors. So you've got an example of what is HTTP 0.9 1.0 and 1.1. On 0.9 you do not have the protocol version. You just the method on the location. And no errors. No errors. It means also no errors on the response. But the security of HTTP is in the errors. Like the content type, the cookies, the content security policies, the content length. Everything is on the errors. On HTTP 0.9 you've got just the body of the answer. So it's just text stream. Um if you've got a text stream maybe you can make this text stream looks like a real HTTP response with errors. So for example you could make an image. And the content of the image instead of being a binary thing would be uh an HTTP response with errors. And if you requested this image in 0.9 mod it would be made looks like an HTTP response. You could also try to hide uh these parts, these HTTP message in the exit data of the image. And make a round query to get only this part of the image. So you get a real image. And if you request the right part of the image you've got an HTTP response. But you should not be able to do a round request in HTTP 0.9 mod. So another, another program uh is the no cache poisoning. Like maybe you know about cache poisoning in HTTP. But for cache poisoning you need the cache. No cache poisoning is in fact socket poisoning. Like take TCP, TCP IP sockets and you hide the response on the sockets. Um another user when the socket is reused get the response. So this is a real thing on FHG for example. So this was the thing we could try. Like here we've got uh a splitting issue on Go.  Like transfer encoding with a space is fixed as transfer dash encoding. Uh so for everyone the line transfer encoding chunked means nothing. But for Go it's a real line. So same as before the blue part uh is no new request. Um there's the no cache poisoning we use it. Uh there's another bug on uh Go which is that we can ask for HTTP 0.9 which does not exist. And this makes a 0.9 query. It should not work this way. And there's a third bug on Go where we can make a round query in 0.9 mod. It should not exist because in 0.9 mod we should not read the request errors. So you make a request uh with a splitting issue on the Go long reverse proxy for example. Yeah I've got an Apache reverse proxy which transmits the request to Go. I've got a splitting issue on Go so Go is doing this request um uh against engineings. It targets an image and takes only the HTTP part of this image which gets back in HTTP 1.1 mod. But for Go it's an HTTP 0.9 request. So it removes the errors of the response and sends you back the real thing. Um it's hard to understand with the demonstration but it works. It means I can um request with the Go an HTTP response which is in an image on a server. Um inject this response on the streams of response. But there's another problem for Apache if we get back there was only one request. And it gets one response. Then there's a new response which scans back which was the response hidden in the image. And for Apache there's nothing to do with this response so nothing's happened and the response is stored on the TCP IP connection. Then when a new request is coming for Apache from anybody, Apache reuse the same TCP IP connection with a backend, send a new request and a read on the TCP IP connection to see maybe I have a response inside and you see that he has a response and takes it and send it back to the user. Just before getting the real response which was A no you should not reuse this connection. This is an RST on TCP IP because there was a 0.9 response so you should not reuse the connection. But it's too late. The message was stored and was sent back to the user. So you can store a response in Apache and get this response with maybe an XSS or maybe everything you want like any header you want, any content security policy header and send it back to every user. So this is the way to do it if you want. You need to run a lot of requests because you need to feed every TCP IP connection. And I cannot show it to you but it works. What can I say? But the real problem on these things are the splitting issues. If we get back just a little here, this is the real problem on go and it's fixed now. As soon as you have a splitting issue bad things happens like having an extra response sends back and for a page the fact that you've got the no-cash poisoning is a public issue. It's not a security issue because they consider that there was a security issue for go. There was a splitting issue and what happens after that is not their problem. It's a little their problem but it's complex to manage if you think that the back end is doing bad things you cannot do anything. So for every splitting issue you should get a CVE because for me it's quite critical but usually project leaders do not like doing CVE on these things or maybe sometimes they do not understand how you can exploit the injection because also they do not want people to try to do things with these issues. The other issues are transmission of the strong syntax. Like I had something which is quite very strong syntax like transfer encoding with a space. You should not have any error with a space in the error title. And a reverse proxy could detect that this error is invalid and could reject your query but usually they do not do this. So there's a big problem of responsibility because everyone is trusting every other one and no one wants to take the full responsibility of the problems on things which looks like smaller things. For security researcher warning you will not earn money with a HDP smuggling because you cannot test it like an XSS thing. You cannot take a big infrastructure and try to break everything because you won't be the only one impacted on this. You may crash everything, you may send back response to people that have nothing to do with you. So it's very hard to test on public servers. I earned one bounties with a go long issue from Google but it was unexpected and it's very hard to usually explain to people that maybe they should have got their servers. The other thing is that we should have more people reading the code of HTTP servers. Like there are a lot of issues which are still there. We need people which really do not trust blindly the code. Things get better. Years after years the issue gets fixed and you should really try to upgrade to avoid problems. Some other exploits maybe because we cannot see demos so we can take time on exploits. I had some exploits on engineings like there are integrals overflows. This cannot be used with engineings as a reverse proxy but if you got engineings as a back end you can try strange things with very long numbers. This was fixed last year. There's another issue which is fixed only in currently which is a 0.9 downgrade using HTTP 65536.9 or .8 where you can even use a post on this is a 0.9 query for engineings. So you get no errors in the response. This is usually not transmitted by the reverse proxy to engineings. Like you need to exploit this sort of things. You need to get engineings as a back end and you need a reverse proxy which transmit these bad syntax and this usually doesn't happen but in the past HAProxy was transmitting these two engineings. HAProxy is one of the best HTTP tools against smuggling. Another one here it's a severe against varnish. We are the CIRA and the offline was valid and you could also use double content line failures. There's another one but I can't remember what I can't read it. And another one on HAPachy. Like it's on the chunk size attribute. So when you do chunk transmission you've got chunks with the size. There was a chunk issue like only the 31 first character are reads. There was a chunk issue. So you can use the work writer and try to alter the size of the chunks. This is now fixed of course. There are all the other exploits I showed previously in go in HAPachy like the nutcache poisoning in NUD. And there's also other people which fix overflows like we had one in the Python URL lead recently. And on NUD there were overs. So how do you protect against this? The first thing is to use the last RFC which is 72.30. And a lot of people are still using the very old RFC for HTTP one on one which is really very, very old. You should really try to reread the RFC because on this new version there are a lot of things against smuggling. Like they said you should try to avoid chunk and content length. You should really avoid rewriting your own reverse proxy because it's a very hard stuff but in case of if one day you try to write a reverse proxy, the goal of the reverse proxy is to rewrite all headers in a very clean way. Do not take blindly the headers I sent and give it to a backend. You should try to read books on TCP IP socket connection because it looks like something like an abstraction which is simple but in fact it's really not simple. You should also think about browser and browser do not make HTTP errors. A lot of HTTP servers are still allowing a lot of things like HTTP 0.9 because of monitoring tools which use 0.9 or because of bots or because of bad implementation on the wide but I think you should reject bad implementation and you should restrict what you allow in HTTP. You should be interirond. And this is one of the problems. There is this sentence which was in general an implementation should be conservative and it's sending behavior on liberal and it's receiving behavior but maybe it's wrong. Maybe the right thing is not being liberal it's being robust. Like you should think that you may get some bad things and you should handle this thing. Maybe you need a special error message maybe but do not fix the things blindly. And there's a new RFC which is called Draft Stompson Posted was wrong which is talking about this thing. We should not be interirond on the protocol implementation. I think also that you should be able to get more option on the HTTP server configuration. Like you should say I do not want to support HTTP 0.9 because even today you may get an HTTP 2 server in Go for example. You've got very nice HTTP 2 server but there's still the HTTP 0.9 support inside. And you should also be able to get the keep alive thing without the pipelining. So there's no option to say there's no pipelining on the server. You could also try to get back to HTTP 1.0 but you get some problems of performance. You may also think, I was thinking this, that adding a reverse proxy will secure your installation and maybe in fact it's the contrary. Every time you add another layer maybe you add another issue. The reverse proxy trusts the backend response and it's the way it works and we never think it works this way. It means if you've got the reverse proxy and you've got the backend with the PHP application and you let everyone write PHP application, everyone can break your reverse proxy simply by sending several responses. So the reverse proxy will always trust the things from the backend and we do not think this is the case. Think about things like asia proxy because it's a very good tool to remove everything which is strange. Engines as a reverse proxy is also quite nice. The next APH in what proxy will have the strict protocol option which is nice. Is HTTPS protection? No. It's just a layer so it's not full protection because it's a side after the SSL thing, you've got just HTTP 1.1 and maybe when you add an SSL terminal you just added one another HTTP server. But HTTPS is great of course. Is HTTP 2 protection? Yes of course it's better against smuggling but you can always ask HTTP 1.1 for an HTTP 2 server. It's just another transport layer. Just the last thing, I wrote a tool which is called HTTP Wookie. It's an open source tool. I will release it today or maybe tomorrow with a test. The goal of this thing is to test reverse proxy implementations and to fuzz HTTP. I need to remove some of the tests which are not fixed yet everywhere. But if you need to fuzz your own server you could use this tool. If you got any question I would be outside. And that's it. And thanks for everyone.


The pride of Saraland, Alabama, did I say it right? Yes, sir. Bayless Jones Jr., congratulations on all your success.  What kind of a thrill is this? Man, this is a dream come true. Honestly, I'm truly blessed to even be in this situation with all the players out there in the country that fought hard and they gave the offer to universities. And like I said, I'm blessed to be here. Being from Mobile, Alabama, I'm to be able to come back. Years of being at the senior bowl, being that kid, looking up to these players that's preparing for the draft. Man, like I said, those guys are like superheroes to me. I really looked up to those players and now that I'm in a position, it's crazy. So I can get back to my community, to the youth and stuff like that and give these kids hope and show them like they never give up. It's been a journey for me. This is my six year in college, five years playing. And so honestly, no matter how long it takes, as long as you get where you got to go. Your life changed with a move after four games.  Ended up catching over 50 balls, nine catches for 50 yards or more. You exploded. Why did that work so well in year six? Well, Coach Hypin, me as like a player, I'm a good ball in hands guy. Just get the ball in my hands any kind of way. I could turn a stop route into a 60 yard run after catch. Just my skill set, I'm good at hand.  And so I feel like that's why they moved me to the slot just to get the ball in my hands in certain situations. And so, and I took off from there. Mr. Skill said I had that I was blessed with, born with, thank God. Let me talk about another one. That's punt returning. You don't learn to be a punt returner as much as that's innate. Why are you so good at that? Why do you like doing it so much? This is my crazy thing is, this is my first year doing a punt return. Yeah, first year punt return. No kidding? Yeah, I just started into the fifth game of the season. It's crazy. Coach Echler, special team coach, one of the best coaches I've been around, had all the faith in me and told me I had raw talent. And I knew that myself. And so everything was just based off instincts. You know, when I get the ball in my hands, make the first guy miss. And I'm pretty good at it, I think. And you know, this is my first year at it. So we'll see if I'm gonna be doing it at the next level as well.