my goodness gracious everybody take a seat as quickly as possible I'm going to introduce our next speaker Kathy Wang from Cinec Labs will today be presenting frustrating OS fingerprinting with morph before this she has worked at Compaq as well as with counterpane internet security she's presented at numerous conferences including not a con okay shameless whoring for that one yeah anyway kick as I said Kathy will presenting her presentation on morph today here you go Kathy have a good presentation I'm Kathy Wang and I'm here today to talk about more which is a tool that I've been working on since late February this year and as Faji said I did speak on this at not a con okay so let's get started we have lots of material to go through but what I'd like to start with is give you a sense of OS fingerprinting history and what's been going on there and then get to the real thing more which I'm here to talk about today more was built on certain libraries so I'd like to go into more detail about that and then the architecture that morph was built on of course is going to be very important there were some implementation problems that I had with more along the way and I'm going to share those with you as well and of course more isn't anywhere near done as I'd like to see it so there's some future considerations for more work on more and there were some people who helped me out with more than finally for questions I have a special request my hearing isn't really what it could be so and in a room this size it could be difficult to hear questions so I'm going to be asking a hearing assistant to come up here and relay the questions to me so please save them for the end that way we can make sure that I get them off okay so what is OS fingerprinting back in the days before case so came out people used to look at you know banner information that got thrown back when they would do a telnet or some connection attempt and based on that type of information they can determine what OS they're dealing with there's also manual reconnaissance which involves things like reading email lists to see what system administrators from certain companies ask questions about how do I deal with you know AIX this version so then you say oh well that's the company that uses AIX servers so based on information like that and I guess some people would do dumpster diving type things you can figure out what type of systems a place is running then active fingerprinting came along starting with case so and the point for active fingerprinting is to send packets to a certain target host and elicit for responses from them and based on the responses you can figure out who they are passive fingerprinting is a little bit different in approach because instead of sending packets to the remote host to get information back to make determinations you're simply just sniffing on the same subnet and based on the type of packet that you see coming across your interface you can determine what OS they are timing analysis fingerprinting is sort of a very subset area of active fingerprinting because it is sending out packets to the target host and looking for response as well but with timing analysis you're looking at well let's say you send out a sim packet and they send a sim app back while you're dropping that packet and then seeing how long it takes them to continually keep sending you sim app packets so you can determine based on the timing difference what OS they are okay so I talked about the different types let's talk about the tools that are out there the first tool was case so which is an active fingerprinting tool and it was based on sending packets to open ports on the target host and I'll be going into a lot more detail about these tools later and then I'm not came out and utilize some of case those techniques except instead of only sending packets to open ports it also sends packets to close ports the passive OS fingerprinting tools that came out like I mentioned in a previous slide sit on the subnet and listen for what type of packet that it gets and based on that information determine the OS X Pro 2 is a very good tool is the ICNP active fingerprinting tool which instead of just looking at like TCP header type responses it looks at ICNP and ring is actually a proof of concept tool I don't think this tool was ever released there were white papers released about how it works but not an actual tool but it's looking at timing analysis like I mentioned in a previous slide so how many people in this room have ever done a pen test okay so we have a pretty good number of people when you go and do pen test you're interested in knowing what your target host OS is that's one of the most important pieces of pieces of information that you can get about the host because based on that information you can then make determinations about you know what kind of exploits you're going to run against that host so this is very very important information now OS standards know something okay they know that like vendors you know implement OS stacks differently depending I mean everyone looks at RFC 793 for TCP implementation but everyone has kind of a different way of doing it and I'm not here to bash vendors or say that you know vendors aren't following the rules as defining RFCs but they're really all legitimate gray areas and you know for example what do you do when someone sends you a TCP header with the flags you know sinfin urge push set I mean or how do you like respond to a fin different vendors would do that differently and based on that information that's the kind of information that OS standards exploit to determine what OS the target host is so in essence I guess the OS being honest about who they are because they have to respond as they were implemented makes them a target alright so like I mentioned I've been working on more since late February and what more is is when it's compiled and installed on a certain host it runs as a usual land process and the goal for more is to be able to emulate Windows 2000 Linux 2 4 and open BST 3 3 well right now more will emulate Windows 2000 and open BST 3 3 so I haven't actually gotten the Linux 2 4 kernel stuff implemented yet now what more for do is more for all modified packet information to full the remote hosts and that packet header information can be TCP headers UDP headers ICMP no IP headers and currently more for actually compile and install on a Linux 2 4 kernel I haven't gotten it working for Windows or open BST or the other BST yet but that's in the works I definitely wouldn't take more than install it on a production quality machine just because if you do that I'm not responsible for what happens now more of this BST license so you can download it for free at CinecLab.net projects more URL so please feel free and download it it's available right now and play around with it and let me know what you think okay if it wasn't for packet purgatory I wouldn't have been able to write more nearly as easily and just to give you an idea using packet purgatory it has probably reduced the number of lines of code for more like by 4,000 or something so that's good for me so more of this built-on packet purgatory which acts as a wedge between the OS kernel and the interface and packet purgatory library was written by Todd Math Dermott who's also a Synapse lab member and sitting over there okay now packet purgatory is built on LibPcap and LibPcap libraries. Morph uses LibPcap to sniff on the interface and uses LibPcap to write raw IP and Ethernet writes. From a high level standpoint this is what Morph looks like and I'm going to be drilling down into more detail about this shortly but you can see that there's a remote host associated and then based on whether the remote host is the one initiating the connection or our host the host OS kernel is the one initiating the connection you can see that packet purgatory is that wedge between the interface and the kernel so it blocks all the packets from going directly to the kernel and instead intercepts and sends those packets along to Morph which starts this handling job and to give you an idea of the Morph architecture packet purgatory didn't just disappear it's actually part of the Morph picture here because I built Morph on packet purgatory library but Morph is consisted of three main parts an inbound handler a state table and an outbound handler so all incoming packets to our host OS come through the inbound handler okay and based on whether that packet is destined for an open port or a closed port inbound will either respond directly to the remote host in the case of closed port destination or it will pass the packet along to our host OS kernel if it's destined for an open port and I like to use the kernel to do some of the response work because it makes it a lot less work for me with Morph I mean why not it's there already so if the packet gets passed along to the host OS kernel the host OS kernel will respond accordingly depending on how it's implemented and then it will pass that packet along to outbound handler and then the outbound handler will then modify headers or you know do what it needs to take do in order to convince the remote host that this is not the OS of we don't want to be so there's also a state table involved and the state table is useful it's a hash table and right now it has four pieces of information in it it has the source IP destination IP source port and destination port and the state table is useful for when for example we initiated a sin connection with the remote host and we need to record that information in the state table so that when the remote host responds with a sin app or no that's part of a legitimate ongoing connection as opposed to you know when M-map sends a sin app packet to us and we have to say oh well this is a you know this doesn't make sense and it's not part of a connection so that's what the state table is useful for now packet purgatory this is just more information about it it's also available for download free download and it's actually not a kernel module it's a user land process and packet purgatory actually comes in a couple of modes and let me go into more detail about that there's a proxy mode and there's a loop graph firewall mode so if we look at the proxy mode first by the way you would use the proxy mode of morph if your firewall isn't supported by LibD9 so for example if it's not IPF or IP chains then you would use proxy mode okay and the advantage of using proxy mode is that your firewall rules are blocked right so you can still maintain the same rules but promise in a nutshell if you look at the proxy mode what happens is the remote host let's say for example remote host sends a packet in inbound gets the packet via packet purgatory pushing the packet over because the LibP cap sniffing on the interface and if that packet is destined for a closed port then inbound will do a raw IP right via LibD9 and respond directly to that host now if that packet is destined for an open port then morph will actually do a raw IP right via LibD9 and then send that along to the host OS kernel the host OS kernel will take the packet and respond however is going to respond to it and then that packet will make its merry way along and packet purgatory will intercept it again via LibP cap and send it to outbound which will rewrite the packet or modify the packet so that it's proper response and do a raw IP right via LibD9 send it back so that's how the proxy mode works loop back firewall mode this is the mode that you will use if you're using IPF, PF or IP chains and what happens is packet purgatory actually blocks your firewall so your firewall rules no longer apply okay now so when the remote host sends the packet, packet purgatory is there via OS firewall blocking and then send that packet along to inbound and inbound is going to either respond directly to the remote host or pass it along to the kernel depending on whether it was destined for an open or closed port and you can see that it's very similar except this time instead of we're going to do raw ethernet writes this time because if we don't and we do a raw IP right the packet's going to go back to the loop back interface and we don't want that but I'd like to note that when the packet gets sent along by the inbound handler there's information such as like the source IP address gets changed so that like we don't actually you know we actually send it to the right place okay there are certain OS scanners that are more for full TASO, MNAP and Xpro I'm still working on pulling the passive OS fingerprinting tool and of course the timing analysis tool I'm still working on that as well but hopefully we'll get that done soon. It's worth mentioning that there have been other tools in the past that defeat OS fingerprinting for example there's FPF and there's IP personality. I like IP personality quite a bit except that it's actually written as a patch for the Linux 2.4 kernel which makes it not very portable okay not portable so my aim here with more of this is to write a tool that does OS emulation and is also portable so because I figured most of the people who are running more maybe are administering Windows systems I mean you know they want to pull people into thinking they're not Windows so I think it would be very useful to have something that works for Windows. FPF I tried to use and it actually didn't compile plainly so it's pretty buggy but it's also kernel module so and I think later on they also adapted it as a kernel module for OpenPSC so it's still not portable okay so just to summarize the techniques the active fingerprinting passive fingerprinting and timing analysis they can all be defeated with morph and you know I mean if you're running morph on your system you own that system so you should have ultimate control over what that system says okay before we do the talk about more I'd like to do a demo of more for you okay so this should be big enough fun for everyone to see hold on let me get this I have this all set up now it's lost okay hide that again all right great okay so what we have here is we have our host here that is running morph and what I'm going to do is I'm gonna do an MAP scan from this host first against this host without running morph and let you see that it's a Linux 2.4 kernel host and just to make it quicker I'm going to pick one open port and one close port okay so you can see based on the scan that this is a Linux 2.4 kernel host now I'm going to run morph on this host let's make it Windows 2000 run MAP again right so now you can see it says it's Windows 2 Windows host okay so now we're gonna run this as open dsd and there we have it says open dsd so that was the demo so now you have a much better idea of what morph is doing right anyway so now I'm gonna go into a little bit more detail about the implementation of morph based on how different OS scanners behave there's case though which I chose to start with because I thought it would be the easiest case to start with and it actually sends seven different packets to the remote host to the target host and all of those packets are destined for open ports and they're all TCP header type packets here I put together a table that shows what morph does behavior wise to those different packets that are sent by case though most of the cases aren't very interesting for example I'm just going to go over a couple of them for fin packet if you're running Windows Windows will respond to a fin with a reset okay now if you're running you know Linux or open dsd or something you just won't respond to that so in this case we have to know that okay we're trying to emulate Windows so we need to have inbound you know respond directly to that packet because the underlying portal is Linux and it's not going to respond to that packet so we have to you know be able to convince the scanner and by the way just in case anyone got the idea that morph only deals with the packets sent by scanners that's not the case morph is actually designed to deal with every single packet that it receives okay so it's a total solution to behaving like the OS that you want to be and the reason why that is it's because if you plan on pulling the passive OS finger pointing tools and you only deal with the packet sent by you know scanners then you're not going to be convincing in that factor now expo to what's the next tool that I chose to work with because most of those packets sent are ICMP informational type packets and that's pretty easy you just have inbound respond to those informational type packets all the time so you don't even have to loop it through the corner or south so ICMP headers four different types one of those is really interesting is a information request packet and so of course I was like what's that so I look at TCP IP illustrated volume one read that section and it says it's obsolete okay so I'm like well what's going on how come they're sending obsolete packets who's going to you know deal with that so I look at the finger point file for Xcode 2 and found that like AIX deal with that so I'm like hmm not very modern are they you know so that was an interesting case for one of the cases and of course Xcode 2 also sends a UDP packet for ICMP on mutual and also a vanilla send pack regular send packet and here's the table again for how more feels with Xcode 2 you can see that it's not horribly interesting most things are responded to kind of like what you would expect now and map I chose to save for last in this process so far because it's actually the most complex of all of them and oh I didn't mention about Xcode 2 but you know how Xcode 2 does the fuzzy fingerprinting technique where you know it determines what percentage chance there is that your target host is this OS so it doesn't have to have like an exact match in fingerprints okay it just has to have like it does percentages and I was like hey well that's actually a joke itself because it makes it easier for me like writing more to like pull that because all I have to do is be approximate I don't have to match exactly like I do with Nmap so I like the fuzzy fingerprinting idea but from the standpoint of trying to frustrate OS standards you know makes it easier but okay so Nmap needs open ports and closed ports in order to be as successful as possible in making it determination so if you run Nmap I'm sure most of you have and you look at like the messaging and it says okay TCP sequence predictions want to be more difficult that type of message that's because you know couldn't find open port or something like that and then half of its cases doesn't work so that's why that's a problem Nmap is challenging because it has to be exact match and if it's not an exact match then it's it's out I don't know send me this fingerprint you know and I'll figure it out there's nine different types of packets five to open ports and four to close ports and here's a table for Nmap you can see on the left that I have the open port section and then the close port section and most of these cases well obviously all the close port we're going to have inbound deal directly with responding to it and the open ports know it's just none of the flags are set a simple urge push that depends on what OS you're dealing with some will respond to that and some well but that's the cases for Nmap now I mentioned the morph state table and I hadn't actually gotten into a lot of detail about it yet but the state table as I mentioned earlier is very useful for maintaining session state but it's also going to be useful for doing things like sequence number generation offsets and the reason why that is is if you're running an underlying OS like open BST or Linux where your sequence number generation is truly random and then you want to emulate Windows 2000 where the sequence number generation is not truly random it's randomly incremental and so what are you going to do in that case let's say our underlying OS initiate a connection so it's a sim packet goes out via outbound well but that sequence number was randomly generated because our underlying OS is Linux but we're trying to be Windows so what we're going to do is outbound is going to generate a random or as random as Windows can be number okay and then take the offset between that newly generated number and the number that was generated by our underlying OS and save that information in the state table so that the remote host will think so think that this is Windows and when the remote host replies with the syn app you know then we're going to take that offset information that's stored in the state table we're going to apply it to that number in the acknowledgement numbers so that we can stay consistent within the underlying OS so that's one of the useful other useful things that the state table can do and the state table will also be used to deal with timing analysis type of scanners because when you have a certain OS that you're supposed to emulate and a tool like ring is looking for how often you're retransmitting certain packets that you need to know what the timing allowance is for the OS that you're trying to emulate so you can be consistent in retransmitting those packets and I've had people ask me before so what do you do if your packets get retransmitted in X amount of time let's say and then you didn't get it retransmitted fast enough to meet that time that you're supposed to well I always tell them it's okay because packets are always getting lost anyway so what you just do is wait for the next opportunity that comes along to retransmit it so don't worry about the one that you miss opportunities okay as I mentioned I'm still working on the passive OS fingerprinting by default that is looking for sin packet information so I'm looking at that right now and the timing analysis analysis timing packet timing analysis stop or ring and also I mentioned snap time because that was a tool that I found which uses timing analysis and also some properties of passive analysis and actually implemented it so that it's downloadable and installable so it's not proof of concept now earlier this year at Kansas West there was a talk I don't know how many people here were there did you see that talk yeah okay couple people so most people haven't but I believe the guy who did this talk works at NFR or something and he was talking about new fingerprinting techniques and it's not like the new techniques are beyond you know active or passive or timing analysis they just expand on those areas more in ways that haven't been done before for example he'll use layer 7 information and how does he do that for example he'll send you know like an HTTP get packet over and then see like what kind of you know the host will respond back to that and then he'll drop that packet and the host will retransmit and apparently when application level packets get retransmitted by a certain host OS it's different timing intervals than like when it's like TCP header retransmits okay so he'll use that different information from the applications to make his determination on what OS is so that's pretty novel because that hasn't been done before so that is actually a timing analysis expansion technique and he'll also do things like measure window behavior under congested conditions and what I mean by that is every OS implementation has window sizes certain window sizes and those sizes are like buffers and when data gets transmitted over let's say you know Linux allows like 5.7k okay window size and windows is like 64k or something so then when windows transmits over and you're trying to be windows but you're underlying OS you know Linux then you have the problem with having to and that's another thing that I do with the state table is you having the problem of like telling people that your window size is this when it's in reality on the colonel side is smaller than that so there sends you all this information at one time and you'll be like well I you know I need to save the information the state table and kind of read off of that you know as it goes along because I can't handle that much data one time on the underlying OS side so what he'll do is he'll look at the buffer information stuff and like the target host will send a request for more information when it buffer gets read off and he'll look at the timing for that that gets sent and determine what OS it is now I keep talking about getting fingerprinted how can you avoid getting fingerprinted well I guess the hard way to do it is to try to push for a new RFC so that all these unspecified unspecified behavior packets can get addressed you know so how does everyone deal with this and try to make it consistent across all of the implementation but that's the hard solution now the easier solution is that you can place hardened critical high value target servers behind a proxy device right so that every time someone trying to talk to one of those machines that are your high value target it's actually talking to the proxy device and all they can do is figure out the fingerprint the OS for the proxy device and not the guys behind the proxy device and if you're really really paranoid you can do that setup and then you can like you saw something like more on the proxy device so that they'll never know what any of those OSes are now there were a lot of challenges to implementing more and one of them is the different window size than what the underlying OS is like I was just talking about so how do you deal with you know if you're underlying OS window size is smaller than what you're advertising to the remote host I'm having to maintain connection state to determine whether something normal or not it's a challenge even if you run more okay so you're running more and if someone was like a casual attacker and all they cared about was just running a mass scan out there to see what OSes are available so that they can start targeting specific hosts after that information then more can help you with that but if they've already decided that they're going to target you and they're going to run you know application scanning or you know like a poor scan against you and they see that you're advertising that you're open BST but you got not files for it's open well more physical to help you there okay so it's good for casual attackers but it's not good for you already a target a serious target also there are exploits out there like the names are warm which doesn't care who you are I mean it's just going to go around and knock on every single door and if your windows well running morph isn't going to help you there and I want to emphasize that morph is not really like a security solution a complete solution all it is it's one additional layer that you can use so don't think that this is the overall solution what would I like to do for morph in the future I really would like to support more OS simulation I first of all I'd like to get Linux in here I want to build more compiling some more fun windows the challenge with that right now is that more open close port determination implementation it's not you know it's not like windows compatible right now so what I was thinking was that I could use a positive compliant like I could use open bind and close and those are positive compliant and I'll be able to use those to determine whether a port is open or not by saying open you know a port and if it succeeds then that means that the port was closed so close it back up and now I know that the port was closed okay and if I and if it doesn't open it fails then I know that the port was actually open so based on that information I can like determine whether reports open or close now there's going to be some computational issues with that but I'm still looking around for how I'm going to do this for windows obviously I'd like to for other standards like the passive OS fingerprinting soft and timing analysis type scanning and everybody wants to add gruries to the stop side guess I'll add a gooey to more all right these are some people who help me out with more in one way or another Todd wrote packet purgatory which was immensely useful to me and some of these people looked at my slides and made suggestions and stuff and other people like call me from Kansas at West to tell me what it was like you know okay so now we have the question section and I'm going to invite Todd up here to help me out any questions the question was what type of network congestion or performance costs does more have okay I did like a SCP on my local network with more host running morph and it took like almost eight seconds to do it when it's running more than like about four seconds to do it when it's not running more but that's on a local network now if we're dealing with remote connections then we're going to have a different picture it's going to be a lot less noticeable because you know it's a remote connection this time did you program morph in such a way so it's easy to put in new OS spoofing implementations are the US implementations that you're spoofing hard-coded in right now or is it pretty easy to put in new spoofing um yes I program morph so that the different cases are hard-coded in right now but I'd like to eventually make it a reference table implementation so that it's easier to scale with all the different fingerprints and stuff the map has and things so what's the server overhead on it I actually haven't tested that so I don't know do you mean like network overhead or CPU CPU overhead yeah I haven't tested that can morph be used with a firewall at all yeah if you want the firewall rules to apply instead of getting blocked then yeah you can use morph under the proxy mode and then what are your thoughts on the feasibility of evading timing-based attacks well I think that if I'm going to be able to make more a more comprehensive tool I'm definitely going to have to evade those timing analysis attacks I talked about how I was going to use the state table to store that information between the timing of the package so that I can do that and I don't think it'll be very hard to do but I actually haven't implemented it yeah so I'll see when I ask you do when morph is running in proxy mode does it pass the packets directly to the kernel or does it make more of a local tunnel collection connection that's more of a packet purgatory question I mean to get that okay right packet purgatory when it's doing proxy mode is actually it's changing the source IP address so the packet comes in remote to the proxy gets rewritten so it's proxy IP to local response goes from local to proxy and then it goes back out from proxy to remote the question was if you've got config file that restricts connections on the local subnet what happens fundamentally yes if you're running if you're running packet purgatory in proxy mode it's going to look to your local machine like it's coming from a local machine and so you got to think about that that could impact your security policy yeah the question was since we're going to the trouble of emulating certain OS packet based behavior how difficult would it be to add in additional stub services so it appears that we're listening on that bios even when we're not actually okay I don't know if you saw on the slide but I had in parentheses after the application scanning stuff polymorph which is a project that I'm looking at working on max which will deal with them and maps application scanning capabilities so I haven't started that yet so I'm still thinking about that but I think it's definitely worth looking at possibly implementing something to full application scanning that that's honeyd in a nutshell I don't want to re-implement honeyd this more also emulate the time to live on the packets of the operating system oh yeah the time to live is some in the TC in the header so yeah more for actually modify that if it needs to depending on what OS you want to emulate you talked before about implementing morph on Windows what are your plans for that well as soon as I can figure out like writing the code for doing the open close port implementation determining whether the port is open or closed I'd like to do this under like a sig win environment but I have to spend some time doing that first what's the commercial motivation for implementing morph well I don't know that I was thinking about the commercial motivation it's been a wonderful learning project for me and I really like working on it because I think it's really cool now commercially it's PSD license so people can do whatever they want with it that they you know feel like doing so I guess that's the most commercial aspect of it okay well I gotta go so thank you very much


The Israel has launched airstrikes into the Gaza Strip in response to clashes along the Gaza-Israel border on August 21. According to the Israel Defense Forces' IDF, it struck four Hamas weapons and storage manufacturing sites. A local Gaza seat arrested Mohammed al-Said recorded a video that shows several explosions on August 22. At least 41 Palestinian protesters were injured and one Israeli border officer was shot during the border classes on Saturday, according to Jerusalem Post.


Hi, you guys. I'm here today to talk about faux fur best. Sew Together is a little challenge that I run over on my Patreon where all the Hemsiders, that's their nickname, the patrons, and I make the same pattern every single month and we kind of just chat about it over there and people get help and stuff. So for this whole year, I've decided to do free sewing patterns and this month's pattern is the mood faux fur vest. And when I say that, that's a very loose, using the term pattern is very loose because it's more of like a tutorial and then it's also like a very skimpy tutorial. There's not a lot of information there. So I thought I would expound upon that here and help everybody that wants to make that pattern but is left with more questions and answers after reading the tutorial. Like I totally get that. The concept that the writer of the tutorial has is pretty good. It is very simple to draft your own vest pattern. We really shouldn't be overthinking it too, too much but the way she has you do it is a little bit confusing and also could cause there to be issues that you wouldn't know because she didn't elaborate enough. So the first kind of problem that I see with the tutorial is that she cut out her pattern, cut out her fabric where there's no shoulder seam. So just imagine putting it up over your head and so it's one whole piece. So that's great for the front. You gotta remember we're working with fur here and fur has a nap. Some furs do where if you rub it one way, it feels good.  If you cut it all one piece and then put it on over your head, the parts in the back will be opposite of what's in the front. So you have danglies in the front, it'll be up in the back. You know what I mean? So whereas that worked out for her fur cause she even says in her tutorial that her fur had no nap. That's great but for universally speaking, most furs have a nap. So we need to add shoulder seams to the pattern that she drew out. You have two paths here once you get to this point. You can either take like an oversized jacket pattern or an oversized t-shirt or something that fits like pretty long in the shoulders and pretty boxy and not really fitted. And you can just use that pattern as your vest pattern. Just pull that out, cut out the pattern pieces as you normally would. I was trying to like lean into what she was trying to do like, hey, you just draw it out and it's no big deal. So I took some videos of me cutting out my fur and how I got kind of the shapes that I was going for. I use a lot of body measurements. You can see she has on hers underarm measurements. And then I think what's supposed to be like a waist measurement maybe a bust measurement, it was really confusing. And then that's it. Those are all the measurements she took, I think. So I added to that my shoulder length. So if you put on a necklace or even like this shirt here you can see how it's kind of like riding up right about here. That's where I'm measuring and I'm measuring out to where I want it to go which is a little bit over my shoulder. So I took that measurement. I took my bust apex. I took my hip, oh and the arm size.  So I wanted it to come down right about here. So I measured from here to here on my body as well. And then I cut that out. So here's what that looks like. Okay, so here's what I'm gonna go with. These are all based on rough measurements that I took on my own body. Started with my shoulder length. I went from like my neck area, my neckline kind of like where a necklace falls on top of your shoulder and went out kind of falling a little bit on the outside of my shoulder that ended up being six inches. And then I measured down from that point on my shoulder to kind of like under my armpit where I wanted it to end. I needed to know how long this needed to be. And that came to six, seven inches as well. And then I just took my ruler and drew a line kind of following a curve along those two things. And then same thing for the back neckline. So all of it's kind of roughly based on the length of my shoulder. I want that to be accurate.  And then from here, we're gonna go straight down. And the width that I folded this over is the width of my hip. Plus two, three, four inches maybe. So that's how I got to this width and how I know that that's what I'm gonna do. So okay, I got the back cut out here. And then I saved the scrap from like the neckline. So this is the shoulder and this is the arm hole. So I've got all of this to be the exact same as the back. And then once I get here, I'm gonna make some kind of v-neck situation. I'm not entirely sure what yet. But I'm gonna use this to mimic the arm side and get the shoulder going and then decide what to do about the neckline. Yeah, it's not as big as it seems. So something like that maybe, right? That'll be pretty. And then cut along the middle here.   That way you'll have an exact matching fronts. All right, and then if you're wondering how I'm cutting mine, I am using scissors because I have an exacto knife, I don't even know where it is, but the blade was so bad on it, it wasn't working. So all I'm doing is taking these serrated scissors from Kai. They have like, I talk about these all the time. I really do grab them more than I would realize. There you go. Can you see the serrated? So I'm just opening them up like this and then doing this dragging number.  But this is actually working really, really well. Very, very similar to an exacto knife or a blade situation. Okay, so just to reiterate, the back is cut on the fold and you have shoulder seams, you have like a little scoopy part for your neck and then you have scoopy parts, semi-circles for your arm size and it goes straight down from there. Okay, and then for the front, you have the same thing for your shoulders, same thing for your arm size, same thing for your side seams, except you're cutting up the middle, so not cut on the fold. And I created like a little V to go out to my shoulder seam here. And then as with any fur tutorial, they talk to you about not just cutting through it, like they do at the fabric store, but to take a razor blade to the back like netting part and literally cutting that, but not cutting the fur. So I was able to accomplish that by using my Kai serrated scissors, which you saw in the video. And then once you got all your pieces cut, you can kind of pick back up with the tutorial again. Her instructions for making sure all the fur is going to the inside of the seam allowance and sewing along there was all really helpful, but on mine, you're gonna sew it the same way, you just add the shoulder seams. So the shoulder seams, so the side seams, sew the same thing on your lining, sew those right sides together, turn it all out. Hopefully this all helps kind of clarify the free tutorial, the free faux fur vest tutorial that Mood has. So hopefully, yeah, you guys will join us. My Patreon is linked in the description box below. And yeah, you can hang out with us and make not only this pattern, but all sorts of patterns. So I hope you'll join us there. But yeah, that's gonna do it for me today. Happy vest making, bye.


and we'll go from there. If not take off, thanks so much. Now let's get into the good stuff, which would be the Q&A. Always great questions. Always good questions. LeBron James, long-term back. It's a very point, it's a good point. Tab Nebraska, great state. Rare retreat to catch a life. Thanks for coming in, I appreciate it. Good times, right? Great times. Curie Boris is right. Pullback is good. I want to impregnate the market, run too early. It's an interesting choice of words, but yes, I can see what you're going from. Ed says, okay, boomer, exactly. Ah, yeah, yeah, yeah. Deep Vega, Oleg's funny. The Deep Vega, because I'm always saying that XRP doesn't really move, so I just call it a stable coin and people say that it's not a stable coin, Rob, it's going to go to the moon. 589, good. It is an interesting thing of that. XRP is the only one with real regulatory clarity because they beat the pants off the SEC in that lawsuit. Didn't move, it's really, really strange. I was a filthy degen. I have my degen side, right? There's a reason why Las Vegas exists. It's because people go there and gamble every so often. I used to live there actually, and it's a great place, but you know, you don't want to gamble all the time. Then you become a true degenerate. Rob can't put meme coins in a degen channel because he can't do a 40 plus minute deep dive on them. Exactly. Meme coins are worthless, I think, but they're really fun to trade if you're into that. I have some. Like I think Bonk is going to do quite well in Solana and stuff like that. When might do awesome? I don't know. We'll see. We will see. Ah, the Shaolin says, this is a good point.  Pretty sure his soul is resting. We'll go with that. That sounds like a road I do not want to go down. Senator Togan says a good gain is a good gain. No money lost. Yeah, take profits, right? 100,000.  But I mean, how many times have we all said that? How many times have we all said that in this market and said, oh, if I just, what a held on? I mean, a two X or a 10 X if it's gonna, if it's gonna 10 X then it can definitely 100 X. Yeah. Lolo says I still hodl alt coins. Nothing wrong with that. Nothing wrong with that. But like Ben says yesterday, don't marry any particular alt. They'll divorce you and take more than half. And that's the truth. And my answer is Bitcoin will crash at 30 bucks. Yeah, maybe. Let me ask you guys a question real quick. Any ideas that you'd like to see for any upcoming videos that we do? So I'm just trying to get some ideas coming into it. I had one from Lolo and she was, she asked a good question. Let me see if I can pull this up. It's about banks. I was Laura. And the question was, what stresses me out the most is how to and where to move my crypto when it's time to sell? I would, I would love to see this topic discussed in great details on one of your shows, how each of the exchanges works when it comes to selling, including fees limits and just how to navigate them in general. And it's a good question. We really should talk about that. And we kind of talked about it a little bit today and talking about cold storage devices, where to put things. And then of course talking to your bank if you're going to do fiat because I hear from some people that if they're normal inflows or outflows is a couple thousand dollars to 10,000 then all of a sudden they have like a million dollars come through the banks and we're like, what? That's how it is. Unfortunately banks are banks. No people will say, well, that's my money and you should do it. If you don't want any problems just go talk to your bank initially and say, look, I'm a real person. I'm not a drug cartel person. I mean, today. So if something happens, I'm expecting a windfall and this will be a massive amount of funds more so than I used to. So just be aware. And I did that in 2021 had no problems no problems with my banks. Like, okay, sure. And it was an easy thing. Ah, yeah. Sean says, still in that Peter Zion prediction for a negative Bitcoin price. Pay me to take Bitcoin. Yeah, Peter Zion. I've never seen a guy sound so smart on a subject and then so incredibly wrong. So it's a real talent, quite honestly. I end up them, actually I like some of his stuff. I mean, it's for geopolitics, it's interesting but the Bitcoin part which everybody knows him for now in the crypto community, it's just, eh, sucks. But I will remind you that Michael Saylor in 2013 essentially called Bitcoin just a gamble and it would go to zero. So, hey, it takes everybody a little bit more time. Peter makes good money making things up. Yeah, this is true. Tom's got a good point. Everyone who has an exchange account should ask them to raise your limits now. It's a good point, especially for the selling. Because like I had to do that with Coinbase last time but thankfully I learned my lesson in 2017 which I didn't really sell too much. But yeah, make sure that you talk to your exchanges because they have limits and if you just ask they usually will raise your limits for buying and selling especially the buying. They love you when you buy more stuff. And that's so keen on you selling it but for buying, no problems.  Write this way, sir. Tim Buck-Dupanis says, he had a debate with a coworker who says buying Bitcoin is gambling.  Like if there's a pop fly, I'll put my glove up and I'll catch it. But I'm not running down some straight shot and dive and catch to explain to somebody. So like, I have people who ask me the same thing and I always say the same thing like when people ask me, I'm like, well, it kind of goes like this. There's a 90% chance you're going to lose everything. That's just how it is. But there's a 10% chance you can make a lot of money. So it's usually not in between. So what do you want to do? And if they say, oh, I don't have that kind of money. Great, less work for me. I can save my breath. But they're like, yeah, you know what? I want to invest a little bit. Okay, you're my guy. And I need you to hold this for four years and I need you to not lose your portfolio too much and go from there. Trust me, it helps a lot when we see the inevitable bear market come. So that's about it. But yeah, for your coworker, you just say, yeah, probably right.  Good luck with you. LeBron James gambling at 73K. Yeah, it's pretty much what it is. Robert Key said, I don't like Bitcoin. And a month later, he said he has 70 Bitcoin and he bought it last summer. Yeah, yeah, yeah. Everybody's gonna, everybody's a genius retrospectively when they come out and like, oh yeah. Well, what my favorite thing is, is all the YouTubers who like give you price predictions every other day, every other week. And then the one that hits, they just point to that video like, see, I called it. That's always fun. Yeah, but whatever. It's good for the community. It's entertainment purposes, right? Rob, video for you, please show us how to get doge chain off the exchange on the doge coin network. Good coin doesn't allow an ETH network. I don't even know what that is. I know what doge coin is. But I just use that, I just put that on my tangent wallet. It's very simple. Jim says, I always like the Satoshi quote. If you don't believe me, don't get it. I don't have time to try to convince you, sorry. That is a really great quote actually. That's really on the money. Really good one. Yeah, he's got a great point. The coworker you're debating with, Yolos has pensioned into a dog with hat at the top. Then it comes back later, broke saying, I told you it's gambling. This is true. This is true. That's why like that four year comment really has to be drilled in and not four year for dog with hat. When you say like, when you are very specific and say, look, when I talk about four years, I'm talking about Bitcoin. I don't know about the other stuff. I mean, you can get into all coins and we'll have a great discussion about that. But right now, since you're a noob and I want you to get wrecked, just start to do the safer thing, which would be Bitcoin and wait four years. And that's it. And now if they come back to you and go, what about Pepe? You're like, do you really want to know about that? Cause you're going to lose everything. 99% chance you can lose everything. 1% chance you could actually make some money. You want to talk or not? No? Good. That's it. And I don't have to waste my breath. Facts, Rob. Yeah. All right, Panda Pi is here. So true. Mike is here. Bitcoin taking a breather. Yeah, I gotta say that. John's here. Is there a Pedro coin? There's not, but just give it some time. It'll happen. And Nuno has another point. Everyone asked me for tokens on the way up. Might tell them the bear nobody cares. And that's why like, there's a reason why there's only so many millionaires in the world, billionaires in the world is because they do the hard things. You do the hard things. You've already done the hard things. Nobody wants to buy the bear. Everybody wants to buy like right around and not even today. They're not going to want to buy until we hit 80K or 100K. Oof, wait for 100K. Then everybody's going to be like, oh, you're the genius who bought Bitcoin? So Ali says, greetings, Rob. I know you're using Ben's risk metric to sell. When to sell it is the risk metric taking account the new ETFs. So risk metrics are just pretty much time. So if we take a look at the ETFs and there's a case to be made because of the volatility. And actually, how are we going to talk about that? And I think a lot of people with some of this as well, they say that the volatility is going to decrease because the amount of investors that are coming in are not going to swap their Bitcoin for altcoins and they're not going to move things around so it should stabilize a little bit more as more ETFs come in and more people get into those accounts. Could be true. But just remember, right now, the market cap of Bitcoin, we're like 1.3 trillion, let me see. Let's take a peak. 1.3 trillion dollars, right? Gold is roughly $12 trillion. It's not going to hit gold. And gold is relatively stable but remember gold does have peaks and valleys, right? And it does have sell-offs. And that's just how it is. That's at a 12 trillion dollar market cap. If we go to like two or three, I still think it could be a little more volatile. So to answer your question, as far as like ETFs, no one really knows for sure. I know some people will say, well, it's only going to go up now, Rob, because all the ETFs are here and once we get everybody in, it's going to be this, this, this, this, this, this. Over four years, I can see your point. But as far as like month to month, I don't, I'm not, I'm not with you on that one. Sorry, but I can be wrong. So to answer your question, I will still sell my Bitcoin.  That's it, TBA. Well, this is a great video. That was a good video, I guess. If you go into the description, see this one right here? Well, first of all, watch that video too. Don't make the crypto mistakes. This one, when and why, why and when I'm selling 8% of my crypto in 2025? I shouldn't really change that to 2024 or 2025 because it's all about indicators. Five-cycle top, MVRVZ score, time and risk bands, 12 multiples, stuff like that. And we kind of go from there. So I'll probably be like one of those people who were like, oh, I missed the top when Bitcoin was a million dollars. It's okay. What if I sell like around 200,000? I'd be pretty happy. We'll see Jean-Louis feedback on Denkun upgrade. Looks like it dropped a lot of the Layer 2 solution costs, which is good. I don't think it decreased the cost of the ZK rollups, which would be like a polygon. But it looks like it's doing its job. Ethereum Layer 1 are still super high in those fees. So they need to really work on that, let's be honest. But I mean, that's great. It's happening. I don't know if that's the winner, as far as like the big winner. That's why I diversify. So like Layer 1s, Layer 0s, Bitcoin Cosmos, Avalanche, Cardano, Solana, ICP, stuff like that. And Ethereum and some Layer 2s. So it looks like it's doing it. It's just, I wonder if we can get to that next step. And that's it. We talked to one of the larger Web3 games this morning. They're gonna do a new push on a new upgrade for the game. It just looks really cool. You'll like it. And they talked about staking and rev shares. And then they were talking about taking their token, which is on Ethereum, it was an ERC-20 token. They're like, look, we can't keep it on Ethereum. This is not working, you know, as far as like fees. We're gonna have to go to a Layer 2. And they actually picked a meetable X and we talked about why that was. And I said, well, once you leave on Ethereum, aren't they gonna do something with the fees like, even if they do, it's not gonna happen this cycle. So we gotta get off to Layer 2s. I think a lot of people will start to do that. And you won't have so much of that massive fees for Layer 1. But Daniel says, when you sell, who are you running over? Let me make this crystal clear. I know people always ask this, you know, like about selling. Where was everybody when we were propping up all of these altcoins? When we were buying in the bear market, when we were injecting liquidity into the market, when we would see our portfolio massively decrease, where was everybody else? It was up to us and we did our job. So as time goes on and people start to say, oh, well, why are you dumping on people? Yes, yeah, I'm dumping on everybody. And we said this many times. I'm like, I'll dump, I'll dump on Daniel. I'll dump on you. I'll dump on everybody in this comment section. I know this isn't a very popular thing to say and, you know, YouTubers won't say it, I will. I'll dump on every single person here. And the reason is, is because I did my job in the bear market. Now it's the tourists that are coming in, they're gonna get the price that they deserve. And when I sell those bags and they pick them up, that's on you. Ah, again, I did my job. So as far as like running anybody over, I'm not putting a gun in anybody's head. If they wanna buy, that's fine. They'll learn their lesson just like we all did. Who here didn't learn the lesson in the bear market and in the last bull market to really all the money's made in the bear market? That's it. Pice like on the monthly 24 hour. I'm using the missing Robin. Yeah, because as everybody knows, when I sell my crypto, I'm gonna step away from the channel and that's it. Nobody needs a pep talk in the bull run, especially in the blow off top bull run. Does anybody need a prep talk? I don't think so. I think everybody needs a pep talk in the bear market and that's when I'd like to come back because there's no reason for me. There's no purpose for me to stick around and go, you know, good job, making that 10X. I think people need to hear like, hey, this is when you make all the funds.  Smart to sell some. Wish I had sold some Bitcoin last cycle, sold Mountain December, but I wish I had sold at least 20% of my Bitcoin. And you know, there's something to be said for the people that just never sell. Like Aaron Bennett put out a great video. And I should talk about this more is that he talks about only taking profits in altcoins and it's letting everything ride in Bitcoin. Look at Michael Saylor, look at El Salvador. They weren't trading it. They just like, you know what, I'm just gonna be around forever. So I'm just gonna hold on to it. And they stood heavy and they did just fine. Look how well they're doing right now. Another person that comes to mind is Simon Dixon. He bought in 2011 at dollars, like five bucks, 11 bucks, something like that. He's doing just fine. So again, I think is how long you wanna actually hold it. But for me, I always think, well, there's other projects and things I wanna do and other assets, but just as a reminder, you know, people say, why would you put it into dollars because it just melts away with inflation? But that's just it. You'll never get out of assets. Now everybody here is you're already, you are an investor, congratulations, which means that you're gonna be finding different assets and moving things around and you might like that or you might just say, I'm just gonna stick it in Bitcoin, that's it. But you'll never get out of the asset game, that's for sure. Dude, what coins don't you have? It's a little too much. That's a good point. Rock's got a good point. I do have too many. Yeah, at Fox. Idea for the video, top indicator check or last year you're gonna see where we're at and poll who will be running your channel and your absence. Birdie has my vote. Birdie could do it, yeah. Birdie could run it up. E, Iggy, where do you put your profits? Ben had a good point on yesterday's NFA show.  And we even talked about the ETFs as a matter of fact, to piggyback on the last one. So you can do that and you can take the altcoin profits put into Bitcoin. You can take profits from altcoin and Bitcoin and put it into stable coins. Just don't pick the wrong stable coin. Tether, UST went to zero or you could just put it into straight cash. Just depends. So for me, I'm gonna try to, like we always talk about diversify, try to put those and spread those things around. Yeah. Yes, Mr. Fox dumping everybody without prejudice. Exactly, it's nothing against anybody. Armando's in crypto. And Rob, when will you be starting to sell your meld? Meld, a special case. I've got most of it tied up as a stake pool operator for meld, which is like, if you don't know meld, go to Dan D. Jen, did a video on it about a year ago. It was essentially like a DeFi bank and they've done reasonably okay, but they've got a long way to go and it's kind of stagnant right now. They'll probably hopefully pick up, but most of my meld is in the, as a stake pool operator. Rob, do you have render or Solana on tangent? Yes, Solana is tangent right there. It won't send out a mine, are you able to make a transaction? This same thing, there was a same question about meme coins from Solana and people not be able to send out their meme coins like dog with hat and bonk on tangent. And then I tried to do that on phantom and everybody verified this, but I tried to do it on a phantom and it just got stuck in phantom. I'm not for sure why. So, tangent, I don't have any of those on there. I just have them in my hot wallet. But I don't know if that's a Solana issue, if that's a wallet issue, because on phantom I had the same issue, not for sure. Hmm, if you got dumped on, you deserve it. Yeah, you know. But here's the thing, like, what if I'm up 10x and I dump and then something like, thanks, sucker, they pick up my token, just like what we just saw, like the story. And then it goes up to another 10x. And they're like, well, see, it was a genius now. A says, sure, let me know when you'll dump with me. I will. I'll do that video and we'll do it live and that's it. Yeah, Shalon says, dump your Bitcoin bags and meme my grandkids will thank you. Would you sell your apartment building in New York? Michael said, that's a good point. That's a good point. And lastly, I will say this, because we've been here almost an hour, is we bought a condo here as a rental property in Puerto Rico in 2020 for like $240,000, right? If I were to put $240,000 into Bitcoin and I think it was July of 2020 and just let it sit there, you know what we'd have? We'd have almost $2 million today. So it's just one of those things. But looking back, you know, who would have, you never know, that's why you kind of had your bets for risk. Very low risk for a rental property or a condo on the beach in Puerto Rico. Very easy to rent out, did well. Not as well as a Bitcoin, but you know, I could have also put in Pepecoin and made up to $30 million. Just depends on the risk. That's it for today. So look, that's it for today for the show. Guys, so much for hanging with me for almost an hour. I appreciate it. If you liked this video, if you could just hit the like and the subscribe on the way out, that'd be great. Also don't forget, if you're looking for the risky stuff, it's over on Dan D. Jen. And again, you're either gonna, the 99% chance you're gonna lose everything, probably. Or maybe you make some money. One of those two things will happen, but usually it's very risky if I lose everything. But that's it for today. All right, everybody, thanks so much. I appreciate you and I'll see you on the next one. Have a great day.


Do-it scholars discuss the importance of college is college important It's up to you to Kashi, but for me. It's very important. He puts his hand over his heart Toes with pale blue polish type. I think that college is important because it creates a pathway to the rest of your life And it really shapes your identity as an adult Teresa College is a great Place to discover your classrooms and meet new and exciting people Naomi still photos a table of students with straws string and tape two students construct a polyhedron This video content was created by do-it-scholars high school students from an innovative transition to college program in Washington Scholars are students with disabilities. They learn about self-determination academic accommodations and disability advocacy in a classroom Wide open you can do HTML CSS JavaScript going to college is important because we're always learning in life and College is a way to help us do that highly lit and that is what shapes us in our later lives Matthew The great thing about college is it can help you get a better paying job Well, I hope to get out of college is a great financial feature Anita what I enjoyed most about college was the chance to live on my own and become more independent Explore life and who I am and make a life for myself with my friends Do-it-scholars stay in dorms during summer study at the University of Washington campus They meet mentors faculty members and business professionals Eric I think college is important because it allows you to get to know so many different types of people and see so many new perspectives on every problem or every situation that you might face and I believe that this is really important because it really allows you to get to know other people Anna, I think college is important because it's a time to find yourself See what you're good at what you like and what you're successful at. Yeah Going through college. I want to understand my reason for being and I want to understand why I am the way I am We can go through this scholars participate in science labs and academic workshops and learn about technology Mikaela, I think college is important because you get a head start and preparing for Getting a job someday and to pursue your dreams and hopefully get paid Carl I want to go into business and it'd be really hard for me to get a job in business Without getting a college degree REM sleep is when the body goes to the student uses speech recognition software Many of the duet scholars use assistive technology designed for people with disabilities Courtney life has changed so much for the world in general, but especially for people with disabilities and The awesome thing is now that we can go to college and we can be a part of continuing to change the world That's why college is is so important not to get it a piece of paper or a degree But to make actual change happen in the world to Kashi.  I'm gonna be a star photos of Carl and a girl two girls wearing helmets a group of students with Sheryl Burgstahler a student with a rainbow clown wig and red nose a group photo with goofy poses Thank you good girl Naomi kisses a black lab described by audio eyes words appear for more information visit Washington dot edu slash do it The duet scholars program is primarily funded by the state of Washington Additional funds have been provided by the Boeing company Microsoft the National Science Foundation and other donors Copyright 2017 University of Washington Permission is granted to copy these materials for educational non-commercial purposes provided the source is acknowledged