As we switch from one sprint to the next, I want to note the importance in this whole effort of thinking through how partnerships will work with existing major projects. So HostyTrust was invoked in this round. Paul Courant and his team have been great supporters and very deeply involved in figuring out how we work with and are interoperable with efforts like HostyTrust, I think, is crucial. So thank you guys for helping us see some of that also through that beta sprint. The fifth is called Metadata Interoperability Services, the Mint DPLA beta sprint. Nassos, Drusopoulos, and Stefano Scolias, over to you guys. Thank you so much. Good afternoon. It's our great pleasure to be here in this event. And thank you very much for the invitation. My name is Stefano Scolias. I'm a professor at National Technical University of Athens, the computer science department. We are heavily involved in the development of digital cultural heritage in Europe the last seven years. And the last four years are very deeply involved in Europe. And what we're going to present today is a system we have implemented during these years. And Nassos, Dr. Drusopoulos, who is leading this activity, will present. Maybe in order to define the scope, I would like to say one word, how it fits with what we have heard in this session. Take, for example, the first presentation where you had three big organizations that would like to share their content and presented through DPLA. What was implemented, if I understood very correctly, was that the two of them ingested, gave some small number of data to the third one who used their own metadata representation schema for making the presentation of the public. So think of the whole country. So you have thousands of medium, small libraries, different organizations that represent their data, their content through different schemas. For example, libraries use Dublin Core or museums use EdoxyRM Lindo. EAD is used by archives. They be used standard, is used for the visual archives. And different organizations may use different variations of these schemas to represent their content based on specific usage of their content. So you really need some mappings, respectively of where you have all the data collected in some place. But what you really use is the metadata representation by given by different organizations. And you really need mappings so that interoperability of access is gained through these mappings. These mappings can be at the semantic level, but certainly you need the involvement of the user, of the experts, at least in the beginning of the organization, to implement the mappings. So based on this, our involvement with all this activity within Europeana, we implement a system that Dr. Drosopoulos will be presenting now. Thank you. Hello, my name is Drosopoulos as you already learned. And I'm going to present our Metadata Interoperability Services that is the core of our Mint DPLA beta sprint submission. I would also like to thank the DPLA steering committee for encouraging us to submit something for the DPLA beta sprint. And we are, of course, happy that it can lead to some cooperation between us. So to start, Mint Services constitute a web-based platform that implements and supports aggregation workflows, as we mentioned, mainly in the European region. And typically, these workflows correspond to three main steps. Namely, the first one is to gather providers' metadata. And in this step with Mint, we are gathering metadata in XML serialization. The second step is, as Professor Collias mentioned, to try to connect or align the different providers' metadata with the aggregations data model. And to do that, Mint offers a visual editor for the XSLT language in order for providers to be able to implement and formalize the crosshooks between their metadata records and the aggregation metadata schema. Finally, the third step is to remediate or host the metadata according to the aggregation strategy and scope. This is a screenshot of the Mint mapping editor. I will briefly explain. On the left, you can see an example input schema coming from a provider side. While on the right part is the aggregations target schema. In this specific case, it's a lead of the museum standard that is being used widely now in Europe. While in the middle of the screen, you see the specific subtrick that corresponds to the selected button. And it is actually the mapping area. And in order for a provider to map his data to the target model, he just needs to drag and drop an element. In this case, we have a simple one-to-one mapping. The title of my metadata is mapped to the title of the target schema. This is done by a drag and drop action. And every mapping action like that corresponds, is translated to XSLT in the back. So that you have a formal way to transform your data between the two schemas and a crosswalk that can be maintained and formalized. All the other buttons and flashy things around will help the user to perform more complex mappings, including conditional mappings or structural mappings, string concatenation, concatenation of elements, and so on. So in practice, Mint has been used by several aggregations in the European sector. One of the first and most important ones is the Athena project that gathered over 5 million of museum items from organizations all over Europe, including Russia and Israel. Under the Lido schema that I mentioned earlier, EUScreen that is the audiovisual aggregator that offers a portal with 35,000 videos of Europe's television history. Karare concerning archaeological monuments and sites with a special focus on 3D digital resources for cultural heritage, cross domain aggregations like Judaica Europaana that was aggregating museum, archive, and library content from organizations in Europe, digitization projects, and so on. Also Mint is used outside of aggregators for different scope for supporting the evolution of data models like Lido, prototyping the new Europaana data model, by the European Broadcasting Union for EBU Corp. In order also to publish, since most of those schemas also have the semantic version of this focusing towards the link data publication, one of the first one is the link data pilot by EUScreen. And of course we are releasing the project source code as it finishes as free software, and we are collaborating with other teams in order for it to be reused. Through all these aggregations and projects, we have gathered a growing number of content providers. It's approximately 300 institutions so far and 500 users. And what we are learning together with them and what they help us define and create services for is that aggregation corresponds to tasks for providers and domain experts. It's just a natural next step after annotation and it's a step that is not a one of procedure, it usually is ongoing. And of course aggregators evolution in these past two years has led in the introduction of new tasks and as a result new services for linking and reconciling. To wrap it up since I apparently went too far, I mean, we'll try to help DPLA in order to design, set up and operate appropriate workflows for the delivery of metadata from the diverse institutions that you plan to aggregate. And help providers to interoperate with the DPLA data layer regardless of existing infrastructure in your different institutions or the level of adoption of any DPLA requirements and of course support the natural evolution of data modeling either it is the schema, the metadata schema itself or terminologies being used and so on. So I will not go on about the people, you can find more information not Mint, Image, and TUHG at the URL. You are of course free to contact us and there is also the DPLA beta sprint server that are available where you can use the mapping tool for Lido, EDM, Mark and several other domain startups. Thank you very much. We do have time for a couple of questions for these gentlemen who have come so far. Thank you for traveling such a distance, right in the center. Trying to avoid strikes. We have some Occupy protests for you and other things that you can see here. Yeah, actually I live next to them, it was strange. It was like I never moved. It's another form of interoperability. Yeah, exactly. No lead transfer. John Arnold from Massachusetts, it's just a quick sort of geeky question. I couldn't quite tell from the slides. When you do the mapping from the source to target schema, are you actually doing that mapping at the sort of abstract schema level or do you actually do it by examples and do you think your system could learn by example by having professional catalogers go from one to the other with an example and let it learn what the generic mapping is? Well, it doesn't actually learn since it's really sensitive, at least with the providers that we're used to work with to tell them that anything is happening automatically or it's adapting itself. They want to be really sure that they can validate the end result. So the idea is that usually on the target we have a specific data model, usually a standard in the domain so it's something concrete. While on the input we have provided data that maybe it follows a standard, maybe they think that it follows a standard but they have customized it so it's a standard no more. So usually we work on the instance level. They upload the specific collection that they want to aggregate, they map it and if they use it coherently throughout their organization they can use this stored mapping for subsequent imports. Sir, go ahead. Sir with the microphone, yes sir. Are the mappings themselves published as open data? For example, as RDF triples and can they be reused by others in other applications? Yes, for the time being mappings, of course they are stored and people can download them and load them in other instances and of course they can share it between them. So we had the case, especially with museums that they were sharing the same metadata schema so someone created the master template mapping and they used it as a template to create their own specialized mappings. Now as we see again through the aggregators evolution while back in three, four years ago we had Europeana for example asking give us your metadata records in the format that we are suggesting. Now it seems that people tend in general aggregators tend to ask for the original data together with the formalized mapping and mapping becomes a part of the data that is being transferred between institutions. So yes, currently it's in XSLT form but for schemas and for linked data publication there are subsequent mappings that can be also published as RDF triples. So your question is, the answer to your question is that yes, mapping also becomes part of the contribution of providers towards the community. Wonderful. Thank you both so much for coming this way. Now it says in Spanish.


Good evening. Today, I want to talk about the thing. No, not the John Carpenter film. The thing is a short fan-made campaign for Half-Life 2 consisting of four levels. What makes it special, however, is that it was released before Half-Life 2 itself. Built from the early version of the game that leaked online in 2003, this campaign is amateur, but impressive from a technical standpoint. The degree to which its combat and art design resembles the retail version of Half-Life 2 puts in a perspective just how devastating the league was. To lay out the timeline of events, the leak itself occurred on October 2nd, 2003. The thing was published online 11 months later on the Russian forum Half-Life Inside in September of 2004. Half-Life 2 officially released two months after that on November 16th, 2004. So yeah, this is a fan-made Half-Life 2 campaign that was released a whole two months before the game itself. It's impressive that the creator, who's credited only as Donald, was able to build a campaign with a decent gameplay loop, all things considered. There were zero officially sanctioned tools or developer resources available for the Source Engine at the time. Only buggy leaked dev software that very few people really understood how to use. I imagine Donald must have had experience with Half-Life 1 mapping prior to creating the thing. It's the only way I can imagine them being able to cobble this together so quickly. And it would also explain how Half-Life 1-esque the campaign is. We'll get into that later though. To play the thing, I used the fan-made Half-Life 2 beta mega build from 2018 that comes prepackaged with the campaign. This allowed me to enjoy it on a more stable platform that crashes a lot less. And if you're planning to give this a crack yourself, I'd highly recommend you do the same. But without further ado, let's have a look at what the thing has to offer. We open in some kind of industrial area with a gray fog that builds a surprisingly unique atmosphere. This area we're in really doesn't make much sense or resemble any real-world structures, but it's hard to knock it for that. If anything, it kind of adds to the map's almost dream-like appeal. The player starts with no weapons except a crowbar on the ground, and it's pretty clear they're supposed to head directly into this big building. If you choose to explore the environment a little bit more though, you'll notice loads of physics props, and eventually you'll run into some zombies, but it's a waste of effort to kill them. Once you head into the facility, you'll run into some headcrabs, the USP match pistol, and a suit battery. It's interesting. The suit battery sports some kind of weird, early Half-Life 1-esque design, and the headcrabs have blood splats on them, but the pistol is nearly identical to what we got in the final game. As you look through this map, you'll notice a lot of duplicate dead bodies of Odell, the early version of Odessa, scattered about. This is pure guesswork, but I think the creator used this model in particular because it kind of looks like a uniform. Maybe the orange jumpsuits are supposed to be facility personnel that worked here prior to the zombie infestation, just like the scientists in Half-Life 1. Or maybe it was just laziness. Either way, I can't pretend it's not a little weird to see so many of the same bodies strewn about. As you make your way further into the facility, you'll start running into ant lines and combine soldiers. It's a lot like Nova Prospect. Sometimes you'll catch these factions fighting each other, sort of like how you can see Xen aliens fighting each other in the original game. It's not made very clear, but what you're supposed to do in this building is locate and press these three buttons, which allow you to leave the facility. However, you're not out of the woods yet. After making their escape, the player will find themselves in an open forest. The first thing you're faced with is this structure. If you enter and climb up to the second store, you'll get your hands on the combine sniper rifle that was cut from the final game. It sucks, and it takes two hits to kill anything with it, but it's still fun to use just for its novelty. This window also gives you a chance to check out your surroundings. The forest is blocky and primitive, with no use of displacements at all. I won't lie, it looks kind of bad and its design is honestly way too open, but I still found it pretty charming, especially with this area's nice ambient soundtrack. Unfortunately, it's copyrighted material so I can't play it, but take my word that it's very calming. Honestly, I'd love to see someone reimagine this area using the white forest assets from Half-Life 2 Episode 2. I can see it being a pretty nice fit.  There's these two sleeping quarters, a water tower, some outhouses, and even an abandoned home reminiscent of the ones you come across in the coastal segment of Half-Life 2. The sleeping quarters are really simple set pieces, but they're pretty fun nonetheless. It's interesting to see how the creator made rudimentary use of Half-Life 2's physics engine on the doors. Although it's a bit jank, this area is actually a decent example of a non-linear combat encounter where the player gets the choice to handle it however they'd like. Playing on hard meant that I didn't have much health by this point, so I had incentive to loop these structures for supplies. But if you wanted to, you could just rush to the end, break out the buggy to run over all these soldiers in the field, or even pick them all off one by one with a sniper if you really felt like it. All this really needed in order to progress though is for you to go into the house at the end, make your way to the second floor, and then press this button to open a gate. From here, we move on to the next area. Entering back into a separate part of the facility, you're meant with this grandiose room that kind of reminded me of the Resident and Evil series. After pressing a button on the wall next to the entrance, doors start sliding open, rock music starts playing, and you're launched into a battle against ant lions, all types of zombies, stalkers, and finally an ant lion guard, which I believe is the thing that the title of the campaign is alluding to. I can't lie, in spite of how jank and simple it is, this bit still gave me a nice adrenaline rush and I found it pretty fun. While playing, I noticed that right clicking lets you toggle laser guidance on the rocket launcher like you can in Half-Life 1, and I always wondered why that was absent from Half-Life 2. I also noticed that the ant lion guard seems to be made of metal, and it also seemed like I was only doing any real damage when I was using the rocket launcher. I can't say this was certainty, but I think the ant lion guard in this is impervious to anything other than explosive damage. Not a worry, however, as this room just so happens to have a stash of a dozen or so rocket launchers laying around for you. After you defeat the thing, the doors at the end of the room open, and you step out into fresh air once again. You're meant with a platoon of rebels guarding a helicopter, ready to help you escape via air. As you approach, the screen fades and the level ends.  So, to wrap things up, the thing is a relic of the early Half-Life community that serves as a testament to its loyalty, craftiness and persistence. Is it perfect? No, far from it, but given the circumstances of its creation, I'd call it pretty damn impressive. If you've got 20 minutes to spare, I'd highly recommend checking it out yourself sometime, and if there's any talented mappers in the audience, it'd be really cool to see someone reimagine this mod, bring it up to modern standards of Half-Life 2 mapping. Anyway, that's all I've got for now. Thanks for watching, join my Discord server, it's really active, and have a good day. Oh, I also have a Patreon, but I mean, I try not to show that too much.


What's going on everyone Sam here with late in sports cards We're up in three boxes the 2022 Donner's Optic baseball hobby for Jesse S. It's good luck Jesse. Let's do it He's been fun, man.  She's it's rough Curse me big time problem blue to 75 one soda Awesome Riley to 249. Oh, yeah, New Haven Sally's pizza, baby be going there. Well, I'll probably go to Peppies I like Peppies better. I like them all but Peppies I prefer paying your rookie That's kind of getting a pizza. Yes, that's pizza in the country really that's pizza in the world. Honestly. Yeah, no by mile Oh by mile it.  Yeah, what's the pizza of some pizza places? It's the best ones. I'm Brandon Marsh. Yeah, modern So there's like three big ones. There's Sally's Peppies and modern those are like three big ones They're all on the same street. We haven't the original ones and then What's it called Peppies like franchised out a little bit. So there's like seven or eight of them Oh, I stand by that hundred percent. I will hundred percent stand by that Absolutely Yeah, poor idea. It's number one Patrick Mazzica seven of ten Nice one there for the Mets. Congrats.  That's really good and then they do It's different. It's not like I Wouldn't say you have to go and get that Thomas a bucking that is the 50 and But their cheese like it's imported Nobody knows where it's from, but it's like so good. Oh, really out of Lopez Saltine crackers in bed Charts is getting up after this one for sure What once the saltines have dissipated? Terry's rookie auto. There we go. Jesse Congrats Gabriel Morena blue velocity Jake Myers to 99 yeah 99 orange Fernando Tautis to 125 base Yeah, we are captain. I think we're probably full on Personals because we've got like eight orders. We have to get to anyway Yeah, we only got an hour left exactly there's a couple of base heavy orders coming up, too Roadhouse is dope Texas Roadhouse, right? Oh Yeah, Texas Roadhouse. I got one down the street for me, man Bang, oh, yeah Every Friday is that really? Yep. They're not know that about you. Yeah, please That's Josiah Gray in a state nice one there for the Nationals Yeah, I love that place man. Love it. Really Kyle Lewis the 125 Like before you come in here. You go there. Yeah, really? Yeah, that's awesome I Did not know that about you that is that is a shot not not shocking, but that is an interesting fun fact I was learned about you. I love Friday. They're only open at lunch on Fridays. Really? Yeah I'm trying for the weekend. You know Friday Saturday Sunday open for lunch. Josh. Oh, I see you. Okay, I do Friday I go there for years. I like it. Yeah, I like it, too So good that's AJ Alexi black stars to 149 Robert. What's up? I'm wired still dude. No wired wired Joshua Yeah, do you eat saltine crackers in bed too? That might be a view only thing short. It's got to be honest I'm not a big salty cracker guy Aaron Ashby. Nice one there for the brew crew I don't either I hate it Heather does it all the time. It drives me crazy not in my bed I don't allow it, right, but she doesn't hers and I'm like dude. This is awful.  I see I sure as heck do buddy. Oh, that's weird It's so weird dude murder weird weird weird Bibles, I like ritz too Oh That is black to 25 Aaron judge nice What? That's favorite flavors butter pecan. Yeah, that's let me tell you something on my Escapades on Sunday night when I wound up at Waffle House Jay Rods. Hello, rookie When I wound up at Waffle House at 4 a.m. All I remember from that night is how good the pecan waffles were That's really caused the scene dude. I was a mess. You caused the scene in the wall. I don't know, dude I don't know what I did that night. Luckily. I was with my daughter, so I probably stayed semi semi-cool. Yeah Last one here. Congrats. Good luck Jesse I'm with you on that. I don't even know how I got there Sean just spawns at Waffle House is it for in the morning. I was like Matt brash black stars My daughter in the morning is like dad.  Then I started putting it together. I'm like, whoo O'Neill cruise the rookies. She was like, yeah, you love the comp waffles. What a mess That's Wanda Franca rookie quantum of Ramon, Loreanna, Robert plus all What is happening there? Ellie Daylock cruise the 25 Boom pull this exact card right here Nice one there congrats Jesse we'll get that mag too Chocolate ice cream Cheetos. Oh god The first half of that sentence makes makes sense though Hello, you don't like Cheetos Wow Nicholas Castellanos the 199 Well, do you like the taste I'm not going after that we're going to get some chips.  Yeah, I love Cheetos. I Can body Cheetos. I'm a cool ranch. I love those two. I'm I completely with murder Funions up completely with you on that one too. I actually really got into the what the Oh Yeah, it's it's in the morning for us now orange Connor Wong to 125 for the Red Sox It Cheetos in a can Yeah, Colin Walker holo Everything Yeah, I don't mind those get Adam are they barbecue ones By Sean Sean's out Got Louise Hill that's going to the Yankees nice one there and last pack for you Jesse. Good luck, buddy That'll do it for your break there Jesse pretty solid break over all They would say we'll get those right out to you. I'm in


Give me your thoughts on the word influencer. The word influencer for me is so loaded because people self title themselves as influencers. They get on social media. Maybe they're in front of the camera. Maybe they do brand sponsorships. That's fine. I don't believe a person can self title themselves as an influencer because you as the person don't decide if you have influence. We do. Your audience. It kills me and it makes me laugh so hard because I'm also not here to denigrate influencers. I think they were the first people who said I can make money with my story and I want to do that and the personal brand was strong with them. But it does make me laugh. For me the word is going out of style.


My life is a movie, bein' shot by city folks What I say, go, like a damn ref Ain't no ears on my clothes, they call that bein' fresh to death When they was jumpin' off the porch, I thought to myself on the step Like if we all crash, I, then who gon' be the one to help? The way I look out for my niggas, ain't nobody gettin' left Set my bro skier, care package, ask some hope Preaching to the youngest, I be really tryin' to help Tryin' to keep their head from spazin' cause I know that One of my status, when I'm not talkin' to you I'm bout to create a new challenge, I'ma put you in the loop, it's called Some millions up and split it up, just me and Wu I know said Keanu Kendrick gon' be up here in the light, kid boo Having fun, I just need the funds In a paddock show, the status born cooler than the Can't fall for anything, makin' threats, it's like a PS1 Cause we don't play those games, they tellin' me that I'm the one You know I feel the same, gotta prove that I'm the best Who I no longer gotta explain That can't nobody see me with the rap shit, I'm invisible So get up on my nutsack, I ain't come to get no physical They tryin' to figure out my moves, but the steps are unpredictable I like to beat, so I pay for the lease, then eat it like some cereal My favorite is fruity loose, that's something you ain't have to keep My circles small like cheerine, time to turn up for the guys My life is a movie, bein' shot by seeds Don't fall with the lies, they ain't tryin' to cause a scene You know I wouldn't get this life, put on for the team Time to turn up for the guys My life is a movie, bein' shot by CD5


Is it OK? I'm talking about blockchain, the concept, and the evolution of cryptocurrency mining. We are a mining company. So this is the most powerful machine we build for Bitcoin mining. I will talk a lot about the evolution in the blockchain we have experienced in this years. First, I will introduce myself. I'm Qin Fenglin. You can call me Fenglin. You can find me in GitHub and Twitter. I have committed to a lot of code in the manner applications, especially in the Bitcoin mining. And I work for Canon about four years. Canon is an asset company in China. It builds the Avalon Manor. So Avalon Manor is maybe someone, do you know the Avalon Manor? So it's like maybe most people know the Bitcoin. They build the largest manor today. But we built the earliest FPG manor in the beginning. So that's about me and my company. The next is we start talk about the blockchain. What is blockchain? Always everyone talk about blockchain. It's like no one know what is blockchain. Everyone has their own concept about the blockchain. So today I will show you the beginning and what happened today and maybe in the future. So I will talk about the rules in blockchain. It's the basic. It's common rules in every blockchain today. So let's start. First, everyone know the first successful blockchain solution is Bitcoin. In the beginning, a paper released is called peer-to-peer, electronic cash system. So it's very early. I think maybe after six years, no one know what exactly does it do. But I will show a video about the Bitcoin first. So let's say maybe someone know. What is Bitcoin? Bitcoin is the first decentralized digital. So loud. But now everybody's awake. Yeah. Sorry, can't turn to some. Maybe here. Currency, Bitcoin. No sound. So just like this. What is Bitcoin? Bitcoin is the first decentralized digital currency. Bitcoins are digital coins you can send through the internet. Compared to other alternatives, bitcoins have a number of advantages. Bitcoins are transferred directly from person to person via the net without going through a bank or clearing house. This means that the fees are much longer. You can use them in every country. Your account cannot be frozen. And there are no prerequisites or arbitrary limits. Let's look at how it works. Several currency exchanges exist where you can buy and sell bitcoins for dollars, euros, and more. Your bitcoins are kept in your digital wallet on your computer or mobile device. Sending bitcoins is as simple as sending an email. And you can purchase anything with Bitcoin. The Bitcoin network is secured by individuals called miners. Miners are rewarded newly generated bitcoins for verifying transactions. After transactions are verified, they are recorded in a transparent public ledger. Bitcoin, oh. Yeah. That's the introduction of Bitcoin. When I watch the video first, I even don't know what it is. So it's hard to introduce what is Bitcoin in the beginning. So I will talk more. In the end of the video, it talks the manner, verifies the transaction. So the blockchain starts from, I mean, the block starts from the mining. So the manner of verifying the transaction and the new block will generate. Yeah. It will like this. So let's look inside the blockchain, the blocks and the transaction. This is the beginning. So it's a block header and a block date here. So the block are chained with a hash, previous block header, the hash to the previous. So chained together, it's called blockchain. But now, in the beginning in the Bitcoin, the transaction only can store some, like the payment from A to B to another. So just the payment. Nor there's a lot of current currency. It can store, like, the code and store it someday. So when you store the code, it will relax the Ethereum. So here, the transaction will be stored more things than Bitcoin. So this is inside the blockchain, all the same. We can say this is the market today. So Bitcoin, Ethereum are the largest. This is the latest date from Wikipedia and also some website. So we can say here and also blockchain. The difference may be the manner and the transaction. So it's different. But let's say the rules in the blockchain. So it's the same. It has a valid manner, the routing network, and a full blockchain. Every blockchain has the same, the full rules. Even if you didn't mining, it also has less rules and less manner. So I will show a little about what are these. The first is the wallet. When you use the current currency, you first need a wallet. No matter what time, the current is offline and online. So you can use any of this. The difference is you can see here, if you use the offline, you will store all the block data. And first, synchronize the block data first, then you can use.  But if you use the lightweight, this is common. I think this is common because this is open source. So I just put some picture here. You can try to search any offline online Bitcoin wallet or blockchain wallet. So it's the same. So this will only store some transactions with your Bitcoin address and the block header. So what inside the wallet? It's just the key pairs. It's private key and public key. So you will use the public key. It's called Bitcoin address in the Bitcoin. In the other coin, it can maybe use it to address something else. So you use the public key to receive the payment. And if you want to spend, you just need a private key here. So you do not need to tell anyone the private key or your money will be lost. So that's why this is dangerous here. So a lot of people want to use like this. Just store the private key in the hardware. So this is very simple, just a key pairs, so wallet. Maybe you can use the private key can do more things, but this is an original idea of wallet. So next is the full blockchain. So when you want to know what's inside the blockchain, you can see the real-time block through a block explorer. Every blockchain has their explorer. But it will be same, like the blocks and the transactions. So what's in the block? It's block header here. So it has its head and the time steps. The miner will use the block header to verify the transactions or the transactions. Because the transaction will be generated, it's called a miracle route here. This can stand for all the transactions. So the miner only need to know the block header. So it's safe. So the block date, I mean the transaction, do not need to send to any miners. So the miner just to verify this. And what is that the transaction? So it's a common transaction. I captured last yesterday. So we can say it is from the left to the right. We can see here is the input from this address and to this. But also you can see how to verify the payment here user-scribed. And also today, it can store extra data, use the data storage, but very small here. I mean, it cannot only use the for payment. It can also use to store some smaller data. For example, like the proof existence, just store some data, the hash that is here. So it can also use the blockchain to store some data. But if you use like Ethereum, here is just a state of code. So that's the transaction here. And then I will talk about manner. Manner, I think there are very few people know what does manner do. Because just a very simple word, it's just like find a nonce. Then it will be OK. So manner is very hard to find a nonce. It's just like the matter manner. You work very hard to find a code. So I will show what's inside the manner. So manner, it works like this. All the cryptocurrency manner is a hash calculator. The original hash function is like this from the Wikipedia. It's a case to hash. But the currency manner, the left is block header. It's also hash. So the same concept. So it may be this long. Because when you use hash, it's very short. You can use one hash to stand for any transactions. So we can also call case here, because for explaining. So the machine will do a hash calculator. First, use this, some words here, and generate the hash. If the hash, I mean, we need a way to know which is our target. So it's called a difficulty. We set a difficulty for the hash. If there's that difficulty like this, we use 0 to mean if you find this, means you find a block. So that's easy. So the machine will repeat hash to find a nonce to find the target, like find the hash. So if you didn't know the left, you just want to find a target. So it's hard here. But in the real blockchain, the 0 will be too much more, maybe 10, maybe 20 zeros in the prefix. So it's very hard to find a target, find a hash. So that's the capital currency manner. It's just like this. In the real mining, it's like this. So this is a screenshot of the mining software. We can say it works like this. First, it will get the block header from the network, and then calculate the hash. And then compare the target, I mean, with the hash. If satisfied, then you got the reward. If not, then you must continue to calculate the hash. So that's the mining. It's the same. So that's the manner. I didn't talk about the root here, the routing node. So it's just a P2P network. It's used for relay the transactions. When you send a transaction, use wallet. You need broadcast your transactions. Everyone can broadcast valid transactions. You can use some online tools to generate valid transactions. Then you can use a network to relay the transactions. So this is like a routing node, so just as a routing. So that's the forest in the blockchain. I think it's more clear and easy for us to know the rules. Everyone, every currency is the same. And then we'll talk about the evolution. So the Bitcoin is the most mature currency today. So it's growing fast. Let's see the history and what will be the future. From the start, it lacks other currency, from the CPU and GPU. So this is for Bitcoin. So in 2011, just to use the CPU, GPU. Because we didn't know, because we just to verify the concept. So just use this. So then we use the FPGA to accelerate the proven work. Why did it happen? Because if you ever know, if you use hardware to do something, if the hardware can do, it always works faster than the software. So it lacks the beginning. This is the software. And this is something that the hardware. But if you use the like the FPGA, you can use special certificate to accelerate something. So a change to the FPGA manner. It's very short. It's very short. Even the time here is even short. Because a lot of companies want to build a powerful manner to verify the transactions. So later, from the 2030, it came to the ASIC manner. So build the ASICs to verify the transaction. So next I will talk about why we need to build this. So we can say it grew fast in the Bitcoin. But in the other coin, you can say maybe just here or here. Also some cryptocurrency didn't want to use the ASIC. They want to use some storage or display card. In my opinion, I think it's the same. If you use the GPU, the GPU factory also made custom hardware for the cryptocurrency. So it's also with a lot of hardware and energy there. If there will be more people use the currency. So it's the same. But we can say this is the history. So I will show why it exists. The first is the difficulty. It's the Bitcoin difficulty. We can say because it's proven work, the difficulty is very high today. So it's hard for a miner, only one miner, the CPU or GPU miner to do this. Because you will spend a lot of money and waste a lot of energy. So it's not good. Because like the algorithm, it's like if you have hair hatch rate, the difficulty will be grew hair. If you have lower hatch rate, then also the difficulty will be lower. This is the Bitcoin. So that's why the difficulty grew up. And then the hatch rate also grew up. We need to build a more powerful manner to make sure it can work, it's secure. So everyone know like this. From beginning the scale is maybe one or 10 manners for users. But no, it's like this. So here it's like the farm. Maybe someone use data center to store a lot of manners. So it cost a lot of energy. And a lot of maybe hot air. So everyone know that the Bitcoin costs a lot of energy. So just like this. But we can say we are hard to build the A6. Maybe everywhere we will release a new chip. We use the latest manufacturing process. Just to make sure the energy efficiency to lower and lower. So you can say if you also use the machine here, it weighs a lot of energy. But today, even to zero. But it's hard. It's hard. Always it's hard. Because the manufacturing process is also, you know, this nearly is the latest advanced. So it's hard also for the A6, for the Fabulous factory. It's hard. So today, why we cost a lot of energy? Because a lot of manner from here, here, here, here are also are using. They do not want to drop. Because in some place, the cost of electricity is very lower. So if you use this, if you use the latest, the energy, because you can see here, I will explain a little about this. You can say, every year, the energy we use will be 50% of the previous. And also, you will see the performance. I mean the heart rate will grow up double. So this is the chart. So you can say, we want to save more energy. But the difficulty always changes too high. So I think the algorithm is not good. Even we can improve. But I don't know. So that's why we are working hard in the mining. And also, if you use large manners like this, because we need to get the block header from the network. So it's real-time. So there's very maybe 5,000 manners or 10,000 manners. If connect to one server or connect to one node to get the block head, it's hard. It's very hard. So the server cannot support so many nodes. So today, we can say the mining are changing from the solo to straight home. We can see the difference. So in the beginning, when you use the CPU, GPU, maybe you know. You just connect to the Bitcoin phone node, mining alone. And then you get all the reward. So this is the previous. I think today, there's no one uses this. Because you will, I think, maybe you want to know what it works in Bitcoin or blockchain. But you cannot earn anything here. So a lot of miners use this, drop mining. So just connect to a pool to mining the block. So the pool will receive the reward first and distribute to separate manners. The pool is different. I mean, the reward algorithm is different. But you can choose any pool you like. Because the pool is a phone node, and also, I will show here, the pool is just like this and this. I have two rows here. So this is the pool. And all miners are just a part of this. So today, it's very hard. Everything in the Bitcoin is more, I think, is advanced to change something, to save the energy, to solve the problem in the capital currency. But it's hard. And today, we can see a lot of pools. Some are larger because they have a large hash rate. Large hash rate means you can verify fast than the other. But also, you know that the hash is random, so you can connect to any pools. I don't have any. Some users want to know which is the best, which one I want to use. So when I answer this question, I will say, anyone you like, because it's just the same. You're the three-time protocol. But the hardware is different. So it's better to use this. But also, you can use this. I like FOS because I use like the Canon. It's very small. So everything you can use. You can also build your own pool, if you like. Because it's the largest miner, because all the ASIC miners connect to the pool. To construct a large miner. So this is the pool today. So it means there are a lot of miners there. No matter. Maybe this is from Canon, this is from Bitmine, this is from any other manufacturer can also connect to the pool. So this is today about the Bitcoin. So a lot of things need to improve to make it better. So what will happen in the future? What will, like the miner, or the hardware, or something we need, we can improve the blockchain? So let's talk about the factor. Maybe. I'm not sure. So first is the consensus, the algorithm. So this is for blockchain. So one consensus of the algorithm maybe can, you know, some of the Bitcoin, something like that. So one algorithm can support one or more current currency. So maybe they use one commanding a lot of current currency. So some or a lot of algorithms will be, I think, will be found to make the community, I mean, make the blockchain or health more stronger like this. I don't know. So even today, we didn't find a good algorithm in this. So a lot of proof and a lot of capital currency. So even like this, I think it's hard. It's hard because everything is like a miner. So even didn't mining use this. So also it's hard to find a great algorithm. So it's hard. So this is consensus. So I also want to say is it's not compatible. So a lot of different software or hardware need to do. And the next is the framework. This is a framework we used in blockchain, everything. If we want to make some dApps today, so we will based on the blockchain protocols. So it's a very basic layer. It's layer 2. So low level is internalized today. So we all know that the apps today are also not easy to use. Maybe some can block the blockchain, I mean block the transactions. So also happen in Bitcoin. You transfer, maybe you pay in blockchain. You need the, maybe you need to wait. If your payment is very small, maybe you need to wait one or two weeks to wait to confirm. So here is very vague today. And a lot of AC company want to build powerful hardware to accelerate this layer. So I think in the future, we need more hardware, like the router, like the switcher, like that in the network. We also need something if you maybe call blockchain accelerate layer here. So because a lot of different currency, we need accelerator to make better apps. And next, I just got this. Maybe the blockchain service will be served a lot of area. So we can imagine there will be a lot of particles here. So maybe we need a mining or crypto standards to make sure it works. Today I can share about some crypto currency. It works like it's called merge mining. So if you're just mining, maybe mining the Bitcoin, it can mining other coins at the same time. So it's also good. We can use the old hardware. Maybe we can use one, like we need a standard. I mean, we need a standard to accelerate all the blockchain. So I don't think we need to recreate everything. So we need standard. So that's all for the future. Maybe it will happen. But today, we can say like the Bitcoin, that coin, a serum, someone are friendly with the ASIC, someone or not. So it's hard. Also it's hard. Also in the Bitcoin, the scaling Bitcoin also is hard, even in the block set, even in the block header. So even it's hard. So I think make a standard also maybe a future. So it's hard. And the next is demo. It's demo about the manner. So everyone can learn the blockchain through the manner. In the beginning, you can use like the CPU manner. But today, you can use this. This is a powerful manner you can use. Everyone can try. I just tell a little about the mining today. So you can use the manner, the wallet, and the pool. So everyone can try. I will show this. This is a configuration in the manner. So for mining, it's very easy. Just fill some the pool. I mean the pool address and your user. And it's enough. Then you can see the status of the mining. So I think for this, everyone can try later. So I do not want to waste the time here. So I can answer some questions. I need questions. Which one? Different chips. Here. Hush. Show the diameter side. Yeah, yeah. This is from Canon. Yeah, yeah, this is from Canon. Because Canon has wrote all the data, the information in the Wikipedia, you can solve that. So the hash rate, because over time, we see the process, the lower the process. Yeah. The latest one, what is the hash rate? Yeah, the latest. For one, you can see the hash rate in the Wikipedia. So one, you can see here, you can use this. We always use this. It's called var per G. Yeah, yeah. It's nearly 0.1. 0.1. So it's powerful. Yeah. 10 pair hashes per second. Yeah. Yeah. So if you put a box of both of them, each box is like you made two points, right? Yeah. But G is the number of both of them. The number here. Because we need just to convert this to, we didn't calculate one chip. Just the, yeah, yeah. You can, yeah, yeah. The latest is 2060. Yeah, so. No, they didn't release the latest. So maybe it will upload the latest. It's last year from last year. So we also, yeah. So it will also use the latest, maybe the seven. Yeah. So for an individual person, does it make sense to still buy a box? For this? Does it make sense financially? Only one or large? Here it is not. But you can buy anyone, buy a lot through the website from Canon. Yeah, also a bit my everything is same. But this, I think, is most easy to connect. You can say one controller can support lots of 20 miners. So it's different. So every miner has, they are different. We don't care about difficulty doing that way. Yeah. And the cost of electricity, or if anybody with a huge scale with a low cost of electricity to the field of actually buying one was actually reduced. How do you say, well, this was very easy to make money out of because these days it's a low cost place you have to be. Yes. It's a huge scale on top without making money. It can, but very slow. You can calculate the profit through the, it has the calculator in some website you can search. Because you need to improve your price of electricity and your cost, something else. So it's different. So you can calculate. You mentioned that this one only used for Bitcoin? Yeah. Not for Ethereum and others? Yeah. No. Yeah. So I just talked about like one is called the consensus algorithm. So one, if you use one, it's different with others. So you can use this to manning the SHG256 like this, the manner like the master, like the doggone, namecon, because the same algorithm. So one algorithm can support a lot of current currency. Yeah, but it cannot support the RTC. For other algorithms, you need a difference. Yeah. Sorry. How come the algorithm, they were designed to actually not being able to be used as an asset because it's a memory or the limitation of the asset is because the hash specific to Bitcoin is very efficient on an asset and the new ones, they actually are designed but it's actually not being more efficient on a GPU than an asset. Yeah. If you use GPU, I think the most powerful today also cannot earn Bitcoin. It's hard. So in the latest manner or in the big building, we use more than 100 shapes. And of course, I think maybe more because 1.86 always has 100 more than 100 cores. So many, maybe, yeah. So 10,000 cores. Yeah, we can show maybe, here we can show outside. Yeah, we can also. Yeah, we can turn on here. The sound is very noisy. Yeah, it's combining. So I think we have more time to talk about maybe the apps based on the Bitcoin and also everyone can try this. Use your own Bitcoin wallet. If you like, you can use your own online or offline. If you use mobile, you can try to download like the BitPay, something else. If you like, we can try. Yeah, we can try later. Yeah, just turn off. It's very few. You know, only block header and some Merkle branch. So it's very few. I think about one MacBest is enough. But it's better if you have best bandwidth because you need to submit your share as quick as you can. Or you will be lost. Yeah? It's more about waiting to see if you can communicate with the pool. Yeah, yes. You need to submit the share to the pool first. But from what I understand, the pools actually, all of the pools are the people who are actually really keen to be more talkative. From what I read, different pools have different return models. So what you said, they all do the same. They're all the same. So I don't think it's going to be very good or from what I read on some forums, there are some sort of list of which pools are preferred. Yeah. But I have to ask you this question. If you are the manufacturer of that box, and if you create your pool, I suppose you have the advantage of a long path forward. Yeah, maybe. So it's hard. So a lot of people want to use the largest pool here. Yeah, it's good. So you do not need to build all your own pool. So I think because it's decentralized, so everyone can connect their own pool to the full node. So you need to, because why is this our largest? Because they make a great effort to speed up, synchronize between their node. Yeah, so yeah. What's the problem that they see is very changing with their location where it is. OK, any questions? Yeah, thank you.


So lovely day, we are starting with security. Why? All about payments and talk about security. Well the aim of this presentation is to give you an idea about why are we talking about security and what are the things that we should be doing and we should not be doing while running a payment company. So we don't go through some of the bad phases that some of the companies have gone through. I am Shadam, I will be taking couple of next few minutes to give you guys an insight about security and payments and the common pitfalls. So the first question is why security? Something is like what's the general idea about security in payments? If I would say it would be like if we have all of these things in place, we are sort of secure. This is what I will say most of the payment companies aim for. We get these things on our website and we are good to go. So the best example I could give you of was Equifax. I guess you guys know about it. Well everything was good, it was running for more than a decade and someone exported some vulnerability and then it figured out the way they were storing passwords were MB5. Now security by obscurity never. Having compliance is good, which means this, but that doesn't make you secure.  So it's not clear but you will see a few things. In this video is like we see like few of you would be amused, few of you would find it funny, few would be like it's a bit awkward. And if I would have played along for a long time, the security folks would be like, are you serious? This is not how things work. That's the same questions security folks have when we see payment app. You have all those things, all those signs that I showed you with 256 bit encryption, military grid security, all those things in place. What, when we actually take in deep, what we find is you do not have authorizations on your APIs, like as simple as that. Anyone can bypass your login system as well. So be sure of how you do things. So why are you talking about security? Security is something that everyone has a point of view. Let me give you an anecdote where if I tell Xenob on how to run a has-been conference where, okay, you know what? I found one problem and I think you should fix this better. Now as a human psychology we tend to come up with patterns. So we have a point of view with one problem that we have figured out. So the problem with security is everyone has faced some kind of a thing and everyone has an idea about security. But are they actually the experts to make a comment on that? Like those value feedback could be valuable, but is it actually that much important or the main point of all of the things? Okay, so couple of facts where this is from IBM report 2007 where it says the cost of a breach is $3.62 million. Okay, and 88% of the attacks that happened are actually something that was figured out in 2014. Okay, there are a couple of facts and figures that will help you understand why are we starting the session with security? Okay, what do you say percent of cyber attacks are actually a small business? Which will be a bit of a shocker because we assume, hey, we are small. Like most of the payment companies we are small. We don't have that much big of a customer base. Why would someone be attacking us? Here is something that you have to look out for. On an average it takes 197 days to detect a breach. Actually it's actually more than that. But do you think you have things in place to figure that out? Talking about cost, it's $6 trillion by 2021. I have the sources for all of these in the end of the slides you guys can go through it. Human attack surface area is increasing like anything. Now, just on this point, you have spent $28 billion in cyber security in 2016. Which would be like combining couple of unicorn companies of India. They are more than their valuation. They spent in 2016 alone. Okay, and where we have tons of payment companies here, how much have we spent or invested, I'll say. Couple of other facts where like 1 in 31 email contains malware. All of these. Now, the point is, if the attack surface is this big, how much have you taken care of? Okay, are you sure you can, like if you are like 2323,000, you know, malware is getting developed every day. Are you sure that your system is secure enough? You have everything in place to figure that out? So, the reason I call this mother of all fallacies in security is this is one thing security completely evolves around. Okay, which is breaking all assumptions. So, just to give you an anecdote here from one of my colleagues from earlier. Let's say this, there's a statement. Tom bought a book for a piece Sunday. How many of you could say how many assumptions are there in this statement? How many of you would say three assumptions are there? Are there any assumptions? Raise your hand. Yes, no. How many? Three? Four? Anyone else? Whatever sentence made up of six words, there are five assumptions. Let's say it was an e-commerce website and my data says, like let's say I'm the owner of that e-commerce website, my data says Tom bought a book for a piece Sunday. The first assumption is the guy who is actually buying a book is Tom. Then he is buying. Okay, because my database says he is buying. Then he bought a book. Then he bought a book. Then he bought it for a piece Sunday. Just because I have a database and these are saying someone did this, doesn't actually make, like how does this happen? It's something I'll cover in the next couple of slides. Okay. Just an image that can explain you. There's a complete door with a sliding door and a hole just to slide the door. And there's a complete bypass of it. So security faces that we'll be covering. This isn't the complete list. But this is something that I'll be touching upon for this presentation. Compliance. What is actually compliance? It's the first question that we need to ask. Compliance means that if some company certifies that the process they are following to get compliance, that all the process that they are doing is all good. And it doesn't certifies that any product is good enough or not. For example, PCI DSS. PCI DSS means that the process that the company is following is all good, but it never guarantees that the company is secure. Okay. And there are tons of examples of that. So compliance is a part of security, not security. You should be running for compliance, obviously. If there is no business, there's no point of security. If there is no security, your business won't run for long. So compliance is all about a bit of policies, standard rules and a strategy. If something goes wrong, what and how would you go about it? Okay. Yes. So let me ask you one question. How many of you have phones which came in post September 2017? Almost all of you, no? Which were released post September 2017. So why don't you do that with security? Again, I'll talk about EQ facts where I was compliant enough, being EQ facts, I was compliant enough for way too long. I was handling all the PI data, everything, credit card numbers. And I was storing cards in MD5. Is that right? Because no one can figure out, does that mean I can do whatever I want? Or is compliance making you secure? Something that you have to think. Application security integration. This is one big topic. The first segment I'll make, I'm not discussing about OASOP 10. I'll assume that's the baseline that everyone would have because we can go on days talking about OASOP 10 is not going to end. So that is something I'm thinking as a baseline. What I'll be talking about here is with all my experience for the last 7-8 plus years, I've seen tons of big companies and banks that have fallen victim to these and their companies are still falling victim to these kind of small goofups which I'm demonstrating. Hashes. So here the first one that I have is algorithm. So the thing I'll start with is about like 5 years back where there are 5 to 6 years back where there were not too many favorite companies. Big enough. And one of the big payment in companies that I was testing which was there for more than 2 decades had hashed in place for all the integrity check. The problem with that was the algorithm they were using was algorithm 32 which is way too weak. It's a 32-bit thing and it's way too weak. I can discuss about the details. Now the problem with that was I could actually buy everything for free though they had integrity check in place. Now the other problem that comes is now sometimes I see that payment company is actually using a good enough salted integrity hash check in but what they lack is that your load includes all the parameters in place like the transaction ID or the merchant name. So what happens now for any transaction ID I can actually use the same check in that they had just because for the same amount obviously like there are certain prerequisites but they don't include all of those things. The third part I'm saying is validation. Now I've seen companies like this is one of the most common where they are using the right algorithm. They have all the parameters validation but they are not validating the checks in. I know it sounds like hey that's like basic 101 but that's what I'm saying that's what's missing right now. Like I have tested tons of companies I'm telling you this is what is missing right now. Just to give you an example with two images I'll give you guys a second to see the first and the second image. Like a guy has invested enough to keep a security guard to do a check and that was happening and this happens I'm telling you with tons of like the latest 2016-17 companies as well. You have everything is checking it but there's no point of having them there. Payment secrets and salts. Here is something I want to talk about is all the companies that I know of almost the way they share secrets is either it's available on a portal or they actually most many companies they send it across to the guy they are interacting with the merchant. Now it's the salt. If I know so obviously me interviewing a product guy will forward to an engineer then someone would integrate. Now the salt has been thrown out to so many people that all of those can actually go ahead and do free transactions and there is no way to trace it back. What's missing right now is we have to come up with smart ways on how the salt sharing should happen between the payment gateway and the merchants which is there not in a very good fashion. The other problem is when a salt gets compromised then a lot of companies again do not support 2 plus salts. They say you could go ahead and change it from salt 1 to salt 2 but the problem is there are value use cases where we have to support 2 salts and that's not there. The problem with that is either the merchant loses customer or there is a compromise on the monetary compromise that happens. Talking about transactional logic wallet security any product folks here awesome wallet security so you guys obviously warned that hey ideally the payment should be without any friction like guys should come to product and the moment he thinks and there should be payment done that's where the wallet came in because India has to have it in place. Now the problem with wallet security is and almost all the wallet companies have P2P in place. The moment I log in I can do a transaction think about this my account is compromised someone logs in transfer of my PTP to someplace else now the problem is what kind of securities do we have in place just that okay you are responsible for the account security of your account. Apart from that do we have any kind of fingerprint in place I'm not talking about that naive fingerprint okay 5 items that we figured out can you actually determine a legitimate guy versus a non-legitimate guy because more ease see usability and security go hand in hand the more user experience the less is security the more security the bad is an experience correct. So this is something that I'll say you guys have to figure out in terms of what's the kind of security do we have in our wallet system that will make sure that our legitimate users don't get compromised and we can track the illegitimate ones. Give card security here almost like I'm talking about 2 years back all websites all all the companies were broken in certain fashion or the other okay the way they were generating the pin they had like the same goes for a coupon abuse as well the way they were generating the pin they had all could have been good for misuse and you wouldn't know about it. I'm saying the aim here is to see have you thought it through and I'm telling you about a company few days back which had very bad logic of generating good okay it's not something of real pass I'm talking about it's something that happened see it could be like okay you are the lead you know how to do it but the moment you delegated to someone else to do does he has the right capability to do it or not he could be a fresher or you could bank on him or he could think who would know or figure this out that I'm just changing the last digit right. Then UPI so I'll just talk about one example of UPI is when someone initiate and says hey I know push notification push notification comes to app the point is then there is no hash in place okay from UPI itself okay now the point is people can change from 100 rupees to one though they are paying for one but there is no validation of what's happening okay those are couple of things I wanted to talk about an application security integration so maybe you have awesome security in place but integration is not equal to your security integration I can't tell you how many times I've seen broken just because because not two parties are involved it's just not you you are security savvy enough but the other party is not they are not validating then you have refund API is your tons of other things in place so you have to make sure at the end how the integration is happening okay network network infra cloud this is another big one where we assume we move all of us have moved not all of us but mostly all of us have moved from typical DC to cloud and we assume now cloud would take care of everything in place just giving example of AWS it's clearly mentioned on the website security is 50 50 percent shared responsibility between the person using it and AWS itself okay now the problem there is how do you go about saying okay I have security in cloud I have in cloud what all things you have to take care of and what all things do I don't as simple as all other systems that are there let's say maybe your systems are good enough but like just talking about dirty cow which was a Linux privileged escalation vulnerability the point is someone at the end it's one place where all the things are there now how you have configured is something that I could exporting someone else can get into your system a classic example would be four years back an Indian company got hacked where someone exported shell shock vulnerability got into the servers which was running for more than four years old okay and send an email to all the customers that we are shutting down okay now whose responsibility is this like shell shock was patched but this is there they had a box which was running for more than four years and it was just a part of fraud VPC that was the only problem security issue due to missed call infigration RMQ is just one rabbit messaging Q is just one example here I can't tell you how many screw ups I guess Akash would be talking about all those things in place where like the reason example I put RMQ is there I have seen businesses that actually completely work on like that messaging Q has their business logic not the business logic such critical data and they have no authentication in place and the administrator account for login account for RMQ is guess guess which is publicly available and anyone can access it so the point is when you see the data you see okay the whole business depend on this I consume it they wouldn't know about it and it's all gone okay so RMQ just one example there are tons of things you have to take care on how do you fix it I have seen databases which are publicly available and have no authentication in place broad databases okay so the reason I have the third point here is I was talking to couple of senior security not security devops guys and they said hey after I'll just give example of Amazon because after Amazon started patching in December spectra and this almost all the systems the CPU latency went high now people are saying for every CPU latency that's going high they are saying it's because Amazon is doing it and one was actually getting attacked now again it's an assumption that because I have seen like three systems Amazon is patching latency goes up my source utilization goes up one guy didn't realize that someone was actually exploiting his system okay so cloud security is all about thing about this these two bug in itself no one knew for two decades everyone was good okay the problem with cloud security is not just cloud the security is the ROI or you don't know you cannot quantify how good it is if Intel would have patched like two decades back like how big is this 20 years later we know the impact we can quantify it now not like 20 years back right patch update the like again couple of months back when Node.js says all their versions are vulnerable to DOS and they are using a patch and there was like a time of 15-20 days where there was no patch how do you go about it how of you actually knew about it how many of you actually did something about it okay not just patching the system that are running but let's say your whole application is hosted on Node.js and every version is vulnerable to DOS how do you go about it it's something we need to think very hard I am for all devices the reason I'm talking I am for all devices I am means identity and access management is we have inventory in place like the other example that I was giving where company was hacked just because they had a system running for a machine running easy to machine running for 4 years is because when you are small you have 5 people you know everything and there is a time the moment you become 200 or 100 the point is now all the things that I was saying has been delegated to this guy okay or I will give you a real example where we figured out a small company one of the devops was running a gaming server in the prod server a counter side gaming server in the prod box and no one had idea about it this could be happening to any of us how do you keep a track of it or now anyone can be using it for mining as well because they are the folks that are doing that okay DDoS protection again 30 more than like 3 decades old thing still exists just moving to cloud doesn't help you a small scale of DDoS they say they can handle but for others you have to handle okay now the DDoS is just not now sync attack itself now you have APIs all around I've seen companies just they are down because someone is abusing one APIs of theirs okay how you architect your system is again important okay just think about this one API bringing your whole system down okay I just can't name companies for the naming and shaming but because I interact with a lot of CTOs I am telling you companies actually go like weird when these kind of things happen and you scratch your head because while starting you didn't care about it it's a small company who cares you care but not that much and then when you hit the security is not the most important thing log analysis and correlation here it's actually important again this is just not a simple a simple shock what I am talking about it's actually far more than that so you need to have a small engineering team to correlate all the logs that you have to so I'll give you one example of Ola this is just one answer from Ola I am talking about where think about this drivers are getting really smart okay fraud could be any level okay now let's say our customer partner what I'll say customer care calls are increasing that for certain cases okay and we see jump in one API now we know drivers are abusing certain thing in a certain manner just if you can correlate these two things this is one very naive example that I am giving you guys have far more valuable use cases now if you can keep a track of what's happening like if you could connect these systems and telling you all the frauds actually you can detect in real time it's just that we need to put in effort to figure that out which is actually missing from all of us this is just one example like I was talking to one of the guys like CTO and they said hey we are setup so they set up their hosted a gate it was publicly available with protected by username password which was integrated with their LDAP so obviously no one can access though it was publicly available a small misconfiguration issue was this now the point is by default when you set up a local gate you can sign in with Google at the regmail as well with this I actually signed logged in into his not his personal like company's official gift repo and I could see all the code in the log of it think about this you think hey everything is protected just one small problem your whole code is gone and you can't figure that out I log in I copy paste the whole code you can't figure that out and it's like the image experience itself you think it is just one small what's the what are the odds of someone getting through it in one shot and I'm saying like the odds are way too high than you think just because you're on this side of the table doesn't mean someone on that side of the table is not smart enough so cloud security is all about raising the attack surface area where this much is the attack surface area you reduce it to this much that only very smart guys could get through earlier thousand guys could get through now only one but there is always a possibility that someone would get through and probably in one shot ok couple of goof ups that happens this and the next one are big ones where I have tons of data on the slides but I didn't wanted to miss out any of those github I'll explain this just by another major unicorn company got hacked two months back where one guy because this was a way too big organization one guy committed some credentials in public github and I as an attacker when and exploited the system right it sounds funny but think about this when you have 2000 plus guys with you you cannot keep a track of it what happened to them can happen to anybody and it's not a breach in some fashion but it's a breach in some fashion ok now how do you make sure that your guys so again I'll give you one more example of not I'll skip that but how about this where like I wrote some awesome automation I committed that code to github obviously you need to show your awesome coding skills on github now the only part that because it had tons of code in it the only part that was missing was it had my let's say corporate account password and username and the whole thing works on SSO how about that now my account gets compromised for every place ok so the aim here is you need to have system in place being payment that if one of you guys by mistake commit codes to github you should be notified in real time github is just one example to be any place like paceman paste any place ok because people copy paste the code outside asking couple of questions what happens that and that's your logic of doing something really important now you don't know everyone knows that this is how you generate coupons I'm just giving example ok third party dependency again how many of you can say right now you can name all the third party dependencies in your company from Kafka sentry to everything log for everything how many projects are being used what also think that are being used any of one of you can say the whole inventory of third party projects ok I'm saying that's that's what happened with equifax like can you say like you're using a purchase search in couple of projects but can you name right now how many projects are using a purchase search no and when someone exploits it then you come to know what I'm saying is you guys need to have list of all third party dependencies which of them are vulnerable which are of them not is something that you need to have ok at Ola we do maintain all of these things ok to figure out ok which are vulnerable how exactly we are using it how exactly we are not what could go wrong are the vulnerable components that we are using or we are not ok something that I'll say for payments it's actually must OTPs man this one is a big one I can't tell you like how many different kind of OTP bypass I have found in my life one second I have seen code which says 1000 plus ok well I have seen so much code which is I just call them blacksmith code in terms of key I label as like hey my parent company has military get security and like it's a blacksmith code that's half running behind like 1000 plus this or just changing one character no that's not how you validate OTP or generate OTP ok even though you could say hey sign up on my website happens via OTP validation like that's fair but have you been sure that there is no bypass to that ok I have seen issues where just going a bit technical where people put the OTPs in reddish and that this cast gets clear and then there is no validation happening I'm saying understand at the end of the day it's a guy who's writing code with certain mindset and certain assumptions on how it's going to be used ok whether that code is running in an airplane or in a payment system ok and because I have written that code with certain assumption there is always a possibility to be bypassed ok that's all I'll say how you generate OTP is really important how you validate is very important like I'm saying that there is cash I'm telling you it gets cleared or you spawn a new cluster there are no things and you are validating it at the end just a code bug ok vendors here what I mean is obviously we have to use tons of vendors to send OTPs transactional OTPs login OTPs and tons of other things to the customers how exactly is your contract with them what happens if they get breached because you say for this one number the OTP is this ok I'll talk about a I'll talk about a just biggest goof up like it was one of the biggest bank in India right now I'm telling you like 3 years old story where when you go to that 2FA page of the bank you say I want to pay by credit card ok you go to that 2FA page the 3D secure pin so that bank the way it was doing so after you put in your thing they used to generate a small checksum which was like a 8 digit code not a checksum I'll say ok that was just authorizing that transaction now the fun part was every time I do a transaction if I return that code the transaction was successful this is I'm talking about one of the biggest bank in India like at the end as I said like it's one guy writing a piece of code with certain assumptions in mind ok to store passwords email GPS location of the customers you want to give them a better user experience I understand now how and where do you store it is these 2 points cover it's ok to hold on to that information not on the device and not in plain text format understand device is something that you do not own ok there are tons of 1000 things on the app I've seen customers getting exploited just because some company was storing some other information ok I'll give you an example password and there was a malware in the phone which was taking that password and trying on all different websites and that guy had same password across pre-auth this is so important I can't tell you where all of you from payments companies know how many fraud requests you get in a day where people have added 11, 15, 20 debit cards to one account then one debit card to 20,000 accounts ok those are all frauds you figure out when a cyber camp complaint comes to you do you know right now how can you fix it for better user put a guys for better user experience we don't add pre-auth let him add and then we'll see whenever he wants to transact but can you take a step back and think can we mandate pre-auth for adding all the cards because I can't tell companies but I've seen finance guys the head of finance getting spoofed into sharing his credit card details to someone and then getting breached ok I'm not sure how many of you have supports multi-currency this is one funny we have seen let's say on my credit card for US I have 100 dollars negative balance what I do just because they don't have validation check on the currency I change it to INR I actually pay 100 INR and in that thing and the currency is not a part of the checksum so I change it back to US USD now just paying 100 rupees I clear my debt of 100 dollars this happens how do you handle multi-currency is something that you have to look and there are tons of cases around that refund API I can't tell you how much abuse I have seen of refund API from so many folks refund API just means that obviously when you integrate with merchants they run something and at the end what happens is because of the bank field transaction or net banking takes up to 4-5 days of transactions you have to refund whatever needs to happen the way all the companies generally implement I'm not generalizing the statement I'm saying mostly implement is they have just an API key you are a merchant I give you merchant key 1 that's the security of a refund API which actually credits money to a customer's account some of few folks have gone a bit deep but again I can talk about all of that but I'm saying it's not secure refund API you don't know how much abuse has been happening just because you don't have the metrics and not collecting the data just as good as third party libraries that I talked about until you get exploited of it you're like it's all good I'm saying it's not it's linked to the refund API itself payment systems obviously have a lot of crons to do daily analysis and then send the rest of the money here to the company's bank account or this do all the validation the cron obviously means it has the power to send money push money tons of things in place ok how many people in your organization have access to that cron that means obviously there would be some API key some access token some place if I as a dev product guy devops knows about it and I start misusing it what happens do you guys even know about it these are big goof ups that no one is looking at is something that I'm trying to cover success you are there failure you are there replay attacks so this goes back to my hash validation part where when from payment gateway merchant if you're coming back to merchant merchant obviously defines for failure URL go here success URL go here just because you don't include success or the failure URL in this in your validation hash validation you can screw up big time big time means big time leakage of sensitive information something all good I'll run through just because there's still a lot to cover goof up operationally is let me talk about couple of important things in terms of data security here is we at the end trust that our customer our employees won't misuse the data I'm not like pointing a finger there but I'm saying at the end if you grow big you'll have tons of employees who would have access to a lot of customer data if you don't plan to have data security from starting you're gonna be screwed up big time is what I'm saying because you have all the salts of all the merchants and everyone and everyone has access to all of it just a reality check is something that you have to see is what is stored how it is stored where is it stored who have access to that kind of a data I'm just running through there's something important I'll discuss in detail how are they stored and what kind of people have access to that and have you classified the data from starting so right now I understand when you're small it's like what's the need like it's just ten four and we know this is critical this is confidential this is ok but the more that you won't be 10 people and they won't understand your definition of critical confidential non-confidential ok why is security hard there is no way to quantify what you're doing security is like medical insurance you pay premium for the next ten years nothing happens you like dude all the money gone bad you pay premium for a year something happens and that money comes in use you're like see I paid one year premium or I had the money insurance just for this so it's hard to quantify what you're doing is adding value or not then it actually doesn't add something to your business growth and derivatives in terms of again numbers this is one important one because assume I mean is where we have a couple of devs who are security savvy ok the problem with that is they think hey let's go injections no worry we'll use prepared statements now just giving example active records which is prepared statements and Ruby could also have because you are doing a concatenation at the end just an example so assuming that hey I'm good enough I don't need security probably wrong do not improve security you have to create application in from which is secure don't think let me build on it I'll add security later security is not like like you'll build a fortress around it it's not gonna work that way I'll skip this example latency versus security something I'll cover again very big vendor in payments in India they support latency up to 60 seconds so what happens is if you start a transaction with them while they are doing a transaction you could actually do all the money as P2P and that transaction was still successful this is I'm telling you like 4 years back ok now I could actually do anything on that payment vendor for anything for everything for free security is always soft down if you think the senior this leadership is not understanding it's not gonna go anywhere why it's even harder when you're scaling up just one example here and I'll wind up is brute-forcing let's say for our folks if the login has brute-forcing possible a security guy would say hey have captcha in place now you know on a mobile lab you cannot have captcha ok now how do you fix it now all the standard solutions of security do not work in a product based company is something or one of the biggest problem when you're scaling up then you have PlayStore signing keys available in your gate I as an employer move out I upload my APK and what happens there I'll just sign off on race condition is something so I'll put up the slides later and you guys can take a look at it there are couple of dos and do not tips that I covered which is a way to comprehensive list that I had in place and I wanted to cover all of this which was important just one proposal that I'm proposing is with all the payment companies is I'll say we need to have a negative database sharing where somehow people could say hey this is bad data and all others could consume in certain fashion is what I'm proposing I'm saying you need to have a scoring for all your customers preparedness of reach is something I'm proposing and you need to manage all your frauds apart from that a disclaimer is this there's nothing specific to a law and I haven't touched upon these things it was general 101 session for security to give you guys a flavor of what security is and why you should care about it just the flavor of it more questions I'll be available around you guys can catch up and discuss with me sorry for taking more time than expected


So tell me about how you settled on the products that you chose. I have two aromas and I call them aromas because they're not scents, scents is from synthetic scents. So that's how you get the word synthetic is from scents. I use real essential oils. Yes, they're safe for the pets. People freak out when they say, oh, there's oils in it. If you put the essential oil directly on the pets and the paws. Yes, that's an issue, but mine's diluted down and wanted to create a product that cleaned everything. These mirrors, granite, stainless steel, floors are very kind, marble. Like you name it, you touch it, it cleans it.