Good morning everybody and welcome to this workshop. The coordinators would have received a mail from Dr. Mukta Atre saying that we have a brief formal inaugural function. We have requested Professor Sukhatme, our ex-director to kindly come and inaugurate the workshop. Our director Professor Devan Khakkar will also be joining and so will be several other important heads of academic units such as mechanical engineering department, computer science engineering and also the head of center for distance education program and the head of continuing education program. We will of course have some faculty members here. You will of course be seeing all of them. We will start this formal program at 9.30. We are at about 9.7. So, I will be starting this interaction with different centers. These are not necessarily in any order, but we have selected five institutions which represent five different states of the country and these five I will be coming to in the stated order starting sharp at 9.30 onwards. Please remember that 9.30 to 9.40 is when we would like this interaction to be seen by the participants of this inaugural function who would be assembled here at 9.30 because as you know we are doing this long distance and therefore speakers here will not ordinarily be able to see you although you are all attending from 31 different remote centers. So, let me just take the names of these five colleges. Please do not feel bad about this choice. This has been drawn almost like a lottery from amongst the available colleges belonging to different states and we have chosen five because that is exactly what we will have about 10 minutes time from 9.30. The modus operandi will be the same that I will be following while interacting with other centers will briefly I will name a center will briefly go over to that center will just say hello to the coordinator would like to see the glimpse of participants who have assembled there and then we will come back and go to another center. So, this is what we will do now starting another two minutes, but before that let me read out the least of names of colleges whom we will be contacting from 9.30 onwards. The first one is SVNIT Surat which is in the state of Gujarat. The second one is Cummins College in Pune which is in state of Maharashtra. The third one is JNTU at Hyderabad. So, JNTU at Hyderabad reprinting Andhra Pradesh. The fourth one is Annai University in Chennai reprinting Tamil Nadu and the fifth one is Amal Jyothi College representing Kerala. As I said these are random choices we have of course 31 remote centers. So, between now and 9.30 I would like to quickly go over to each remote center very very briefly just to ascertain that the connection is working fine that you are able to see me and listen to my voice and similarly we are able to see you and listen to your voice. The first center is NIT Tiruchira Palli. Coordinator NIT Tiruchir. Good morning. Can you hear my voice? Yes, yes. We can hear you loud and clear. I hope our audio is very good. Thank you. Thank you. Right. So, let us go to VNIT Nagpur. Good morning. VNIT Nagpur we can see you very clearly. Can you hear me? Yes. Wonderful. Professor Gokhale nice talking to you. Yes sir. Good morning. I came just last week and then this is the first official assignment and I am very glad that we are undertaking this particular exercise during the summer month. You know it is pretty hot over here. I know it is raining in Mumbai. Mumbai you know if you would be able to send us some rains you know it would be very helpful. Well, I do not know whether thermodynamics will directly help but we can request Professor Gayathunde to try that. Thank you so much Professor Gokhale for personally participating. We will go to GH Rajasthani College Nagpur. Yeah, good morning. I can hear you and I can also see you. Good morning sir. Thank you very much. The connection seems to be good. Are you able to receive our video well? Okay sir. Thank you sir. By the way I hope that all users are aware that in case of a problem they can send a chat message and we would be able to quickly correct situation if there is any problem. Let us go over to COEP sorry College of Engineering today. Yes, Dr. Puthervi, I can hear you loud and clear. You can see several participants there. Our director Dr. Sasarudhe wants to interact with you for a minute. Good morning to all of you and it is a welcome feature that all the faculty are going to be empowered in teaching of thermodynamics you know. That is a very difficult subject for students. Well, thank you Professor Sasarudhe for personally joining us and we are happy that COEP is continuing the relationship with IIT Bombay. Thank you so much. Let us try going over to Mefko Shleng Institute at Shivakashi. I would like you to confirm sir whether you can hear me and you can see me clearly over to you. Your voice and video are good sir. Thank you so much. I recall that last December when I had come to Shivakashi to give a keynote address this is precisely the hall where I had a cup of tea with your director and other dignitaries. Sweet memories of your place. Thank you sir for participating. Very good morning Professor. This is Dr. Balakrishnan, Principal for Kapko. So nice to talk to you. The audio and the video quality are good. Thank you Professor and thank you very much for personally participating. This encourages all the participants you know to put in their best. Thank you so much. As I would like to mention it to rest of colleague participants from other places that Amruta University has been a strong partner in this endeavor and in fact the application that we are using for the audio-video interaction the AVU application has been developed by a large and dedicated team working at Amruta under the leadership of Dr. Kamal Vizlani. So I am glad to go over to Amruta. Please confirm whether you can see us and hear us. Over to you Amruta. Good morning sir. We can hear as well as see you very well. Thank you very much. Thank you so much. Let me try Walton College strongly. I can see Walton College participants. Please confirm whether you can see us and hear us. We can see you and hear you very well. I would like to just say good morning to all the participants as well as the resource persons of this course. And this is a nice initiative taken by IIT to start a course on thermodynamics. Thank you very much. Over to you sir. Thank you. And thank you Professor for participating personally. Thank you so much. With this we will halt this interaction temporarily and start the formal function in a moment. Let me request Professor Sukhatme and Professor Khakkar our director to kindly come and take the seats here. I would also request Professor Gayatonday and Professor Bandarkar the teachers of this course to join them. We will continue our interaction very briefly with the five colleges which I mentioned earlier. We will go to the Cummings College at Pune. I can see participants from Cummings College and the dignitaries are watching you. Please confirm whether you can hear us and see us. Over to you Cummings College. Yes sir. I can hear you. Good morning sir. And good morning all the dignitaries on that ice. Over to you sir. Thank you so much. The next college we go to is JNTU Hyderabad. I can see participants from JNTU Hyderabad. Likewise we would like you to confirm whether you can see us and hear us. Over to you. Good morning sir. This is Brahmara along with the coordinator Professor Vijaykumari and about 50 participants. All of us wish you good morning sir. Over to you. Thank you so much. You have 60 participants. That's a large number. Thank you so much. We will now be going over to Anay University Chennai. We are able to hear you properly. The video is also very clear. Thank you. Over to you. Thank you so much. And last but not the least we go over to Amal Jyoti College Kerala. Yes. This is Fradu Jo's the principal of Amal Jyoti College of Engineering Kanyarapali, Kerala. And all of us are here. We have got 43 participants. And the audio as well as the video clarity is excellent. We can get you very well. We can also hear you, listen to you properly. And things are fine. I hope that you also can see us and listen to what we speak. And all of our best wishes. And we are extremely happy that we can interact with IIT Bombay. And thank you very much for having taken us as the participant. Over to you sir. Thank you father. Thank you for personally gracing the occasion. And yes I confirm that we can see you absolutely clearly and we can hear you absolutely clearly. In fact this is the very purpose of using this technology that we can actually participate as if you are attending the course from IIT Bombay itself except you do not have to physically move long distance. And over the next two weeks you and your participants will find that the interaction with the resource persons at IIT Bombay is as good as if you were personally attending it in IIT. Thank you so much. So let me start this function by formally welcoming the dignitaries Chief guest, Professor Sukhatme. Thank you so much for coming here sir. Our director, Professor Devan Khakkar. Thank you Devan. Thanks for coming. Professor Gayathonde who is agreed to conduct this program for us. Jointly with his colleague, Professor Bandarkar. Thank you so much for coming. Please be seated. We have other senior colleagues here. We have Professor Sanyal, head of the computer science department under whose ages we run this program. We have Professor Tembe, head of our center for distance engineering education program. Thank you so much. And we have Professor Kannan Maudgalyan who is the Institute coordinator for all the national mission projects at IIT Bombay. We have, thank you so much for coming. You see these four people that you see here are the people who coordinate almost all of our outreach program in one way or the other, barring of course the my head who coordinates all of us to deliver a proper program. Thank you so much for coming. Before handing over the proceedings to the chief guest and to Professor Khakkar, I would just like to mention that this workshop, these workshops under the national mission project have been a dream of IIT Bombay for several years. We started doing these distance education programs almost a decade ago, but we perfected the technique over the years. We did a sort of pilot project sponsored by TIFAC and subsequently we are doing this national mission project. This project envisages that a large number of teachers across the country should have the occasion to interact with faculty members from IIT Bombay on specific subjects and that is how we have started this. This particular workshop is being attended by 850 teachers all across the country. My dream is we should have 1000 plus teachers and we have another workshop on basic electronics which Professor Dinesh Sharma is going to conduct and his colleagues starting two weeks later. We have again another set of 850 teachers participating, sorry, or 1200 and 6. So, Dinesh Sharma by conducting a program two weeks later is able to get more teachers perhaps anywhere. So, we are very happy and we are particularly happy that both Professor Khakkar and Professor Sukhatme have agreed to come here and to encourage all of us, both the participants and the teaching faculty. So, without further ado, I would request my director, Professor Devan Khakkar to say a few words. Thank you, Professor Sukhatme. Distinguished colleagues in the audience and colleagues who are with us virtually. A very warm welcome to IIT Bombay and to this workshop on homodynamics which is traditionally a very difficult course. First of all, I want to start by expressing my appreciation for this great technology. You know, this allows so many of us to come together virtually and at a low cost and I mean low cost not in just in terms of the money required for travel, but also cost in terms of time, in terms of arranging for places to stay and so forth. This is really a wonderful technology. If Professor Fatah had to organize a workshop of 850 teachers at IIT Bombay, I know that that would take at least a year of preparation and a lot of effort on all sides including the participants to come all the way here, spend two weeks away from home and so forth. So this is really a wonderful technology and I think we must explore new ways to see how this type of connectivity, how this type of computer power can be used in a big way in education. We have a huge educational ecosystem. I was told that just in Maharashtra there are 112,000 students who have joined the engineering program. That is 112,000 students have joined the engineering program in Maharashtra alone and there may be 10 million or something in the whole country. So this is a very, very huge system and any initiative that we take will be meaningless unless it can be scaled up in a big way. And I think ICT is one means by which we can scale up to address issues that affect a very large population of students. I am very happy that IIT Bombay has Professor G. Fatah who has been a pioneer in developing techniques which allow the use of ICT in education. I feel more and more of us should be involved in this effort and I think that this workshop program has been a great success and I am sure that there will be other such programs that we can think of because such types of programs can have a major impact on the kind of education that we deliver to students across the country. I would also like to thank all my colleagues from IIT Bombay for this particular course, Dr. Daitone there and Dr. Thakur for actually participating in this intensive workshop. I know it takes a lot of their effort and everyone in IIT is, you know, occupied 100% of the time so I am very happy that they have taken time off to really participate in this very important activity. Also, this is the first time I think that we are I may be wrong in this but the first time that a non-computer science course that we are dealing with and I think that is also welcome and we are taking a course that is, as I said right in the start sort of considered a difficult course in engineering. Finally, let me say a couple of words about teaching because all of us over here, many of us are teachers. In my opinion, for academics, teaching is the most important activity and really I feel that in terms of the impact that we have on the overall system, teaching undergraduates is the most important activity because of several things. One is there are more of them, only a very small fraction of postgraduate I mean undergraduates go on for postgraduate studies so we have a huge number of undergraduates and so if you just look at what impact they have on the economy and on the society when they go out I think in terms of impact, certainly an undergraduate with a good education is a great asset to the society. The second thing is that the foundations of a person's knowledge are built at that level and really I think there should be great clarity and when we teach undergraduates and in a sense we should have the best teachers teaching the youngest students because if we can build very good foundations then the rest of it is easy. I think workshops such as the one being conducted are really something by which we can address how we teach the students, how we can do a good job of teaching and in many ways I feel that to be a competent teacher is quite straightforward. One is that one must have a thorough knowledge of the subject the second is of course to be able to organize the course third is to systematically deliver the material and finally to be able to communicate with the students and I think this is something that one can learn participating in such workshops is very useful and even within IIT we have been having a lot of discussion along these lines we have actually had a retreat for two days in which our faculty are discussing among themselves how we can do this more efficiently a senate has taken this up and we have had several reports and several resolutions on how these issues can be addressed. Of course the next level is to be a great teacher and that is something that I think once you reach this platform you can aspire to and there I believe that that is something beyond all this there is some magic in it because finally a great teacher will inspire the student to learn on his own because finally learning requires effort on the part of the student and if the teacher can essentially excite the student about what they are saying and inspire the student to put in efforts to learn I think that is really at another level and that is something to aspire towards so thank you very much Professor Fatak for inviting me and I wish the participants all the best in this workshop I hope you enjoy yourselves thank you. Thank you Prasak Akkar for those very wise words I would like all the participants to note that what our director said that teaching and particularly teaching at the undergraduate level needs to be taken very seriously you would have understood how seriously IIT Bombay itself takes this undergraduate teaching we do indeed have very senior people teaching undergraduate students particularly younger students. Anyway we will continue this interaction further over the next two weeks but now I will request the chief guest of the function to come and share his thoughts with you let me briefly add a few points about Professor Sukatme he was a faculty member a colleague for what over 40 years after he retired from IIT Bombay he was given the responsibility of chairing the Atomic Energy Regulatory Board he has been an avid researcher and a great teacher and a great institution builder and of course being a mechanical engineer thermodynamics is very close to his heart so that is why when Prasagayatunde and I were discussing this course ordinarily we do not have a formal inaugural function but this time we said we would like to invite Prasukatme and when I talked to him it so happened that he was free and in fact he was keen to come and talk to you so thank you very much Prasukatme for joining us I think people would like to hear you Good morning everybody Professor Khakar Professor Phatak Professor Gayatunde Professor Bandarkar Heads of Departments Colleagues Friends It is a great pleasure to be here this morning for the inauguration of this workshop on the teaching of thermodynamics and as Deepak said, Professor Phatak said the moment he asked me I said yes for the simple reason that I have taught thermodynamics for many years and so obviously any workshop on this subject is of interest to me Now, Professor Khakar alluded to the need for such programs we are reaching out today from here I have an audience of only say 20 or 30 people but I am reaching out to 7, 800 people who are going to take part in this course and that is the technology which is enabling it the distance education this distance education is being enabled earlier the old style we used to hold summer schools in Bombay IIT Bombay under the QIP program or various other programs sponsored by the ministry we would have about 30 people come here we would have a work you know month they would stay with us and we would lecture to them on some subject or the other and they would go back and carry some way in which they could improve on their teaching that is the best we could do today with these technologies suddenly one can reach out to 800 people and that is a very big thing Now, just to give you a magnitude of Professor Khakar mentioned the magnitudes today in India the admission capacity for engineering in the country is more than 6 lakhs all the seats are not getting filled and all have not been wisely created but that is another issue the point is at least 4 or 5 lakhs are getting filled every year and mechanical engineering is probably around 25 percent of that so we are talking of about 1 lakh students joining mechanical engineering every year across the country an average class is about 60 students sometimes more but 60 is the norm which we use in so many ways in creating capacity so if you divide 1 lakh by 60 you get an idea of the magnitude of the number of students who are going to be learning thermodynamics every year at some stage of that 4 years that they spend in their college or their institute you need let us say approximately at least 1000 teachers if not more for teaching the subject of thermodynamics every year so today when we reach out to about 800 we are contributing in a substantial way towards helping these teachers to improve their skills in teaching thermodynamics whereas if I follow the old technology and I can at most reach to 30 or 50 students right here who have to come all the way here it is going to take me 20 years to do that so you can see immediately the kind of impact that we are making what is even more important is that this particular session the 10 day the 2 week program is not just about delivering lectures from here but also has with it a content of tutorials and problem sessions and in order that those be conducted well at your centers coordinators of those centers have already come here in March and spend 2 weeks with us and that is what makes this a still stronger program in trying to convey thermodynamics thermodynamics cannot just be lecture it has to be finally solving problems in fact that is true of all engineering courses you can lecture and lecture but finally students have to solve problems that of interest from the engineering viewpoint so we believe that with such programs one will make a bigger impact and it is absolutely necessary because we have created the capacity we have the students they pay a lot of money they deserve the best education at the moment what we do is when we select teachers we say well he has got a first class he looks like a good boy or a good girl he is interested in teaching take him or her and beyond that we do nothing literally nothing we expect them to learn the art of teaching on their own from colleagues or by the experience of walking into a classroom and finding out that something went right or wrong that is really what is happening you learn fast of course when you face 60 bright students all over the country you better learn fast as you run away from the business and you say teaching is no good for me you know things like that so it is very important that we have more of such programs now let me revert a little to thermodynamics as I said it is a subject to my heart graduate thermodynamics for many years to mechanical engineering students and if anybody likes if I were to use one word to describe the subject I would say it is a beautiful subject that is the objective that I would use for describing a subject like thermodynamics it is a beautiful subject for many reasons one reason is it forms the core of what we call as an engineering science course in moving up from basic science to practical engineering subjects for a mechanical engineer if he has a good grounding in thermodynamics a good grounding in fluid mechanics a good grounding in solid mechanics and dynamics and a good grounding in let us say heat transfer to some extent you can expect that he can analyze problems whether they be in design whether they be in production or whether they be in controls whatever be the areas of application in which if he does not have that good grounding he is always going to be empirical in his outlook so a good grounding in basic engineering science is the basis for being able to analyze problems in your profession and speaking of mechanical engineering one could similarly list a set of subject in say electrodynamics or in electrical engineering or in computer science and so on so there is no difficulty but that is the point basic subject basic engineering science subject forms the core and helps us to analyze and synthesize problems of interest then of course if you are creative you can do something in that subject like build new technologies and so on but the ability to analyze comes from having a good grounding in the basic core engineering science subjects of your discipline and that is why thermodynamics is a beautiful subject but there is another reason why it is beautiful you are trying to describe nature in a set of laws and those laws look terribly simple but have evolved over were evolved over years and have stood the test of time to this day first the first and second law of thermodynamics and the zeroth law it precedes it are laws which describe nature and have now stood the test of time and they are very beautiful laws very simple this is our standard question when somebody comes for admission you say tell me the first law and somebody says people say it is conservation of energy somebody says work and heat you know things like that various descriptions but basically in simple terms what the first law is saying it does not matter whether it is a work interaction it does not matter whether it is a heat interaction if I have a system whether closed or open and energy is flowing in and energy is flowing out in the form of work and heat the algebraic sum of all that will be if it is in the steady state that is all that you are saying it does not matter what it is and the second law goes a step further and that is what makes it even more beautiful it says look that is fine as far what the first law says I have no objection but there is something more which nature as nature says I can convert all of work into heat that is what Joule did when he stirred water and heated it up but I cannot convert all of heat to work that is what the second law says it is a very beautiful and a powerful statement and then in order to explain it we have introduced the concept of entropy saying entropy is a measure of disorder work is more ordered heat is less ordered and that whenever a process takes place in which we go convert heat to work and get work we are introducing order locally but on the whole in the world as a whole we are increasing the measure of disorder that is the concept of entropy and it remains still a very important concept which has stood the test of time but really one does not know whether it is the only thing that the only way to describe what is really happening why should necessarily there be such a concept which says entropy goes on increasing is not clear but it stands the test of time so we say well fine let us stick to our concept of entropy accept that disorder is going on increasing somebody says to what extent can it increase I do not know that is what makes thermodynamics a beautiful subject there are things still which need exploring things of a philosophical nature which also need exploring but on the practical side as an engineer thermodynamics is much more all our problems of energy power plants everywhere are all problems in which we are analyzing energy and trying to get the best out of those power plants so that we can get as much work out of heat as possible we stop worrying at that point that we are increasing the overall disorder in the world and things like that it is happening let it happen right now I want work from that heat how efficiently can I do it and that is the last part of what we teach in engineering thermodynamics that is trying to see what are our power conversion cycles and what are our refrigeration cycles so as I said it is a very practical subject it is a philosophical subject and it is a subject in which you really understand that how well I have people have ended up describing what nature is given us and that is what I said a very interesting subject now let me come to the last part of what I want to talk about briefly and that is one can talk about a subject to a teacher and say look thermodynamics is this and this and this but if you want to be a teacher if you want to face a class of 60 every day finally you have to enjoy what you are doing the business of teaching is a difficult one people say I can teach fine everyone can teach but the business of doing good teaching is an art which you have to develop and cultivate over the years it never finishes even on the day of your retirement you cannot walk into a class and say I know everything about teaching there is no such thing you are all the time learning so teaching is something you have to enjoy that is the first thing I would say to all those who are listening to me across the country if you enjoy your job that is the first step towards doing it well the second thing which I want to talk about teaching and which is maybe old fashioned because I am getting old many people of course use modern technologies I am surrounded with gadgets just now as you can see monitors and things like that but ultimately in teaching a subject like engineering thermodynamics there is really no substitute for having finally a teacher with 60 students in front and having a blackboard and maybe chalks of 2 or 3 colors there is really no substitute for it you may have power point in which you may use for showing say there is a difficult sketch to draw or a difficult figure you do not want to take up the time to draw it on the board or it is difficult to draw you may use some projection technique where you have to show a video or some process taking place or something like that but when it say let us say comes to explaining or deriving a law there is very little that can substitute deriving it on the board with a chalk there is very little substitute for it and in that process students learn in a manner in which it stays imprinted on their mind suppose to come back again to thermodynamics I had to teach the first law and to derive an expression for the first law for an open system or a control volume whatever you call it and this will be done in this class when you go along you can straight away on a power point say this is the expression and say this stands for this first term stands for this second term stands for this third term and so on that is your expression nothing wrong you have stated on the board you will never do that on the board you will draw a system an open system let us say there is a fluid flowing into this space A B and you say this fluid is flowing in with a velocity V the area of this is A and then you ask somebody in the class what is the rate at which fluid is flowing in and the person will say rho A V say fine then you ask the next person but he has made some assumptions in saying rho A V what are those assumptions and maybe he will answer it maybe it does not matter you say well he has made two assumptions he has assumed that rho is a constant he has assumed that V is a constant across that area A I now say to you it is not a constant both are varying across that area A so what will be the expression he will immediately say if he knows a little bit of calculus he will say put an integral outside the integral dA that is the rate at which mass is flowing in through that area and now if you have said this in the class those students if they have got it will never ever forget it in their life if you write it on the board straight away rate at which flow is going in is rho A V dV and then you say if rho is a constant take it outside the integral they may or may not quite grasp the importance of what you have done so I am saying a board using a board well is an important part of teaching and that can only be done on a blackboard with this class which is interacting with you a little cannot interact too much otherwise you cannot cover too much material during your one hour so you need recourse to modern techniques I am not saying do not use power point some power point is needed from time to time some what you call projections of videos are needed from time to time but there is very little substitute for using a good using a board systematically by the way by systematic what do I mean let us say the board consists of three panels you start in the left hand panel go down straight finish that go to the next panel but do not erase the first one because there are students who may want to write something from it when you go to the second go to the third then go back again to the first and I learned this the hard way I can tell you after joining IIT Bombay when I attended after I joined in 65 we had a very senior professor in mechanical engineering professor and you know I he used to teach thermodynamics also incidentally and I said to him I would like to attend your class I hope you do not mind you said of course not please come and so I attended his class and the first thing that struck me immediately was how systematically I use the board he used the board because I appreciated that you would go down systematically the second thing which I appreciated about him was how many sketches he would draw on the board my teaching thermodynamics he said you have to picture the situation first you have to draw a sketch then only put down equation he did not believe much in equation being an old time person so later on the roles were reversed where I taught he transfer he attended my classes and he said fine whatever you teach is excellent but you know every time you draw an integral sign I am reminded of a snake that is all things like that so we were on in different let us say generations but the fact is I had I picked up that wisdom how to use a board by attending his class and I still remember that so the point I am trying to say basically is in this course we will cover of course thermodynamics very carefully the teachers are outstanding teachers who are going to be covering this course for you so you will get all the fundamentals but ultimately if you are going to face an audience of students develop a love for the students develop a love for teaching you will enjoy it the students will enjoy it and then teaching becomes a wonderful profession in which you are proud to be going out every day and saying I am doing something that is worthwhile for you for your students and for the nation so I thank you very much for inviting me this morning it's been a great pleasure and with these words let me say I have great pleasure in inaugurating this workshop on the teaching of thermodynamics thank you very much thank you Prasukatmay for those very encouraging and nice words in fact now I understand why many of your past students still remember you for thermodynamics I wish I was taught like that I studied thermodynamics at Indore and it never occurred to us at that time that it would be a beautiful subject but now I understand better I hope all of you heard him very carefully when he emphasized the importance of teaching and the systematic methodology that you must adapt I would like to add and all the participants and also to Prasukatmay that we indeed understood the fact that only power point is not going to be very useful so in all our long distance teaching programs we have a gadget which is an equivalent of a board which is this writing pack and in fact I believe Prasar Gaitonde rather prefers to use that than just the power points so do we in fact I was an avid user of power point but when I was teaching my programming course I found out that a pre-written program does not appeal to the students as much as development of that program so I learnt it from a colleague of mine Prasar Rana from Maths department was using a tablet PC to write and I have since adopted that and I find the teaching has become far more effective so I entirely agree with Prasukatmay that a teacher must use the conventional wisdom of interacting with students encouraging them to think and giving them picturizable visible sort of artifacts to think about and develop the derivations rather than show completely derived things I would also like you to remember the most important thing which he said is that if I want to be a good teacher I must enjoy teaching there is no substitute for doing anything well without enjoying it and I think that is the message that you will carry with you so thank you very much Prasukatmay for giving us these wise words I would also like to thank Professor Khakkar the director of IIT Bombay or for that matter director of any institution is an extremely busy person but you could see that he emphasized exactly the same point and he did mention that this kind of programs can reach out to large number of people which was endorsed also by Prasukatmay let me tell you that the first that we are doing would not have gotten off the ground if successive directors of the institution had not supported all our early experiments in fact when we started it I remember Prasukatmay was the director then and we had put some very costly visa equipment subsequently when Prasukatmay joined as the director he encouraged it and in fact extended our distance education program to a full-fledged center which my colleague Prasukatmay now leads Center for Distance Engineering Education Program so thank you very much Prasukatmay for joining us I will not thank Prasukatmay and Prasukatmay that is a job I would like to do the valedictory and in fact some of you at least the co-edators have interacted with both my colleagues here but let me tell you that in terms of being systematic and in terms of being passionate both of them are no less particularly Prasukatmay whom I know for well over 35 years incidentally he happens to be one of the favorite cellars of Prasukatmay so there is every reason to believe that he has imbibed the systematic development of courses and much of the passion for teaching from him I think we are in good hands let me also take this opportunity to thank several functionaries of the institution without which this kind of programs would not have happened the two most important people are the co-ordinators for our continuing education program Prasukatmay and co-ordinator for our Center for Distance Engineering let me tell you that the conventional wisdom in continuing education program is that you conduct workshops for 30 or 40 teachers and to endorse a conduct of 850 teachers program is not very simple or straightforward particularly when those teachers are not physically here but our CEP establishment went two steps forward to say this is perfectly fine they in fact help us conduct the co-ordinators workshops which have to be held specifically in IIT which as Prasukatmay said is a precursor to every such workshop that we do Prasukatmay of course makes all the facilities of the center available to us for all interaction in fact the hall from which this function is being conducted is the major seminar hall for Center for Distance Engineering Education program a project like this cannot be conducted because all projects sponsored projects of the government or any other agency project they are all conducted in IIT Bombay under the ages of a department this particular program is being conducted under the department of computer science engineering and let me tell you computer science department is currently undergoing a lot of problems our new building is not yet ready we are all working in a compressed mode making space available for any kind of activity is difficult the primary demands on the space are always from our research labs it is to the credit of my head Professor Sanyal and to all my colleagues in the department that in spite of the space crunch for last 2 years they have been very very considerate in giving last space for this mission project you might only see a few teachers talking to you but let me tell you that there are about 50 project engineers working on several technology developments like clicker or the AV related development and other things there are several managers and supports of which are working and is almost like a very large entity itself all of that entity can function very comfortably in the ages of CS department and I would like to thank Professor Sanyal and my colleagues for that I must also thank all the other faculty colleagues who have come here to grace this occasion I hope more of you would come forward in coming years to conduct these workshops I am taking the point made both by Professor Khakkar and Professor Sukhatmay that these programs indeed are able to help make an impact on the general teaching ethos of the engineering subjects in the country and I promise you sir that will continue this good work the government of India in fact wants to expand this to not just the core courses in engineering but even other elective courses and other things in specific areas which will probably appear in the next plan I would like to thank my own team members as I said there are 50 people the technical people are not here of course they are always in the background the technology that they develop they develop is what we and I use but they are led by my managers the video team is led by Mr. Sajjan Kumar Dixit then we have our three senior admin managers Dr. Mukta Atre most of the coordinators and in fact many of the participants would know because they would have interacted with her that is Mukta for you Mrs. Kalpana Kannan Kalpana is sitting at the other end yes so she is another manager and of course our finance minister Jaya she handles all the finances it is not easy to interact with 31 remote centers getting their functions settling their bills and in all the work that she and her colleagues do we are very able to help by an extremely efficient office of our dean RND Professor Rangan Banerjee unfortunately could not come here today I had invited him but I would like to express my thanks to him and his office for all the support that we get with this I would like to conclude this inaugural function I will personally be talking to you I have been kindly and graciously given a slot of half an hour by Professor Gayathound day on Saturday before lunch so this Saturday before lunch I will be engaging with you where I will tell you more about the spirit of this workshop and what we want how we want to take this further I just wanted to make one announcement I think Professor Gayathound has already put his first test on the Moodle so after the tea break this is the typical IIT style you are learning by solving problems so in the typical IIT style we will be doing that there is also an additional questionnaire you see we want to measure the effectiveness of this effort and this effectiveness can only be measured by seeing how much impact the teachers who participate in these workshops make on the learning of the students whom they teach later so this we have evolved a methodology and MTech student is working on that where we will begin by collecting feedback from the students whom we have taught in the past collecting feedback from you now collecting feedback from you after the workshop and collecting feedback from you and your students in the future so long run process we are just beginning to do that but the first feedback that we would like to collect is from the 850 participating teachers before they start the workshop to assess in their own mind what is the state of preparedness and what is the state of their experience in teaching this course so please remember that before the course becomes old just as you will answer professor Gayathondhe's technical quiz I would request you earnestly to answer those 9 questions it will not take more than 6 or 7 minutes that is in the moodle over and out thank you very much


Anyway, speaking of you and Reginae, let's really get into it. What I want to start this part off by saying is I think that you two have taught me something about a bias that I have towards relationships in my generation. I will say that I was very skeptical about y'all if I'm being honest because I felt like you know you guys were posting a lot of videos together posting a lot of pictures and I was like damn like this is moving very fast. But then I thought about it to myself like we've normalized the sneaky links the buying gifts expecting gifts going on trips basically spending a night at each other's houses after so it's like we didn't even do that and and so for me to be skeptical about someone showing their love publicly just because it's publicly when we be doing the stuff in private and stuff like that it's like why is there like a stigma behind genuine love in today's society so I will say that you guys have made me realize that I have a bias I guess maybe based on the lack of experience maybe that's where it comes from so I do want to say that I love you guys love the way that you genuinely show love for her your baby girl baby girl yeah it's my baby girl so walk me through the timeline because was the blind date really the first time that y'all met yeah that was the first time we like I met her at a bmf premiere maybe a year and a half prior but the blind date was the first time we actually like met and was face to face like that yes really yeah because it was given like the connection was given the eye contact was given it was real like well let me tell you so the reason why it was kind of like it was it was the first time but you know we was we were like friends and we were cool like you know okay uh like maybe like that's when we kind of like you know like yeah like when so let me say this so it was the blind date but people don't even know like the blind date is really like when I actually looked at her face to face I was that was my first time coming over there you know I was in at her house prior I didn't even see her because I didn't even know it was at her house yeah like well that's a certain part okay I'm saying like that's not her house but she have a like you know I want to you know disclose my girlfriend locations but you know that's where she does you know her her content exactly that's her content house so um yeah before that like that was my first time actually seeing her like okay so I'm saying prior to the the bmf movie premiere that I went to with my management okay so was jazz throwing the ad like jazz was helping you shoot your shot like what they're already some interest there because you said that y'all were friends so was it like you know you talking to jazz like oh yeah I think she's cute she fire the body body in you know like um definitely I was I was like shout out to jazz for that she really she don't think that yeah I was uh you know I didn't like before I was we were just real cool like you know like I said after that you know she had like how you were saying like just a lot of things we did was different you know I'm saying like a lot of things we did was different and you know I'm saying like the whole like I told you what we weren't even sleeping at each other house is like that wasn't even a thing in our mind like you know I'm saying to start out with so um yeah okay that's crazy okay so I'm thinking back I'm like yeah like what was this what June that was what the blind date yeah it was like that I think well at least when the video was posted it was like five six months ago yeah July okay six months ago it was like July so when you did that too you had said that you were like two months out of a relationship or something like that at the time I was March April May I was yeah three three months like three and a half months yeah so what was it but okay but let me let me let me pause you hold on I was three months out of a relationship but I was I revisited the relationship I was in for two months that I was prior out of for a year see what I'm saying okay I see exactly yeah I had like I was off trying to make it work again exactly yes okay got you so it wasn't like long-term then you hopped right out of a relationship for a month and then January February I tried to work it out and then March we cut it loose you see what I'm saying okay I think so you were out for a month then got back to it I thought you said a year at first no no I said I was with her back with her you see what I'm saying so I was single for a year you are 2021 okay okay see what I'm saying the whole 2021 I was single the beginning of 2022 January February I tried to make it work exactly it didn't I broke up in March tried to make it work again no it didn't no it wasn't it was done all right the math right now May June I was single okay yeah all right I think it's just it's the heat that's getting to me maybe that's why it's not the math not math in it's not but I'm sure that the viewers get it and that's all that it's not nothing let me okay no no no you know your math is nothing I'm saying me right it's me not you yeah let me let me make it right for you I want to know what's not not you said you said a year y'all were off right then beginning 2020 the whole 2020 2021 I'm sorry yeah then the beginning of 2022 y'all got back together January right oh for the month for the two months yes then y'all took a month off no we broke up that's where she's getting it confused all right yeah it was done in March hold on you want to know something arm on because at one point I think you said a month instead of a year and I think that's what caught me up oh okay now I think you would say I think I heard you say a month and I'm like nah we wasn't broken I think that's where you kind of we got lost we got lost she confused all of us then I'm sorry I'm not not a month I was single for a year we got lost the translation all right you would say before a year my bad four year and then I got back tried to make it right with my baby mother for January February and we broke up in March right I was single you had to break and then met Reginez yes cool all right thank you for setting the record yeah no problem all right so what was it um about Reginez that made you like for it seems like you fell really fast yeah what was it about this relationship that made a different from anything that you've experienced before um like I said it wasn't really falling fast because we were friends you see what I'm saying like before we even jumped into a relationship like the blind date wasn't me saying hey be my girlfriend like we were actually friends like you know I'm saying after it wasn't like I said it wasn't oh come spend the night or let's do this let's it wasn't that we took our time yeah we was slow mo you know um so I'm on I when I say falling fast I don't mean like rushing into a relationship but I think it was very clear from very early oh that I like it yes of course very very clear that there was something there I feel like everybody could tell that like whatever was between yeah that I that I felt it was real strong it was real strong and and that's really what I'm asking about like what was it about what there was the connection what there was about her in general that like made that okay so okay yeah I see okay so basically just the way she talked the way she she handled herself you know different questions that I asked her in different conversations that we have um I just felt like she was um I was kind of like you like in a sense like I'm like I was kind of like you know no female really where I'm at you know I'm saying mentally or where I'm at so I kind of like want to take a step back and just focus on my career but talking to her that was like a breath of fresh air and then to actually be almost six seven months in of you know I'm saying a relationship with her I just feel like like that's her you know I'm saying I'm like yo jackpot you know I'm saying because she really you know is what she told me she was you know I'm saying she real she authentic you know I'm saying she support me she's a woman she's a business woman she's an actress she's you know I'm saying she's everything that she put out there yeah I love love and I love the way that you talk about her that's my baby girl that is your baby girl like you like even in the video where um Jazz tried to prank you and say like she didn't think that Regine was the one for you yeah you um like like just respect to her when she wasn't even in the car you vouched for her like you really was making sure that Jazz put the respect on her name and it was like neither going to respect it get lost yeah and to go back to you asking me was the pranks real that oh yeah that was the conversation we had off camera yeah that was conversation we had off camera but definitely that was one that you know I'm saying because Jazz got different gadgets and shit that she used on YouTube like I told you I got my one camera like and I be just uh no I vlog but Jazz got the I don't know what she had in there I think it was a GoPro but I wasn't paying no attention you know I'm saying like okay by the time she told me and look I'm like yo like that's wild but you know just when she did play that you know it kind of caught me off guard but it's like you know like I like I told her and I can read say what I said it's like I know what I want right and she checked every checklist that I want I love that for y'all okay so you gave her a promise ring um what is the significance of a promise ring to you um the promise ring the significance of it was just you know me being a man I feel like um just me learning my woman and me just you know listening to her I just feel like you know women just need that reassurance you know um and like I said I just wanted to let her know that that's just like my loyalty you know like you know I only see her I only want her um and you know just my gesture that's just what I do like you know I'm saying that's just who I am I think the promise rings are making a comeback because I don't know if you know um there's an artist out here Nas E.B.K. he gave his now ex Jada a promise ring and that was like a really big thing and that was the first time that I had seen someone respectfully in our age group give somebody a promise ring because they haven't really been normalized um at this point so now seeing you do it as well it's like okay promise rings making a comeback love the man committing to their women so shout out to you for that also um so what are your thoughts on like people who make speculations about you and the way that you handle your relationship for ex you want me to give you an example for example like in academics you know I know you've talked and talked and talked about this situation um but coming out of that you know I think that there are a lot of feelings that people may feel because like I said before this kind of love isn't really normalized in our generation at least not publicly um so what are your thoughts on people who make comments about you and the way that you handle your relationship so lovingly and like you're very vulnerable and open what do you think you know what what I don't really trip about it's because honestly man like you know the the people that be talking you know it's it's the comments but honestly man that the the people that they look up to them the same guys that be like yo that's fire or a bro like a what what flower should I see my girl bro like or a yo gang like how could I you know you see what I'm saying so when I look at it's like yo y'all trying to be it's like it's just I could never even get mad about that and then you know I'm I'm just me you know I'm saying I feel like that's what make me me you know um I ain't really got too much it's like you know okay you know the females I don't give a fuck about niggas like you sound saying like I'm a ladies man like you know I make music for the ladies you know I'm saying so I'm not worried about a bunch of okay and now I want you to receive this question in the way that I'm asking it um to what you're saying about being the ladies man you're making music for the ladies all that how does it make you feel as somebody who's also in a relationship to see somebody like academics who's like imitating you with like a flamboyant voice and like trying to like lead to speculation of things about your sexuality that you know what do you think about that he don't know me you know and like behind that I just feel like you know when he see me you know then he'll get a chance to know me you know it ain't nothing flamboyant or ain't nothing to hell no I mean I don't know what I don't man I do this goofy like I don't know what the fuck he even I don't know like I ain't even I don't care about okay well academic that's crazy yeah that's academic society what do you think about the way that society expects for men to conduct themselves right and I don't know man I feel like yeah like it was like it was like like you saying it was like the way like it is I talked to my girl he apologize like I he's at like what bro so you think because I talked to my girl you know I'm saying respectfully respectfully like um I should be taking as you know lightly you know I'm saying but like I said just to make this clear once again like I'ma tell the young cats of the day the young dudes like ain't nothing weak about loving your woman nothing weak about it you know I'm saying you stand on your business you stand on your principle but at the end of the day a real man is gonna love his woman that's just period you're not gonna it ain't you know I'm saying they're normalizing this shit but that's not it's not normal you feel I'm saying like you keep it P you be respectful you respect your woman period you respect the bed period if that's not what you want you get out the situation but trying to shed a light that someone is you know I'm saying gay or someone is flamboyant because I'm not you know I'm saying that sound like he got like he just a little nigga to me like I don't even like that's just a little shit like I don't I don't even want to talk about that okay I'm saying because that's old I don't want to shed no more light on that seven months old and thank you for clearing it up and yesterday seven months old but this is my first time see you so of course I gotta ask you about it not towards you I get it that's something that you know that I feel like people is going to talk about and that's something I'm gonna have to say but you know I just don't feel like you know I said like once again the young the young cats of the day but even the older cats that's even that ain't that ain't what it is you know be respectful to your woman respect your woman and stand on business period I wish you were holding your mic so you could drop it because I was yeah I would have dropped it I would have dropped it for you saying you know because that's real shit so how have your supporters um been receiving your relationship like how would you say that they've been reacting to you and Virginia being together um man they've been reacting they love her they love what we got they love you know how we did it um they just love you know what I didn't grew to I feel like they watched me um go do different things in the past you know I don't know if you know but just a couple things here on the internet and um just to see this you know happening for me and me actually you know I'm really in love with this girl you know I'm saying like I really like I can say that you know so I feel like they just they love it you know yeah and you know what I think that that is big because the supporters don't be playing around like you brought up jazz a couple times and I'm gonna bring up jazz now because they will not let go with hey they will not let go of hey all in the comments like it don't matter how many videos jazz posts for crystal they still asking for and I love jazz and take down but I respect her relationship with crystal as well and I feel like a lot of people as they watch you grow with somebody and they get to know you as a couple with somebody I guess they want to hold on to that but I think that it says a lot that you're able to start with somebody new and they're being so receptive to seeing you together I think that says a lot because I don't see no mention of your ex and none of the comments yeah but speaking of how did you approach the relationship being fresh out the relationship with Regine excuse me being fresh out of one with the mother of your child are there certain like protocols certain things that you have to do to like make sure everything's good like how did you address that um yeah I just I just took my time you know um just didn't want to make the same mistakes over again you know I'm saying they want to move too fast you know didn't want to just do too much so I really took my time okay got to know her got to know the dudes that don'ts what she like what she don't like you know what make her mad what don't okay I think I wasn't clear but so I'll give you an example personally like me my one of my non-negotiables for a long time has been like I don't want to date a man with kids it's kind of changed now that I'm getting older but more than just because of the kids it's been because of the uncertainty with the relationship between him and his the mother of his child okay so going into a relationship I know that that was something that Regine asked you from the blind date like what is the situation between you and the mother of your child um so that's really what I was asking like are there certain things that you had to make sure were clear or were there like are there certain protocols towards like being in a new relationship after being a fresh out of one oh are you following what I'm saying I just want to make sure I'm not saying yeah yeah of course they're saying basically like like yeah yeah how do you yeah right while in while trying to manage a new relationship as well um thank you just just respect you know um honestly you know I really don't have to make that call unless I'm talking to my daughter so okay you know just made that clear um she don't have that problem but that is a talk that we had and you know like I said it's my daughter over there so of course my girlfriend with me all the time so she's seen my kid and you know that's how we do that and then you know just going to go get her I make it to where I get my daughter then she come back it's it's all right okay cool all right that's nice so now how has father because I won't get I won't get too much into it I'm saying that's good that y'all have that that set up um and it seems to be going smoothly from what you're saying um so how has father had been treating you overall you seem to be a very great dad um you're present you seem to talk very highly of your daughter how does it feel to be a dad I feel great to be a dad right I always had like a feeling you know that I was gonna have a little girl so this is always something that I you know I feel like that was the type of love I had hidden to pour into my my daughter so I just man my daughter is everything like you know she's coming here next week so she's gonna be with me yeah it's my baby love that for you man that's my baby did you how did you grow up what was the structure in your household growing up no yeah okay that's fine so there was something that you um spoke about and if you're open to talking about it you talk about it you tweeted something about you didn't know that men could go through postpartum depression as well how's to do that you tweeted that yeah I did you did where on twitter what do you mean where you tweeted that out with my brother I'll pull it up for you that's on our monetary page right yes that was true you you pulled it oh that was my brother okay yeah because I don't like I didn't say that I stand corrected because it was also on the t-page too yeah that's my brother yeah um was that something that you had experienced at all um going into fatherhood um no no I feel like what I deal with more so just being in my head okay you know about being a father and like you know I just I'm really really really really really hard on myself like really you know I'm saying so like man sir like I'd be so scared to take my daughter to a water park you know what I'm saying only because it's like like this this all I got you know I'm saying this is my baby right here so you know her and you know of course but I mean like that so hey guys it's Enrique from talk of the town thanks for watching be sure to subscribe to our youtube to see more


Okay, so your program promised you an open-source love story in 3x and so like every good 3-act play we open with the dramatic person a So first this is peppercorn Peppercorn is one of your users dogs and like any good dog owner The first thing they did upon acquiring peppercorn was go and change their password on all of their software services to peppercorn This is Mallory Mallory is an attacker. We will come back to Mallory more later, and this is me My name is TJ shook I am on the internet everywhere as TJ shook with the dots and spaces removed from my name github Twitter Also Instagram and yo like tenderloft. So if you want to yo me as well you can I work at Harvest I'm a developer there. We are the makers of the world's best time tracking software If you do anything where you charge money for your time agency freelancer consultant, you owe it to yourself to check it out Notably for this talk. I am not a security expert There are people who are real security experts who get paid lots of money to know about a lot more stuff than I do But by virtue of having users I have to be a security expert and so do all of you Ignorance is not an excuse here if there is a security breach in your system You can't just say we didn't know any better that is insufficient and you'll see later There's a lot of interconnectedness here that your breach can have further reaching implications So though I am not a security expert. I have to be as do you So back to Mallory. Let's talk about her attack. So good security is about layers You should have all sorts of different kinds of security. You should have application level security You should protect against SQL injection XSF CSRF rails gives you a lot of that kind of by default You should also have infrastructure level security. You should have a secure data center You should have physical firewalls between your devices However to truly investigate any particular level of the layer cake that is security We have to assume everything else has failed. So we have to assume that this works Mallory can just run her script and get a raw dump of your database So let's Considering what we are going to do with our users passwords. What's the easiest option for what we can do? We can storm as plaintext It's easy it makes sense when someone just logs in they pass their password. We check it if it matches great This is obviously bad and no one here is doing this, correct Right does anyone want to admit to doing it? All right Someone is doing it someone is not raising their hand But someone's doing it because it doesn't matter they have a site that's just like you know Gift ranking and you know you say like I like this anime give more than this one It doesn't matter if their passwords leak someone's just going to rank a bunch of gifts on their behalf But this is bad because users reuse passwords So if they break into your site and steal a bunch of passwords, they don't necessarily care about your site But now they have a big Long list of user names and passwords that they're going to go to Gmail and try and Facebook and try and all the banking sites and try and they're going to get into some of them And if they get into some of them they now have additional vectors of attack to get into more of them So it's important again to remember that you are part of a greater world And you cannot be the weakest link in the chain because again ignorance is not an excuse for not knowing this So we know this is bad so we need some way to obfuscate the dump so that when Mallory gets it She cannot use it so the easiest thing is just encrypt it This is a very secure form of encryption known as ROT 13 wrote 13 a Caesar cypher with a key of 13 You take all the letters and you shift them by 13 so an A becomes an N a B becomes an O a C becomes a P That's just for illustrative purposes. This could be DES 3 AES 256 any kind of real encryption But the key to all of this is that there's a key there's a way to reverse it So here the key is 13 if you know 13 you can take all these passwords and reverse them back out again So somewhere there has to be this secret. It's either in your app code or it's on the server or any number of places But it's important to remember that since the attacker has already gotten through most of your defenses Presumably also have access to that secret in some way and it's also important to remember that an attacker could be a malicious employee Who has easy access to your application code or your server? And they don't even have to be the only attacker like if there is a public leak and you work at somewhere big like there Was a big leak for LinkedIn passwords all it takes is one malicious employee to kind of like leak out the encryption key And then all of those passwords are broken So it's important to note that encryption is reversible so data is obfuscated But if you have the secret you can decrypt it and read it hashing is irreversible so if you have Peppercorn and you apply a hash function to it you get some output and If you have secret 1 2 3 4 and you apply some hash function to it you get some output But if you have some output you don't know what the input is because hashing is irreversible. There is no Inverse function to give you the input Additionally hashing is deterministic this becomes useful for authentication because when you hash peppercorn you get an output When you hash peppercorn a second time you get the same output when you hash the third time you get the same output That's how you can actually do authentication when the password comes in you hash it if the hashes match You know that the input was the same, but you can't back out because it's irreversible It's also important that it's deterministic, but not obvious So peppercorn has the same time as the same output, but if you trivially change the input say you capitalize peppercorn The output is completely different and if you have output that's just trivially different So here the least significant bit is off by one. You have no way of telling what the input is So this is great all of our problems are solved We just hash all of our passwords and now anyone with a dump can't reverse them back to get plain text passwords Throughout all this I'm using md5 just because it's shorter so it fits on slides better But sha1 is effectively the same so we can't go password backwards. All of our passwords are safe However, we have a problem in that hashing is deterministic This is a double-edged sword because the hash of peppercorn is always the same The hash of peppercorn is always the same and this leads to the concept of rainbow tables A couple of logistical points here. First of all, that's the best slide that's ever been made Second I have already turned it into a gift for you. I will tweet it out later Third we're not actually going to be talking about rainbow tables. We are technically going to be talking about lookup tables Which are kind of a generalization. They're the first step of rainbow tables rainbow tables are a little bit more complicated The understanding of them that you're going to get those effectively the same They have the same consequences and the same ways to mitigate them and if I was talking about lookup tables My slide would look like this and that's boring. So instead you get this one But remember we're talking about lookup tables here Okay, so we have this dump Mallory has this dump and she wants to work backwards from a table to see What the original value was so as a proof of concept we can use the world's best lookup table Which is Google if you just drop in the hash and Google it we don't even have to leave the results page You can see that that md5 is for peppercorn. So Mallory in a better tool than just using Google can figure this out So we need some way to render all of these pre-computed tables obsolete so that you can't just Google a hash and see what it is The easiest way is to just change all the inputs So we know that the hash of peppercorn is this but if we just append a string of nonsense to it We get a different hash and in our apps password hashing method We just say okay Here's our like app-wide string of nonsense you append it all the time and you can see you check our label lookup table And there's nothing there. So we did it. We totally defeated it. We did it Except we didn't so an attacker cannot just look up the password now in a pre-computed table But they can generate a new table trivially because it's not that hard to generate these hashes on this MacBook Air Which is never considered to be like the fastest computer on earth. I can calculate 13 million Shaw ones every second 13 million a second on a MacBook Air So if you have that altering scheme from the app code or from the server again It's a secret that's built into your thing someone can just use that to attack by doing the same method This is where harvest was so as a proof of concept. I decided to white hat attack our database I had put down a dump I did my best to anonymize all this data. So I only worked on the raw hashes You can use any freely available program going through and googling each individual hash will take a long time There is one called hash cat that you can download Google it It's not hard you can use John the Ripper which you can install via Mac home brew It is not that hard to do this you also need a word list I googled for about ten minutes and I found a 25 million long dictionary and I ran it through hash cat and as I was considering whether I should make a cup of coffee 87 seconds later There was peppercorn along with 80,000 other passwords 80,000 passwords in under a minute and a half Now this isn't even a majority of our users, but it's enough to do significant damage I can now go and attack everything again. I can't I know these passwords, but I don't know who's they are I don't know your password Additionally in this list of what you would think are insecure passwords We're also these that a lot of people at first blush might think are secure So the first one that universe It looks secure because it's that sort of lead speak alternate swapping But these word lists are really good and they have a lot of those and the programs are really good and can do a Lot of these automatically so even if your word list only has the word universe It knows to swap things out the second one looks really good until you look at a QWERTY keyboard And you realize it's just effectively a hardware hack where you're just tracing keys on a keyboard Again, they're smart enough to know that the last one. I have no idea. I don't even know what that is I can't figure out why it's in there. It's probably just in there because of length. It's not that long But again, they're good these passwords are easily cracked and as a user You should be using some kind of randomly generated long passwords, but that's a different talk So our last attempt was close But it was using a global salt where we were just depending known nonsense So we can do a per password salt so now instead of doing just peppercorn with the global nonsense We can on every individual user give them a different one This now gives all of our users those strong passwords Everyone now has very long very randomly generated passwords effectively We just store them in the database next to the thing knowing the salt doesn't particularly help the attacker But now the computational complexity is greater because they have to compute a table for every individual user I Got rid of the email column for space here. By the way, you would normally also have that If you have a very random salt as well with particular length you would get enough entropy so that people with repeated passwords So if you have a thousand users with the password password, they also have different hashes So this is pretty good. This gets us pretty far, but this is pretty good for 1976 This is approximately what Unix's Crip 3 does in 1976 and at the time Modern hardware could calculate about four per second So there was enough kind of difficulty to keep someone from generating a million lookup tables for all these users But today we have these this is an AMD AX 7990 it costs about a thousand bucks So anyone can reasonably buy one of these this can calculate 1.5 billion hashes per second So my MacBook Air 13 million this 1.5 billion it makes generating these one lookup table per user calculations feasible again and The problem is all of these hashing algorithms that we've been talking about Shawan MD5 they're not made for password hashing They're made for things like checking vial validity on both ends of a network transfer and they're designed because of that to be fast So because they're designed to be fast hardware keeps getting faster and they keep getting computed faster And now we have a problem So in 1999 Niels provos and David Matsiere's published a paper about a future adaptable password scheme where they were trying to solve this exact same problem And they came up with B crypt now B crypt has all the goodies. We've already discussed. It's a one-way hash pre-image resistant It's deterministic it has built-in salt So you don't even have to worry about doing them anymore But it has two additional goodies that are the actual notable ones that we're going to talk about a little bit more One is that the underlying cipher is X blowfish. It's based on blowfish, which is notably expensive It's known for taking a long time to boot up But it has a new set of algorithm to be even more expensive. So the EKS stands for expensive key schedule So it requires more memory which makes GPUs and other specialized hardware Less feasible in an attack, but more interesting is the notion of an adaptive cost that was right in the title of the paper That's how important it is. So let's look at the dump again So we have a dump with all of these B-crypt digest in it B-crypt digest looks approximately like that So let's investigate its anatomy First of all ignore the dollar signs. They are just delimiters. They don't really signify anything at the end here We have the actual output of the hash that is the checksum. That is the hash. It's a hundred and ninety two bits encoded into base 64 To the left of it is the salt. It's a hundred and twenty eight bits salt that again You don't have to worry about it's just taken care of by the B-crypt algorithm It's again base 64 encoded to be a little shorter on the left here. That means this is B-crypt a Value of 2 to a to be 2x and 2y all signify B-crypt for assorted historical reasons We can go over those later, but generally you'll see 2a because that's what B-crypt Ruby uses But this is the most interesting one. This is that notion of cost So let's see what that means when you want to be crypto password You pass in additionally this cost parameter that gives you an output if you do it a second time You get a different output, but that's because of salting We already know that and if you do it a third time with the higher cost you get a different output yet again But there you see that the cost is different This isn't particularly notable until you look at the time that it takes to do each of these So the first one took about 0.06 seconds second one the same the third one took just over one second And that's what that adaptable cost is as hardware Gets faster over time we can march that cost forward along with it to get more expensive calculations These are all approximate averages using my laptop right here So a cost of nine takes about 0.03 seconds to calculate one of these hashes and a cost of 16 takes about four seconds Right now today You probably don't want to do that last one because you don't want to add four seconds to your login flow but somewhere in like the 12 to 13 range is probably Something that wouldn't be noticed by your users, but would definitely be noticed by an attacker Using a cost of 12 in harvest that previous attack that took 87 seconds would now take about 84,000 years So we've now kind of gotten over that hump of the cost calculation where it's no longer worth it So be crypt is kind of that sweet spot. It has a Ruby library We'll talk about that a little bit more later, which makes it very easy to use And it gives us kind of this future proofing Some people right now who skipped ahead in class are saying well Why don't you just use PBKDF to or why don't you use script or something else? And that's fine. You're again. You're ahead of the game. Those are okay. Those are probably fine I disagree with you. We can talk about the finer points later But if you are already using PBKDF to or script you can stick with it It's if you're using a an older algorithm like sha one or MD five that you'll want to change So how can we fix this problem if we have it currently? We need the plain text version of the password because if we have hashes we already learned they're irreversible So if you already have the plain text if you're in that step one This is easy just run some kind of one shot to go through them all and convert them all Otherwise we need the plain text password and the only way we get this is in our current authentication method So currently we have something that looks like this Authenticate with the plain text password that we used to hash and then match we want to get to here where we're using b-crypt to check them The astute members of the audience will notice the double equals there and get immediately concerned because I told them the b-crypt is Reversible and we're comparing this plain text string against what appears to be the reversed b-crypt digest this is actually because b-crypt Ruby overloads the equal equals operator and I think this is one of the worst design decisions of b-crypt Ruby and I intend to reverse it eventually I've actually just got an issue on b-crypt Ruby like two weeks ago that someone was confused about this But just know that that's being overloaded and it's actually not just doing a string comparison So the easiest way to do this is just hook into our off filter with there with a pre-filter so you get the plain text password and you run it through this conversion and then you check it because it's Been converted and the conversions easy to b-crypt provides a way to check Is this already a valid b-crypt hash if it is just kick back because we're already good Otherwise take it convert it easy as pie This code works because this is exactly what we used in harvest We dump this in and over the course of a couple of weeks This is two and a half weeks of natural conversion of our users This is the number of users who had b-crypt passwords So there's the immediate big spike upfront as daily users and like all the API hits came in and then it slowly Tapers off as we catch more and more We needed some way to get the rest and because I had already white had attacked the database I just did it a second time but this time with conversion in mind and we got a big spike that took us the rest of the way There were a couple remaining ones that didn't get caught in this they had both strong passwords And they didn't log in recently those we just reset and send them an email and let them know it was up And it wasn't that many users and it wasn't that difficult So if you have this problem, it's not that hard to fix you can do it There is one downside to b-crypt and that is that is it and it is an expensive algorithm But because of that it's an expensive algorithm. You will see more load on your servers This is the CPU across all of our servers. You can see it approximately doubled after we launch b-crypt However, it's still within the realm of tolerability We also probably have a higher level because we still support basic authentication through our API Which gets used a lot and every single one of those carries a username and password Which will do another b-crypt it if you are already whole hog on OAuth and only support OAuth You won't see as big of a hit, but again, it's totally worth it So act one was the easy part you can learn that on Wikipedia act two is where we had conflict in a three-act play so This is about that binary gems We talked about b-crypt Ruby b-crypt Ruby is the Ruby gem that is for b-crypt I wanted to add a feature to this it was missing something that I thought would be convenient But the test didn't run and the dependencies were out of date and they were docks missing so that one pull request turned into a dozen pull requests and After they were all merged You can get commit bit by persistence and so after enough annoyance I'm on asked can I get commit bit and then suddenly I was the maintainer of b-crypt Ruby There have been a couple of de facto maintainers before me most of whom no longer do it This is what b-crypt Ruby looks like the source of b-crypt Ruby, but more accurately. This is what it looks like It's just a Ruby gem. That's a wrapper around C and Java extensions so when you distribute a gem of it as a convenience to your users so that they don't have to have a Compiler on their system you can provide Compiled binaries, but you can see that every version has four different versions One is the compiled Java version one is the compiled like Knicks like version the top two are Windows versions one for x64 and one for 32 bit The problem is that for Windows you need to have what are called these fat binaries that provide support for Windows 1 8 1 9 2 0 in one wrapped up thing I'm not a Windows developer, so I had no good way to do this Luckily when Amon added this to b-crypt Ruby He left these long commit notes about how to do this But he left these three years ago and like anything about computers written on the internet that's three years old It doesn't work Five years ago Aaron introduced the notion of fat binary gems Where I found out that he made the same queen joke as me five years before me But additionally like anything written about computers on the internet. That's five years old. It definitely doesn't work All of this is ultimately though just wrapping up rate compiler Which is this great gem that abstracts a lot of this away So I followed through all the docs of which there are many it is very lengthy and none of it worked so The rails team has this rails dev box that they use to keep you from having to on your development Sheen have all the dependencies that you need to run the rails tests You can see what's in the box all these dependencies So I had a dream that was inspired by this where I wanted to make a rate compiler dev box that had all the rubies You needed GCC the JDK Min GW, which is the library that allows nicks like machines to compile Windows binaries and I thought man This will be great. We can all have these fat binary gems forever and vagrant Kind of offered that solution right what it says on the tin create and configure lightweight reproducible and portable development environments Exactly what I wanted and it didn't work so what do you do with anything that doesn't work you put it on github and With that I opened up rate compiler issue number 79 in our three-act play. This would be the climax This is our turning point. You were promised a love story This is Louise Lavena Louise is the developer of the one-click Ruby installer for Windows as part of that work He became a member of the Ruby core team as part of the work of both of those He was voted a Ruby hero in 2010, but important for this talk He is the developer of rate compiler So when I opened that rate compiler issue, I said listen, I did everything I can I followed all the docs I just can't get this to work and then Louise opened up rate compiler dev box number two Which was his pull request to attempt to help me through this trying trying time and on this epic thread He dropped triple hearts on me not once not twice not three times before times So I need all of you to take out your assorted internet devices phones computers and help me pay him back So everyone tweet at Louise right now three hearts Thank him for being a wonderful maintainer an OSS collaborator Pro tip if you have a Mac that's running Mavericks or later you can hit control command space and get access to the real emoji so Louise help me through this and to half of you I want to kind of implore you to find your Louise and thank them for the work they do It could be a maintainer of something you use it could be a co-worker or whatever But more important than just thinking because that's easy collaborate with them You'd be surprised how willing they are to accept this collaboration And it can be very worthwhile additionally Louise lives in Argentina in Paris So it was a nice little fun global collaboration to to the other half of you the half that are already Maintaining assorted things and you know are the the Louise is already out there I want you to be the Louise you wish to see in the world So next time you know someone comes to you with that issue that you've seen a thousand times already or has a Question that you think they should have just posted a stack overflow or God forbid it's a stupid question Before you say RT FM remember that the problem might be the FM and you know do your best to help them through it And the world will be better for it So what have we learned number one just use B Crip. Just do it. It's easy It's not that hard talk to me afterwards if you want to go through this will laugh will cry will hug We'll convert our passwords number two distribute a dev box if you have anything that has complicated external dependencies Other people will be much more likely to Collaborate with you and submit pull requests and help you go forward with it if you make it easy for them Also, if you have something that has external dependencies, you should try rate compiler dev box It will help you cross compile your gems without pulling your hair out But most importantly I want to encourage you to release collaborate and iterate Thank you


This is TFNN, The Tiger, Financial News Network Update. Good morning, everyone, Basel Chapman here on this Wednesday, the 21st of June. My pleasure to be here for this Tiger Financial News Network 10 a.m. market update. The Dow is down 126,000 at $30,925. We had a second Chapman with Roman Candle yesterday and we went halfway in to the WIC and that says you can test the low of the day or maybe even take it out, which we've done. The low today so far is $32,886, attempting right here to try to hold the 14-period exponential moving average as support. We did have a Chapman with Tringage High Reading yesterday and we saw overnight the 9 to 12 point E-mini rally but I think it's going to be later in the day where we see another attempt at a rally. It might come from lower down but there should be some kind of a decent bounce. We're looking at the S&P right now so down somewhat it's down 22. This is really not bad action when you think if this is a bear market but the week is young. 43.65 down 22 made that peak G-slash-C at 448.47 three days ago three sessions ago and here we are at the 4.364 level so far. I mean that's that's not good because we gapped down into yesterday's open and then we stayed down all day and now we're having a red candle with a lower low. QQQ here we go NVX 100, 363.25 down 367 acting much better but still weak today and we've got the IWM, the Russell 2000 small caps down 98 down almost one at 184.11 on the 14 period exponential moving average. Gold is down under the 200 period moving average that's been my target the 1937 area we're right there now but at the same time the weekly chart did go on Friday from a sell signal to a sell mode that's the weekly chart. That's not a good sign and the monthly chart has pulled back but that doesn't look bad at all looking at the dollar dollars up just a little bit dollars up nine ticks at 102.63 and we've got the crude oil, the crude oil is up a little bit and bonds are now the yields are going up. I'm back with the target, the conditions are in a moment, check up on what we're called the equals level.