So, you might be asking yourself why school software now, and just like many other industries, every year there's a new breaking record of publicly disclosed cyber security instances, and the K-12 school districts was no exception to that, so we noticed that there was a big uptick in that, and then kind of also tying into now kids are going to start learning over the network and starting to use maybe more software in their day-to-day learning habits, we decided to take a look. So, that's kind of when we began to look for software that is widely distributed. It has like one of the largest user bases.  So, this is when we stumbled upon NetUp. NetUp Vision Pro is the software that's used in the school districts. They have around six million teachers and students using their platform in over 9,000 school districts all across the globe, and the NetUp is actually the parent company that has like around 100 million users. So, let me explain a little bit more about how the software is designed to be used and how COVID has actually made this more vulnerable to attacks. NetUp Vision Pro is primarily designed to actually be used in like computer labs or on-premise classrooms, things like that. It's not necessarily actually designed to communicate over the internet. It's primarily designed to be like a local network piece of software. However, with COVID-19, we noticed that there was an uptick in hybrid and e-learning, and this is where we kind of started to put these two together and how due to a lot of these students needing to borrow PCs or maybe a district requires them to use a certain software set might be letting these students bring home these computers, and I'm sure they didn't have time to go through and, you know, disable local-only software, like NetUp Vision Pro here. So, we kind of identified a new attack vector here where software that has traditionally be confined into like the walled garden of the school district network can now be a little bit more exposed if these students are bringing these home. So, let me explain a little bit more about how the software works and kind of what it's designed to accomplish. NetUp Vision Pro is actually like a student management software. The teacher kind of has like this overarching control and view of all of the students on that's connected to their classroom at the time, and the teacher can you blink the screen, remote control this computer's block web access, run applications even, and then like log in or even shut down the computer. And this is all to kind of facilitate the learning of these students and keep them on track. When it's installed, it's installed as a system service and it is automatically started at boot, so the students can't really disable it or anything. It's kind of tamper-resistant in that way. So, kind of now that we got the groundwork lay that let's put our hat and shoes on and dive into some of the technical details. Like I said before, we like to think like the attackers and these are kind of the four goals that we set out to accomplish and this is what we think that would also be what an attacker looking at the software would want to achieve. So, since there's no internet access, we wanted local network attack. We wanted to see if we can get remote code execution on the machine. We wanted to see if the software is leaky and can potentially leak Windows account credentials and then we wanted to maybe try to see if we could improve our position on the compromised machine by privilege escalation. So, the first thing we did was after we identified this as our target from the user base, we just went to the website and they actually offered a 30-day free trial which to a hacker is indefinitely free trial. So, we really like free trials. It's a good way to instantly get in there and start reverse engineering and kind of see how the software works and we don't have to pay for it. But I don't want companies to take that as a negative. So, keep offering free trials. And then after that, we kind of set up a test environment where we created a handful of VMs, made one the teacher and the rest the students and we kind of at this stage wanted to identify the most common install. So, there's nothing worse than once if you find a vulnerability and you realize you didn't check security or something during the install process. So, at this stage, we were trying to make sure that our test environment here made the most sense and would be what we saw in the wild. And this installer was actually pretty simple. There was not much to change there. So, we set up this little local network with a handful of students in the teacher. And then we began just poking around at the software.  But a lot of it is actually just understanding the software to kind of identify where vulnerabilities lie. And this is a large part of our job is just trying to figure out how each of these function. So, the teacher, like I mentioned before, has quite a few actions that they can perform. And we kind of wanted to narrow our scope here and see which ones would be the most interesting. And then lastly, we just, right before diving into the reverse engineering and debugging and whatnot, we wanted to identify the differences between the two installs, the student and the teacher install, and kind of identify if there was any overlap if we found a vulnerability in one. Could it affect the other? And they were actually quite different. So, the student runs most of those plugins, I mean, most of those actions that I showed in the previous slide with separate binaries. So, when the teacher wants to, for instance, open application, it will use a plugin with it. It has a different EXE. And the teacher kind of just uses just the one. One thing I want to point out is that all of the student installs actually run as system. So, I think that's to probably prevent students from tampering or disabling the running applications. And the teacher just actually runs as the normal teacher. So, now that we have kind of the setup going, let's go back into our goals and start going through them one by one. So, the first thing that we wanted to do is just kind of look at the network and see how the teacher and the student communicate. And that's pretty quickly we identified that all of the traffic was unencrypted. Even things that we considered sensitive. Like, right here, this is on the top here. This is the action where the teacher is trying to log in remotely to the student PC and they can type in Windows username and password. They actually block it from here. So, they blocked the password from being viewed, but not in the wire shark capture. So, in the wire shark capture, all of the credentials were just passed in plain text. Any eavesdropper on the network could have captured that. And it's not only the credentials were passed in plain text. For instance, when the teacher was going to run an application on the student computer, that was also passed in plain text. As well as, soon as the students are connected to a classroom, they instantly begin sharing their screenshots like these. And those were also passed in unencrypted, not in plain text necessarily. But using a piece of software like DriftNet, it can pull these JPEG images out over the wire and kind of display them in a semi-real-time view of the students. All just kind of being a passive listener on the network. So, just to kind of fill in the system architecture now, we can add the network traffic and the green unencrypted because none of the traffic that we identified was actually encrypted. And this was our first finding and our first CVE that we we filed against them of clear text transmission of sensitive data. Not only the Windows credentials, but also commands can be seen as well as the screenshots. And to kind of just highlight on how simple this is for an attacker, all they would need to do is have access to the local network where the students are, have a Wi-Fi card or a network card that has promiscuous mode and just a simple free network sniffer that can capture that traffic. So, if we look back at our goals, we didn't actually get a local network attack since we haven't attacked anything. We kind of just passively listening, but we were able to actually compromise Windows accounts. So, just seeing that if the teacher used that login function, we would be able to capture those. So, the next we wanted to do is try to see if we can get remote code execution on the student, seeing that the network traffic is unencrypted. And we wanted to do that. First, we wanted to see if we can actually just emulate a teacher seeing that a lot of the actions a teacher can perform on a student remotely is already a great step in the right direction. Being able to run applications, for instance, that to an attacker is a wonderful thing. So, we wanted to see if we could now just emulate this unencrypted traffic ourselves and kind of become a teacher. And these are, there's a few of the things that a teacher can get or an attacker could get from emulating a teacher. The students always trust the teachers. They can't deny teacher requests or actions at all. It doesn't matter if it's school time or not. If a teacher says to run this application that there's no way the student can disable that. And then they also just start sharing screenshots like I mentioned before. So, how would the teacher or how would we as an attacker try to find these students on the network? It's actually quite simple. The student client actually starts beaconing out their presence on the local network every few seconds, actually. And you can see here, we got in this Wireshark capture, the student computer name, their MAC address, and their IP address all just kind of being broadcast out every few seconds. And it's kind of everything an attacker needs to kind of create a list of these targets on the network and kind of enumerate through each of them to perform this emulation attack, if you will. But first, we had to see how the student and the teacher actually make the connection together and how they begin to send commands or whatever. And that's when we started to look at the handshake between the teacher and the student. And I want to point out that there is these two UDP messages before. So, the teacher actually sends a UDP message to the student and then the student responds with the UDP message. But the first connection is actually the student talking to the teacher. So, the teacher is actually the listening socket. The student is the one that initiates the connection. Kind of after this, these first UDP packets of the teacher kind of telling the student to connect. So, the student makes the connection. And it's around 11 packets in a handshake from just diffing multiple handshakes. We actually only identified three unique elements within that handshake across different students, computers, and different teachers. So, most of it was actually just a static replay for when we wanted to actually emulate it. But first, we had to identify how these three unique elements were being created. And to identify those, we kind of dove into some more packet captures and some reverse engineering. And we identified that the first unique element was just a teacher ID. So, each teacher has a static unique ID. And then the second one was the same, but for our student. And the third one actually was quite a mystery from the majority of our research. We kind of just left it as token three like in this Python output here from one of our scripts. However, after being in Windybug for so long, that address, already this token three started to look a little bit more familiar. And if we actually ran the address command on it, it was this student was actually broadcasting out their heap address for some reason. I don't know why I really was hoping to use that in some kind of like ASLR bypass or a heap exploit or something, but never got around to using it. But I just thought that was a very interesting way of sending a, I don't know, a unique ID over the network. So, now that we kind of understand how the handshake is completed and how to find these students on the network, we started to just write some Python scripts to actually do the emulation. We use Scapey. So, these are some Scapey layers over here. And I want to just kind of point out that not all of the fields we did identify, some of them are still UKW unknowns. So, we identified as much as we could, but they were static. So, we actually didn't really need to know what they were in the end. And then this is kind of just a simple script showing how we can emulate running a command on remote code on the student PC. And you can see that all were really changing here is the target IP and then those tokens every once in a while. And then lastly, the command. So, most of it was just a straight replay, actually. And I'll kind of show a demo here of this. So, these three Windows PCs are actually just the student PCs. And this is our tax script. And so, all it did was right there. It happened really quick, but it scanned on the network for five seconds, actually found all of these computers, beacons, and then just ran PowerShell. And we're doing it again right here. So, scanning for five seconds. And this time we're going to run calculator. So, it creates a list, goes through each of them, and then just replays that handshake with the dynamic fields updated. And we just replaced the command with what we want. So, we kind of used that as our code execution. And that was our second finding, actually. Incorrect authorization. Since there was no way that the student actually can identify if that teacher is their teacher or if it's a Python script like it is here, that's a problem. So, we filed this one against them. And so, we now have a local network attack now and we can do some code execution on the student. But we still haven't increased our privileges. So, in the last example where we're running calculator, for instance, that is actually being executed as the student. So, it is correctly dropping the privileges from the main executable that is running a system to that of the student. So, even though all of the plugins and the service files are all running as system on the machine, they actually have code in place to identify the logged in user and drop the privileges to that. So, we wanted to see if there was any way to bypass that or since we have access to unencrypted network traffic, if there was a field or whatnot that we could pass that could bypass that. That's kind of when we started to dive into, well, we've been doing some of this reverse and sharing this whole time. But this was the first time that we kind of started to look at how the privileges were getting dropped. And as you can see on the left here, this is just all wrapper code for identifying which user is logged in and then calling shell execute way down here with the application that the teacher wanted to execute. And there was a path just going straight to shell execute. You can see right here that all it's doing is it's skipping all of the wrapper code to find which user it is and essentially just running as system. However, there was no way to actually change the variable that was setting us onto this path. It was like read from registry at boot. And nothing over the network could really get us to change that. So, that was a failed attempt of just finding something in the network that we could modify to get system execution. But it kind of got us thinking if all of the code or all of the shell executes are wrapped in this code to drop privileges. And that's kind of when we started diving in to all of the binaries. Not just the main one. And that's kind of where we identified that there were a few that weren't actually. So, you can see right here there's a shell execute down here that doesn't have any of that wrapper code. And these were all unfortunately local privilege escalations. So, none of these shell executes actually were, they never digested user input. So, we couldn't run arbitrary commands. And they also were all needed a mouse. So, a mouse space exploit. And this is just the first one I'll kind of highlight on is, for instance, this one was if you right click on the icon and click help, it will bring up a window with their support web page in it pre-filled. And so, it starts Internet Explorer as system.  And if you click on CMD or whatever, you can usually execute that. So, that was our third finding and our third CVE that we filed for incorrect privilege assignment. But this is still not what we wanted. We still wanted to be able to do this kind of privilege escalation over the network. And so, that's kind of when we started to dive into some of the other plugins and how they were handling it. And it kind of brought our attention back to when we were downloading the free trial when we saw this change log here where it said, we fixed an issue where the teacher sends a file to the student and the student clicks on it, it launches as the system context. That was important in two ways. For one, this chat client can send files, which is always good to have a primitive to drop files on a remote system. And it clearly has had problems in the past with privilege assignment. So, you can see, like I mentioned before, all of the plugins are still running as system. So, that's probably how it inherited that system context. So, we kind of at this point diverted our attention to this chat feature. And we wanted to see how the file operations worked. And that's when we actually identified that this chat function was way more feature complete than we thought. I thought it was just going to be a simple instant messenger. But it actually has primitive or it's not primitive, but the ability for the teacher to actually kind of view the remote file system of like the students, which is kind of interesting. So, this is a teacher view. This is how the teacher would see it. And if they click on the student, it will actually like show you their file system. And you can actually go into traverse these paths.  So, we're kind of confined to my documents folder here. But we can still from there view, copy, delete files. So, that was pretty great finding right there for us. But next we wanted to kind of figure out if these file operations were wrapped in that wrapper code to drop privileges, for instance, or if these file operations were also running as a system like the plug-in is. And that's kind of when we dove back into IDA and found out that they were actually doing all of the file operations as system. And then only at the very end kind of just CH modding 777, the file just setting the access to everyone. So, they just that was their easy solution to make sure that the student can can view these files, I guess. And so, this was actually our fourth finding and actually our highest CVSS score because we now have a remote primitive of system level file system access remotely on these students based on this. So, to kind of highlight on the impacts here, we definitely wanted to figure out if we could traverse back up to maybe the C drive, for instance. And that's kind of when we dove into this convoluted path and actually found a way that the teachers do control this remote path of the student. So, you can see right down here at the very end you can just type in whatever you want. So, being trying to get a system level execution on the computer, we decided to just change this to the C drive, navigate to the folder where the other NetApp Vision plug-ins exist, over delete one and drop in some malware, I'll just call it, where then we know that that software will eventually be executed with the system context and we can just use our emulation script to kind of automate all of that. So, and that's exactly what we did. And I'll show some of the Python code here of how we got system level access or system level code execution remotely on these students. So, the first step we did is we, all we need to do is find those students on the network. Like I said, just scan for the network for five seconds and we can usually make a list of them. Then we enumerate through the list and we start a chat thread in the background, just like how the student connects to the teacher. The teacher is the listening socket, the same with this chat feature. The student connects to that. So, we started listening chat thread. Then we send the UDP broadcast message telling the student to connect to us. We grabbed those three unique tokens from the handshake and then we finished the handshake with those tokens in there. And then in this stage, in the background, the MChat thread here will change the root directory to the NetOvision Pro install directory, delete one of the plugins, drop in our malware and then just exit. And then right here, we're calling, we overwrote the screenshot viewer, for instance. So, this is a screenshot viewer plugin. So, in this call is now just emulating us being the teacher of starting that screenshot viewer plugin. And then we just drop out into kind of show all of that happening in real time and kind of showing how fast it is. I'll play this little video, this demo here. Same thing. So, all the teachers are, I mean, all the students are around the top and then this is the attacker. In this, I'm just kind of showing that they're all just normal users with real time protection and whatnot kind of on. Like a standard install, I'm sure maybe a school district would probably have more running but this is kind of what we decided would be normal. And so right there, I was just showing that none of the students are connected to anything. And so we'll start our emulation script again and this time we've added just a dash s for system and then our binary of choosing. And so it scanned for five seconds, found the three vulnerable computers and then we'll enumerate through each of them and then begin starting this reverse shell for each of them. So they will all eventually get compromised here. And one thing I want to point out is since we are emulating the teacher pretty much stock, these client, these disconnect warnings do pop up but as soon as we're done, we can disconnect. So you can see right there that it just says disconnected. So could raise suspicion, I guess, but it was the best we could do. And now from the attacker screen, if we run like PowerShell, we can do a who am I and we are actually running as system all remotely. And just to kind of give a visual, I'll start calculator there. And since we're running out of time, I'll skip over the other two, just open calculator two, so not miss it much. But kind of highlight on some of the impacts of the systemable privilege remote code execution is that this could technically be a wormable infection where if a well designed malware, for instance, was just laid dormant waiting for these other beacons from other software that was vulnerable to this, the other NetOption Pro clients, it could eventually kind of further the spread. And like I mentioned before, since these students are kind of taking these devices off of the district network, it's always running in the background. It's starting a boot. The students can't disable it. It doesn't matter which network it's connected to, it's still listening. So if they brought their computer to a public cafe or a library and an attacker saw them there and was able to run this kind of attack on them, and then like dormant, and if they bring it back to the school network, the school network could be compromised. Lastly, so we disclosed this to NetUp on 12.11.2020. And we followed our 90 days disclosure period. They were really responsive and actually got it patched before the 90 days. And so the patch version is 9.7.2. And we publicly released on 3.21.21. Thank you again for tuning into the talk. And I'll be in the Q&A session a little bit later. I hope to answer some of your questions. Thank you.


Hey, folks, something that's very difficult in our jobs is to make things that are rather stale be quite funny, which brings me to the topic of withdrawal designs. Quite frankly, they're really simple. It's an A-B, A-B. You've seen those before if you've watched our videos in alphabetical order, A-B, A-B. Why do we have a different one on it? Because people get confused between the term withdrawal and reversal design. So withdrawal is, again, it's an A-B, A-B design. So it's an experimental design. It's got a lot of experimental control with it, but we're going to withdraw a piece of treatment or all of it. There's some things that you might be able to reverse, but if that was the case, then it wouldn't be a withdrawal design. It would be a reversal design. People use them interchangeably. They shouldn't see other video A-B, A-B design for some examples, but you could think of all sorts of stuff. We could think of a treatment where we're trying to help our kiddos learn to read. We could add some components to that. It's a basic ... Anyway, so an example here, we could focus on kids learning to read. They could be doing the same old stuff that they're doing on the classroom, and that might not be working so well, so we could add a component for that, and then we could test to see how well they're doing without that component by withdrawing the treatment. Then we go, they're not doing very well as the return to baseline showed, so we put it back in place until they catch up with where they're supposed to be. So that's an example of a withdrawal design. Thank you. Cheerio. Bye.


In part four of this series, we're talking about some of the unique features coming to GenoPet, including my favorite feature that I'm looking forward to, which is skill-based battling. That's right. It's skill-based. Kevin goes into details on all these features coming into the game, including social fight, challenges, and achievement systems, how they're battling cheaters, and much, much more. Let's go ahead and dive into part four of this series. So let's talk a little bit about the gameplay. This game is not what most are probably used to in the move to earn space. There's no stopping your run. There's no starting your run. You don't have to open it to stop your run. You don't have to be outside moving for your steps to count. When it comes to anything with games, people are always looking to cheat the game. They're always looking for ways to exploit the game, looking for an edge, for an advantage. What are some of the mechanisms that the team is implementing to prevent cheating? This is submitted by Nenchi. Yeah, it's a good question, one that we get a lot, and boy, do I know that if there's something that can be exploited, it will be. We're addressing it in a few different ways, and I think a diverse approach helps us here. First, I mentioned how steps need to be converted into energy to be used in the game. Energy is not a token. It's literally just what it's like action points within the game that you can use for any purpose. Leveling up, earning, exploring battle, all of that is going to require energy. The steps to energy conversion, however, follows an exponential decay function where every incremental step you take is going to give you slightly less energy, such that it's not to your benefit to walk 50, 60, 70,000 steps a day, unless you naturally do so, or that's really your goal. But in terms of earning energy to use in the game, you're going to be getting marginally less and less. And we did that on purpose because we didn't want people, even if cheating wasn't a concern. This is not a game where we want people to be trying to walk 100,000 steps in a day and injuring themselves. So there is a natural decay for a diminishing return on each step you take built into just the baseline formula. On the back end, we're looking at the data now, and at this point it's just about continuing to collect data and get smarter about identifying problematic or exploitative walking or behavior, and then punishing those users. Now it's Web 3, so it's very difficult to come up with the right sort of penalty right now. I think we're just banning game accounts. But the basis for that is we look at a number of factors. Essentially at a high level, looking at how many steps you walked, what the cadence of it was, the timing, how much of an outlier you are versus the rest of the population. These are just a few of the factors that go into the decision making on the back end. But I got to say, it's pretty obvious when someone is cheating, when you have all of that data in front of you. And so that's kind of what's powering our decision making on the back end. And that model will only get smarter as we go. Yeah, and it sucks because there's always a few bad apples that ruin it for the majority of the community.  But it's a reality of any game, really. It doesn't matter what game it is. There's always going to be those people looking to try to exploit it one way or the other. And at this point we embrace it as part of the design challenge. It's part of what it means to build in Web 3, that you accept that players will take it seriously. And if you are careless, they will make you pay for that. And from my perspective at this point, I just embrace it as part of the journey. And it makes certainly game design a lot more exciting from our perspective. So other than of course moving, what are some of the other features that, other than just walking and moving, that will keep the game fun? I know you mentioned the battling is coming up. That's a feature is coming up. You've mentioned some of the stuff with the habitats that you'll be able to do. Now what are some of the other features that are going to be in the game? I think battle is a huge one because typically in our own style, we have to, we want to make battle our way. And it's not going to be, or at least the way we're developing it. We don't want it to be this very take your turn selecting your attack. And then there's a random number generator in the back. And maybe your attack was super effective. We want it to be more dynamic. And so there's going to be the strength of your geno pet, but there's also a skill element, a live skill element involved as well that will make battle very interesting. I'm all, the other big piece of gameplay that I'm really excited about, that's a little bit closer on the roadmap is what we're generally calling nurture. And that's just pet interaction and bonding.  These might all seem like very simple actions, but we're incorporating a lot of expressions, reactions, dynamism within the pets themselves that I think players will really enjoy. Like, petting your pet is just awesome. I've just been testing it a little bit. It's eyed, light up, it's dancing around, it's so cute. But that's also going to have some serious impact on gameplay because the way we're tying it all together is if you nurture your pet well, it's going to be more efficient. It's going to convert energy better. It's going to be in a better mood. It's going to be more effective. And so these are just some of the elements of gameplay that probably don't sound all that new compared to the traditional games, but we just have our own spin on it within the context of our game. And I'm glad to hear that there's going to be some skill element to the battle. It's not just a random number generator. Absolutely. I played another move to earn game where it was with cats. But that's just random. There was no skill base. It was all random. And you lost most of the time. I think I was keeping track of it. There was like a 25% 1% and it was all random, so there's nothing I could do. So a little bit of variance keeps things interesting. But I think for us, and maybe this comes from us being passionate gamers that love games like Starcraft, we are building a skill-based game. It will reward dedication, skill, and creativity more than anything. And I think, honestly, that's the only way to create a game that is meaningful to people. And only when you have a meaningful game can you create enough value for people to earn. And so that is pivotal to what we do. You need to be able to look at another player and be like, wow, that player did well. And so that's why what they're doing is worth more or is more valuable, or I want to aspire to that. And that's the kind of gamer mentality that we want to cultivate within even just the bones of the game that we're designing. This kind of connects with this next question that I have. And it's about the social fight aspect to the game. I know you guys already have the leaderboards implemented into the app. I know you guys have the, like we just spoke about the battle features coming up. That's going to be a lot of fun. Will there be challenges and maybe an achievement system or anything like that? Yeah, definitely, definitely in the works. I think it just makes a ton of sense, right? Like, hey, if you've walked and hit your step goal five days in a row, we should celebrate that. If your pet has been in a great mood, max mood for 10 days straight, we should celebrate that. Everything within the game can be turned into an achievement or a challenge. Honestly, at this point, it's just a resource prioritization exercise. It's like, should we build that? Or should we build this other thing first? And that we're trying to grow the team as we build the game. And sometimes it's just tough. Everything has to go in order, unfortunately. That question was submitted by Nathan Chappell. So thank you, Nathan. AR, VR, are there any plans for VR and AR in the future for this game? That's a good question. Maybe something AR related. But at this point, it's just ideas. And I think we're seeing as far as augmented or virtual reality is concerned, gaining companies really kind of choosing one or the other. Like, I'm gonna build a world in VR that I'm gonna pull you into as the player. I want you to immerse yourself physically into my world. Whereas AR is more about maintaining your presence in the physical world, but the game is like an enhancement, right? It allows you to interact with the physical world in new ways. And that, the latter is much more, I think, in spirit and mission aligned with what we're trying to do. So right now, currently, the game is invitation only. Will the app, do you guys plan on always keeping it invitation only or do you ever plan on opening it up? No, we do not want to keep it invite only. The plan is to open it up fully publicly. The apps are already conditionally approved for full public release. We're just choosing to keep it on invite code right now. And the real reason for that is because we are building this whole thing the WEM3 way. If we had done it in a traditional way, no one would even know that GenoPets exists right now. We would all be in some dark headquarter facility building the game in secret. And then we get a huge marketing budget and we go launch and now everyone knows what it is, right? And we can start focusing on acquisition. Unfortunately, that's not how we've done it. We've done it. We are building open kitchen style. The community gets to see what we're building almost every day. They provide feedback. They have input. And so we are building as we go. We're laying down the railroad tracks as the train is going. And so what that really means is it's a slower process, but it's a more inclusive process. And that also means that we are not ready yet to just open the floodgates with user acquisition. We've seen what happens sometimes when you open too fast and you allow yourself to be buried by just the amount of new people coming in. We know people are so thirsty and ready for more, but I would ask the community to trust us a little bit. We are continuously increasing the number of invite codes out there. And eventually we will get to a fully public launch, but we also need the actual game and the product to be able to support that each step along the way. Yeah. And for those looking for an invite code right now, if you're watching this video currently, drop a comment in this video, and I will be giving out some invite codes for those engaging with this video who tuned in this far. So make sure to do that. I'll be giving away some. Yeah, one of the few ways you can get one right now. Yeah. All right, so, and those last two questions were from Rui Mello and MJ Crypto. So they'll also be winning some invite codes for submitting those questions. I hope you guys have enjoyed part four of this interview with Geno Pets COO Kevin Kim. If you guys want a free activation code, I have 100 to give away. Drop a comment below, referencing your favorite part of this video with your thoughts or comments on it. And of course, make sure you subscribe to the channel. Goes without saying. If you have made it this far already, then you don't want to miss the last and final piece of the puzzle part five. In part five, we talk about the elephant in the plater earn room, sustainability and tokenomics. And I asked Kevin the tough questions. I even asked him about Ponzi Nomics. And I think you'll be surprised at his answer. Just click the video on the screen to watch part five right now. I hope you guys haven't been watching all these videos without subscribing. If you have, make sure to smash subscribe right now. I'll see you in part five. Peace and love.


And with that win, the BSU football team moved to number 8 in the most recent NCAA Super Region 3 rankings. The Beavers premiered in the poll last week at number 9, jumping one spot this week. With two games to go, they still need to jump up one more spot in order to number 7 in order to make the playoffs. If you've enjoyed this segment of Lakeland News, please consider making a tax deductible contribution to Lakeland Public Television.


venture out I use my own money because the company doesn't sponsor me I use my only to book the plane ticket I get a hotel and get to the conference where I choose the virtualization track and that was a very eye-opening event for me because after that I know if virtualization is the future of course at that time we never think of talkers containers and all these different things at that time server virtualization is very hard and that's over in my eyes second things that changed my life is a public conference again somehow you may call me lucky I get a free pass to public conference I use my mileage to to fly up to San Francisco I stay at my cousin's place so the whole trip I don't have to spend much and dinner and lunch is all sponsored driven so I don't have to spend that much but that was a life-changing experience to me I don't remember exactly the context but during lunch someone sitting next to me said oh you'll be a speaker of some conference I wasn't paying attention I said me I'm not in a million years but then another thing happens is that in a real world we am where world they have a something called the feet of fast forward no feet forward well something that you go to Starbucks you pay for the one behind you they have something called the guys that okay I will take five people I'll mentor them and do public speaking that's where I first start public speaking and this is where I start and then I participate scale scale 12 which is five years ago I was helping out by the teacher in fact today you will see me at a scale teacher booth giving up because I am a true believer that I need to give back to the community and this is some way I can give back to the community so if you want to scale t-shirt just stop by and get your teacher later on you will see me then in the afternoon okay why did I need to tell you my story well because when I submit this talk I want to give back to the community I want to encourage other people to step out of the comfort zone so what is your comfort zone currently everyone must have their comfort zone but what is it outside of your comfort zone because in the depth of environment we need to know a lot more just than the things that we have been doing I was a software developer for 20 some years in on embedded equipment but that's not enough I need to know how virtualization work I need to know doctors container I need to know Kubernetes all these things is it's important to my survival see this is everyone would know if you are in the depth of environment this picture it is the depth of kind of an ecosystem that all these things that involves off I have not count how many items or companies or products in this picture but I let me ask you how many do you know you cannot know it all but we have to know more and of course if you are in a depth ops environment this continuous feedback loop you will be very familiar with that I don't need to go into but this is a very important thing for us this is the continuous development testing integration deployment monitoring and also the feedback of and of that also there is an infrastructure as code I'm not sure what's the mix in this audience you more from the development side or the operation side or I think I would guess is 50 50 no matter what it is I think developer needs to know operations operation needs to know something about the code let me show you something on this at least when you UI on the operation side this is a Python script just to test the number of speed I grabbed I didn't write this one I grabbed it from the internet but of course you can always like get things from the internet very easily these days but you have to know what it do what it does you have to understand all these things what is this trying to do so well be maybe the code you don't know may be useful but are you can you sure that it is box three or there's any hidden thing backboard that is inside of your run let me implement a Trojan horse into your system that we have to know so this is something that we need to know as as in the depth of the environment they know that probably wrong one this this one no should be this one yes now these are the things we have to know I mean this is something very common I'm not going into detail about these things because this top is not about this this thing this this this tools this is some just example of configuration management tools for the cloud and containers for us we have to know container cloud and this out of three most popular public cloud and then the last one I also listed the Chinese base Ali Baba because I think at this time of this age everything is going so fast we cannot ignore the outside outside of America's public cloud so this is something we have to know in one way or the other there's some API we need to know and for programming again this is infrastructure is called I encourage you to step out of your comfort zone to learn some kind of programming my personal faith personal pick on learning if you are new to programming is Python it is good for scripting in terms of libraries to support easy to learn I think this very easy to learn of course if you want to write very complicated Python code you can it is this the tool for a tool but it is easy for you to learn if you want to do simple thing this is a good tool for you I think the entire open stack project is written in in Python open stack is very complicated it's a Python can support it and it's a people's choice of programming language speaking of that what is the most popular programming language most popular Kobo okay anything else basic you get it wrong it's profanity okay let's move on I just want to keep you guys awake with other coffee for programming I was a developer I went to school they taught me these three things all no matter how complex the program the program is it boils down to all these three basic steps assignment a equal to b a equals to three if then else and then iteration is the loop there's a for loop while loop you cannot go away with all this basically it boils down to all these three so don't be scared programming is not a difficult of course if you want to write very complicated program then I take some time take some thoughts but then if you really want to do program is all these three if you can master it or let me at this time show you something about these three I am trying to pick up pick up editor I'm deciding between Adam or visual studio code but I think I like this the most this is the I have a program here it's a lot of good plug-in this one I have it's big enough to I need to increase the funds it so this is some of the basic very basic thing about programming so this is assignment a equals to four b equals to five and if a greater than b then you print this it's very very easy to read and it's not that difficult and then there is also the while loop and one thing about the visual studio code is that you can run it here say run Python on terminal it just run it just got all the display b is it greater than a because b is five a is four and it just print out all these things this is something programming so simple so don't be scared about this but and then let's move on this one yes so Python this is something basic you can look it up it has built in types every programming language has this operator flow control function and classes don't be scared with all these names they are all the concepts are similar but this is something about Python programming and I encourage you to take a quick look on that for do so those developer or programming or programmers you see anything wrong with this with this code x equal to 10 then I check if x is not equal to 1 or x equal to 2 print the evaluation is true else it's a very simple if then I'll statement but you spot anything wrong with this looks good if you put it in the editor it won't complain but there's something is wrong with this the problem is the else case will not and will add will not be executed at all it's always the evaluate to be true from whatever your x value because this is some some of the things you have to be aware of so if you have to check for not case you cannot put to or to not case together otherwise the evaluation will always be true the else case even though you put in the program it will not be executed anyway this is just just to show sometimes programming can be tricky let's get back here this is some of the things we learn to develop skills on DevOps well for me the my personal experience I I was not involved with any DevOps project but I'll involve with a agile programming for me I like it myself because it integrates with the test group with the architecture group so we all work together we put things into small chunks tested integrated so it's in a way is a continuous feedback to but then what my experience is that the test group always blame the programmers for fault so they are not very interested in participating in this project so while I was in the pilot and then never never get it too much into it but another thing that I've away from our comfort zone are these soft skills to me there are these three different things the soft skills the writing skill networking skill and the presentation skills writing skill what are they everyone can write but how well can you write what are you going to write I think blogging is one way to improve our writing skill and also one thing to share to share back to the community like what I have said here is to show off your technical knowledge and also when you block you're writing something out you'll make sure you really understand the subject it's not maybe sometimes you think oh I know about this but it's not exactly how it works but until you really get down to the code or you will take the project and you can know about it I block one time for me I always keep myself to the edge I one time of three years ago I think three years ago time is not exactly important here I participated in a 30 blocks in 30 days in which in 30 days I have to produce 30 blog posts I was pushing really pushing myself I was on vacation still I need to write blog post but then I was trying to push myself I think the key is that we need to push ourselves to a higher envelope or not not a higher envelope I'm not sure if this is a correct statement but you push yourself to the edge to to to so that we can be able to keep ourselves relevant I think the key for this whole thing is that we need to be relevant so blocking is one thing I encourage you to step out of the comfort zone and do some writing okay I am a software developer I'm from Asia I don't like to talk to people too much I don't like to watch baseball I don't watch basketball I don't watch football soccer so during a con a conference like this when you step outside what can I talk stop thing nothing much I can talk about but the good thing is I like beer if you look at my handle there's a story about my my my Twitter handle used to be chowder and beer because my last name is chow so chowder and beer food something but then I get into a cloud I change the chowder to powder and the beer I still like so I can talk with you about different kinds of beer so this is something but the key isn't doesn't matter there must be some kind of interest that you have and that other people have you can talk technical things but the key thing is that to step out of our comfort zone we need to start talking to other people's networking this is how we keep ourselves before I come to this talk I was at the expo floor talking to an employee of Microsoft I know him at Twitter we would talk about things different thing on Twitter and then we were able to meet face to face and was able to talk I learned things from him I'm going to write something about the mark down on blocking because I am a contract blocker to some other company too and I need to start writing the block in mark down format so this is something see I talked to him I learn things from him so networking skill is very important and then there's also the presentation skill this is something I want to share about to be about stepping out of the comfort zone everyone is the very of public speaking this morning I woke up as I can I can still remember 438 I woke up at 438 thinking about this presentation I'm still worried although this is not my first time presenting but still the butterfly in the stomach still happens to me it is not not a natural thing to me but I want to do it I want to give back to the community so I think this talk is important I want to engage with one another engage with you to talk to you so we'll be able to move I have I'm not sure if I some of the slide deck that I have here is not what I want but there's a one motto I always said is I know some you know some let's share what we know just like a potluck Asian always like food we share what we have like a potluck then we grow together if I myself I cannot learn I can only learn so much but if we get it together as a pool that's why there's something good about meets up with a different meet-up gatherings you can talk about AWS you can talk about as a ball you can talk about Python you know what you know and share out so people can learn different things I think this is very important anyway going back to the presentation skill is this how we organize I thought one thing I learned is that we use the mind map to organize the thought we bring storm or whatever you want to talk about let's take a subject and then you talk about oh one thing I forgot about to meant I forgot to mention about blogging is that you need to know about your target audience who do you want to reach because that makes a difference on your tone and how deep you're going to write so when you block you have to make sure who your target audience is maybe it's a beginner or some very really in-depth technical if you your target audience is the sea level executives don't talk bits and bites they won't care they only only want to know how much what is the ROI is the rate of it return on the investment how much they can earn with this new feature they don't care about how the feature works but if you talk to a developer he was not oh how this function work when you're calling this how does it work so your target audience is very important so but when we do a pretty well when we do a presentation we just write down the thoughts random thoughts doesn't matter as long as you think is related to the subject just write it down and put it on a mind map and then with the mind map you translate into the outline and slide that this is a example that I forgot to put the source usually when I get something from Google I need I put a source I grabbed this from from from Google search but this one is mine when I prepare this presentation this is my mind map I have a topic here actually that there was a different different different presentation I did that as a user we am where user group this is called a feed forward but I organize the thoughts into this what what is feed forward why do I want to do it and how can I do it this is some kind of things I think this helped me so much if you want to do a presentation and do not know what to do give this a try a mind map is a very useful tool for me and then once we have this as a see at least getting to this point there's already all different my slide deck this is once one slide another slide and I just follow the steps and then this is the whole presentation so you work it out very well for you about preparation of the slide this is something I learned points to be simple and concise this is something I just show you an example I think this is a very good source the seven that these sins of presenting presentation of slides is the data it is it also from the internet so I don't know which one you like better the upper one or the lower one in the upper one I prefer because it it does the filtering for you it has the it says the minimum requirement positive business outcome so if you don't want to look at the detail these are the two things that you you can look at and versus on the lower one this is so so worthy it's a sometimes you want to choose to two sentences you don't want to move I want to move on and this is doing it for the community I am a true believer believer of giving back to the community for some reason with this slide deck I'm missing some some of the some of the slides I think or you see okay get back to the community like I said the whole thing is that we learn together so giving back to the committee is very essential and the other thing is engaged with the audience you see me working up here I try to engage with you I don't necessarily want to even though I want to I very much want to hide myself behind the podium then you don't have to talk to me you just see me talk and I don't have to worry about your eye contact with you that is very comfortable for me but it's not good for you will you like me to talk like this or rather then I may be I don't have to have the tool read from my presentation oh bravo good evening thank you for coming to scale that is not engagement giving presentation is not just dumping the information it's about engagement I need to engage with you I need to have eye contact I know I'm not doing it very well with eye contact I am not looking at you too much I know this is important but I need to tell you that this is also important too but I need to engage with you I need to because if I engage with you I will be able to give out my information better versus if you read the book it's not personal if I can talk to you I can have eye contact with you then it's better for me to communicate my information or whatever I want to say to you and I can have the feedback or what if most of you just cross your hand looking at your hope you are tweeting about how great this talk is but most of the time it's not so you be looking are so boring but just stay stay well I don't know have anywhere to go the exposed floor is not open so I just stay in and look at I play what's that game I my friend always play Candy Crush you just play Candy Crush and then let us go but that's not the point I need to get the feedback from you see I heard someone's laugh that means good my point is able to get across because someone has feedback to me even if you yarn well that could be negative feedback if you yarn if you walk out to walk some people walk out maybe the topic is not interest interested to them or my presentation it's not relevant to them it doesn't matter so they go this is some kind of feedback that I need to be aware when I do presentation I need to be aware how am I talking and then engage with the with the audience I think this is very important these are something that I learned throughout the year and there's a one thing I learned from last last I'm a VM wear user group leader for Ventura County and Pasadena last December we had a tour to the VM wear campus and they have summit for the leaders for two days they have one workshop is that this is something I learned is that when you do presentation do your hand like this it feels more comfortable it is naturally giving you a podium you can hide yourself for the arm but the position of your hand is important this is in this is very difficult you don't see people doing worship you can raise up the hand but this is not very comfortable because I'm open up myself to you and that makes myself uncomfortable so the position of the hand is also important this one I don't know this is more natural I can talk like this too but this is a very natural position so this is something I learned last year the smile I mentioned smile is something that I need to learn because smiling is not it's not me it's not natural for me I need to say second is eye contact and I talk about sensitive to the body language the other thing is I always did it very badly is that when I ask a question I don't give time for you to think when I ask a question do I ask the question rhetorically or do I really want to ask a question so that you will think yeah I asked a question now I have to give you time to think if I give a presentation I cannot just dump the out the information written me 8.8 point B point C even if I ask a question if I don't pause you don't have time to think then you I'm moving on to then you get confused so when you do when we do a good presentation then if I ask a question I need to give you time to think possibly or preferably I'll get feedback from the question I will have to welcome answer even though the answer is negative or positive because this is a two-way communication I can not just say go and dump the information out and again this is a engagement happens even after the presentation so I'll be around if you want to talk to me or you want to hear more of my story I can more have more story to tell you about how I step out of my comfort zone if I have not been able to convince you in this in this session I have other stories to tell you what I've experienced or what are some of things that I have encountered how to step out of the comfort zone they have you have you if you will notice English it's not my primary language I'm born and raised in Hong Kong I did not born or raised in America so speaking English is one of my my a hindrance for me to do public speaking I'm not sure if you are at the virtualization world I always make the joke is that I'm a type 2 hypervisor anyone was a type 1 hypervisor type 2 hypervisor type 1 hypervisor is that the way you have to run the ESXi that is native or the type 2 hypervisor is that you run the work VMware workstation you have to do translation it translate the instruction into the host machine for me when I speak in English I have to translate why because I don't think in English I think in Chinese and then I have to translate to the proper language and on top of that I have to do grammar check have to make sure I have the right grammar sometimes you apparently you have you have you caught me saying things with wrong grammar during my presentation but I have to grammar check see it when I say some one sentence out I have to went through all this whereas if you are native English speaker you don't have to worry about any of these you just speak whatever your content see for me I did worry about my content I have to worry about translating language and I have to worry about the grammar so all these things this is a little bit deficit for me but still I am willing to stand up and apply the I wrote this call for paper I want to because under the assumption that I want to give back to the community so even though this is something not natural for me like I said I woke up at 4.38 this morning I couldn't get back to see I was thinking about this whole presentation how it goes and how well how effective my talk is but it's something I have to do and see if I can do it you can do it also this why I put put put this picture here when I was in Las Vegas intro I went to the virtualization track at that time there are few there are Citrix there VMware different server virtualization solutions why I picked VMware is mainly because of their smile if you go to the I remember so well maybe it's not happening now but seven years ago if you go to a VMware booth or the employee has a very good smiling face I think because they have to stop often they have good futures and they are very happy this is a site when you go to a Docker container booth you will see people very happy so smiling is very important smile is where it gets attracted me into get choosing VMware as a path so smiling is very important and I need to learn about that too well I skipped over myself this is something about networking this is very this is very trivial but still I want to put it up just to make the point is that when we talk I think I already went through you get to know more about other people in the community the most important thing is I never tell my kid this way later on but it's not what you know is who you know so this is very obvious I don't have to elaborate on that but this is something I'm still not talk telling about my kids when I tell my kids you have to study this is whatever you know is important anyway so I don't know what is your dream job or what is your goal this is something so how can I start I think it is to build up the self confidence well if I say this I probably will give out give out just like a security information system how old I am have you watched a movie top gun this is one of my favorite movie there's where Tom Cruz you know Tom Cruz is doing Mission Impossible Tom Cruz I make a failure and then causing his partner to get killed during an exercise and then he lost his confidence but he was able to still graduate top gun school at the graduation a few of the reply is when being deployed to to to some some conflict so his training officer was that you remember what he said anyone ever watched Tom Cruz to doing top gun are you guys are just too young anyway I tell you the punchline the instructor said fly there if no one fly fly with you I will fly with you so if you want to get started you don't know where to get start I'm I'm don't claim to be an expert but I know enough I can point you to different resource I will fly with you come contact me I can help you to get started in blocking in public speaking or time in whatever I will try because I am trying to make myself useful see my personal goal is I want to be a developer advocate because I was a personal developer and I won't like to engage with the community why did I want to share my my personal story it's a story okay let's say if I walk in Google whatever I said will be interesting because I work for Google but what if I walk for a small company and I'm a developer advocate for that company or I work for a company that I am responsible for a very bad product I still have to tell story this is well you guys are my guinea pig I'm learning how to tell stories because being a marketing person of a developer advocate I need to tell the story I need to tell you as a developer or that's up engineer how great the product even though it is not but I need to make it so interesting you have to come to me so these are the some of the skill hidden soft skill that we need to develop if you may not want to be a deaf of engineer for life you may want to move to marketing you might want to some other things these are the soft skill that we need to build up and so these are the some of things build up the confidence tell yourself yes I can I have been telling this for myself the whole morning since I woke up at 44438 I remember so well because I woke up the Sun is not out yet I look at my watch 438 and I cannot get back to sleep but I keep telling myself yes I can do it and also how many times okay I see up some time oh no actually I'm I have lots of times anyway I keep telling myself okay I currently I don't have a company I don't work for Google but I know the content is important I wrote the CFP and I want to share it with you so I can keep telling myself they need to know what I know so whatever you know just write it down do some blocking do some networking just do some step out the key is see like this is one set step out of your comfort zone this slide I think summarize what I have in mind you're just that you have to push ourself over we to a higher technical level the IP industry is growing so fast that I was talking to Omar new things is coming in every day it's difficult to catch up but we have to stay relevant I think that I highlighted this I what I've been doing all these years that I want to stay relevant and I think I have been I've been looking into different things I look at Kubernetes I look at Docker's container I look at IOT currently I am all looking at blockchain hyper ledger all these things I'm trying to keep myself relevant just to say I stay alive because sooner later whatever you know is not enough so think about venturing into something new well even though that thought may be something new but sooner or later whatever you know might not be necessary important or require to need some some other skill so if you do not start learning new things stepping out of your comfort zone because this is not the sense come with natural I have a slide I think I missed it here is that we need to be a homelab I think this is very important whatever you want to build a homelab you have to invest your time yeah I know after work L.A. traffic you have to drive an hour or an hour and a half from work to home you don't want to do anything else but I think doing giving a homelab to play around with different things is very important this is no choice but you have the balance between your family life and and your moving forward so I think this is something important too but again the whole idea is that do you want to stay relevant if you want to stay relevant you have to step out of the comfort zone and try something else I don't know what your comfort zone is today it may be public speaking is very natural for you good then you look at something else the idea is whatever you feel comfortable I can tell you it's not enough you have to push yourself so not this is repeating myself because I think this is important so I have to slide doing the same thing this is I like this quote very much if you want something in your life you had never had you have to do something to have never done I think this summarize the whole thing and I encourage you whatever comfort zone you're in fine but try to step out of the comfort zone and do something that is not that easy or not true for you sooner later it will be beneficial for me see I'm still trying to pursue a job in being a developer advocate that's why writing developing content is important public speaking is important to me and engagement to the community is also an important aspect of being a developer advocate so I'd like to check with you I think this is all I have I don't have I did not use up the whole full hour but I think oh good I now have some question and answer if I can answer but I may be anyone it's a good time to be a question and answer time


So difficult, of course, to come to terms with this shocking news, it's too soon, I think, for us to even say something meaningful. Perhaps a request to just say, I think he was an engineer in our technical section, head of this section. He joined HPCC a few years ago, as I think some of the details will tell us. Of course, many of you would have seen him because he was very friendly, because he interacted with everybody, not only the old-timers, but also young people, new people. He was very active in all meetings, seminars and talks. He used to take an active part also in Science Day celebrations. And of course, he was very active in terms of the duties of the technical section. On the other side, we had some of the time before he completed his service at HPCC, and we were looking for time to look at his family and so on. I think we will, maybe Raju will say something, and at the end, we will discuss it. It's been a long time since we worked together. In 1997, the joint was done. And as a form, I think I will call Trigun Saheb as the head of the section. It's been a long time since we worked together. Because, as I said, we were looking for time to look at each of our family members. The medical department was very busy. The department was very busy. And the medical department was very busy. If it's okay, then we will do some medical help. We will start the work. We will do well. And it happened suddenly that we had a meeting with Gavi. And we had some news about Gavi. But he didn't reach home. So, we called his family member. When we contacted him, he finally told us that he was going to be discharged. He didn't come home until he came home. We had a technical section head. In 1997, the joint was done. It was in the building in the center. And as a result of that, the government was in charge of the house. And in his studies, he was in charge of the forest. He was in charge of the language department. So, he was in charge of the policy department. He was in charge of the language department. And he was in charge of the discussion. He was in charge of the agriculture and politics department. He was in charge of the language department. And I am not going to advise him. He was in charge of the education department. His name is Samadhan. And his son's name is Sakshi. His son is also in charge of the agriculture department. I think that was last year. We have already talked about the problems of some people. But we haven't talked about them completely yet. I am giving a special message to all of them. We have to help their family members. We have to teach them. We have to do what they have to do. And we have to try to help any of their family members. Thank you. Thank you. If anyone has any questions, please share them. We will give you a short break. I request everyone to be quiet for 2 minutes. Thank you.


Before listing all the sources I used to make this 2015 update, I'd like to point to two websites you might find interesting. One is Galaxy Zoo. It's a site where you help with over a million cataloged Hubble Galaxy images. Hany's Varoup was found just this way by Dutch schoolteacher Hany Van Arkel. The name is Dutch for Hany's object. Amazing Space, Hubble's sister site, is launching a new look and feel. Amazing Space takes users on a journey of astronomical discovery through the nearby and distant cosmos, from the combined perspective of the Hubble Space Telescope and its successor, the James Webb Space Telescope. Take a look. And here are two articles worth reading. This is Fritz Swiggy's 1937 paper that first introduces the idea of dark matter. You'll find that it needs some amount of mathematics to understand. The second paper is a recent article by Vera Rubin that you'll find easier to read. And don't forget, every video segment on the How Far Away Is It YouTube channel, including this one, has a document with the text, pictures, links, and notes located on howfarawayisit.com slash documents. Here are the links to the Hubble and other locations where I found the information contained in this 2015 update. These are the places you can go to learn more. Thank you for watching.