Okay. And we are live. Hi, everyone. This is Jenkins configuration as code status meeting. So we will sync up about configuration as code status and I'm going to give you this about that. So we have a really nice Wilco's and Nicola Deluf from the call. And yeah, also me, Oleg Mnashv. So really now, would you like to drive the meeting? Yep, that's okay. And as I mentioned before, before we actually started the broadcast, I don't have much to say, but I'm happy to drive after the Jenkins world in San Francisco, which I consider to be quite a success for configuration as code. I hadn't had a single hour time to look at configuration as code. First, I just couldn't look at it and then I had internet free vacation, which is perfect. But I'm back. And I could see in my mailbox and also on Gitter that there was a lot of things happening, some new issues and some new users reporting issues and getting help, hopefully. So this is looking good. Oleg, are you planning to edit something, the meeting notes while we speak or you want me to start that? Yeah, I can start the meeting notes. I'll share my screen then. That's great. So the agenda is as usual, we should go through, oh god, there were some action points from previous meetings, then we'll check the status and we have a couple of new things to talk about. So yeah, let's have a quick look at the action points. Have a look at tests. Is this the last one? What was it? Cannot install configuration as code plug-in. And I did not look at it. I don't know what's the status. Sorry, I completely forgot about it. Make sure the export feature has limitation. Okay, that's not the right sentence, but it was about informing people that export will not give them fully working YAML most probably. And then it was mentioned in the UI button in by Nicolas. And again, my action point might have been missed so kind of partially. And let's just move the documentation part and the first action point to new action points from this meeting. And I promised to take a look at that this time. Sorry about that. It was the Jenkins world fever that stopped me from doing that. So those are action points. Then the status. Last time we talked, Nicolas, you were mentioning a potential new release. Yeah, so we have a security fix Pentagon release. So the main issue here is that during the exports, we have some secrets being exported as plain text. So this has been reported in public both on GitHub and GitHub issues. So we already have a fix in the repo, but now need to release it. I didn't try the release already. I was investigating the plugin installation. So I have a pending request for plugin installation, which I'd like to be reviewed. And talking about plugin installations, we got some people to ask for assistance on GitHub. And clearly I consider this to be still pretty experimental and a bit hackish internally. So I used to recommend people who are using Docker images to better rely on external plugin installation. So probably the feature still makes sense in terms of country gas code and a higher level scope. But maybe this is not the best way to address this. What I have in mind here is a custom work package which already provides this feature another way. And discussion around this topic. So I'd like this to be at least fixed so it won't break country gas code. But I don't expect this to be featured complete without some glitches. Yeah, what we were discussing is having a kind of universal plugin management tool which runs outside Jenkins runtime and which generalizes a lot of existing plugin management utilities. So Nikola has created an issue in JIRA. I want to log in. Do you remember the issue number, Nikola? I was just checking. I discussed this with Koshiki yesterday, so I should have the ref in the notes. So once you're logging in, I just have a quick comment. When I use Jenkins in a Docker container, I rely on the way of installing plugins provided there. This install plugin is a SH script. But I know there is a lot of users that can't allow themselves to restart Jenkins and have downtime. Yes, sorry. And if you want to rely on that, you have to rebuild the container as far as I know. So that's why I still think that we should work on providing that feature in Jenkins configuration. At the same time, if there is some work, there is a plan to change the way of managing the plugins, then we should not spend too much time on adapting to existing solution if we may be forced to change it in the future. So I wouldn't put it on a super high priority to make it working perfect for now. I had issues with that too, and I will have a look at the PR you mentioned, Nikola. So we can have it merge and release when we're ready to release, but it should happen in a couple of days, if I understand correctly. Yeah, so we can do whatever we need as long as it's an experimental feature. So maintaining the plugin definitely makes sense. And when we have a generic engine from this task, maybe we could somehow generalize it. But yeah, this engine is also not nearly there. So the implementations are really different and the behavior is different. So we will need to do something. But yeah, since we all agree on that, we're going to review and merge this. The PR you mentioned, Nikola is handled latest by comparing installed version with the update center metadata. Is that correct? Yeah, so we'll have a look at that one. It will be some fix and then we'll have to, maybe when we meet again quite soon, we can have some extended discussion about it. But we'll find the right way forward. We won't probably try to do something almost impossible. If there is a chance, we have to change it in the future. So we'll see about that. Okay, so speaking of meeting, I believe you meant the day of Jenkins's code. Yes, that one too. Yeah, so I guess everybody on this call meets today. Yeah, if everybody else is interested, please feel free to join. There will be a hackathon and before the conference, there will be also a meetup. So yeah. Yeah, I can just a couple of more information. So it will be a two tracks event. We'll have some keynotes at the beginning that everyone can attend. And then you should decide if you're interested in the user track or if you're interested in hackathon track. The user track will be more focused on just Jenkins users, not developers. So a presentation how to do some stuff. And then the hackathon will be about fixing and improving configuration as code plugins. So yeah, I expect it to be good. Yeah, let's see. I'm looking forward to meet there. And by the way, speaking of hackathon, there is Hacktoberfest now. So it may be possible to add this hackathon to the list of Hacktoberfest events. And in Jenkins project, we have announced Hacktoberfest on Monday. So there is a blog post. Hacktoberfest contribute to Jenkins. And if you scroll down, you may see that configuration as code is one of the projects we advertise. So if anybody is interested to contribute to JCASK, just submit your pull request to JCASK itself to plugins, mark them according to guidelines and they will count as Hacktoberfest pull request. So you can get t-shirts, stickers and other cool stuff. Oh, then I want to contribute. Anyway, I've seen there was some, you were talking about it on Gitter about maybe leveling some issues. And I agree that it doesn't make sense to make issues just for the sake of Hacktoberfest. But I do expect to spend some time on the list of issues and maybe I will find something or I will, I will create something that is missing and I will use a, I will use a hackathon label and it can be both used for the hackathon a day of Jenkins or Hacktoberfest. So what we're missing is a list of new friendly issues. So we have them for some components, but there is no such status in JCASK. So technically I can take this example. I believe it should be close to actually this task, but he is a good first issue label. Technically what you could do now is mark issues which are simpler enough as good first issue. And then we have a kind of solution because here there is a good first issue. In Jira there is a new friendly label. So we can add links and these issues become a kind of examples of issues which can be picked easily by contributors. I will work on that most probably tomorrow during the day. Thank you. Just a second, I will also find Jenkins Jira label. Yes, so here there are new friendly issues and what I would do here is let's say it's labels in JCASK. For example, if you take JCASK compatibility issues, then there are two new friendly issues now. So we could use queries like that or there are queries for JCASK itself. It's something like that. So should I put an action item for you? Yes, and maybe in this point about new B friendly issues, you could add a comment that more issues will be labeled with those enough or I can do it. So if someone reads it, it's clear that we're not done. It would be really helpful. We also have a list from Google coding. We will prepare this list towards the application in September. As Jenkins project, we were not accepted, but we still have a list of issues, so we will be submitting them. Do we have any other topics to sync up on? I don't have anything to sync up on. As I said, I'm not up to date with what's happening, so I need to go through the list of issues. So unless there is an issue any of you wants to discuss, then I am more or less done. Nicola. Yeah, nothing much on my side. Not that much on my side as well. I was doing some patches for custom work packages and other such things, but it's not exactly in the scope of JCASC SOFA. We had the demo last meeting anyway. So I believe we meet again at the day of Jenkins and then the contributor summit at DevOps Vault to Jenkins Vault. By the way, when do you plan to arrive to Jenkins Vault? I'm just checking. I arrive relatively early afternoon on Monday. So I'm asking that I'm trying to organize a kind of mini hackathon on Monday. So yeah, if I find enough people, I will push it forward. Okay, if you arrive on Monday afternoon, it's probably not relevant, but let's see. But well, you can keep me updated at least. Okay, so that means we're done? Yeah, I believe so. So there will be ongoing discussions about JCASC support plugin, so about moving the features of the two plugins. Nicola, are you still working on the pull request for that? I just asked about moving code from JCASC integrations. Right, excuse me. I got some audio troubles. Yeah, so as you know, we have this support module, which is mostly some incubator for third-party contributors. So I have some pending pull request to get this code adopted by other plugins. And we also have, as you say, the integration tests that would make sense to be hosted by relevant plugins as well. So I'm not sure how much of them we have to keep in the Configure Scott project that can be debated. I think it still makes sense that we have some tests for for some major plugins. We have to get a correct balance. So I'm open to suggestions on how to manage this balance. And also, as you can guess, it really depends on how much plugin maintainer will approve adopting this code and doing some tests. If I recall correctly, we have three plugins. It's a role strategy, a matrix authorization, and the job-desert. So a role strategy considered approved once the code is done. Matrix authorization is managed by Daniel Beck. It was mostly positive, just the question of getting some spare time for it. And the credentials begin and job DSL is another story, but just wait for maintainer feedback. Yeah, it should be fine. And yeah, I believe that regarding, so regarding testing side, we still can keep the tests model as we have now in the plugin. Then what we created in May, there is an essential test step in Jenkins Pipeline Library. So this step allows running a plugin compatibility tester against plugins. So what you could do is just invoke this step and run the tests of other plugins with the new version of JCask. And I think that they have a JCask test, it will give you a kind of integration testing. You just, I can show an example of that. Yeah. So do you see my screen? So, yeah, Jenkins, Python library. So there is, yeah, essential steps. So it was created originally for Jenkins essentials. Now it's called the Jenkins Evergreen. We will probably rename the method as well. So what it does is just builds a word using customer packages again, then it runs ETH and PCT so that it runs against the version, the packaged versions of the plugins and you can manage what you actually test. I can probably find some examples. So why it's helpful that you don't need to move the code on your own. It's another essential step, guys. Okay, I can find it. Generally, there is a pull request, for example, to Stepler. Stepler is a web UI and the data binding framework in Jenkins and one of its problems is that it had exactly no integration tests with Jenkins. So we had some issues with Stepler a bit previously and here's a pull request. It doesn't quite work, but you can get the idea. So we had integration tests and then there is just a YAML definition, which says what exactly to run. This is, yeah, this is a jcasc setting. It's really obsolete. Yeah, here's an ETH.  So we run tests against jQuery, icon, shim, pipeline, maybe, and etc. And yeah, we could do the same for jcasc if you want. Okay, makes sense. Yeah, once we get some test distributed in various plugins, it would make perfect sense. Yeah, it already happens. So people started adopting the jcasc. So even without incremental configurators, there are plugins which have their own test solid idea. Right. So the trick, I think, would be to filter tests so that we don't run the entire PCT framework for each jcasc change, but yeah, it's a kind of improvement. Anything else to discuss today? I don't think so. Nothing from me. I was trying to finish the meeting five minutes ago, but sorry about that. I think I'm gonna forgive you. But it went very efficient anyway. And yeah, as I said, I should be, I'm back online, so I will do some work and see you soon in person. Yeah, yeah, so see you. I'm stopping the broadcast and thanks to everybody who watched it.


This meeting was held at Exciting Las Vegas, Nevada, for July 9th, 2011, 1999. This has been your 224th Introduction to Scanners. How's everyone doing? I'm Modify, I'm part of attrition.org staff. I'm going to be doing intro to scanners, basically showing NMAP and the flags and what shows up in the logs. So I'm going to start off. A scanner is a program that detects weakness in remote or local computer systems. Scanners attack TCPIP ports and servers and record the response from the target host. Hosts, however, attacker must know how to interpret these scans. They're not going to show you what's vulnerable. They're not going to tell you what kind of exploit to use. Ports are monitored by the INATD daemon, which is started at boot time. INATD reads the Etsy INATD comp file at boot time to determine which network services it is supposed to manage. These are all the services. I'm going to comment them out when they want to be started at boot time by putting a pound sign before them. In simple terms, port scanners pro the host and attempt to establish connection. Whenever you're available, port one after another. This provides a roadmap of available services on a certain computer and can be used to launch an attack against the system. We're going to be showing NMAP, which is found at www.insecure.org. This system is running Slackware 3.5 with kernel 2.0.34, as you can see. Port scanning is a very popular reconnaissance tool amongst hackers. Some of the other scanning techniques I'd like to mention is RPC Info and Showmount. It shows the RPC services that are running on a host. As you can see right off the bat, NFS. The other is Showmount. This shows a list of exported file directories and who can mount them. If we did have an export list, it would be shown with the directories and who's allowed to. When it shows it, if they show like a root directory and sometimes you'll see anonymous, you can mount that by doing a mount minus TNFS, target host, colon, whatever directory, space slash mount, you see the end amount and you have controlled the system. Then you probably grab the password file and crack it or add your own entry. We're going to some of the flags of NMAP. You can learn more about NMAP by doing man NMAP or NMAP and pipe it to more. It gives you all the flags and what each one is associated to it. Some of the flags are NMAP minus ST post name is TCP scan. It's not very stealthy. It shows up a lot in the logs. I'll demo that right now. It gives you the port, the state, which all on the open, the protocol TCP and the service. It gets the services by looking at Etsy services, but there's also an NMAP file called NMAP-services. What it does is it scans the ports and then matches those to its file. It's like a database of all the services, the ports. We'll run it again and take a look at the logs. As you can see, it's telling you what port it's connecting to, what services running, and it also has the identification of who's doing the port scanning and where it's coming from. This flag is NMAP minus S, capital S, local host or target. What this is is it's a TCP scan. This technique is often referred to as a half open scanning because you don't open a full TCP connection. In other words, you don't do three-way handshaking. It waits for SINAC from destination. If SINAC is received, then the port is open. If it's not, it's obviously closed. If reset is received, then the port is closed. Rather than AC establish connection, it immediately resets to close the connection. We're getting the same ports here, but if we look into the logs, we get connection from unknown. They can't determine who's port scanning. The next flag is a stealth fin that's minus S, capital F. The fin scan uses a bulk fin packet as the probe. Used on SIN scanning is not stealthy enough. Some programs watch for SIN packets such as SIN logger and Courtney, just to name a few. We'll show that one. It's been planned. I was going to put on some Bee Gees. This is the stealth scan. By the way, I don't have any extended logging on this machine, such as Advicus Century or anything like that. The conventional bar log messages, the scanner won't show up. The next one's a Christmas scan. Christmas scan turns on the fin, urge, and push flags. That's done by a minus S, capital X. You don't get anything coming up in your bar log messages. The next one's a Null scan. Null scan turns off all flags. Don't know. Oh, yeah. I actually wrote that. Oh, this is a fire door, a theater. He wrote an M-map, actually. I just like Christmas scan because you've got almost all the flags there. It's kind of a Christmas packet, heavy deal. You don't have the same packet in there. It's almost a Christmas packet. Sorry. I just said you're almost sending the Christmas packets, Christmas tree, light segment packets where you have all the flags enabled. That's just why I called it that. Sorry, this is kind of impromptu. I thought it was a radio scanning seminar. Someone just said, hey, do you live in that room? I thought I'd stop by.  The next one I'm going to show is the ping scanning. Ping scanning is used to determine what hosts are on the network. Since an ICMP echo request to every machine on the network, hosts that respond are up. I don't have a network up here, so it's only seeing my local computer here. It sees my one IP address, one host up, scanning in zero seconds. The next one is minus PT, capital pting. It's a TCP ping to determine what hosts are up. Instead of sending the ICMP echo request packets, like in the previous one, and waiting for a response, we send out a TCP act packets throughout the target network. According to a single machine, and then wait for responses to return. Hosts that are up should respond with a reset. To set the destination port, it's NNAP minus PT, and then whatever port you want to scan. The default port is 80, so we'll just leave it at 80. Those are from VARLOG messages. The next scan is minus SU. This is a UDP scan. This method is used to determine which UDP ports are open on a host. Sends a zero byte UDP packet to each port on the target machine. If we receive an ICMP port unreachable message, then the port is closed. The UDP scan takes considerably longer because of the kernel limitations for sending out ICMP error messages. This is defined in RFC 1812, section <IP_ADDRESS>. Yes, it's beautiful to ignore the RFC, that's why. Another send packet, an error response, where the packet you send immediately, there are no recommendations at all. It's beautiful for printing. On Solaris, it takes considerably longer. Linux is, I think, 80 messages, or 80 per 4 seconds. And Solaris is limited to about 2 messages per second. Some of the UDP services you may find are Alt of the deadcals, back worthless, trivial, FTP, NFS, SNMP. What was that? How do you know how to be that sender when you're on the hold? Sorry? How do you know how to be that? Exactly, just put the flag 16 at the end of the, you know, just the IDR, I guess. Yeah, by default, if you don't specify any ports, you can go through 1,000, 24, reserve ones in the services file that comes with NMAP, which is basically your normal, at least, NAP services, plus some backwaters, as in NAP bus, and the other ones you kind of want to keep a watch out for. How do you tag your own services if you want to? It was created by basically taking a shitload of NMAP services and putting them together. But if you find new services and you think to be in there, you know, just drop the email for a human NAP hero and NMAP services file. By default, it only uses the one that's included. As you can see, it took a considerable amount of time, but we had the port, state, and protocol in service for the UDP to scan. The next one is the FTP bounce. In older FTP servers would allow proxy connection. An example, a user could connect to an FTP server and send a file anywhere on the internet from that FTP server. This method uses the FTP proxy to bounce a TCP scan off the server to the victim. So basically, you're scanning from another host. And that's, I'll put up the syntax. And then you put up the FTP bounce host and then the target. And that's how it's run. I don't have two machines connected, so I can't show it to you. The next one is the minus capital O flag. This option activates remote host identification by a TCPIP fingerprinting. It takes advantage of nuances found in each OS's TCPIP stack to determine what OS is running. Send specifically crafted packets to a host. This information is used to generate a fingerprint, which is then used to match from a database of known OS fingerprints. So it shows us all the ports that are available, and then we have TCP sequence prediction. It's truly random. It would be very difficult to hijack. Hijacking using trusted relationship exploitation. Remote operating system gas, Linux 2.0.32 to 3.4. And I am using 0.34, so that is accurate. It shows one IP address and scan in two seconds. The next one is a login option. As they said they can. If you have any proxy, sometimes even those transparent proxies are in between.  If you have anything in between you and them, you can ask a rating host or whatnot, that rewrites the packets, you're in trouble. You can still sometimes figure it out, but it's hard for N-MAP to automatically figure it out. You have to kind of compare the fingerprints you get with the N-MAP fingerprints file. His question is if there's a network device between you and them, a router shouldn't cause you any trouble at all, but mostly it's masquerading hosts, or those IP transparent proxies like Linux has. Anything that rewrites the TCP or IP headers has the potential to screw you up, because it kind of pollutes it. Some of the aspects will then look like the host in between you and them, but it shouldn't generally cause extra ports to be shown. Are we going to do that? Yes, it absolutely does. It takes a little bit more effort, and you have to compare the fingerprint, but if you see something like the TCP window size is 0x2297, that gives you a good clue. Look in the N-MAP fingerprints file and see what machines have used that TCP initial window size, and you can often figure out who's at the very end and what's sitting between you and that host. Yes. Yeah, there's actually going to be a presentation by Craig Rowland, I believe, I'm not sure at what time. Okay, at 6pm. And he's been working on the Abacus project, which kind of helps you detect some sorts of scans. Of course N-MAP has a lot of, I don't know what he's shown you so far, but it has a lot of extra features in order to counter-attack those defensive measures. For example, you can spoof the IP address you use, and you can also send decoys out, so they'll say, hey, it looks like 10 different IP addresses scanned me. You know, who was the person actually scanning? You can also sometimes trick port sentry into firewalling the wrong hosts, like if you have it on defensive mode. So you'll fake a port scan as coming from their main gateway, all of a sudden they say, oh no, a port scan. You know, I'm going to drop their packets, but there goes their network connectivity. So you have to be very, very careful in deploying reactive capabilities. Because always remember, the scans could be spoofed, just because you logged a scan, it could be someone scanning you, or it could be someone who wants you to think that someone's scanning you. So take everything in your logs with a grain of salt, of course. Yo. Yeah. You know, there are various things with the network that can in some cases cause it to fluctuate. You know, one of the biggest things is that people have, like I said, a masquerading gateway between them, so you're getting kind of pollution of one system in between. You can also have cases where, hey, you know, if they specially configured it with a kernel parameter that changes, likes less has a parameter, that'll change the TCP sequence predictability. We have that one covered in NMAP, but there are other examples where people can, you know, change their kernel parameters and make it look different. Generally you should, but if you can find a host that doesn't always give you the same response, just send me mail preferably with the IP address if you can, and I'll, you know, see if I can address that. You know, sometimes some, like Windows machines are really bad about this. You know, they're just not deterministic in a lot of ways. You know, you would think, if I send the same packet to them, I'll always get the same packet back, the same type of packet, but no, sometimes you'll get a completely different flag set. You know, it's like, you know, maybe they have some uninitialized memory or whatnot, but I've seen some very bizarre characteristics where a Windows machine will look one way the first time, then you'll scan the same machine, you know, and it'll respond to the same packet differently. But yeah, there are some cases like that. I think so. Um, yeah, it definitely does. If it doesn't detect a host, like if in that example he just did, if it hadn't detected the host, it would have given a URL you can go and enter it in, and then I'll add it to the global database so that, you know, NMAP should be able to scan that sort of system.  You know, anything with an IP stack is fair game as far as I'm concerned. So send it in and I'll add it. It's just hyphen capital O. Um, the last one I just did was a minus O and then a log file. I called it dc7.txt and it just writes out to a file that I name. It's just like doing NMAP minus lowercase s, uppercase s, localhosts and then direct it to a file with two greater-than-symbols. The next one's port ranges. You can actually set the port ranges you want to scan. And you get the listing of what services are running on those particular ports if they're open. The minus path is a file scan. It only scans for services listed in Etsy services file. You know, it does IO multiplexing through select and such and I found that produces significantly faster results because you don't have to waste kernel time scheduling all the threads. Multiplex the IO. They're actually automatically randomized. The next one is decoy scanning. He mentioned that. It causes a decoy scan to be performed which makes it appear the remote host that the host who specifies decoys are scanning a target network too. IDS might report five to ten port scans from unique IP addresses but they won't know which ones are decoys and which one is the IP scanning them. The syntax for that is... While he's typing it in, let me just mention a couple quick things about decoys. A couple hints that people may have found useful. One, a very popular and very excellent tool for detecting SIN scans and such that I recommend is ScanLogD by Solar Designer.  So by default and use all your memory space. So by default ScanLogD only logs the first five addresses that are scanned from. So I recommend always use at least five decoys and you can use ME as a parameter saying my IP in order. Otherwise it randomizes which order is you and which is the decoys. You know, if you have six or seven of them and then you say capital M, capital E, you know, ME, then ScanLogD will only log the first five addresses and you'll generally be home free. Another quick decoy hint is and this is probably obvious to most of you but I've been amazed how many times I get people from, you know, Yahoo and Microsoft.  I mean, let's see, I gotta scan from Microsoft.com, yahoo.com and dial up 33.eu.net.  But I've seen that a lot. You know, how did I get caught? I used five decoys. Well, you know, you gotta have a clue. Same with hosts that aren't up, you know. I just made up IP addresses. They don't even route. And you wonder why they figured out who it was doing it. You know, you do have to show a little sense here. The last one is that I'm gonna mention is minus G and that sets the source port number used in the scan. Because many firewalls you'll let through the DNS port or FTP data on port 20 so you can spoof a DNS packet and scan inside. That's minus G and the target and that's the syntax. Yeah, it's a quick note. You know, that's more useful than it even looks. I mean, I'm sure none of you administrators do it.  We gotta let these DNS packets through. Oh, well, let's just anything from source port 53's gotta be DNS, right? You know, just let it through.  Well, a quick firewall rule. You know, so, you know, I've been completely flabbergasted by how often just adding hyphen G53 for UDP scans or hyphen G20 for TCP scans. You know, suddenly you get straight through. Right, that's a great tool. It's kind of on the lines as fire walk. I don't know if any of you saw that by route. You can check that out at packetfactory.com but does anyone have any questions? Sorry?  A guy, see what's his name? Yeah, it comes with an X version for people who like GUI's. A guy who wrote it. Fuck. He forgot his name right off hand. It's called NmapFE. If you go to the web page, it has links to it.  So here you can just, you know, they're intuitively placed and you can click your buttons and such to check that out. The last thing I want to mention is really I try to attend Craig Rowan's speak speech. The Abacus Century IDS is really nice.  It's really nice. But does anyone have any questions? You said 6 o'clock. You said 18. 100 hours, 6 o'clock. In the back.  One thing that would be useful in that respect is like you're really slow scan, you know, that take a week or two and scan port by port so you stay under the thresholds. There's also distributed scans, you know, scans from six machines and coordinate the results. technique is distribute widely available, easy to use tools to do this so that all the script kitties, that way they don't see anything abnormal. They'll say, huh, this looks like the 20 other scans that are in my log from today. So since these tools are so widely available, it allows people are less concerned about seeing a port scan. They see it every day, it's kind of like a trace route. And also you can use the decoys. It's very difficult to trace that back if they see 10 or 20 different IP addresses doing the scanning as long as you've chosen the decoys well, of course. So I am probably going to add the slow scan, but I haven't yet just because I'm not very patient and I don't want to wait a week for my scan results. I think we're going to wrap it up now. CDC is about to start with PO2K. If you need to email either one of us, modify at attrition.org or theodore at insecure.org or dhp.com or dhp.com. Thanks a lot.


Welcome! As you know, with more than 300 million native speakers and more than 1.5 billion official users, English constitutes the most widely used individual language of our time. This unit discusses its main regional varieties in a global context and lists their main phonological properties using numerous spoken examples. In the virtual session, we will look at the central inner circle varieties. The English is spoken in the United Kingdom and Ireland, those typical for North America, as well as those of Australia and New Zealand. We will define their main subtypes and will list their main phonological properties. If you don't know where to start, use the question sheet as a default guide through the unit. The mastery worksheet is a dynamic multiple choice task with several questions about English in a global context. You shouldn't encounter too many problems here. Well, and the practical wants you to describe the phonetic details of the varieties discussed in the virtual session. Not easy, but important for an overview. In summary, quite complex, but manageable.


Hello there lovers and all my friends out there now. I know today's title is a little But I do want to intend this to come across with love and respect But some of you guys in the comments section, especially of late have been getting right underneath my skin And here is why it's these self depreciating self cancelling I can't do it. How dare you try to motivate me comments that feed a negative mentality Because as you can see a lot of these comments that they have lots of thumbs up They have lots of responses in the bottom It's kind of like in gym class when everyone is like hustling and one person is like I'm tired And that gives permission for five other people to be like, yeah, I'm tired too. I just Want for everybody to stop saying that they can't or they shouldn't have to or they've done enough or that they are Tired or that things are different for everybody else and it's easier for everybody else It's easy for me to say or for them to say because they aren't you and being you Automatically means that you can't accomplish things or that you don't have access to certain things in life that you have cancelled Yourself out from the opportunity to live your best life specifically on this channel You have cancelled yourself out from the opportunity to live the best intimate life and to be able to walk into any Room that you want to and control that because of X whatever you have determined in your mind that X is that stops You from being your greatest and best self and there is a community of you guys who really fostered this attitude That it's not fair for you the car just stacked against you. Therefore. You shouldn't really bother trying anything new And that trying anything new is a betrayal to the fact that you should just be allowed to be yourself And that should be enough wouldn't that be great So I decided to go on a date with a guy and I wanted to test something out as you guys know in my full Screenshow I go on ten different dates and test out a different thing every day and this one was directly inspired by these kinds of comments So I was like, okay, what if I went on a date with a dude? And again, I did my research on him and found out what his exact ideal physical type is and I embodied that and then I identified his Exact mental type and I embodied that but here's the kicker. I don't have self-confidence. I doubt myself constantly I'm very insecure. I felt uncomfortable answering questions I asked a lot of questions and I was very engaged and I was very encouraging However, when it came to talking about me or complimenting me I had a real Debbie Downer attitude about myself and my body language reflected that How would this person respond on a date with someone like that? Oh, thank you take a seat As your day going it's good. It's good. It's good. It's good. Just Weird and let's see what else my favorite films fast and furious series Oh What about you? What's your favorite? I'm probably not your type, right? Yeah. Well, I exclusively date black. Yeah. Yeah What's your background?  And so I'm not like that's cool That's a great mix. You got a lot of a lot of cool things going on. No, you're very beautiful. Oh, thank you Yeah, you're welcome Wow, thank you. I thought yeah, because like, you know, you just never know and so I was like, oh, this is probably a waste of everyone's time For this yeah, this date you took the whole day off. I don't know. I'm flattered inviting me out after if you are We could hang out after yeah, if you wanted. Oh, I have a shoot tonight.  I'm not But you're chill. Yeah, I'm cool. Well, I'll let you get on to the rest of your day And yes on this date and on every date I've gone on for this whole entire full-screen experience I have exaggerated the premise and hypothesis. And so if you don't directly see yourself in there Please look for little bits and pieces of that because I'm not expecting that anybody has that much of a self-depreciating lack of confidence But I do see a lot of bits and pieces of those especially in the comment section especially of late as we've gone on these different experiments together and I want to Emphasize to all of you guys who are looking for someone to say that you know what just be yourself go out there Don't try any harder. And that's okay that I'm never gonna be that person for you I'm always going to encourage you to strive harder and to push through and that being ourselves Is an illusion and that's exhausting to say and I'm I feel exhausted saying that out loud But if I could just be myself and that be enough I wouldn't have had to lead my family and move to America I wouldn't have had to go back to school for separate occasions I wouldn't be begging right now this certification program to take me in this professional board to take me on I wouldn't be doing pilots I wouldn't be making three videos a week at this point because my YouTube channel has been struggling like no others this January And for the hell of me I can't figure out why I wouldn't have to keep striving and trying I wouldn't be wearing a mother freaking wig right now because of the fact that I wasn't able to do my hair today If we all didn't have to put our comfort and our pride and admit some of our shortcoming and faults and work around those or work To mask those and yes, I'm sure it would be a better place in a better world If we could get into relationships and let ourself go and stop worrying about being our best selves If we could finally find someone to love us and allow us to be jealous or whatever being yourself or eating junk food For a lot of us that we're looking for that excuse to just let our guts hang out Wouldn't that be great? Or would it? Or would it? We're all subject to have to try a little harder and it frustrates me to see in the comment section you guys say Trying is out of your league There's no point in trying because you were born with a certain ailment that disallows you From attaining the things that I'm talking about because I have natural advantages that you don't Or whoever else it is that you compare yourself to to say well It's easy for them to say if we start playing the game of who has it worse We'll all lose eventually we're going to lose to the person who lives in Sudan We're going to lose to the person who lives in Iraq going to lose to the person in our neighborhood Who has great disadvantages that we can't even begin to relate to so let's not play that game I'm not saying that I have all the answers for you or I'm not telling you that all my tips are perfect But what I'm trying to do is give you guys viable options for how you can work around some of your weaknesses To make better intimate connections and to continue to strive for more Because we are all subject to the human flaw that says Not that's not good enough Whether you are an iphone or whether you are a couch or a person We all are subject to that thing that says that I think we can do better. I think we want better We're not caterpillars and I was having this rant the other day where it's like wouldn't it be grand to be a caterpillar Where you go into cocoon you go through one major change you spend six months Completely revamping yourself and when you come out emerge as a butterfly.  What next? Once you finish school someone's going to say, okay Now what job are you going to get and once you get a job we're going to be like, all right, awesome Don't where you going to live? What house are you going to buy? That is just the nature of why there's a new iphone every single Mother freaking week because we're all Subject to this thing where it says change do better grow growth That's why we have lived in a rapidly advancing society and especially for the past 100 years We've seen ridiculous examples of this and to the point that it may actually become our downfall. That's a different story for a different day Amen to that What i'm really trying to say is i want to find a way to communicate to you That yes, you are enough and you are beautiful and you are glorious and the work that you have put in to be Who you are today is valid and important and we appreciate that But that doesn't mean that it's it and that it's over It doesn't mean that you've done all that you can possibly do because i would love to be in that boat as well too But i don't think that boat exists. I think it's a mirage It's something that's put in the distance in front of us And i think the reason why a lot of people when they become successful aren't fully satisfied is because they have the expectation that when they achieve This place in their life that success means free sailing success means you don't have to keep reinventing and trying hard And doing new things it doesn't mean that and i don't think a successful relationship And i could be wrong on this means that either I think it always means that that struggle to stay on top to be your best self to find new ways of communicating of connecting to find New ways of selling off your strengths and buying your weaknesses to put yourself in a position of power Continues till death do you part? if Maybe not and i don't get me wrong. There are definitely people out there who say that's good enough for me And they find contention with that. I believe if you're on this channel I don't think that that would be what your truth is. I'm looking for the best in life I'm looking for the best out of my partnerships the best out of love the best out of sex the best out of life And no different to that I'm looking for the best out of you as well And I can't get that if you guys form these gangs against me that say you'll never understand What it's like to be a shit is don't try and tell us for a second What we should be doing or how we should be trying because it won't work for me because i'm not you Whatever you or whatever I represent Um to to who you are So I just want to encourage you guys To kick those comments out as a matter of fact I'm now going to delete those comments because I hate when somebody makes that I'm dark skin and big it won't work for me comment and don't get me wrong I will never be somebody who minimizes especially for black women how difficult the experience of being a dark skin black woman is One that I cannot directly relate to but I definitely empathize with because statistically This is the most educated group Statistically this group raises families on their own over and over again and statistically This specific group of people put themselves out there time and time again only to be passed up and never be chosen as the first pick And to be a double minority in that regard is extremely difficult And there are so many challenges against you and I empathize for you because at some point it feels like How much more can I do and give? And why should I bother trying when all the efforts that I put in Haven't gotten me the exact results that I want and the answer to that is Because when we make those small strides eventually those big leaps Even though we can't see them in hindsight because we're the ones inching it along If you really looked back at your life and saw how far you have pushed that massive boulder by yourself so far You would feel so encouraged to continue to push it more and I know when somebody asked you to do more it feels like You don't get it do you and maybe I don't and maybe we don't but at the end of the day Please don't fault me for asking you to try harder Please don't fault me for asking you to try different tips if i'm telling you guys Look potentially you might be too nice and that might be your downfall I know that feels like a really shitty thing to say to somebody because being nice Is supposed to be something beautiful and valuable on this planet But again because we are subject to that drive that says we want to be better Sometimes being nice doesn't bring that out of people and they can end up being resentful towards you for that Don't kill the messenger I'm still learning And i'm still finding out why it is that i'm not reaching my best potential and within my relationship I have to constantly go through these checks and assess and figure out and relearn myself and learn how to be a better person And that is the constant struggle that we're going to go through But if we do it as a community and we all agree that that is a natural normal and healthy part of life And if nobody stops in the gym class and says yo i'm tired. I'm not going anymore Then the rest of us don't feel that same like relief like cool. I'm with that person Don't be with that person be with the teacher be with the leader and i'm with my leaders on this as well too I have had a really Hard month this month and it really had me thinking about this a lot because of the fact that once again I had a pilot put before mtv and It was declined This is my fifth pilot in three years since i've moved to america and spent Ridiculous amounts of money to stay in this country and to fight Only to essentially you know be told a lot of the times that yes, you're good enough But not quite and the reason they declined this recent pilot is because i'm not splashy enough or the show wasn't splashy enough And then they made a comparison to amber rose who's on their platform and said that you know She's really splashy and out there and radical which she is Which made me feel like i am less than right that um I don't fill up the space or i don't compare to the space that this presence fills up But it's frustrating because i have unique talents that i think make me different and splashy in other ways But they couldn't see that so what do i have to do? I have to find different and unique ways to make them see that And that is a part of why i'm making three videos a week right now I'm upping my content because i realize the fact that if i'm not willing to do extreme things for attention that like Help me stay out there in the world over time I have to constantly be at your guys heels nipping telling you like i'm still here. I'm still here eventually You'll be like hey cool come this way This book is by lizzie velasquez It's called dare to be kind and for those of you guys who've ever met lizzie before or known her story She has a youtube channel and she has an incredible story in which she was on the internet one day Just she has gone through a lot of challenges major health challenges And she was told that she wasn't supposed to live past the second decade and here she is I think close to 27 years old still kicking because she has been fighting against life as is But along with that fight of health, which is one that i am very grateful not to have to do She went on the internet one day and there's a video called the world's ugliest woman Which had millions of views and it was featured her face She didn't know this person she didn't ask for it She'd never done wrong to them and that started a quest for her where she said that I think there's an ugliness in the world that I want to see beauty in not in myself I already see the beauty in myself There's an ugliness in the world that I want to right that wrong And she began her channel and she exists in healthy relationships. She just bought a house this year She has her own show. She has a book out I've seen so many examples of people who have had way more Difficulties and adversities and hard cards dealt their way and that isn't to minimize mine or your adversities But just to remind us that everybody out here is fighting and striving And yes, some people may have a lucky chance or a lucky break or maybe born with green eyes But at the end of the day Nobody is chilling. I don't think anyone's chilling Um And that's I guess part of the frustration too when the full screen show tips come in you guys like these are manipulative I don't want to have to do them then don't Don't try but then why are you on a video that's trying to teach you how to make better connections If you at the heart of it all don't feel like I could probably do better at connecting with people Don't reject the tips look for you inside of them And I often compare what I'm doing to that of a golf swing So when you go to learn a new sport and you're learning how to do a golf swing, it's very mechanical It's very like do this put your bum out square your hips up And then eventually when you practice those tips you find your own stride within it And at first it feels very mechanical and stiff But eventually over time the you and it comes out and you make your own unique golf swing And that's what I'm encouraging you guys to do I'm giving you guys these arbitrary tips that have been studied and psychologists say that like on a mass level This may be a successful way to connect with the average person and there's always nuances But the average person these tips may work for so I'm educating you guys on these tips and you can take them and say Okay, maybe when I go out on dates I have to be more mechanical to ensure that I am balancing disagreeableness with agreeableness Or that I'm encompassing some of the traits this person loves about their family Into how I connect and love them intimately or that I'm ensuring that I'm not just focusing on looking good for this person I got to also connect with them as a human being to make that long lasting intimate interaction Those are the things I'm saying to do and maybe the way that they're coming across and I could learn from this Don't feel authentic for you But I'm just trying to give you a golf swing so you can get in your own groove eventually But these are the basic things they're going to allow you to get that ball to go the farthest So yes, I read all of your comments And I take in as much as I possibly can and maybe in the comment section below It's an opportunity if you let me know where my golf swing isn't the greatest where my delivery isn't the greatest But I also really want the comment section below for us to have a love fest right now. I'm a little tired I'm tired of this myself. I'm tired of looking at myself and saying what's wrong and what I'm not doing right Especially this month and I'm tired of you guys looking at yourself and saying what's wrong and why things won't work out So just in the comment section. Just let me know what you motherfucking love about yourself What are you so proud of what is your strength right now that you can say?  So please go and watch that episode It was insanely insightful and for anybody who has ever asked yo shannon How can I support your content? This would be it when you guys go on other platforms that are able to pay me which youtube no longer really is And say yes to this content that lets people know that okay people are willing to invest in this kind of stuff Let's do more of it So I want to make more youtube videos for you here and the trade-off for this being free Is that once in a while when I do have an opportunity like this, please go and support it And like I said, there's two different ways you can do so without spending a dollar of your money Big ridiculous massive shout out to everybody who has already gone over there and watched I see you I appreciate you. I love you and speaking of people I see appreciate and love Okay, so I did the video how to dance sexy and I had a challenge in it called the two to four challenge Which I encourage people to like yo for 15 seconds put this song on and just move in the most seductive Sensual way that feels authentic to you and the videos that I got back were so beautiful and affirming and sexy and self-love filled and just Unapologetically fucking cool and I want to encourage everybody who hasn't given this a try Even if you're not ready to put it out there in the world Just do it because I think it was so cool and you People are the MVPs right now to me all you women who took part in this challenge I couldn't even begin to tell you how inspired you made me feel this week Because of the fact that you took a little bit and you made it your own and you made it beautiful And that is what the spirit of this channel really is and you guys embody that in 15 seconds And I didn't know how you could do that, but you did and you've encouraged me to keep going. Thank you Thank you so so so much That also goes to you guys. Thank you for being here till the end Due to popular demand, I am now podcasting daily on anchor fm Now that is a place you guys can go to ask questions You actually leave voice notes and then I answer your questions So go to anchor.fm slash shambli to sign up and to have your daily questions answered