Community-based active case finding, ACF, has been shown to increase the detection of tuberculosis, TB, cases by up to 1.14 times when compared to control groups. This suggests that ACF can have an indirect effect on TB case detection, potentially due to its influence on subsequent TB testing behavior. However, there is limited evidence available to support this conclusion. This article was authored by Helena R. A. Feesey, Rachel M. Burke, Marietta Mawassa, and others.


wooden sketchbook. I started working on this project in 2004 in Paris. Since then I work on the wooden sketchbook regularly, sometimes in a very intense way, sometimes only very rarely. It is a matter of feeling. As indicated in the title, a wooden sketchbook. The concept is the one of an open diary or an artist's sketchbook. It comes along with sometimes very personal subjects of my personal private everyday life, sometimes more general subjects, political or social events. The more the wooden sketchbook grows over the years, the more it becomes large-scale fresco depicting our time. One information literally destroys the other one, makes us forget about it. The illustrations for the Tower of the King by Lao Tzu in the Luxembourgish translation version by Serge Tonard. I treat the different images in a very free way. The series in relation with this ancient Chinese text are the exact opposite actually of a wooden sketchbook. As I stick to the meaning of the text as far as possible. Also, these illustrations were made in three months, a very, very short time. And once the illustrations were done, the work was done, unlike the wooden sketchbook, that goes on and on and on. The Last Waltz is a series of trees and leaves in the autumn wind. A poetical and quite abstract work in nine parts that is also a tribute to painters like Claude Monet or Syte Wombly. After 34 years I started working on etchies again. The great technical skills required by these old techniques fascinate me. The look of a copper print is something absolutely unique. It is a pity that these old-fashioned techniques are disappearing more and more as most people nowadays don't make the difference between a skillful piece of handcrafted art or a simple photo print. My diaries and sketchbooks, the basics of my work and an everyday practice since I was a young man. The artist's workshop first version, a series of 16 drawings and the large oil painting I did for the Moodham Collection in 2004, about how and what is art.


Ok, welcome. I am Henrik Zemmel, a new member of the document foundation from 2014, and a former member of the libertarian. This is a territory of the USS-5. In the USS-5, it is held of transition. It sprays in the vector region. It has four hospitals with 1,600 species in territory. This is a logo with the USS-5 and the picture of migration. In 2005, I was moving in the USS-5 in a computer at desktop. I was already a free software user and understood the lack of the known agent of available software, especially with regards to the office automation. I still exist at the workstation with Windows 1880, and most of them were Windows 2000, and the Office 2000 was the Office 3. Then they started to include the software such as OpenOffice and Firefox, yet keeping Microsoft Office, because OpenOffice was still very mature for this version. All this situation remained a change of the routine, the final element of LibreOffice. Since the first release, OpenOffice was replaced by LibreOffice, after the fourth installation, the reason of the change was to give confidence to a new community, no link to any company and software from commercial rotation. This is a situation, a difference from user and PC asset. This chart is possible to view the number of users and PC in asset. They are different because many PC are Shara, Shara and Honor users. In OPC it is installed LibreOffice in a very good version. The most is 4, 3, 7, still vanilla. While in part of Asante it is installed Microsoft Office, 2,000 and LibreOffice at the same time. In installation we use a Torista only LibreOffice, unless Microsoft Office is required by older software already. This communication is very important, the communication and tracking. About two years ago, I had started the training for users, with the collaboration of the ULSS files directors. In the first moment it was just an introduction, a first offer, told me to do this way had buzzed on TDF's training problem. The Migration. Migration started this year and the project will last two years. The process scheme requires a procedure with tracking. Migration and every single department is documented from the TOC and accelerates the older format to ODIF. And so they comparatively promise with the older health software number. This chart represents the number of users involved in the training. During last three years and yet now, the trainings are Calca, Brighton, Impress and Role for beginners. In the future we will have a training to Calca and Brighton advances some problems. The very problem is the fonts. To use these fonts is monitoring to agree Microsoft and end user license agreement. At least 2007 or later Microsoft Office. If you have this font in PC and don't add Microsoft Office 2007, it's not allowing. In fact, we pay the license office. Conversation on TOC and Excel file or ODIF format. Interoperation with older public administrations. Micros and template. Most proper connected older software requiring Microsoft Office which has been dominating for so many years. To exchange the document with other public administrations may become a problem if they are able to handle ODIF. The deployment technique. For the deployment technique the user OCS inventory is a software with France. Deployment technique. For the deployment we don't test with the critical documents and the spreads and the reprocessing version we are going to deploy. If the test is ok, I use to create the script and insert it in the OCS server for the deploy. I use the Panilla version in this model for 4.4 file and the script is not a massive deployment but by the department. This process is variable in time and in packages number. Ok, thank you. If you have a question for OCS. Thank you. The support from the companies that are selling them or it's not going to be a sustainable strategy. No, the support is inside the technical department. They train the people not third level but first and second level. So far third level has not been necessary. Ok, and he also is somebody working in an external company. So this was all made by his company which is outside the organization. I have a desk for one level and two levels. For all problems we have computers and laptops. The question for this system is not technical presentation. Ok, it's only demonstration of the deploy. We don't use active directory or other system. OCS deploy permit the deploy with Microsoft system and a Linux system and a Macintosh system. OCS for this I actually... If you don't know OCS directory it's really worth a look because it works with every platform and it's rather easy to use. It's not very known as a tool but then unless of course the organization is already deploying using Microsoft tools for massive deployments but if they don't use a Microsoft tool for massive deployment this one is very interesting because you can't control on the deployment but it's pretty software so you basically can configure almost everything in your massive deployment. Control the deployment and control the version of software style for group. So you can change the configuration, change the user profile, change all the switches and the software takes care of that. Unfortunately it's not very well known but it's a very good tool. People who are used to managing a bracelet network something like Nature's for example it has an agent to be installed on your machine and with that agent you can really take control of it deploy in a software and it's very easy to use. And it's most platform and I would say that OCS is perfect. I just learned about that. Thank you very much.


This is stock number 9C23B, we are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and use Dodge and Minivan headquarters. Today we are checking out this super clean 2017 Dodge Grand Caravan. From this HD video you will be able to tell that this not only is this van extremely clean all the way around inside and out, you'll get to learn a little bit about the mobility package that is on this one. We shoot all of our videos in 1080p so if you have HD capabilities on your computer tablet or smartphone device turn them on right now because it is like you're right here looking at the van with me and definitely your best way to check out the vehicle before seeing it in person. If you want to check out more pictures of this van go to in the upper right hand part of your screen as a link to this vehicle on our website comes with these 17-inch painted and polished aluminum rims and it has Michelin energy saver 22565R17 tires and these tires have a lot of tread left I'd say 70 to 80% of that tread at least left on those tires. In fact those are the same tires I got on my van. Headlight lenses are nice and clean and clear, front bumper no dents, dings or cracks on that. Passengers side fender is in excellent condition as well and the passengers side rim no scuffs or scrapes on that really nice condition and as you go down this side of the van you can see just how clean the body is, how reflective and mirror like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down you can still see the vehicle hear the vehicle and have confidence in what you're looking at before you even get here it has the hideaway roof rack. In fact we offer a summit fast-pass option on our website where you can apply for financing, get payment quotes, appraise your trade all from our website so you can basically do the entire deal before you even get here and then when you get here all you got to do is drive the vehicle and love it and take it home. That's simple. Back tires have just as much tread as the front tires so as we get around to the back of the vehicle here it's a www.tripplesmobility.com it has a ramp in it and this ramp is probably the slickest thing I've ever seen from a wheelchair ramp perspective so basically this thing's all hinge and spring loaded so you just grab the handle here and you just pull and the whole ramp goes down just like that you can see it's spring loaded right there and I mean you're ready to get right up in there it has a couple of tie downs I guess you could call them or ratchets so that you can get the wheelchair up in there and then the spare tire is right there but just as easy as that is to get down it's easy just as easy to get up so you just lift and it'll go right into place and you're done it's that simple it's really really a cool design so you can literally put it down in two seconds that's how quick this stuff goes there's no locks there's no latches to do it just it's all self-contained really cool system this is a power gate to press that button you know come on down like so the gate itself is in really nice clean condition you see it closes up nicely and you're all set to go so really a cool piece to this van and especially if you're looking for a van like this you'll definitely like that ramp this back rim for full disclosure no scuffs or scrapes on that down the rest of the side very clean it does come with heated power mirrors inside the SXT package gives you the black leather and suede interior these are captain's chairs in the front power driver's seat factory floor mats in the front here as well auto headlamps power windows power locks power mirrors and it does have the power venting rear windows which are really nice feature and as we hop inside the van here be able to tell that this one only has 22,197 miles instrument cluster is very nice and clean you get the leather wrap steering wheel cruise controls on the right Bluetooth and information center controls on the left and there are audio controls on the back of the steering wheel you get this nice gloss black trim on the steering wheel as well and the dash AM FM serious satellite radio capabilities CD player with an aux jack tool climate control you got rear air controls as well passenger seat is very clean as well no rips or tears span has never been smoked in and smells extremely clean inside side current airbags you got your power doors and gate button right there and then your map lights up front we'll take a quick look at the back seats here because it does have some back seats in it power sliding side door so they got the seats off to the side there still has the seat belts on them you do get rear air controls back here as well and kind of take a look at that flooring really a nice job on the up-fit here with that ramp I think if you are looking for a ramp like that that this will do the trick under the hood we have 3.6 liter pentastar v6 motor engine bay is very clean runs very smooth this van has been fully safety and inspected by our service shop has a fresh oil and filter change all the fluids have been checked and topped off and this van is 100% ready to go see more pictures of this van or one of our other 450 new and used cars trucks scvs minivans wranglers half tons three-quarter tons one tons you name it we got it go to our website www.summitauto.com full pictures and descriptions of every single vehicle from two locations all at summit auto.com and if you'd like to check out more HD videos you can go to youtube.com slash summit auto remember to like subscribe and share on this video and all the videos that you see there in fact in a second you will see a link to subscribe to our YouTube channel on your left it linked more used inventory videos like this one on your right if you've not been to our website on the bottom link to this vehicle on our website click those checks out and we really look forward to helping you with this super clean 2017 Dodge Grand Caravan upfitted with a mobility ramp thanks again


What is the importance of peatlands? We're having a whole day of activities dedicated to it. How do they figure in terms of climate change, adaptation mitigation strategy and development goals? Peatlands are a fascinating ecosystem. They are found in at least 180 countries. So there's probably one near you wherever you are, but they're one of the least understood ecosystems. We've only recently seen that they have enormous carbon storage. Basically for thousands of years organic matter has accumulated, so it's almost like oil and gas, but it's plant matter that is collected in these large peatlands. So for the climate it's an enormous potential to keep that carbon in the ground and continue to sequester or be a carbon sink in those peatlands. It's only about 3% of the world's surface area, but probably responsible for 5% of all greenhouse gas emissions. If we can plug that leak it would probably give us enough leverage to reach the target of the Paris Agreement to stay within 2 degrees of global warming. If we don't reach to plug about a leak of the peatland fires and peatland degradation, it might be very difficult to stay within safe limits and reach the Paris Agreement target. And for countries who do have red plus plans in place now, are they looking at peat? Is it being fully considered or is the potential still to be leveraged? Not yet. For example, Indonesia has a forest reference emission level under the Climate Convention to measure how much emissions they have and how they want to reduce them, but it does not take into account the peat store or the fires that are burning on peatlands. The same situation is in many other countries where peat is not yet included in those efforts, but we're seeing a change and countries are more alert now to the possibilities and the challenges. That's why we formed the Global Peatlands Initiative bringing together more than 20 international organizations and countries like the Congo, the Congo Basin countries, Peru and Indonesia to look at how peatlands can be better integrated into their sustainable development goal aspirations and into the climate efforts that are undertaken. Tell me a bit more about the initiative you've just mentioned. I understand it was actually launched at another global landscapes forum. That's right, in Marrakesh, yes. So we launched it only in November last year, 2016, and now we have over 20 partners. We aim to better harmonize all the data and the support that the international community can give to countries like Indonesia, like the Republic of Congo. And through that we hope to also sensitize policymakers, ministers of environment, ministers of finance, of planning to the fact that peatlands are really probably the most important terrestrial ecosystem for the fight against climate change. What are some of the challenges or obstacles for countries to fully leverage the power of peatlands in terms of climate adaptation and mitigation threats? First of all, many countries don't know where they are. In the climate convention many years ago, about 10 years ago in 2006 in Kenya, climate negotiations were trying to bring peatlands into the discussions, but some countries said, well, we don't have peatlands, including the host country of those talks, Kenya. And not even five kilometers outside of the convention venue, there are lots of peatlands. So there was no knowledge where these peatlands are, how deep the carbon is, the peat is in those peatlands. We're only now starting to have that knowledge, and we will put out later this year a global rapid response assessment on peatlands. Where are they? What are the main threats? Followed next year by a more in-depth scientific assessment, a global assessment on peatlands that will hopefully help all the countries to at least know. Do we have peatlands? Where are they? How big are they? How much carbon is there? What can be done? So the first point is they don't know that there are peatlands. The second point is that in many cases, and Indonesia is really the country that is the most important country for this topic right now, many of these areas are under agricultural production. So there used to be peatlands, now they're often drained, there are plantations on them, there are agricultural fields on them, and the fire problematic that we see in Indonesia is largely due to that drainage of peatlands. What do you hope to achieve with this global landscapes forum here in Jakarta? What are some of your hopes or takeaways you'd like at the end of the day? Well, I think the motto of this event, peatlands matter, which is I think also the hashtag that's now all over Twitter, is the core of the message we want to bring to policymakers. Peatlands do matter for the climate, but also for development. These are millions and millions of hectares of land in many tropical countries. There are millions of people who depend on them for their livelihoods. In some cases, they are overused, over exploited, managed badly, drained too deep so the water tables fall too low. That means we have to turn that tide around and make sure they're sustainably managed. We're here at the global landscapes forum here, a lot of successful examples of how that can be done. And again, we would like to bring those also to the other countries that are some of them are here today, but many are not. We would like to use global landscapes forum to really elevate the topic to the international policy agenda.


For the third day in a row, in the border regions with Ukraine, Russian volunteer troops continue their raids. Battles in the Kursk and Belgorod regions persist, and it is expected that there will be shelling of Russian occupiers' military targets in these regions, so the call for local residents to evacuate urgently remains relevant.As of this morning, there were reports of battles in the area of the village of Spodarishin in the Belgorod region. The pro-Kremlin telegram channel MASH wrote that the so-called subversive reconnaissance group, which the resource refers to as Ukrainian, approached from the side of the Ukrainian village of Popivka. And there the battle began. The Russian army allegedly deployed aviation to repel the attack. So-called Russian correspondents claim that heavy equipment is being used to attack Spodarishin.in addition, battles for Tyatkino and the Kursk region continue for the third day. Furthermore, a volunteer of the Freedom of Russia Legion, Alexei Baranovsky, made an interesting proposal, which, in his opinion, could be put forward to the Russian President Vladimir Putin. He said that the volunteers are ready to withdraw from Tyatkino with the Kremlin dictator withdraws the occupiers from the Ukrainian Melitopol. They are leaving Melitopol, and we are returning Tyatkino to them. In my opinion, this would be quite a good deal, Baranovsky said according to him, the situation in the border regions with Russia is developing very dynamically. Looking on the outskirts of Tyatkino continues. Thus, there are battles both in the Kursk region and in the Belgorod region. Our special liberation operation has been ongoing for the third day, Baranovsky added, since early morning, Belgorod and surrounding settlements in the region have been under shelling. Footage of a burning car allegedly hit by shelling was posted online. The Russian volunteer corps, in turn, declares that a military serviceman of the Russian army, Dmitry Oksayevich Galishkin was killed in the car that was shelled after yesterday's warning, representatives of the Russian volunteer corps urged residents of the Belgorod and Kursk regions to evacuate again this morning, as strikes on military targets of the occupiers are being prepared. Your leadership has taken no measures for your protection or evacuation, while shelling of peaceful cities and villages of Ukraine is ongoing. We are forced to open fire in response on military targets in border regions. But immediately, the statement said. Russian troops will be deployed on the border with Finland, Russian President Vladimir Putin said in an interview with Russia One TV channel and Russia's RA state news agency, the Russian leader said Finland's accession to NATO was meaningless, adding that he does not understand what has prompted the need for the alliance in Helsinki. Our relations used to be very good. But now the situation will change, Putin said. It should be noted that Finland joined NATO in April 2023.Earlier, Estonia's Foreign Intelligence Service warned that Moscow is planning to possibly double the number of troops along its western border with the Baltic states in Finland, as it anticipates a potential military conflict with NATO in the coming decade. Russians are planning to increase the military force along the Baltic state's border, but also the Finnish border. We will highly likely see an increase of manpower, about doubling perhaps. We will see an increase in armed personnel carriers, tanks, artillery systems over the coming years, Kaupo-Rosen, the head of the service said. Recall Russia unilaterally terminated a Finnish-Russian border agreement dating back to 2012. While this move is largely symbolic as the agreement was suspended following Russia's invasion of Ukraine in 2022, it nonetheless demonstrates Russia's willingness to escalate tensions with its neighbor along its northernmost boundary with the EU and NATO.


I'm an Annapalofra beetle. I could be one of two species, Galapagnenis or Chaniaensis. I'm a wood-boring beetle. Some of my favourite foods to eat are broadleaf trees from pears to acers to hornbees. A tree can be cut down, processed and turned into timber, can be pallets or furniture and be shipped all around the world just at the right time when the adults are ready to emerge. And if they do emerge, they can then mate and lay trees and start a new population in the country that they're not native to where there aren't any natural enemies or defences so they can become quite a problem.


Hi there, today I thought I'd look at some of the best SNES ROM hacks I've played. Now there's like a thousand of these, so obviously I haven't played all of them. I just wanted to share what I've enjoyed playing. First I should explain that I'm talking specifically about ROM hacks, not homebrew games. A ROM hack is a person or a team of people modifying existing content. A homebrew means the programming code would be entirely original and made from scratch. It's worth pointing out that usually these ROM hacks are made by people who have put well over 200 hours into the original game, so the temptation is to stretch the game's capabilities to their limit and by proxy their own skills. And as a result, the hack can end up way, way too difficult, and just not worth the aggravation. Yeah I get it, a lot of these ROM hacks are made for a niche audience, but hey if you want a challenge, I'd argue it's tougher to design new platforming levels that match your character's abilities while still being fair, and while still seeming new and keeping the spirit of the original game. That's why I want to start with the hack of Super Mario World called Return to Dinosaur Land. This is a ROM hack that comes reasonably close to capturing the same spirit of Super Mario World while keeping the game fair and balanced. Sure it starts off pretty easy, but it features multiple exits on certain levels, so the emphasis here is on exploration, rather than just surviving some insane ridiculously designed world that would take like 30 minutes to get through just one level. Don't get me wrong, Return to Dinosaur Land still presents a challenge, especially once you get to the fourth world, but the game remains fair throughout and is one of the best ROM hacks I've played. There's also stuff like a very Super Mario World, which introduces some interesting ideas like bringing in a couple elements from Mario 3 and Yoshi's Island, as well as some new enemies and some interesting new music. It's a pretty decent playthrough. Of course if you do prefer the sadistically difficult ROM hack levels, there's stuff like Super Kaizo World, but personally I would prefer guys like Proton John to suffer through that kind of stuff. Go check out his channel if you haven't. Of course you can't do a video about Super Nintendo ROM hacks without talking about Super Metroid, which behind Super Mario World is probably the most hacked SNES game out there. There's two hacks that stand out. One is Metroid Super Zero Mission. This has got to be the best ROM hack on this entire video, and even if you kinda like Super Metroid, you have to play this hack. It's so polished and intuitive, and it impressively has a similar kind of open-ended structure to it that rewards the player for exploration. Some puzzles are really tricky, but never unfair, and they're rarely sloppy or half-assed like you see in most ROM hacks. If you play any one ROM hack in this video, make sure it's this one. It's fantastic. It's as close as we'll ever get to a Super Metroid 2. It's that good. If you're looking for other Super Metroid hacks, there's stuff like Hyper Metroid, which reimagines the story entirely and gives the game a different kind of look. That's pretty cool. Another well-made hack by someone who knows what they're doing. Here's a small example where you come to a barrier here. You go back and you notice this enemy moving against the ceiling, but it disappears. Hey, there's a new path up here. I know that's super obvious, but I just want to demonstrate that these hacks are made by competent people who know what they're doing for the most part. Hyper Metroid is another example of that. It's buggy here and there. It's certainly not perfect, but I really enjoyed it. Of course you know there's hacks of Link to the Past out there. One of the most popular and most impressive is the Parallel Worlds hack, which has a brand new story, design, layout, map, everything. There's even new pieces of music here and there. The problem here though is that Parallel Worlds isn't all that intuitive. You'll find yourself wondering where the hell to go often. And the difficulty here is just brutal. This may not be for casual players, but hardcore Zelda fans will love this one. Plus it's inspiring to see such a thoroughly remade game. Clearly a lot of work went into Parallel Worlds, but the amount of frustration here makes me think this game may not be for everyone. The Link to the Past Goddess of Wisdom ROM hack may be a bit easier for casual players because, well, it's more Link to the Past. It's the same basic design and everything is very familiar. It's just there's new puzzles and new layouts. Nothing too fancy here, but it's still pretty solid if this is what you're looking for. But again, like I said earlier, the problem with some of these ROM hacks is that they can be very buggy and glitchy, as you can see here. Next we have Oh No, More Zombies Ate My Neighbors. That's exactly what this is. It's More Zombies Ate My Neighbors. It's 55 levels of more of the same great top-down co-op action and the same difficulty you've come to expect from the game. This is essentially an unofficial sequel. So if you want more Zombies Ate My Neighbors, well, here it is, literally. Of course, I have to talk a little about the Chrono Trigger ROM hack called Flames of Eternity, not to be confused with Crimson Echoes, which was made first years ago. But Flames of Eternity is a more complete version intended to bridge the gap between Chrono Trigger and Chrono Cross. It's pretty interesting. The music and artwork are modified a bit here and there, and you start the game after a lot of text, as Magus by himself on the surface of the planet after the collapse of the Kingdom of Zeal. Personally, I thought Flames of Eternity was just OK. It's certainly not terrible, but obviously it can't touch the original game. Still, it's a decent enough story using familiar characters, themes and visuals. Last but certainly not least, we have the infamous Earthbound Halloween hack made by Toby Fox, otherwise known as the guy who later went on to make Undertale. So yeah, if you enjoyed Earthbound and Undertale, well, I'll just say it's interesting and leave it at that. This ROM hack is, I'm not even sure what to say because I don't want to spoil anything. I'll just say it's super messed up. You play as a bounty hunter who has to track down a monster who killed and ate this girl's parents and you come across all sorts of horrifying stuff. It takes place in a timeline where the four Earthbound characters did not succeed. So there you go. This ROM hack is very crude, but you gotta check this one out. OK, so there's nine ROM hacks for you just to get started. So how do you play these games? If you really wanted to, you could buy a hacked reproduction cart with the fancy label and all that, but that's not really necessary. You just need an emulator or a flash cartridge if you insist on playing these games on your original SNES hardware. ROMHacking.net is a fantastic resource not only for these ROM hacks, but for how to implement them and to get them to work. There's a link in the description that explains how this stuff works in detail. To put it briefly, you just need the original game ROM, a ROM hack, which can usually be found at ROMHacking.net and comes with a .ips file format and a program called the SNES ROM Utility to join the two together in either a headered or a headerless format. I've got a link to the program that'll do that in the description as well. Anyway, that's all for now. Thank you for watching and have a great rest of your day. I'll see you in the next video.


Let's take you to Niger State, where the APC Governorship Candidate Mohammed Baggo has urged the federal government to involve traditional leaders in the fight against insecurity in the country. Honourable Baggo was reacting to questions on how he would deal with issues of boundary tree and kidnapping and ransom for money by criminal elements in Niger State during his fund raising ceremony in Abuja. He served the strategic position of traditional rulers and local leaders as the custodians of culture as well as security in state, local government areas, towns and villages cannot be overemphasized. He said collaboration between traditional leaders and government would go a long way in solving insecurity in the country. The federal lawmaker also spoke on the current fuels caused to be experienced in the country, calling it pure sabotage while urging the federal government to make sure relevant government agencies are drafted to ensure availability of fuel in filling stations across the country. On the current hardship being faced by Nigerians due to the new CBN redesigned policy and the Naira Swar policy, Baggo says contrary to such insinuations, politicians who are not raising funds for their campaign do not care about the policy by the CBN. We want to bring a new state, we want to the brand of Niger, we want to be part of the city development in Nigeria. As you are aware, Niger State is the largest state in Nigeria in terms of land mass, we have 76,000 square kilometers of land, we have four hydropower stations in Niger and yes, we don't have irrigation dams in Niger, so we want to be an aggregate giant in this country, an industrial giant in that matter.


Good morning, John. It's been quite a week and I spent a lot of time looking at a Google Doc trying to like come back from your very good, very emotional video and have something deep and profound to say, but I'm a little too overwhelmed for it right now. So that was the thing of what do I like to do? I like to share knowledge, I like to learn things, and so I tweeted, What's your best fact? And then I read through over 900 replies to that tweet and I have selected for you the best facts, according to me. Let's start with some good evolutionary history action because sharks have been around for longer than trees, which is something considering that as Dr. Steve points out, also trees aren't a thing. They're a strategy for survival, not a taxonomic group. Honorable mention, shark fact, there are individual sharks that are alive today that were born before my country existed. Best music fact gotta be that Dolly Parton wrote Jolene and I Will Always Love You on the same car trip? She was like driving by herself and wrote the song? Can you imagine being in that car? An extra good fact because it contains the surprise fact that yeah, Dolly Parton wrote I Will Always Love You. Second fiddle to that though has to be the original lyrics to Yesterday by the Beatles. Scrambled eggs. Oh, my baby, how I love your legs. Not as much as I love scrambled eggs. Oh, we should eat some scrambled eggs. It's like they wrote the weird owl version of their own song first. Best movie fact, I'm sorry, just Vigo broke his foot. I know we all know it, but Vigo broke his foot. Speaking of feet though, this one blew my mind. The majority of the bones in the human body are in the hands and feet. Unless the person is pregnant, in which case the majority of the bones in the human body are in the uterus. Because babies have more bones than adults. Look, I don't like it either. Which leads to a broader category of fact that I really like, which is facts that are definitely true even though they definitely seem not true, like that the average person has an above average number of legs. Other facts in this category include the fact that you were once the youngest person on earth and that every day there is a person who has the biggest poo, but they will never know it was them. I like this one a lot. The second largest purchaser of explosives in the US is the happiest place on earth. And speaking of explosions, if the earth-moon system survives the expansion of the sun into a red giant, which like it might not. But if it does, then like 60 billion-ish years after that happens, the moon will crash into the earth and destroy whatever was left here. So it's coming at us from all angles, like space is a dangerous place on long time scales. Gotta throw one history fact in here and it's gotta be that there is a chance that Charlemagne was killed by his tablecloth which was made of asbestos and he loved it because he could clean it by throwing it into a fire. John, our second to last fact, is the best fact as voted by people who click the like button on the tweet. And it is that arctic comes from the Greek word for near the bear. And there are no bears in Antarctica and there are lots of them in the arctic. But I have to add an addendum fact to this because this is not why we named them this, it's a coincidence. The arctic is near the bear because of Ursa Major, the constellation in the sky above the arctic. The bear that the arctic is near is barely a bear at all. It's a dipper. But John, the number one fact in my judgment, the one that I liked the most because I did not know it and I have believed the lie my whole life is that fingers don't get pruney because like the water absorbs the oils out of them or whatever you've been told your whole life because if nerves to the fingers get cut they don't get pruney anymore. It's not a physical reaction. It's a neurological one. Our bodies are intentionally making our fingers wrinkly probably so that we don't slip when we're in the water. Why didn't anybody tell me this? Who was gonna tell me? Everybody thank you for sending in facts on Twitter. John, congrats on the book release and I'll see you on Tuesday. Scrambled eggs. Oh my baby how I love you legs.


To nobody's surprise Fox News has once again decided to attack Democrats for government Socialism Participating in society. That's right So if they claim that they care about climate change, but yet they participate in society by traveling by flying in planes and private jets Well, they must be inherently hypocritical now. I've covered this argument before they've made this argument time and again But they've somehow managed to make the argument sound even dumber than the last time when they made the same exact argument Take a look flying high 2020 Democrats candidates taking to the campaign trail to push their plans for climate change While at the same time spending big on private jets in order to do it spending in private flights by Democrat presidential candidates Soared over the past three months from roughly $680,000 in the second quarter to more than 2.2 million in the third fundraising period according to the FEC Joe Biden Spent the most on private flights 924,000 with Bernie Sanders at 360,000 and Liz Warren 132,000 they've got to get from place to place, but should they get a pass on this one? What do you think Gary? They absolutely should not look David. Maybe I'm being cynical or maybe it's my old age or older age But each of these candidates are total hypocrites. Look if you sat them down over a beer or wine or whatever I guarantee you they don't care about climate change what they do care about about is getting elected and Climate change is a buzzy issue right now. I think we all can agree on that But if you sat down also over that same beer wine and ask them well, what causes climate change? What specifically can we do? They don't have an answer. You know why? Scientists don't have an answer out there. So they raise this buzzy issue They fly around they act as hypocrites to get votes because that's the thing to do They don't have a solution though other than you know, we're all gonna you know eliminate cows and cars and stuff like that It's all silly. It's all nonsense, but you know, this is the age we live in where that's what you have to do to get elected Gary my friend first of all, of course, they're hypocrites second of all I don't think there's anything funny thank you comment. You made scientists do know what causes climate change, but David I have the solution we need to pass a law the way other countries have to dramatically shorten the campaign season That will mean less money The Republic will be in better shape as a result good luck. Yeah, we are in agreement. I thought he was Amtrak They should call him Gulf Stream Joe Joe. He keeps it up. He's got the biggest plane, right? I wonder if he's gonna buy that new G 700. They just got that it's a snazzy politicians vehicle Okay. Yeah, we all joke about it. I'll go or obviously used to spend there That was a lot of he started this whole thing with the with this documentary his house was much bigger than most Americans Look at the end of the day It's the voters would have to pay for the for energy You got to stop the masses from consuming energy and that's why would they think that they can target energy companies or rich people That the energy companies just deliver energy to people that want to consume it ultimately The price would have to go radically up to everybody their voters not just the rich with their jets or the Rolls-Royle That's a very small percentage as we know from the inequality graphs of the world The average person the but and the politicians for the green jet that don't want to face the reality that it's not the energy companies It's the consumer and they would have to pay a lot more and live in a much smaller house than they want to You know a lot smaller than Al Gore's house And what's out debating the impacts or effects of climate change and what causes them? I just think it's a bad look like Do as I say not as I do if you're gonna talk a green deal then live green so it's just of course to me It seems like hypocrisy, but in politics. What is it? Well, it's not only politics Adam You got all those folks down in the south part of your state in Malibu and everything living right on the beach And those properties are going like wildfire. I'm told by real estate agents So, you know, they're apparently not worried about global joke about the fires No, no joke. It's the truth. No, I mean, you know the average age of these people is is Probably they probably have fewer years ahead of them than they do behind them So you're you're criticizing them for using their their vast wealth to buy homes I'm criticizing them for not doing as they say and as they do. I mean, they're they're just hypocrites They're total. Well, I mean this do they honestly believe that they're convincing anyone with this argument.  Because we can say the same thing about Republicans and how hypocritical they are like Rand Paul denounces Single-payer Medicare for all yet. He flew to Canada to have a surgery. Donald Trump is against immigration But yet his wife is an immigrant. I mean we can go on all day So the hypocritical argument isn't the best thing to trot out if you're a Republican because they are the embodiment of hypocrisy, but nonetheless They made the argument. So let's address it Quote if you sit them down over a beer or wine I guarantee that they don't care about climate change. What they do care about is getting elected now This is true about pretty much 99.9% of politicians and I'll grant you that maybe this is the case for Joe Biden I don't think he cares at all about climate change. He just doesn't right? He just wants to get elected He wants power, but when it comes to Bernie Sanders and even Elizabeth Warren, they care about climate change I genuinely believe that they actually do Want to fix the planet. They want to make sure that our planet is habitable for future generations I Mean if you go back and look at Bernie Sanders record He was talking about a climate change in the 1980s when nobody else was talking about it He was educating children in classrooms about climate change There was nothing to be won politically for him back then. He wasn't going to run for president back then If he had ambitions for a higher office, don't you think he would have ran for office, you know in the 1990s?  Nobody cares about policy, but there are people on the left who do care about policy We know Bernie Sanders means what he says and Americans don't agree with you Hence why they view him as not only the most popular politician, but the most trustworthy according to some polls Now he also says if you sat them down and asked them what causes climate change and what we can do They don't have an answer want to know why because scientists don't have an answer.   In fact, let's extend that to Joe Biden even where does Joe Biden say? He wants to eliminate cars and cows. Is there any Democrat in office who says we should eliminate cars and cows now?  They took that literally now what AOC's office said was since we can't eliminate Farting cows and airplanes. We have to do these things cut emissions in other areas to get to net zero So even in the joke that they put out They weren't even saying we should eliminate cows, but what did they take away from that? They want to eliminate hamburgers. They want to get rid of cows. They want to ban airplanes all they have are lies They have to be disingenuous because they know that we have the winning argument They know that the green new deal polls very well So that's why the only way that they argue against us is by lying and strawmanning us now another panelist fear mongered about how climate change mitigation would ultimately affect consumers because if you crack down on large multinational corporations with additional taxes and regulations Then they're just gonna pass that cost off on to consumers and he clearly hasn't been listening to any of the solutions That are being proposed because what is the green new deal doing? It is trying to make us a global leader in Green clean renewable technology. That means we invest in win solar Hydra we stopped these subsidies to fossil fuel companies and rather than just allowing China to become a global leader We become the global leader in green technology, which is the future like it or not But then one panelist times and it said if you're gonna talk green new deal then live green This is such a convenient argument to make because they say it and they don't expect us to push back And I get that right because this is kind of difficult to push back against because it just it makes sense Right. Oh, of course if you're gonna talk the talk then of course you should walk the walk I get that the problem with this argument is that it's overly simplistic. It's a gross oversimplification because What's the thing about capitalism? There is no ethical consumption under capitalism and even if all of us as human beings We all cut our carbon footprint to zero and I'm not talking net zero. I'm talking zero. We stop emitting greenhouse gas emissions We're not gonna solve this climate crisis because again 100 corporations are responsible for 70% of global greenhouse gas emissions So this is an issue that cannot be solved at the individual level. This requires governance This is a wicked problem that Governments have to solve because it requires power and authority human beings have no control over taxation and regulation Hence why we need governments to take action Hence why we are directing our pressure at governments worldwide because they're the ones who can save the planet But I mean this is Fox News. It's almost Like it feels counterproductive to even try to respond to their criticisms as if I'm gonna persuade them because Fox News viewers they've already drunk in the Kool-Aid so they're just gonna hear this and it's gonna be music to their ears They're preaching to the choir But this disinformation it really is problematic because we have 11 years left to act and there's zero sense of urgency from mainstream media Fox News is still not even really accepting the reality of anthropogenic climate change And it's just it's frustrating at this point These people are a threat to the planet because if you are not with us You're against us because we need all hands on deck and for you to still Be at this area where you are denying climate change. I mean, what are you doing? We are witnessing a mass extinction event Oceans are heating up coral reefs are dying the ice caps are melting Wildfires are ravaging California Hurricanes are getting more common and they're becoming more intense and you're still Plugging your ears and closing your eyes and pretending like there's no problem. I Mean at what point do they ever admit that they're wrong? I don't think they ever will because these people are not normal They're psychopaths and they're liars and they care more about the industries that they represent Then you know actually saving the planet that we live on bad news for you without a planet that's habitable None of the interests that you represent that you show for are going to be able to exist They all go out of business because no planet means no economy. No economy means no corporations can exist Now the problem with that argument is that they don't care because they're all old and it's gonna be too late when they realize What's its date? So all around it's just sad. It's what we expect from Fox News But it's certainly it's something that I still feel as if we need to call out whenever we see it because this is harmful this is literally fake news and It's just it's really it's a threat. I'll put it that way.


All right. Hello, everybody. We're going to go ahead and get started. I'm Atlas, not the cool guy from CTF, much lamer than him. So if you missed his talk, I apologize. It was pretty good. And I'd also like to tell everybody I'm really sorry that you couldn't get into Dan Kaminsky's talk, but we'll try to be pretty good, too. We're Chaos Theory. We're Chaos Theory because Shmoo Group was already taken up here on stage with me. We have Dr. Chaos. We have Beth, a little bit out of order on our slide here. We have Fade right here, Digunix and Archon. Also joining us out in the audience there is one of my collaborators, Johnner and Paul Sasquatch, in case you're wondering. Today's special is what are we serving up for you? We've got two projects. First one, what I'm going to be talking a little bit about here is NARC. The whole idea here is we're going to transform the output of your scan data. We're not going to recreate scans. We're not going to be doing scans. We're not sniffing. Instead, we're going to take the output. In this case, we've got Nessus. We're hopefully going to have in-matte for you by the end of the week. The XML, parsing and data normalization, we'll get to that. But tools to produce quantifiable, meaningful, and some hot-looking results. SAMIL, up next, sort of the natural evolution of the product that we released at ShmooCon, which is anonymous. This is a black box gateway. We'll create a secure, anonymizing, transparent firewall. Maybe when you're behind it, nobody will notice all the nasty things you like to do online. So, diving right in with NARC. First of all, I represent only myself. I'm a little bit irresponsible, so I can't take on anything else. So, yeah, work likes this one. Why do we do this? Well, started off a pen test a few months back and was supposed to have about 4,000 hosts involved, normal amount of data. Instead, it ended up being about 92,000. So, a little bit of scope creep and a lot of data to try and analyze. If you guys are familiar, Excel cuts off after 65,000 rows. So, you have to start doing something a little bit more creative in terms of pulling out what you're looking at. What else do we want to do? We wanted to be able to do a little bit of trending and vulnerability analysis quickly. I don't know how many of you work in consulting, pen testing, vulnerability analysis, but very rarely does a client come back and say, you guys just, you don't cost enough. We really wish that you would spend two or three more weeks going through this data. So, we wanted to try and cut down the time there and produce some pretty nice results in terms of reporting format. So, a little bit about security reporting. The things that don't work. Selling on FUD, I think we all know this at this point, but you know, you can't go in and say, oh, we're going to get hacked. Most people don't really respond well to that.  Hey, here's 10,000 pages of results that we got out of a scan tool. Mr. VP, please give me some more money. They rarely like that one. Oversimplification. If you're talking to the guy that is in charge of fixing this stuff, you don't want to say, hey, it's good. It's bad.  So what do you got to do here? You got to report to multiple levels. You have your network engineer. He wants some details. He wants remediation steps. He wants something that he can hang his hat on so when he goes and does this thing and there's still a problem later on, he's not getting canned.  You guys are probably familiar with this. As you move up the chain a little bit, you have to start summarizing a little bit more. You have to start taking out some of those complicated and hard words like protocol and port. As you go up even further, what you have to start talking about is a thumbs up, thumbs down kind of view. Hey, information security? We're good. No, we're not so good. So what are we going to do to make security reporting better? Well, number one, we need to rely on objective and quantitative data because when you're going in and you're trying to, again, when you're trying to push an information security program from the standpoint of we want to remediate these vulnerabilities, we want to protect these hosts and we have this data that is of this value. You need to do that in a numerically sound and mathematical way, not in the, well, I kind of feel like this host is important and let's spend a little bit of money. We also want some correlated data. You know, you want average number of vulnerabilities by platform. If you're going to decide to move platforms in the future, you may want to have a test program. You may want to see, hey, we're spending half of our time patching Windows boxes. I don't know why that one would come to mind. Maybe we should move to something that doesn't have, you know, Super Tuesday. So what have we got for you here? We're going to have, as I mentioned, we're going to have some import scripts for a few other tools right now. We're able to pull in anything that can output into SQL. And in this case, we've got an SSWX scripts that we can show you. Some canned queries to show you, you know, what type of things you should be looking at. And of course, pretty colors and some really, really slow JavaScript. So if anybody would like to see me after, to help me out with that, that'd be awesome. So, let me see here. I'll switch over. This is our tool. We're going to go ahead and import some data. This data is a result of a quick little scan of the Aladdin this morning. So anybody who's staying there, I apologize. Let's come back around. We're going to run a report. We have a few canned CSS styles here and you can, of course, modify those to match any color schemes that you want and any sort of image replacement. Uh-oh. I'm sorry, say again? You know, it came down at the very last minute and it was the one that had to go.  So go ahead and grab Citrus, because what style would be complete without one called Citrus? We want to see, let's take a look at everything for any database, because surprisingly there were a few. So here we go. You have a couple of Postgres vulnerabilities. This was, of course, as you'll notice, this was the router, so happily provided by Cox. And then underneath, apparently a client with MySQL running. It's probably MyBox, who knows, right? So you can sort these also. And this is, as I alluded to, the slow running JavaScript. You can sort by, in this case, you know, we only have two criticalities. You can sort by the description, or by the scan date, and in this case, all of the data came from one date. But it'd be fairly simple to correlate between them. Alrighty. So that's the basics. Again, basic stuff right now. Launch back in. As we move forward, what are we working on and what do we have? We have, first of all, some of my development team helped me out with this. It was on PHP 4. We're releasing on PHP 5, so that caused a lot of fun last night. That's why some of these things aren't there right now. For instance, some of the AJAX got pushed off the page. What we're looking at doing is fully customizable queries, where it will provide you a Google Suggest interface. So as you're typing in, it'll go ahead and populate and say, oh, by the way, you know, you've got these other weirdo services that are going to drop down. Extensible import framework. This is a big one. This is one that has given us fits, and we really haven't found anybody we could steal the code from, which was really sad. But data import from XML into SQL statement is kind of a pain based on the hierarchical structure and the data normalization that's required there. If anybody has any experience with that, again, I'd love to hear from you afterwards. We have something that we think, probably by the end of the week, we'll have something out where we can go ahead and pull in your results from NMAP or any other XML tool. Ultimately, what we'd like to have is a web-based front-end for graphically creating regular expressions to parse any sort of tool that you can get data out of. So if you've got a scan tool that, say, does your application layer, but only reports into HTML or only reports into PDF, go ahead and be able to parse that out and, based on regular expressions within the file, pull in the data that we want and then cross-correlate it to your platform vulnerabilities or your operating system identification or your banner grabs, anything like that, and then be able to quickly sort through and limit that data down. So after that, we move right along to SAMIL and Dr. Chaos. Thank you very much, Alice. All right. So without further ado, we will jump into SAMIL, which is our new Secure Anonymizing Megalomaniacal Autonomous Encrypting Legs. Ba-ba-ba-ba-ba. So what I'm going to do I'm going to talk a little bit about the history behind SAMIL. We're going to talk about motivations, why we built it. We'll talk about what it does, how it works, and then show you, as well, a live demo of SAMIL. In the process, we're also going to expose you to Chaos Theory's internal software development life cycle. This begins with phase one, what we call the enthusiasm phase. A little bit of history here. First of all, in earlier this year, we actually introduced AnonymOS and show of hands how many here saw our presentation at Shmukan. A moderate number of hands. How many here have used AnonymOS? Not bad. So, all right. January, we introduced AnonymOS. Our first public release, we believe it's the world's coolest OpenBSD live CD. And then in April, we went to layer one. The intention was to either release a maintenance build or documentation. We opted for documentation. So we exposed the build process for putting together your own AnonymOS. AnonymOS was cool. However, this is DEF CON. And DEF CON goers demand more. We don't do zero days. Therefore, what we brought instead was SAMIL. I'm going to turn the mic over immediately here to Beth, and I'm going to let her talk a little bit about why we did what we did, and why we go through the trouble of building tools to provide anonymity. Tools like AnonymOS, tools like SAMIL. So, with that, I will turn over the mic to Beth. Okay. What motivates us? Well, unfortunately, in today's climate, there's plenty to motivate us. All your base are belong to the NSAT&T, anyone? Internet-facing, small businesses need anonymity and security, but that's pretty hard for them to achieve. And online marketing, profiling, tracking data, they have it. Did they ask for it? I don't know. Okay, for those of you who don't pay attention to current events, I'm just going to go through a brief rundown. I'm going to be a... Suck! Oh, excuse me. She got finger-happy. I do. I got very happy fingers. Did any of you give your permission for your phone company to turn over your records to anyone? Nope. Oh. Why not? Gee. Weirdos. Yeah. Well, you and I are not the only ones who didn't know about this. No judges knew about this either. So, although this doesn't really relate to a secure anonymizing gateway per se, it gives me the idea that maybe there's other things that you, me, and judges don't know about. And this guy. If you don't know who this guy is, this is our attorney general. And he is the one who refers to the Geneva Conventions as quaint. I guess it's his turn to try and figure out a good way to make such data collection legal. And he does a pretty good job. He throws around a lot of words like reasonable. Everybody wants to be reasonable. And a couple of, we have to protect the children's. And that always works. And it works on the legislature. Apparently, a legislative champion was found almost immediately. Mr. Jett of Colorado did this nice piece of legislation, which requires your ISP to keep your identifying data as a subscriber for at least one year after you cease to be their customer. Between me and my ISP, we don't think that's very reasonable. The FBI wants to get in on the act. The FBI legislating? Yes, they draft legislation. Although that's not their gig, they had to find a proxy, Senator Mike DeWine from Ohio. Anybody from Ohio? Did you vote? Did you vote for a senator? If you didn't, now's the time to start doing your research. Yeah, the FBI just isn't interested in retention, though. The FBI wants to have ISPs give them real-time access to the network created by ISPs. And they also want manufacturers of net gear to build in backdoors for them. The last time I heard about a piece of legislation that made my life easier or forced industry to do something that helped me to get my job done, I don't know, I'm not that young, but I still can't remember one. So the FBI must have a lot of pull there. And, of course, it's not just here in the States. Europe, the great bastion of privacy is also caving to the pressure. And then there's marketing. That, I think, is the next frontier for data mining for the government and other people that we don't really want to have our information. Marketing information. They know where you're going online, what you're buying, they know what you're searching for, what you're curious about, and who you are. They all say that they don't correlate this information and keep identifying info together with aggregate info about anonymous browsing. I don't know if that's really the case all the time. They have all the info, they store it, and it can be mined by marketers. It's sold to the highest bidder, and ultimately it can be subpoenaed by your government. Geolocation is also very interesting with wireless, mini wireless networks. They can now actually market to you based on where you're physically standing.  If you're not by Fishman's Wharf or you're in Chinatown, you know, they'll give you ads for something else. But they know where you're standing, not just what you're looking up on the net, not just what you bought three years ago. It's all information that they have, and they store onto the underworld. I love this Fox News headline, cybercrime, more widespread, skillful, and dangerous than ever. It's like new improved cybercrime with fresh clean scent. And they're right, it is improved because now they're organized. Speaking of organized crime, card cartels, mafia, everybody likes to talk about the Russian mafia. And the bottom line is they're commoditizing hacking. There's always been a little bit of that, but now it's on a broader scale. And it's continuing to evolve with our defenses and our technology evolution. And there's that old Chinese curse, I think, I hope you live in interesting times. For the commoditizing of hacking, I think the next 10 years will be very interesting times. Is it hopeless? Absolutely not. There's great folks like the EFF who are ever vigilant and actually looking out for your interests and my interests. You know, they could give a good lesson to our public servants. And they're not alone. They're not the only group. There's tons of them out there, here in the states, online, broad groups, country-specific groups. If you look for them, you'll find them and they're all doing really good work and you should support them. There's also alternatives to the status quo. They've been around for a long time. They're not new, anonymous e-mailers, tools like we're incorporating in our secure anonymizing, encrypting Linux. You know, if you haven't heard of an anonymous e-mailer, by the way, if you're that young, go ahead, find out about them and build something better. The alternatives are out there and it's worth it to check them out. Oh, I like this, too. The reason why Google Analytics, for example, has two different privacy policies, one for Europe and one for the United States is because in Europe, they elected representatives who looked after their interests. And California is very smart, as well, because they're doing similar things and we could all learn a lesson from them. This one's so good, I'm just going to read it straight to you. This is in addition to the California State Constitution with explicit privacy language. They quoted someone here, the right of privacy is the right to be left alone. I believe that was Brandis. It is a fundamental and compelling interest. It protects our homes, our families, our thoughts, our emotions, our expressions, our personalities, our freedom of communion and our freedom to associate with the people that we choose. It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes or to embarrass us. I think they got it right. I'm going to turn it over to Dr. Chaos. Okay, so this begins, Chaos Theory, Software Development, Lifecycle Phase 2. This is what we call Disillusionment.  Now we've got to go out and fix it. What are we going to do? Here began the design goals. Here's where we started with SAMIL. We had a lot of ideas and a lot of these ideas come straight from what we did with anonymous. We got a lot of requests after folks got anonymous in their hands and they started using it. One of the biggest requests we got was, hey, how can I run this in a context where I can have machines behind my anonymous box and be seeing the internet anonymously. So this is what we set out to build. So the drawing board, again, as per anonymous, our first incarnation, we wanted to design a system that was secure from the ground up. Again, if the box itself is not inherently secure, it's going to be hard to remain anonymous when people are rooting your box. We also want transparent anonymity and transparency is key here because we want ease of use. Although SAMIL may not be something your grandmother is going to use, we'd like to know that, hey, anybody who wants to can power up a box, pop in the CD, boot up, and essentially have the ability to hide what they're doing from anybody they don't feel should be privy to it. With that, we set out to architect this solution. Now, many of you may know we built Anonymous on OpenBSD. There were a couple of reasons we opted not to go OpenBSD for SAMIL. One of the most important reasons had to do with the final bullet point here. We wanted to make sure that we did not continue to put a significant burden on the tour network. We released Anonymous in January. We honestly expected, hey, we're going to have a couple hundred people in the room if everybody tells three friends. We'll get, I don't know, 1,000 and 1,500 downloads shortly after we release. Within two to three days, I think within two days we were up to 170,000 downloads of Anonymous, and we're currently sitting at around 300,000 downloads. Now, I don't know how many people are actually out there using Anonymous on a day-to-day basis, but the bottom line is giving that many people access to the tour onion routing network without requiring them to operate tour servers potentially creates a problem. So we said, hey, if we're going to do this and we're going to do it right, we need to run a tour server as well. This was one of the primary justifications in using Linux, specifically Gen2 Linux, in that OpenBSD has issues that essentially prevent us from really operating a tour server in the manner we'd want to. And I'll be happy to provide more information and links as to why towards the end of the presentation. So, here's what we did. We said, hey, we're going to take a Linux box and a little bit of IP tables and net filter magic. We decided we wanted to use Squid for local caching. Those of you that have used tour know that it is not always the fastest means to browse, check your mail and chat with your friends. We're using Privoxy primarily for business in depth. Privoxy and tour really gained a relationship because of tools that leaked DNS requests. We don't or won't have that problem in SAMIL because of the design of the OS, but nonetheless Privoxy provides a few things that we wouldn't otherwise get if we weren't using it. And again, I'll go into more detail shortly. We're using a tool called TransproxyTour. We actually started with a tool called Transsox and after a little bit of testing opted to go with a newer albeit slightly lesser tested tool, TransproxyTour which is handling essentially transparently anonymizing or more appropriately transparently socksifying all of the traffic that would not normally go through our tour socks proxy. Tour again is providing all of our anonymity and encryption and I should be careful in saying this although traffic is encrypted between tour nodes this does not necessarily mean that all of your traffic which might normally be in the clear is going to be safe from prying eyes on the local side as well as on the far remote side if you're running clear text traffic it's still clear text traffic but the traffic is at least encrypted amongst tour nodes and again we opted to start a tour server automatically. So here begins phase 3 Phase 3 of the software development life cycle of chaos theory is panic.  So here's what we did. I'm going to go into a little bit of detail here and then I'm going to let one of my other guys give you a little bit more detail about how we made all this work but the 50,000 foot overview we opted to use Gen2 as a base. Most of us use Gen2 on the Linux boxes we have in our own networks it is an excellent base it's highly customizable because it is based on source or because it is built from source it tends to provide higher performance than we might get out of a stock binary build it's easily maintainable and most of us are pretty big fans of the portage package management system show of hands. Gen2 users in the audience alright so again there are issues with running tour servers on either open BSD or versions of free BSD we eliminated our tour server issues. In theory it should work on Intel Max although I will be honest and tell you up front we have not really done any testing here so this certainly deserves a little bit more examination. This also means it's easy to install on your local hard drive USB stick, compact flash or really whatever you want. Again with Anonymous we didn't provide a mechanism for installing it to your own box automatically we wanted to overcome that with Samuel. Again we use IP tables and net filter default firewalling mechanisms in Linux this provides not only our firewall functionality again bearing in mind that this is an anonymizing gateway it's potentially going to sit at the front of your network in front of all of the other devices so it needs to function like any other good solid enterprise firewall would so we're handling firewalling functionality we're also using net filter to force traffic into our transparent proxies or into our soxifying proxies. In this case we're doing it with essentially three components, squid you'll see more in a moment DNS proxy tour and trans proxy tour and finally net filter is widely used and understood it's also easy to customize extend or update so you can take our rules and play with them to your hearts content add remove delete as you see fit squid there was a little bit of an internal debate about using squid and we decided to go ahead and do it because the bottom line you don't want it you can turn it off. Squid does provide transparent web proxying that's the first piece so that's nice we don't have to worry about configuring any of the clients behind SAMIL we want to plug them into the network let them get an IP and go about their business without having to set browser proxy settings or sox proxies and their game clients etc so we get transparent proxying through squid we also get caching both good and bad from a performance perspective caching is good how much it will help with your browsing really depends on your individual network and what your users are doing however in addition to improving performance it also stands to reduce overall anonymity because there is no anonymity when we are retaining cached data locally the SAMIL box itself will potentially become a source of information about what your users are doing you might want to consider turning off the cache turning down the cache or disabling squid entirely if this concerns you and essentially system will work perfectly without squid if you disable it and then modify your firewall rules appropriately so firewall is not trying to force traffic into it from here privoxy privoxy is an only but a goodie again is really more defense in depth than anything else designed to or not designed implemented in conjunction with tour to overcome limitations old versions of firefox other tools that leak DNS requests however even though in our case we are manually grabbing all of the DNS and ensuring it goes out the right place there are a few things that privoxy provided albeit squid could provide them on its own privoxy does a pretty good job out of the box at doing things like hiding personal browser settings hiding browsing history stopping referrers trade changing user agents so we kept privoxy in the chain and as well it also blocks ads web bugs and other tracking mechanisms that Beth was talking about marketers and data collection so again privoxy is there the system will work perfectly fine without it so long as you modify your firewall rules by default the chain will include both squid and privoxy from there we go to trans proxy tour trans proxy tour again is the tool that we decided to use as an alternative to transox trans proxy tour is a bit of a newer development it has a few potential advantages and a few differences in the way it's written the way it works primarily it number one it's written in pearl number two it has multiplexed IO so we should potentially see some performance improvements using trans proxy tour instead of transox ultimately though what trans proxy tour does is it takes information that is not designed to go through a sox proxy it soxifies it and hands it off to tour so the tour is going to be able to take it and anonymize it appropriately the other cool thing about trans proxy tour is that it works in both linux and bsd so the way we look at it is for future iterations of either sam yl or anonymous we have a single component that will allow us to transparently anonymize without going through some of the machinations that we went through anonymous to accomplish that goal and of course tour I am not going to go into significant detail on tour mainly because we've done it before we're on a limited timeline and I expect that most of you know and understand what tour does at least at a basic level how it works tour essentially provides ubiquitous anonymity for any soxified service and again hence our use of trans proxy tour to ensure that services that don't recognize sox are still going to be able to pass through the tour proxy without knowledge of the way it works bear in mind that tour is a tool that is useful both for personal privacy we're trying to protect ourselves against nasty legislation that's going to allow people to collect all of our personal data and sell it to marketing agencies or give it to government agencies that might think you're a terrorist because you come to DEF CON but bear in mind it's also very useful to those same agencies when FBI is out trying to investigate child porn it's pretty important in fact it's pretty critical that they can do so without you know a lab full of guys coming from an FBI.gov address granted there are other means and mechanisms by which to investigate things like child porn and gain some level of anonymity but the bottom line is this provides all of us all of the good guys so to speak with a means for anonymity that we haven't really otherwise had that is essentially the list of components that make up SAMIEL in terms of what it does with that I am going to turn this over and pass the mic to ARKON.