What's up, Navigation Traders? In this video, I want to talk to you about one of our preferred brokers, TastyWorks, and talk about their low commission rates. So if you go to navigationtrading.com slash TastyWorks, we have everything set up here. So if you're interested in opening an account, you can simply click open an account and that goes to the page. It takes about three minutes to open an account. They've made it very seamless and very easy to do by using our link that actually helps us, our status with them, we're trying to get our indicators built on their platform. So the more people they can see coming from navigation trading, that'll definitely help our cause in that situation and it'll get those indicators on their platform out to our members quicker. So any assistance there will be definitely much appreciated. But the key thing I want to talk about today is their commissions. So they have on options on stocks, it's a dollar per contract to open the trade and zero to close. On stocks, it's $5 flat fee to open a stock trade and zero commissions to close. Options on futures, $2.50 to open, zero to close. And if you're trading futures outright, it's $1.25 per side. So the commission rates are super, super competitive. They've kind of taken the industry by storm and a lot of these brokers are lowering their commissions just to stay even relevant when it comes to commissions. So I want to show you a couple things in addition to just the closing commissions. If you go to the pricing page on TastyWorks website, the same information I just showed you there, but the other thing they have is what they call capped commissions. And so starting this year in 2018, they are capping all commissions to $10 per leg. So regardless of the number of contracts that you trade, they are capping it at $10 per leg. So a leg is considered, if you do one put or one call, that's considered a single leg. And so if you did even 100 of those, you're only paying $10 in commissions. That's the cap on the commission rate. So not only is it super cheap to get in and zero to close, but they're actually capping it for those who trade larger contracts. If you're looking at verticals, so that's considered two legs, right? You're buying and selling a leg in the same spread. If you do 100 of those, you're looking at a total of a $20 commission. That's ridiculously low. And then iron condors, those are considered four leg spreads because you're selling two options and buying two options for the wings. So if you're trading 100 iron condors, for example, that's just a $40 commission, so ridiculously low. And then if you scroll down, you can get an idea of what this looks like on different puts or calls. So single legs, on verticals, on iron condors to give you an idea of what your total commission is. So if you trade one lot, it's going to show you what your total commission would be and then compare that to the top brokers out there, okay? If you're trading 10 lots and you're doing just puts or calls, 20 total contracts, for example, on this $12 commission, if you compare that to these other brokers, significantly less, half as much in a lot of cases, 10 vertical spreads. This is where it starts getting even more interesting. You've got $24 for a 10 lot and compared to the other brokers. And then iron condors, $48 compared to much higher commissions from some of these other brokers. And it gets even better the more contracts that you continue to trade.  So it's just a really powerful, powerful way to trade knowing that you're keeping more of your profit in your account, you're paying less in commission to your broker. It's a pretty amazing thing that they're doing.  One of the tools that we have for you is this broker commission comparison tool. So if you just click on that button, it's going to pop up a spreadsheet that we created to really nail down what you're paying in commissions per year and how that could compare if you utilize Tasty Works, where you can compare two brokers, one next to another. It doesn't even have to be Tasty Works. But let's walk through an example here. Some brokers charge in addition to that per contract rate, they charge a ticket charge. So a pretty common one is about $10, $9.99. Let's look at a per contract commission of, let's say $1.50, which is pretty common as far as a per contract fee for trading options. There's another minimum charge. If there's one in there, additional fees, these are kind of your exchange fees and things. So you have to check exactly what those are, but let's just say, I'm just throwing out pennies here because that's typically what they are. And then you can choose, is it free to close the position? We'll say broker number one is false. You do have to pay that same per contract commission both to open and close, so we'll call that false. Broker number two, we're looking at potentially like Tasty Works, $1 per contract is the commission, but it's free to close, so we'll choose true there. We can look at the exercise and assignment fees. Some brokers, it's around $30. We'll choose $5, which is what Tasty Works currently charges. On stocks, we can look at flat commission rates. Let's just change these two. A lot of these brokers came down to $7. Tasty Works is charging $5. No per share commissions in this case. Some brokers charge a per share. Free to close the commission. Broker number one, we'll say false. Broker number two, we'll say true. And then you can put in your details as far as how many trades you make per year. Let's just set that at $1,000. So entering a trade and closing a trade, that's considered two trades, so I made a little note down here about that just to get an idea. And then with an iron condor, for example, it's four legs, so that's four contracts per trade. So just to give you an idea of what we're looking at here. So let's say we made 1,000 option trades per year, we made 50 stock trades per year, average shares per trade on stocks was 100 shares, number of assignments or exercise per year, let's say five. We don't exercise or get assigned very often, so I kept that number pretty minimal. Let's say your account value is $100,000. So if you just, all you got to do is fill in the green cells here and that populates the details out here, what we call the output. So this is all the details in a table format or you can, if you're a visual person, you can look at the graph right next to it and get an idea of, okay, if you're trading with broker number one, assuming all these inputs that you put into the green cells up here are true, then you're going to see that if trading with broker number one, over the course of a year, you're going to spend $16,800. With broker number two, with the inputs that we put here, you're spending a total commission over the course of a year of less than $3,000. So I mean, that just paints the picture to show you the difference between the amount of commission you're paying can vary widely between brokers and the fact that TastyWorks has come out with this incredible commission rate. You want to take advantage if you at all possibly can. And so just go to navigationtrading.com forward slash TastyWorks. Click on open an account, you can open that, play around with it, get an idea.  It's actually the easiest trading platform I've ever seen. So for newer traders, it's so simple to use. For advanced traders, you have all the capabilities you need. Really excited about this platform. They're still building out some functionality, so it's going to continue to get better. So hope this two cents on TastyWorks was helpful. If you have any questions, let us know. Talk to you next time.


As you can see, this is all the stuff that's going to the trash. They did ask us to remove the air purifiers as the new homeowners were concerned. There might be stuff in the air purifiers as well. So the air purifier, the mattresses will go to the regular dump. That bio will get added to another bio bin like this. It will be picked up and sent to be incinerated. So as you can see, we cut out some carpet in there. We had some bio underneath it. We use an indicator and make sure it's gone. Just label it Part A and Part B with the cleaners to get the blood broke up and out of the concrete itself. We're going to clean up everything out there. We'll put this in the truck to haul it back to the office. We'll put this in a dump trailer to haul it to the dump. And then we're going to fog inside the bedroom with the disinfectant to get rid of any remaining odor.


everything just slowed down. But Daily Tech News Show will continue to be here Monday through Friday, helping you understand how technology is affected and how technology can affect you. Today we're going to talk about how 3D printer enthusiasts are rallying to help hospitals pour over those new Xbox One Series X specs and help Allison share it and deal with her Android support frustrations. We're here for you and for Allison. DTNS starts now. This is the Daily Tech News for Monday, March 16, 2020 in Los Angeles. I'm Tom Merritt. And from Studio Redwood, I'm Sarah Lane. And this is Allison Sheridan from the Podfeat podcast. And I'm the show's producer, Roger Shane. Ah, we were just talking about frozen food and the best preparations for keeping yourself entertained during some semi-isolation. Folks, it's a good time to hang out with us on Good Day Internet. Become a member at patreon.com slash DTNS. Let's start with a few tech things you should know. Microsoft sent out an invite for a digital announcement at 9 a.m. 8 a.m. rather Pacific Monday, March 30. Microsoft says it will focus on productivity across work, life, and family. You could probably expect new Office 365 and Microsoft 365 announcements, but probably no hardware. The intercept sources say TikTok moderation guidelines blocked posts from the Your Feed section of the app based on physical appearance and environmental factors, ended live streams that carried political content and suspended and banned users. TikTok says the policies are either no longer in place or were never in effect. Bloomberg sources say the U.S. Health and Human Services Department suffered what was probably a denial of service attack Sunday night. It was reportedly slowing down things on the network there, or at least designed to slow the agency's systems down, but it did not appear to do so in a meaningful way. Data isn't thought to have been lost or exfiltrated in any way, and it's unknown what caused it. Alphabet's verily subsidiary launched its pilot COVID-19 screening and testing website on Sunday night. After completing a screener survey, the site can direct people to available mobile testing facilities based on capacity in San Mateo and Santa Clara counties in California. The site appeared to reach testing capacity by late Monday morning. All right, let's talk a little bit more about some breaking news that happened just about an hour ago, and fulfilling a wish that I made on the show on Friday, Sarah. Yeah, Universal Pictures will make its movies available on home entertainment the same day as they hit theaters. The change will begin with Troll's World Tour on April 10th, and films currently released in theaters like The Invisible Man, The Hunt and Emma by the Studio will also be available for digital rental as early as this Friday for a 48-hour rental period at a suggested retail price of $19.99. And you said it was wild speculation on cord killers, Tom, when AMC, when you were talking about AMC with Brian, or not with Brian. Yep, no, it was with Bryce, actually. Yeah, you're right. It was not the theaters that did this, though. It's the studio. And the thing that changed between cord killers last Monday and this day, this Monday a week later, is a lot of the theaters are not open. There's no chance for them to have anybody in the theater to see these movies. And I think that takes away some leverage if the studio's like, look, if you can't even be there to show the film, you can't really hold us to a 90-day exclusive. Yeah, yeah, that's a really good point. I am really surprised at the retail price of $19.99 because a first-run movie is, what, like $16 at a lame theater here? So $19.99 when you can share it, that's pretty good. I don't know what the average movie price. Average movie theater. I think it's like $3 in Ohio. Good price. You say that, but everyone in Ohio just rolled their eyes at you because they outdo it. Rob Dunwood is always talking about going to the matinee and paying like $3, and it's like the matinee is $16. I don't know what kind of matinee is he? Lucky Rob has near him. I haven't seen anything at that price in quite some time. But yeah, I mean, this is the sort of thing where a large studio like Universal, there's not much choice. You realize people are stuck at home. This is something that they will welcome. You're going to get a lot of people who do pay the $20, especially if there's a whole family because like you said, all of a sudden you're saving a lot of money that way, and it can be a great experience and you're just staying safe at the same time trying to recoup some lost costs otherwise. Average cost of a movie ticket in the United States in 2019 was $9.26 according to the National Association of Theater Owners. So this is only double that? So this is basically assuming like, man, you and one other person, which is probably on average about right. Even if you have kids, they're probably not all going to watch the same thing as you unless it's a family movie like Frozen 2 getting put out early this week by Disney on Disney Plus. A lot of families watching that, but on average it might just be one or two people watching these things depending. Very curious what we learned from this. Very curious. Microsoft revealed the full specs of the upcoming Xbox Series X. We already knew it would include a custom AMD APU based on the Zen 2 architecture with that custom solid state drive. Microsoft now revealed the APU will offer eight CPU cores clocked at 3.8 gigahertz with an AMD RDNA2 GPU using 52 compute units, 16 gigabytes of GDDR RAM and a one terabyte NVMe solid state drive. Storage can be expanded by one terabyte expansion cards on the back with also support for USB 3.2 external drives. The disk drive is a 4K Blu-ray. That's the optical drive. Microsoft previously discussed the load time benefits of its custom SSD, but it detailed the Xbox velocity architecture, which lets developers dynamically load large environments from the drive into memory. Microsoft says it's targeting performance at 4K 60 frames per second, but it will be able to support up to 8K and 120 frames per second for some games. All of this sounds so great. My only question is cool for all of this. What will they cost? I think that's a lot of other people's questions as well. It is. It is a big question, because obviously consoles are generally loss leaders.  You charge other studios a little bit to make develop for your platform. And of course they all have their in-house studios that they can make even more off of. With this level of spec, at least right now, we're talking about a fairly expensive piece of hardware. So how far down can they push the margin? How much can they optimize the supply chain with bulk buying and all of that? Because they're going to make a lot of these. And what is that price point going to come in at? Was it really necessary to go to NVMe for the SSD? That seems a lot of people really wanted that. Necessary is a whole different question, right? But a lot of people would have been very upset if it wasn't. They're making people happy with that, for sure. This was not supposed to be the finale, the final announcement of the Xbox Series X. We're still waiting on that around E3 time. Of course, it won't be at E3 this year, but it will be sometime in June that we're expecting to get the full details like date release date. But a lot of that stuff must be up in the air too. I mean, there is a date they probably expected and a supply cost that they probably expected. And both of those may have to change just based on the changes to the supply chain, the changes in cost to parts, because all of that stuff is up in the air right now. Well, the French competition authority fined Apple 1.1 billion euros for the anti-competitive practices regarding agreements with wholesalers TechData and Ingram Micro. The ruling found that Apple and the two companies agreed not to compete with each other, that Apple stopped premium resellers from lowering prices and unfairly limited supply to those resellers. TechData and Ingram Micro received fines of 76.1 million euros and 62.9 million euros respectively. The complaint that sparked the probe into Apple's practices came in 2012 from the premium reseller ebizcus.com. Apple plans to appeal the ruling in other shocking news. Yeah, no doubt. Apple, their response was, you know, this is a 10 year old situation based on old rules. We don't do any of these things anymore. And we didn't think they were even wrong when we did them, which is what you would expect. But, you know, Apple is famous for being very restrictive over its retail and service both. And this is about retail, not about service, but they're very, they try to push the law to its limit as what they're allowed to let you do or not do with its stuff. And since we're talking about Apple, I mean, it is Apple, Apple has a lot of money, 1.1 billion euros, not chump change. That's a lot of money. I'm a little bit less familiar with what kind of finances TechData and Ingram Micro have, but to be fined 76 and 62 million euros each for those two companies also a lot, but Apple definitely getting the lion's share of the blame here. Wouldn't you just bother yourselves anyway? No, you know, I tend to definitely support Apple and say, well, they wouldn't do that. But when I think about, would they be likely to do cutthroat procedures to try to get the supply chain to do what they want? Yes, I'm guessing. Probably. With no evidence, I have made that calling. It's possible, yeah. Some news that came in last Friday after we wrapped up the show, Microsoft announced that co-founder Bill Gates is stepping down from its board of directors. Gates plans to spend more time on philanthropic activities and will continue to serve as technology advisor to Microsoft CEO Satya Nadella. Gates had been progressively stepping back from Microsoft for almost two decades now. He served as CEO of the company from its founding in 1975 through 2000, then his board chairman from 2000 to 2014, leaving day-to-day operations at Microsoft back in 2008. Has it been that long? Yeah, we talked about this on Good Day Internet. Did we even get to talk about it on Good Day Internet? I think it happened right after. I think it happened after Good Day Internet. We only talked about it in the Discord, honestly. Maybe that's true. But it's a big deal. Bill Gates not on the board of Microsoft is a different Microsoft. But it's important to note that he's still advising Satya Nadella. Basically what that means is Satya Nadella can call on Bill for the institutional knowledge that only Bill Gates has. He's not stepping back from that. It doesn't mean he's being ousted. It doesn't mean that he's not welcome there anymore or that he's done with it or anything like that. It really does seem to mean that he wants to focus on the Bill and Melinda Gates Foundation on philanthropic works. My suspicion is that with everything that's going on in the world already plus the coronavirus, that he wants to put as much of his effort into making the world better while he can. I think that's commendable if that's the case. Which one would you rather have him work on? Making Windows Neater and Azure really awesome and cool and Microsoft Teams or World Health? It's a tough call. Honestly, he's still able to do some of that stuff as an advisor to Nadella when they need him to. On the board it was more about how can I maximize Microsoft profits? That's my job as a board member. Maybe not the most important thing he can do with that brain. With that money. A hospital in Brescia, Italy ran out of valves needed for respirators that are used to keep patients breathing. Most of these patients, of course, have COVID-19. The original supplier couldn't send new valves quickly enough to replace them. An Italian journalist Nunzia Valini was covering this, so put the hospital in connection with a 3D printing company called Esennova. CEO Christian Fricasi and mechanical engineer Alessandro Romeoli took three hours to design a prototype valve to test. It worked and so because each valve takes about an hour to print, Esennova teamed up with another 3D printer company, a competitor named Lonati, to begin churning out valves for the hospital. They are already in touch with a second hospital that would like to maybe get some valves made for them as well. To encourage similar efforts, a Google sheet has been created called 3D Printer Crowdsourcing for COVID-19 and has been populated with several hundred people's names, email addresses, locations, and design experience around the world to say, hey, you need a 3D printer to make something. I've got one you can use and the design experience says that I might be able to even help with the design or not, depending. Some people are just saying, I've got the printer, I'll print up whatever you give me. Man, this story made me feel so good. The reality of not only medical personnel, but equipment and life-saving material being in short supply is real for a lot of people, in particular parts of the world being heavier hit than others. It'll be in one of those places. The fact that the journalist was like, huh, you know what, my work, and the 3D printing company goes, let's try it. And then a competitor is like, we want to, on the help as well, people working together to literally save lives. So cool. Maybe I'm becoming more jaded, but I want to step back to enthusiasm a little bit that I get worried about the quality control and the materials used, whether they're safe, have they been tested? I mean, I guess a valve that maybe ends up not working, but the next one does, is better than no valves at all. But I just, there's reasons that we have really robust testing processes on medical equipment. So it just left me a little bit trepidatious, but hopefully it's as good as it sounds. And they address that. Both the creators from the ESA NOVA team said, look, this is not something that we wanted to get wrong. This is a clinical issue, so we have to print it in a way that it won't be contaminated, it won't fail. And that's why they made the prototype and brought it to the hospital and had the people trained in that say, will this work? What do we need to change? What do we need to do? This is a, you're not wrong, Allison. This is a tricky piece. It's a 0.8 meter opening on the tube, but it has to be just right. You can't have it fall apart while it's working because it introduced particles. Quality control, very important here. But it sounds like they were aware of that and working with the hospital to make sure that this was a part that was going to work. I think you might have meant 0.8 millimeters. I'm sorry, millimeters. What did I say? Yep. The opening was this big. 0.8 meters would be a lot bigger. Sorry, millimeters. Yeah. It's real tricky, though. I should actually check that and make sure that I'm not getting that wrong, but it was a small opening. That's the point. Yeah. Right, right, right. But cool. People working together, working on problems. Yeah. Very good. It was 0.8M. So very small. Anyway, yeah. To get all the tech headlines each day in about five minutes, don't forget you can still subscribe to dailytechheadlines.com. Let's take a break from the world for a moment and get back to something that makes us all feel like things are normal. Horrible, frustrating tech support issues. Alison, you've been talking on your show and actually talking for a while about using an Android phone, and it's commendable that you, an avowed someone with a little bit of ever so slight Apple bias, is making the effort to use Android so that you expose yourself to it and understand how it works. But your support issue with your latest Android phone seems to have driven you to the edge. Tell us a little bit about it. Well, I've been really trying to be open-minded, and I know I'm not. So I own that, but I try really hard to get past that. And so I bought a Motorola G7, a Moto G7. And what I wanted was an Android phone, the least expensive Android phone I could get that was most likely to still get security updates and to get operating system updates, the new hotness whenever possible. So I went to the SMR podcast Facebook group and said, hey, everybody, this is my requirements. I want some to play with. I do need an Android phone for my Google Fi card in order to be able to tether my Mac when I'm out on travel in other countries. So they said, you know what, this Moto G7 looks pretty good. It was 200 bucks for a 64 gig model, and I got it. And this is actually a really nice phone. I mean, it's really hefty. It's got a nice little fingerprint sensor. The OS is fun to play with. It's fun to learn something new. And then, you know, I have Barbu shots on my show every other week. He does a segment called security bits and he tells us whenever there's a particularly terrifying security flaw in something and it tells you what you can do about it. And he said, okay, well, there's this security update is required for Android. And there's a, I think it's a maliciously crafted PNG file can cause remote code execution, which you don't want. So I went up and I said, okay, let me get the security updates. And it says December 2019, you're up to date. Thumbs up. I was like, well, wait a minute, wait a minute. That's it's March. What about what about January? What about February? What about March? There's been three security patches. So I thought, okay, well, I must be doing some I must not know what I'm doing. I ended up actually wiping the operating system, which is really, really fun and super nerdy.  It's kind of fun. Yeah. Oh, you're actually, yeah. Yeah. It's like a boot ROM. It's really, really fun. So I did all that and I reloaded the OS and everything same thing couldn't get in. So I thought, okay, well, let me just contact Google. I'm retired. I can spend time fooling around with this.  So let's direct you over there. So I get a hold of Google five and Google five says, oh, yeah, well, we can't help you with that. You got to talk to the manufacturer. I thought that Motorola was still owned by Google. What I didn't realize was they'd been bought by Lenovo at the time. A while ago now, yeah. Like five years. Yeah. It's a long time ago. I missed a memo.  Daily tech issues told me about it. So I said, all right, well, you make the operating system, but okay, I'll get a hold of Motorola. So I get a hold of Motorola and they said, yeah, all you have to do is download the Lenovo smart assistant to your PC. And I said, so wait, what? And I go look at it and it's a Windows executable. So she really meant PC. And I was like, I don't have a PC. I have a Mac. And she says, well, this is the only way we can help you. Otherwise talk to Google. And she dropped me. And so I ended up doing some tweeting and I sent, I got a survey on the call, which was really good. Oh, I ended up calling on the phone. That's right. I called Google. I'll get it yet. Motorola on the phone. And I got this guy on the phone who was like super apologetic. He said, we can't get you the update. There's nothing we could do. And I said, well, that's a horrible answer. And he goes, no, no, it's the truth. I said, oh, yeah, I believe it's the truth.  So I got a survey on the call and so I responded to the survey and I did some tweeting and the tweet response was, oh, don't worry, don't worry. All you have to do is download the Lenovo smart assistant to your PC. And I explained that I was on a Mac and they said, and they said, don't worry, you can download it to your Mac. And I said, yes, I can download it. Sure, you can. I can't run it. I've since then gotten a letter from a guy named Joe at Motorola Tech Support because apparently my survey triggered this. And five days ago, four days ago, he said, oh, well, give me a number I can call you. I'm going to help you. And they haven't called yet. I haven't called yet. So this phone is seven months old. And I'm not getting security updates. You bought it seven months ago. Yes. And the latest security update you have is December. And I have a pixel model. I have a pixel for the latest security update on mine is February. So you're two behind. There's there's a March one. March is not on my phone. And I do that on purpose to see like, I'm just going to be an average user. When will that arrive? And that that is not there. I'll just go ahead and test it and see if it's I will add I have a pixel 3a and it automatically updated on March. Okay. So you have the March one. So you're two to three months behind, depending on how you look at it. But the point that I'm trying to get to is that that doesn't matter. You should have had someone tell you like, oh, February is the most recent one you can expect. And then you could say, well, I'm on December. How do I get to February? Or, well, you really should be up to March. Great. How do I get there? And you got none of that, no matter who you talk to. And you got this game of tennis where everybody was bouncing you around from somebody to another. They did all verify that I should be getting it, though. Yeah. So this wasn't I mean, my previous phone, I actually threw it in the bin, as Bart said, because it wasn't getting the security updates. And it wasn't going to anymore. It was a it was a Google. What was it? It was from Google. So I it's not just that it's not coming to my phone. They're telling me I should be getting it and will not cannot help me. This is not a situation of like, oh, she bought a phone near the end of life. Like, your phone should be getting that update. And it's not. And and this is this is the this is the tradeoff, folks. You can you can criticize both Google and Apple for being too controlling. But there is a balance of if they're not controlling enough, then no one takes responsibility. Like someone should be responsible for that update. And if Google takes responsibility for those updates, it also takes a lot of liability on it that they are increasingly being put under investigation for like, why are you the only one who could deliver the update? Which is why, in my opinion, if this was actually shifted back to the open source project, and Google actually let go of some more control instead of trying to live in both worlds, maybe there would be an option for you to be like, oh, there's a there's a vast Android open source project ecosystem that I can take advantage of and get help from. And I'm sure there is. I'm sure there's somebody out there in AOSP who could figure out your your situation. But it's not obvious how to get right. Right. And the title of the article that I wrote on this was I don't understand why anybody chooses an Android phone. But I think I got the answer. Nick had security at an article this week about the number of Android phones that are unpatched right now. And 40% of Android devices as of Google's dashboard in May, and I don't know why they haven't updated that since May, but 40% of Android devices are using Android five through seven. So they're completely unsupported 40%. So the answer of why does anybody who's Android is because they don't know or don't care. That's got to be the answer, right? And and you didn't know you were that far behind on your security updates either because it didn't tell you. No, I'm on March. I'm on March 5th now because Roger prompted me like you really should have the March one. And and I just restarted my phone and it gave it to me. But it again, I shouldn't have had to do that. So part of Motorola's answer was, well, we can't push this out to everybody on the same day. And I was like, sorry, Apple does it all within like the same two or three days, six years back. Yeah, it doesn't have to be on the same day, but maybe the same week wouldn't be asking too much, right? Months later might, you know, and I don't think that were that many Moto G seven sold. Yeah, it would overwhelm the network. So yeah, I'm frustrated. And if anybody knows how to fix it, I would like you to contact me Allison at podfeed.com. Excellent. Well, we don't ever want anyone on our discord to be frustrated, but it is a place where you can connect with others help help you help each other. You can join in the conversation in our discord, which you can join by linking to a Patreon account at patreon.com slash DTNS. All right, let's check in with our amateur traveler Chris Christensen, who has a money saving tip for those probably aren't traveling right now, but those who still might be able to snag a good deal in the future. This is Chris Christensen from amateur traveler with another tech in travel minute. Now I know you're probably not thinking about travel right now unless you're trying to get home. But there are some amazing travel deals out there. For a couple months out, you might actually be able to book something and even have some crazy strange ability to cancel it because the airlines are really hurting right now as well are the hotels and the cruise lines. So if you're thinking that you might want to travel again in the future, you might want to start looking for deals. And I can suggest getting on some of the airline discount newsletters and a couple of the ones that come to mind are daily flight club, Matt's flights and Scott's cheap flights. Search for those, get on their newsletter and see what deals you can find. I'm Chris Christensen from amateur traveler. Yeah, a lot of people aren't going to want to make plans. But if you're like, well, I've got that wedding in July, maybe things will be, you know, looser by then, especially if you can get a fully refundable ticket, which you might be able to get right now, even at a good price. That's something that a few people anyway, maybe not everybody, but a few people might benefit from. And those newsletters sound like good things to be part of anyway. Dave Hamilton just tipped us off that the hotel room that he had booked for CES in 2021, he just went and checked the prices right now.  So it's a good time to do Ray Future. Well, maybe a refundable. I mean, that's the thing, right? It's so uncertain. You just don't know, even if you're like, well, it's far enough in the future. But having a cancellation policy that's more lax can definitely work to your benefit. And while you consider thinking positively in the meantime. Let's check out the mailbag. Okey dokey. Ryan, AKA creative vast arts is offering a way to mitigate some of those uncertain financial times that a lot of folks in our community and elsewhere might be experiencing. Ryan says I'm selling a complete DTNS art bundle on my website, discounted to $25 from the standard 55. What I'd like to do is to use those proceeds earned from each sale to help cover the cost of the DTNS patrons who may be hit financially due to this outbreak. So they won't lose access to GDI and other patron perks that they enjoy today. Once I've reached about 10 sales, I should have enough to help cover 30 people. Watch for an update in Discord for further details. Another reason to get into Discord, good stuff there. I'm thinking that the offer would include enough to do a $2 level for about three months with the prerequisite that you have been supporting DTNS at the $2 or above level for at least six months. That's so nice of Ryan to do. You can help Ryan stay as a patron as well. This is art that he makes on his own. It's cool stuff. He's been working on these sorts of things for a long time. So go check it out, creative vast arts dot com. And if you've been wondering like, geez, economics, not just the virus, but economics are looking shaky. We put a post up at patreon.com slash DTNS just kind of describing like, hey, folks, we understand that you may not be able to continue to support. So I love that Ryan's doing this. That won't work for everybody. But we have free versions of the show available. Many of you are listening to it right now. We stream live at twitch.tv slash good day internet. And there are people who can step up and cover for you. And in fact, a few people have done that already just since I put up that post and said, you know what, I'm going to raise my pledge a little bit because I can pick up the slack for somebody who's having a hard time right now. And I really am very grateful that people have done that. So thank you to them. Also special shout out to patrons at our master and grandmaster levels, including Sonya Vining at Tony Glass and Ruchan Brantley. Also thanks to Alison Sheridan for being our co-host today. Alison, where can people keep up with your latest work? Well, my latest work is always at podfeat.com. And this week I had Dr. Mary Ann Gary on Chichett Across the Pond to talk about the story that Tom and Sarah talked about last week, which was that study that was done to find out whether language learning had more to do with aptitude and learning to program than numeracy. And so the two of us dig into the original report that's in nature and we dug in and talked about all the stats and what does it mean. It was really, really fun. And you can find that over at podfeat.com. And of course, you can always support our show at any level. I'm going to pitch the URL this way today to make Alison happy. DailyTechNewsShow.com slash Patreon. Do we not usually say that? No, I usually just say Patreon.com slash DTNS. Oh, all right. Everything good starts with DTNS. Just keep y'all on your toes. Got a couple options. Our email address is feedback at DailyTechNewsShow.com. And we're also live if you can join us. It's Monday through Friday, 4 30 p.m. Eastern, 2030 UTC. And you can find out more at DailyTechNewsShow.com slash live. Back tomorrow with Patrick Beja. Stay safe, everybody. Bye.


The pace and the penetration of a core enabler, wireless broadband, and smarter devices, are happening at an unprecedented rate. With more than five billion mobile connections, we foresee smartphone prices falling well below $100, and with it, global mass adoption of smartphones. Mobile tablets will predominate forcing PCs to become niche products. We see this coupled with near universal access to the wireless internet and digital social media. This new digital combination of wireless internet and digital social media is occurring at an unprecedented speed and with a scale that opens up new economies, new business models, new opportunities, and new ways to overcome traditional barriers, especially in the emerging markets. The new digital combination will discard old cost models, create new applications, and enable the ability to tap at the touch of a finger new reservoirs of wisdom and the resources of others. Let me know two areas where traditional approaches will be upended. Education and employment. For education, teachers become virtual, books become digital, and rented at a fraction of their old digital selves. Rather than dogged, warned, and out of date, the new digital books are consistently refreshed at a very little cost. A new world of the self-taught, or maybe more correctly, the group-taught will emerge, spread again by wireless connections and digital social engagement. For the other part, the employment. New ideas and business models can flourish on the web for again a fraction of the cost of the traditional approaches. The cost of digital tools are plummeting. And again, wireless broadband access becoming more available and affordable. Marketing and distribution is as easy as using your digital social crowd. Mobile entrepreneurs can flourish with traditional jobs and drive up. A compelling mobile application can be created in days and become virtual within hours as the new digital combination pushes down traditional barriers to job creation. It opens up tremendous opportunities for the young in the world today to turn their restless energy into creating their own employment and for social entrepreneurs to tackle pressing social problems. Competitive innovation will be done, I think, through three main building blocks. The first building block is the open platforms. The open platforms will give us more innovation, lower cost as we talked about a couple of times, and as a result of that, a greater value. The second building block is really the affordability and the widespread access to broadband data. And the third building block, which is a logical extension of the two first, is all the things happening in the cloud today. I think the cloud-based capabilities, which again will give more and higher scale of economies and also through its nature, ease up the use. Those three elements I think will help innovation a lot going forward. The telecom industry is first and foremost a fundamental enabler of the new digital combination as wireless is the essential digital platform. Our industry will continue to work, I hope, with others in the value chain and with governments to enable new digital uses and models. For example, in areas like financial services, healthcare and education, we will continue to press for open platforms, which are without question the most efficient and compelling for everyone in the value chain.


The following video was recorded live at the conference and produced by the Sound of Knowledge Incorporated. To welcome to the annual DEF CON connection, this meeting was held in exciting Las Vegas, Nevada from July 9th through the 11th, 1999. This is video tape number 9, Hacking Warfare 101. First off, there's my email address if anybody wants copies of these slides, just send me an email. First a usual disclaimer. And then because of my professional affiliations, my absolutely necessary disclaimer. I'm not saying God can use this information for any kind of illegal purposes. Okay, what is Oracle? Oracle is a relational database management system. Database provides a transparent interface between the storage of data and the representation of data. And Oracle is a very widely used database. It's very prevalent in the industry. What's the value of attending this presentation? One is that, like I said, Oracle is widely used. If you get some Oracle expertise, you can go out and make some money with it. And you can apply the knowledge around here for some good things. Oracle uses standard query language to get database. Here's some Oracle SQL tools. SQL is probably the most widely used. It's basically a shell to do standard query language commands. The forms is an Oracle application. The port writer is a query front end data query tool. SQL menu also is an application front end for menu applications. SQL loader will load data from system files into the database. SQL net is the TCP IP communications protocol used to communicate in client server fashion. SQL DBA is an administration tool. Here's a few other Oracle tools. Basically, these are case tools, the first two to help develop applications. And the last ones are newer reporting utility. Here's current programming languages that can be used to create batch jobs or application code for Oracle applications. Basically, it's each of these languages with a compiler that will let you embed SQL commands into that language, into that compiler. This is the way Oracle stores data in tables. Here's a sample table. These are columns, SSN, last name, first name. These are rows within the table and any single data element within a column within a row is called the record. If you're on an OS and you want to know if they have Oracle on that OS, here are some ways you can determine if Oracle is present on that system. Unix lists the processes and grep anything with ORA in it. In VS, under Interactive System Productivity Facility, there should be an Oracle option. In VMS, you list the processes and on NT, there'll be an Oracle option under programs and it will also be running as a service. In order to access the database, you have to have a few things. You have to have your path set up to where you can access the Oracle executables. You also have to be pointing to the system ID of the database. Oracle databases are named with system IDs and it's just basically a generic naming standard. You can name it DB01, DB02, DB03. You just have to be pointing to the valid database in order to access it. And you need a valid user ID with connect privileges. In order to identify valid environment variables, you could check the INI files to see what databases have been loaded on that system. And the environment variables, the path in the SID will be in those files. And in VS, it's in sys1.proclib, in VMS, INI files, and NT INI files. The types of user IDs that exist in an Oracle database. DBA, database administrator, basically can do anything they want. This is the God ID with an Oracle. A privileged user is a user that has been granted specific privileges to data elements within the database. And an unprivileged user can be a user ID that's been created but has been given no privileges that can access anything that's been granted to public. Within Oracle, some system elements and sometimes data elements are granted to public, which means any user ID can access it. So you don't need specific permissions if it's been granted to public. Oracle uses several different types of authentication options. One is authenticated by the operating system. If you have a valid user ID in the operating system, you can get into the database. Another is a standard user ID and password stored in the database. And two more X509 certificates and smart cards, which are newer options. With operating system authentication, this is probably the most widely used authentication due to lack of password management within the database. And what happens in this case is you have a valid operating system user ID and in the database you have the same ID that has a prefix of OPS dollar sign. And that's the default. It can be something different, but that's pretty much 99% of the time that's the prefix. So if you've signed on to the operating system, you type SQL plus to try and get into the SQL shell. And when it prompts you for a user ID, you just put slash and it lets you into the database. So what does that mean? If you can become a user on the operating system that has a valid database user ID and they're using OS authentication, you're in the database. No additional authentication required. If you're doing some type of penetration testing or certification and accreditation testing, you should check out some user IDs that are on the OS that look like they're Oracle application users to see if you can get to that ID and then get to the database. Another way is to look for IDs that are in the DBA group because if you can get to one of those IDs and get into the database, you're now God of the database. The user ID and password authentication. This is pretty much used for client server environments. The user IDs can be from render 30 characters. It cannot be mes, but it can be a space. Password to stored does encrypt it in the database. And basically when you log in, it will encrypt the password value that you enter and match it up against the stored value in the database. The big problem with this is that the does key to do this crypto is not well secured. So if you access that key, you can pretty much crack all the passwords in the database. User ID and password authentication. Every Oracle implementation has three default user IDs and passwords. Anytime an Oracle database is installed, these IDs and passwords exist. The first one is sys, the password is change uninstall. The second one is system, the password is manager. And like I said, if you're doing certification and accreditation testing, these are things you should try. And the third is scott, password is tiger. That's basically an unprivileged user ID, but it's always there.  Sys is the only ID that can start, stop, or tune the database. But system or any other ID that has the DBA row granted to it can do anything in the database except start, stop, or tune it. The X5 or 9 certificate authentication. The newest version of Oracle is Oracle 8. It's been around for about a year now. They have a separate security server that's an option with the database. And with it, you can use X5 or 9 certificates to authenticate yourself to the security server and then to the database. The smart card is the same thing. If you're doing certification and accreditation testing of a database, on most implementations, any user in the DBA group can run the SQL DBA utility and type the words connect internal and be logged in as sys. And use of the SQL DBA utility should be locked on Oracle implementations, but it's usually not. And it won't work on NT because NT handles groups differently than Unix and VMS and MVS. It doesn't recognize group privileges the same way. Okay, once you're in the database, how do you access the data? You must have specific granted access to the tables or views of the tables. Within Oracle, you can limit access to a table to certain data elements within the table through use of views. So once you're in the database, you have to have these table privileges granted to you to get to the data. Table privileges can be given on a table by table basis. Lots of tables can be grouped into what's called a row and then that row can be granted to the user. And only the owner of the table can grant access to the table. Or a user ID that has been granted access to the table by the owner with grant authority. So they can re-grant permissions once they've been granted permissions. That's not typically done. Like I said before, the access views can provide granularity of record level access. You can limit it just to specific rows or specific columns or specific records within a row, within a column. And all users and player SQL in some way to retrieve and present data. Also besides the database data being in the database, it's obviously in the OS files. And those OS files may not always be well protected. If you find the OS files and they're readable, a lot of the data will be gibberish because of the format it's starting. But there will be normal readable clear text data in those OS files. So it's not always necessary to get into the database to look at the data. All core sub-directories have names like those listed here. And like I said, access and data this way is not going to restrict you to certain rows or columns or records within the database. Here are some all core system privileges rules. You must connect to any user ID that has to log onto the database. Connect as a rule within Oracle. If you grant the resource rule to a user, that will allow them to create, manage or drop database resources such as tables within your schema, which means under their user ID. And DBA is a rule which allows users to do just about anything they want to do within the database. Within Oracle, Oracle 7 and 8 came out with some other granular rules to further limit access to system resources. So you have some granularity where you don't have to make a DBA or just a normal user. You can just give them only the privileges they need to do their job. But before Oracle 7, these were pretty much the only system rules that existed. Any and all system privileges can be granted by any user with the DBA privilege. So if you want to grant a system privilege to a user, if you're a DBA you can grant any system privilege. You cannot grant system privileges to a non-DBA with grant authority. Auditing within the database. Auditing in Oracle can be turned globally on or off by modifying the INI files for the database. This is going to require a restart to actually get the database to start or stop logging. However, DBA can turn on or off auditing within the database by issuing commands and it would not require a database restart for that change to take effect. The DBA can set granular or global auditing parameters. And basically I'm going to get into some commands later that specify the different types of auditing that a DBA can do within the database. All audit records are sent to the sys.aud$sign system table. Any DBA can access those audit records not through querying the table itself but through querying views that have been created to point to that table. The sysaud$ table must be backed up to regular tables and cleared periodically. And the reason why is right here. If the sysaud$ table grows to 50,000 records, the database basically stops running. And if you audit every successful read of an Oracle table, you're going to reach that limit pretty fast. Oracle password management. Other than the fact that you have to have a password to access the database, all Oracle versions prior to version 8 have no password management features. What does that mean? That means that a user can establish a password of a space, a run, or an A, or anything. They can establish passwords that match their names or user IDs. Passwords will never expire and accounts will never be locked within any version of Oracle prior to 8. Most people are still on 7 or lower. Some people have moved to 8, but there's been some instability within version 8 that's kept some people from moving there. Exceptions to that prior slide. If you're trying to connect to the database after three unsuccessful login attempts, the SQL plus session or login session will be terminated. However, you can restart that session thousands and thousands of times and let user ID will never be locked. It's just a lockout on invalid passwords within the logon form. These two companies Mer systems and Blain Tree offer third party password management software for Oracle version 7 and 8. And Oracle 8 finally puts some password management into the database. Mainly because people like me bitched enough of them to do it. If you're looking in an ORS and you want to know if Blain Tree or more is being used to do password management within an Oracle database, version 7 or 8, they have SysOS IDs, the Blain Tree user ID on the ORS with the SQL CQR. I don't know what the more user ID is, but I'm sure it can be found on more's website. You can call them up, ask them whatever, some information about their product. And within Oracle 8 password management parameters can be set by any DBA. And if you list the default profile and the Oracle database, it'll show the password management parameters that exist under Oracle 8. Which can be turned on or off or set to different parameters or levels. Oracle TCP IP Sessions. The SQL NAT protocol is used to remotely connect to the Oracle database. Multiple database instances will usually run on a single server and each instance will require its own listener or port. So basically you can have three or four or five database instances running on an operating system. And you just have to have separate listeners for the SQL NAT connection to connect to. And Oracle Server listeners usually run in this port range, 1500 to 1599. In order to encrypt SQL NAT sessions, there was a product called Secure Network Services. Now it's called Advanced Networking Option. And sometimes it's used, sometimes it's not. Crypto strength of AMO is pretty good, but there are some flaws in the key exchange protocol. And basically if you want to know what they are, you probably have to do a source code review and sign a non-disclosure agreement like I have. And you'll be able to pick out that stuff. And AMO encryption can be mandated or it can be optional. So the server can say every TCP IP SQL NAT session is encrypted or you can encrypt if the client wants to or not. Here are some useful SQL statements. Grant connect to user ID being any user ID you want to name, identified by password being any password you want to name. That will create a new user within the Oracle database. If you want to change the user's password, you can use that second command. And basically all the information here, I gave this presentation to a guy that had to do some certification testing. And he took this presentation and went at this database. He knew nothing about it. He didn't know anything about Oracle and he was able to get into the database lots of different ways and do lots of different things once he got there. You can grant the DBA rule to a user ID if you are DBA or if you're in the system account or sys account within the database. And you can drop user IDs by drop user ID cascade. The cascade is an option and it will drop all the tables created by a user when you delete the user ID. If you don't use cascade, the user ID goes away but the tables still exist. You can look at all user IDs and passwords in the database by issuing the top command. You have to be a DBA to access any DBA table. And basically that's any table that starts with the name sys.dba something. Only DBAs can query those tables. There are also some tables within Oracle that start with the word ALL. Any user ID on the system can query those tables. So any user could look at all the user IDs on the system by selecting user name from all users. That table all users does not have the password stored in it so you would not get the encrypted passwords. Select asterisk from profile default. If you're in Oracle 8 and you want to see what the password management settings are, that's the command to do it. And if you wanted to change the default profile, you could do a command like alter profile default invalid logins unlimited. So then there will be no lock. What's that? Do you have to be a DBA to do that? Yes. In order to change that default profile you do have to be a DBA. But there's plenty of ways to become a DBA. If you grant ALL on any table to a user ID, basically it's going to give you a whole list of permissions on that table. Like select, which means read, insert into the table, modify the table, delete records out of the table, and a few others like create indexes on the table and links on the table. You can grant specific privileges. So if you want to just grant read access to a user ID, you can do grant select on the table to the user ID. And that user ID would only be able to read that table. And you can revoke everything on the table from a user ID. You want to take away access on a specific table or object. If you want to create a row, basically it's just create row and row name. And drop a row, or delete a row, drop a row, row name.  And then the second and last command, you can grant that row to a user. Prior to version 7, there were no rows, so it's a security administrator job that's really hard because you had to grant specific table privileges to every user ID on the system. And with Oracle 7 and 8, you can just grant it to a single row and grant that row to every user that needs it. And the last command is to take a row away from the user ID. The granular auditing options are alluded to here. You can turn on auditing for any successful login by using the top command. You can turn on auditing for any unsuccessful login by using the second command. And you can audit specific privileges, say anytime someone updates a table, you can audit just that updates on default, like any table on the system. If you issue that command, any table that gets updated will cut an audit record. Or you can do it on a specific table. This first option is showing how to do it on a specific table instead of every table by default. You can turn off auditing by just doing no audit all on a table. So any access to that table at all would not be auditing if that statement was issued. And no audit all will turn off all statement auditing. Basically any SQL statements that are issued will not be audited. And no audit all privileges would turn off auditing for any system privilege that was executed. No audit all on default will turn off all default audits. If you want to turn on auditing for a specific user, you do audit session by the user ID. And if you want to turn off auditing for a specific user, you just issue no audit session by that user ID. So if you were doing something in the database and you didn't want to be audited, and you could issue that command, you would not be auditing. And delete asterisk from the CISA dollar table will delete all audit records. This first statement say you're querying a database that has a bunch of credit card numbers. This would show you how to possibly retrieve some of those credit card numbers. Or a database that had some other data. The second statement has a wild card F name like Liz percent sound. Basically you can put a percent sound before or after any string. And that will give you any option like Liz or Lizzie or anything that came after Liz basically. If you wanted to see all the tables in the database, you could select owner and table name from sysdba tables. If you wanted to list all columns within a table, you would do a describe on that table. And if you want to list audit records, here's one of the audit views of the CISA dollar table that can be queried to look at all audit records for a specific user. Here's some of the useful security tables within an Oracle database. The first one is stores all users and passwords in that table. The second one any table privileges that have been granted to anyone would be stored in that second one. The third one any system privileges that have been granted to any user would be stored in the third. Any profiles that have been created and granted to specific users will be in sysdba profile table. Any rows that have been created will be in the dba rows table. Any row privileges who they've been granted to will be in the dba row profiles. And audit records will be under the view of the dba audit trail table. And the sysdba dollar table is the actual audit table. It kind of went quick, but that's it. If anybody has any questions, now is the time. Yes. I'm a newbie when it comes to Oracle, but I'm going to put me on a server on keys 400. There's more than anything like a rollback file. And if it does, and thinking about OS tags on files, if there's any way to take for instance a rollback file for OS type files, you can put them off and set them up in a clean environment to inspect. Okay, within the Oracle there are rollback segments. So if you're doing a lot of changes within the database and something happens, it crashes, you can rollback to some certain period in time. You want to know if you can offload those rollback segments? Yeah, yeah, basically you can structure, you can separate some of those things like the rollback segments on different disks on an OS. So if you have a disk crash on a disk that has part of the database, it's not necessarily going to affect where you have stuff like rollback segments if you have it on a different disk. So you can separate those things. As far as putting them on another OS, I'm pretty sure you can do that. Let's do an export. Okay, yeah, I mean I'm not a DBA so those functions are kind of outside of my realm. I do know that if you're issuing a bunch of SQL statements and you're not committing those statements to the database periodically, you'll overflow the rollback segments and the database will run to a halt. So if you're issuing a thousand create user commands and you're not committing those commands every 50 user IDs or something, you'll overflow the rollback segments and the system will halt. Yes? On operation authenticated accounts, does it still let you enter a password? Is it possible to authenticate using that password or what is the operating system? If you're using OS authentication and a user ID has already logged into the OS, it doesn't matter what the ID in the database has as a password. If it's set up to use OS authentication and the ID exists that matches the OS ID and has an ops-dollar prefix, they'll log in. If you want them to have to log into the database, don't use the OS authentication. They'll log into the OS but if you create an ID for them in the database, don't prefix it with the ops-dollar and when they connect, they'll have to supply the user ID and password. So if they've got an ops-dollar prefix, for example, if they're going to sequence that to the OS authentication, they'll go into the database, they'll go into the database and they'll have to log in. Right. If you don't sequence that, that's not OS authentication because you're client-server mode. You're not logged into the OS. And the ID can exist just as a regular user ID with a password or it can be ops-dollar user ID with a password. You'll have to type ops-dollar user ID in the password if you're coming in over sequence that because you haven't authenticated to the OS. Yes. I've seen some of it, you know, some sales pitch stuff. Do you have any specific questions about it? I don't know. There's problems with that. One of them is to use a global user ID to access the database and it's doing all the ID mappings at the web server. I personally have a little heartache with that but haven't filled with it much. Oh, yes. It's viewvandal at exploit.com. The O in exploit is a zero. Yes. It does encrypt it. An offline tool to list the... Yeah, I mean basically if you can access the OS data files from the OS you'll see those encrypted passwords there. Okay. Yes. Right. This is just to start. He's asking if it's possible to start the secret met listener on a privileged part like less than 10, 20, 30, you're asking. If that port's not being used by another service, yes, you can specify the listener to use one of those privileged ports if it's not being used. Yes. Oh, yeah. I mean those commands I was issuing. If you want to delete audit records for a specific ID you can do that. If you want to delete audit records on a specific table like anybody that's accessed a specific table you can do that. Basically you just delete staff from the CISR dollar table where some condition is met, whatever condition you need to meet. Does that answer what I mean? Yeah. Okay. Yes. Well, you can, but typically it's a date-based thing where you offload all the, you know, if you're going to be making audit backups you'd probably want to store them by some weekly parameter or monthly parameter or daily parameter. So you'd have to have your script set up to offload just that week's data and then a script that would delete just that week's data. So, you know, you can code that. So yes, you can automate it. You could, not in the database itself, I mean there's nothing to trigger that. You could set up something in like Kwan to go check it and, you know, if you can select count from the table and it'll give you how many records, how many rows are in that CISR dollar table and based on some output condition that if it's greater than whatever 40,000 then you can, you know, kick off whatever you need to to clear it out. Yeah. Yes. Have I tested any vulnerabilities with the SQLNet protocol? As far as like man in the middle attack or I'm getting a key, a crypto key for the session, yeah. But, I mean, as far as anything else, you know, it's either encrypted or it's not. As far as connecting to the database with SQLNet, you know, you have to have a valid ID once you get there. I haven't found a way to like exploit that to get in otherwise. Yes. I don't think so. I don't think anybody can drop a DBA table. But I haven't actually tried that. That's a good little test. Yes. Oh, no. Any statements like if you're inserting data into a table, you're inserting some row into a table and you have insert this row, insert this row, insert this row. You can insert to any table you have access to. Yeah. I mean, basically, if you have access to do some type of command that's going to alter any kind of data, whether it's creating users or inserting data or deleting data, whatever you have access to do, if you do too many of them without committing them, you will overflow that row back segment.  I don't know exactly at which point it breaks. It probably depends on the complexity of the SQL command you're issuing. But I never go over 100 SQL statements without issuing a commit unless I want to break it. Yes. It's just something that Oracle overlooked. I mean, they do have the ability to does encrypt the passwords, but they didn't really take good consideration in how they were going to protect that does key. Can they fix that? Yeah. Is it fixed right now? No. How is it affected? How is it protected? Basically, it's not. Basically, there's a few ways you can find out. You can fool around with it and find it yourself. You can do a source code review and sign a non-disclosure statement like I did, which is why I'm not disclosing it right now. And you'll find it. Or you can get me drunk and maybe I'll tell you later. So, yes.  But it's not necessary for them to be in a specific group at the OS if you're using. Right. With the exception of if they're in the DBA group and they run the SQL DBA utility, that's the only time it'll actually check what the group is. Yes. I have a few questions. The first question is, what's the most secret it goes? Is there a way to lock it in so it's a web server to work with it? No. But you can only execute it through procedures on the local database, so you can lock it in online. It's a good process. But the second thing is, can you not really build an application proxy that will work with SQL DBA? If you only want them to execute stored procedures, you can set up profiles for a user within the database that can limit what they can do. You can basically say they can't issue this command, this command, this command, or any command except this one. So yeah, you can do some stuff to limit what they can execute over a SQL node connection. The second part of that was... Application Proxies. Most of the proxies, if you're talking about firewall proxies, are like generic proxies. They're not really doing any command filtering within the proxy. It's just some proxy to get them through the firewall and handle the SQL node traffic. But to me, a generic proxy is not really a proxy. A proxy is going to limit what you can actually do while you're using that. This guy is saying Sidewinder. I don't know what it limits you. What is it limiting? What is it stopping you from doing? Most of the names at a time, they do it right. That's the fairness you think about. It's going to be a hassle of finding it. It's supposed to be fixed first and foremost. Yeah, well, most of the ones I've seen were generic, but... No, I'm talking about the proxy, just to point out that the generic proxies is not really doing this. Anyone's not going to be a new one yet but you can get a new one and you can get a new one. Right, well, it does that on NT. The SQL node implementation on NT uses a wide range of ports, which is really F'd up if you're some kind of security administrator. On the Unix, it doesn't do that. The listener listens on this port and this port only. If you run an NT and trying to do SQLnet, you could have a situation where you can't use proxies, because of the wide range of ports, and the proxy's not going to handle that. You would get that the port is open. If you were port scanning, would you know if the port was being used? You would just get an open port and not use any kind of... Depending on the kind of scan you were doing, yes, it was... If you were not going to do SQLnet, why would you choose the wide-stranded and internal listening system because it's not the protocol itself? What you probably want to be doing is connecting SQL plus over SQLnet to see if you get a username, login prompt. Yes. Do you have any possible way to exploit the database? What's the way to get operating system show access? If you're in a SQLnet session, if you host out, you host out back to your client, you don't host out to the OS. I haven't tried that, so I don't know. Yes. I've seen it, but I haven't played with it. I don't know. One more question? One more question? Thank you all for coming.