Welcome to the Cloud Foundry community panel. For those of you that have been watching the keynotes, you probably know at this point that Cloud Foundry is an open-source software project and it has a lot of members. If you look at even the slide that has all the member companies, one of the things I think is most powerful is that it's not just providers on that slide, it's also a lot of users. So people that are using Cloud Foundry are participating in the community, they're participating at the organizational level, and they're participating at the individual level, and those people are from all sorts of different industries, from automotive, to financial, to Internet of Things, and so we have I think one of the strongest, most diverse open-source software communities that are out there right now. To give you the idea of the size, there are 190 meetups listed on just meetup.com, of people that try to meet regularly once a month to talk about Cloud Foundry. There's 45,000 people signed up in those meetup groups and they're around the world. Every continent except Antarctica, so I'm going to have to have a mission to start a meetup in Antarctica. So I've brought some of the most successful meetup runners here. I didn't bring them, they actually asked to come and participate and what I wanted to point out before we get started is that this is a panel, and this is an open-source software project, and so you will get out of it what you put into it.  I just finished a book a couple nights ago, that was a science fiction book about Mars. It was really interesting, it had awesome technology, awesome character development, the plot was going really well, and I was getting really worried because every time I looked at the bottom of my Kindle, it was like 20 minutes left, and there's still like three spaceships floating out there that don't have power, and there's like aliens chasing them, and I'm like, how is the author going to wrap this up? Well, he didn't. So I was left hanging with the spaceships still floating out in outer space, and I don't know if there's aliens, and I don't know what happened. That will happen to you if you don't participate in this panel. So if you have a question, if you have a question, it is up to you to bring it up. We'll have the mic in the middle is open at any time if you wanna jump up and ask a question, and there's a URL where you can submit them, and I can see them here, and I could ask them for you if you'd rather do it that way. So first I'm gonna have the panelists introduce themselves, and they'll say their name, and maybe meet up or meetups they run, and kind of who they are. So since they can't see the slides, we'll start with Kim. It is on. Hi, I'm Kim Banerman. I run the Seattle and the Atlanta Cloud Foundry meetup groups, and I started both of them. Okay, this sounds like they're doing really modest introductions, but Kim started two really active, huge meetup groups. Mark. I'm Mark Carlson with ECS team, and helped co-organize the Denver Meetup. We've been doing that a little over two years, and we started that in the days when we'd have about eight or 10 people, and it was sad, and we'd bring speakers in, and they would have not very many people to talk to. The good news is after a lot of work and kind of promotion, we averaged around 75 people in our meetups, and we have kind of our content calendar now planned out through September of this year, and so people interested in coming to speak, and so it's been a fun journey to see the community really get behind Cloud Foundry, and come on and talk about it. Awesome, thanks. And the poll. Hi, I'm Paula Kennedy. So I run the London Platform as a Service User Group, so our group is slightly different. It's not just Cloud Foundry, it's a wider kind of group, so other platforms, essentially. We've been going since about 2012, and we've got just over 800 members now, so it's a really big, big community in London. And Paula has trained her group not well, not only to focus on Cloud Foundry, but also to have fun, and they're all in the bar right now. Bridget. Hi, folks. Wow, my mic is very loud. Hi, so I'm Bridget Krumhout, and I don't actually run a Cloud Foundry-specific meetup. What I do is I am the current unelected head of the shadowy global cabal that brings you DevOps days, and I also run the Minneapolis DevOps meetup. So that means I'm encouraging people to submit their Cloud Foundry content to DevOps days conferences everywhere. And I have a couple of coworkers showing up in Minneapolis June 1st, and I checked earlier today, and there were about 170 people RSVP'd to a DevOps meetup to hear them talk about Cloud Foundry, Spring, Docker, Neo4j. So like Casey West and Kenny Bustani are coming and speaking. So that's kind of an example of, and our turn out is I'd expected at least 120, 130 people to show up for that. So that's kind of my, I like to bring the Cloud Foundry into the other meetups and further parts of the ecosystem. Which is an awesome way to grow the community of Cloud Foundry. Daniel. I'm Daniel Crook. I'm a software engineer at IBM. I founded the New York City Cloud Foundry meetup in 2013. Also helped co-organize OpenStack New York and have been running New York PHP for over 12 years at the IBM location. So many folks on my team as well run the Cloud Foundry meetups in Austin, in Seattle, along with Kim, and Silicon Valley area. So if you went to that CF camp that was scheduled on Sunday, that was a outgrowth of a vibrant user group around here that was able to align with the summit and create some great content. Awesome, definitely. I did introduce myself. I work for the Cloud Foundry Foundation and I focus on the community and the developers of Cloud Foundry. So if I can help you in any way, let me know. With that, we're gonna move into the panel and you might, if you're on Twitter, you might have met some of these people virtually through Twitter. They've been pretty active all day. So if you could help us out and while we're up here not tweeting, if you could take over the job and tweet for us during our panel, that would be really awesome. So if you use Twitter, please tweet. You can tweet quotes, you can tweet questions, however you'd like to do it. So I'm gonna start out with a question for the panel and at any point in time you are welcome to jump in, but I'll just kick it off with a question. I'm curious why you all do this. Like what is important about growing the community to you?  I guess I'll start. So one of the great experiences of running a meetup for a PHP for all those years was that you learn that it was a great place to learn new skills, find new job opportunities, and for people hiring or freelance, looking for partners, the meetup was a great place to find that. So I thought it was a great idea that Cloud Foundry was growing and needed to build a community around it. And one of the I think most important parts of what we do in terms of running a meetup is that Cloud Foundry is such a complex, sophisticated piece of software that in order to learn how to use it effectively, you can't just work with virtual resources. It really helps to talk to people that are in the community using the technology and sharing their lessons. So that's why I do it. So the ability to ask face-to-face questions is important? I'll go, I'll say as a service provider, we believe in the value that Cloud Foundry brings to a lot of our business customers. And so it's really growing the community and growing the exposure of those customers to Cloud Foundry helps them. And then getting to kind of hear real-time feedback from people who are trying to do real exciting at scale things with Cloud Foundry helps us to get better and see where the challenges are. And obviously gives us great market intelligence from a service provider standpoint. But mainly it helps us understand the areas of pain that we can help it really take back into the Cloud Foundry community itself to make the product better, but also services that we can provide to help our customers. Don't forget the part where it's fun. I was running meetups before I worked for a vendor just because it's fun. And now that I do, it certainly is also great for our field because it's easy for them to say, hey, we have some pivotal co-workers are gonna be speaking at, are gonna be running this event, you should show up. And it's a great place, a good soft entree for people to come and learn something without getting the handshake hard sell. That's right, agreed. It is fun and I agree with Bridget, but it's also ridiculously hard work. I'd have to say, I mean, I do, with our London Paz user group, so we call it Lowpug, we do an event every month except for August and December we skip because people tend to be away. And doing an event every single month is hard work. I mean, I enjoy it, it is fun, but it's finding the speakers and organizing the food and making sure you have the venue and it's not nothing. It shouldn't be underestimated. So I'm gonna skip ahead, Paula, I know you're really good at finding speakers and you have a couple of specific techniques I've watched you use. You wanna talk about how you find speakers? Yes, okay, so there's a couple of things I tend to do. So being a Paz user group, we try to keep an eye on the competition. It's one of our secret agendas, which is great. It's great for all of our community. We like to invite people from OpenShift and Docker and various other people that are doing similar things, similar technology so that we get to see what they're up to mostly and try not to be too sarcastic when we kind of ask them questions about why they aren't using Cloud Foundry. Another thing I tend to do is actually look at other events that are going on. So Bridget mentioned DevOps days and I like to see other speakers that are kind of in our community, particularly I look for people that are kind of not always white men, kind of the typical speakers. We try to encourage a more diverse kind of group of speakers at Lowpuck and I find reaching out to groups so we have a women who code group in London that's very big. We try and reach out to them for speakers. We try to approach different groups just to have a balanced view actually at Lowpuck. Oh, and I should play off of that and I wanna hear your thoughts on that too Kim, but it's not just getting people to come and talk about the stuff they're doing. It's also kind of fun when you can get a Docker meetup to let you go talk about Cloud Foundry at their meetup. I mean, and honestly, or even at like a DevOps meetup, pretty much if you put the word Docker in it, it's like putting the word Unicronals in it that's starting to be just sprinkle some magic on it. So if you can show them demos and be like, hey, these are exciting and yet irrelevant details, but let's look at exactly what the capabilities are. That goes really well. I actually have our Docker organizers, pretty good friends of mine and so we cross post and different our groups and we try not to do them on the same night so that we can share the community. That works really well in Seattle. Yeah, it works the same in New York. One of our best meetups or biggest meetups are the crossovers. So, especially with the OpenSack and Cloud Foundry, you have opinionated people on both sides. They're always trying to one up each other. Now with the .NET support within Cloud Foundry, we've done some crossovers with Visual Studio users groups where people are hearing about things like 12 Factor and Cloud Native for the first time ever. And so that's exciting to kind of broaden out the awareness to a group that may not have even encountered those concepts, which is kind of hard for us that have been in the echo chamber for a while to consider, but there are large technology communities that are not familiar with the things that we've kind of been hearing every day for the last several years. And that cross-pollination between meetups and user groups is so key because you get people who maybe would never think to go to a Cloud Foundry meetup because they'd be like, well, I'm not using that. So I'll just go to a meetup about something that the hype cycle has told me I should go to. But you have a meetup and actually when I said 170 people RSVP, that was just on the DevOps part of meetup.com because we are co-meeting for that one June 1st in Minneapolis with the Docker meetup and the Cloud Foundry meetup. So that probably puts us above 200 RSVPs if I went in Canada. And that's getting people who maybe wouldn't have thought about it to consider it and look at it. So I'm gonna move a little bit to the audience because someone has asked the first question.  So to get everybody warmed up, could everybody who has been to a meetup stand up? Awesome. So you need to share with the person next to you after this is over what the best thing about the meetup was. You can sit down. Has anyone helped organize a meetup or organized it themselves? Awesome, round of applause. Yeah. Yeah. Yeah. Okay, you can sit down. Is anyone here because they want to run a meetup and they haven't done it yet? That's willing to raise their hand. Oh, not as many. Awesome. Cool. There we are. All right, so all of you have experiences at meetups that are valuable or organizing meetups that are also valuable. So feel free to share those or feel free to ask questions of our panelists if you had something that didn't work well for you and you're curious how they did it differently. Now is the time to ask. We got a couple of concrete questions online and one of them that's getting a little Lego guy or gal. There's no hair. There's no facial features. No gender. No gender. When we're talking about community, what kind of breakdown are we talking about? Is it users, service providers, core committers, evangelists? Who's in your community? It's everybody. So we get everyone from VP level down to core users, down to people who are having the enterprise and I'm sick of shipping applications and it's taking way too long. And so I'm a little curious. I've heard about this Cloud Foundry thing. So we get a very big gambit. When we were first going, like I think Mark and I talked a lot when we first got it off the ground on our meetups in 2013. We were mostly vendors sitting in a room talking at each other. And thank goodness we've moved past that pretty quickly. I would say that we've seen it shift just like Kim was saying. So in the early days it was interested parties either from providers or from service providers. And unfortunately we've seen the adoption take place so that now we have more actual business customers, enterprise customers at scale. And we've been really fortunate to have them come and talk about what they're doing. And that's when we really see the growth kind of accelerated so we move past kind of technology hobbyist and enthusiast and actual real world use cases that we all really wanna be talking about. That's right. Yeah, we do a mix as well. So we have to vary our content. We have some regulars that are experienced with Cloud Foundry and that brand new beginners. So you gotta make sure you can tailor the talk to the audience for who's there. I think that's pretty important as well. So we get a mix and it's not consistent. And in fact one of the funny things about the name Cloud Foundry is like OpenStack opens X clear but Cloud Foundry sounds like a place. It sounds like a startup incubator. So sometimes you get people come in there not thinking about Cloud Foundry technology, they're thinking about Cloud in general, a place to build clouds. So it's kind of interesting. You always get a few of those people. So we have a couple of questions here. The next one's kind of a logistical one. How did you find the space for your meetup? The key for us is local employers who very much would like to attract like practitioners to their companies tend to be very interested in hosting. And sometimes they can fund the food and drink. Sometimes you need another party to come in and fund the food and drink just depending. But that has been the least of our problems really just because like in Minneapolis we have a SPS commerce as a supply chain logistics company that wants to hire people in this whole DevOps platform orchestration realm. And then a target headquartered in Minneapolis is very excited and happy to host. So one thing I would recommend is when you find a good venue, keep going back. I mean, we have with our low-pug group, we go to the pivotal office in London and we meet there same place, same day of the week every month, which means that our regulars kind of know even before we've announced when the next meetup is or the schedule, they know it's probably gonna be this time, it's gonna be at this place. They know how to find parking. Exactly, they know it well. They take a lot of rail, right, that's right. So we played around with different locations for a while. We were trying to do, in Seattle you've got the east side and you've got Seattle and then in Atlanta you've got OTP and ITP. And so very different. People outside of the perimeter don't wanna travel the other side. It's very similar to Seattle. They don't wanna travel across bridges, it's traffic. So we started getting more consistency and we started having it in the same place for sure. I generally agree with that but we've actually had some success in New York with scheduling at IBM, at Pivotal, at third party companies that are users, not vendors and actually at Pace University. So we had a whole bunch of students come. But the consistency is key. I think the time of month, the day, right? The third Tuesday and what, every month? I think that's more important, at least for our venue, in our city. But if you're able to vary up the menu, then you get different types of folks come out. Sometimes you can attach to a conference, maybe at the conference venue going on, just like what the Silicon Valley group did here. But also if you can engage students at the start of their semester, January, September, you can get a nice diversity of new members. So we have a couple of questions about how to start up Meetup Group. So when you're first getting started and you're small, how do you attract the sponsors and the speakers and how do you generate interest when you're just beginning? There's several questions on that topic. So the best place to start is to look at the sponsor companies for Clock Foundry Foundation. See who's local in your town and reach out to them via LinkedIn. That's what I did in Twitter. I found a Pivotal SE that was in Portland, Oregon. This is before the Pivotal Office in Seattle opened. And we kind of got it off the ground from there. Something related to what we were just talking about to keep in mind is if you're going to bring a speaker in, often like a vendor might have someone like me or the members of my team who travel around and speak at a lot of things, having a little bit of flexibility with your days is really key because if you can only have your event on the third Wednesday and then the speaker that you really want is available only on Tuesday, like having the flexibility there between if you can manage it with your venue and everything else gives you the ability to book speakers that otherwise their work travel schedule would make it impossible. All right. I was gonna say, oh, in terms of starting your own meetup. So we actually did a presentation last summit here and had a couple of best practices for that. There's some slides on available if you look at Cloud Foundry Summit 2015. But number one, I think one of the best lessons is if you've seen a great talk here and you want that person to try to be your first speaker, talk to them, go out, engage them on Twitter, talk to them after their talks, see if they're gonna be around the area. Or if you go to meetup.com, find maybe a city that's near you and then if someone's already in town for that, perhaps for us, we have Boston, Washington, Philadelphia and New York, we can kind of find the speaker that's on the circuit as or and kind of bring them in. So those are two different ways. And be careful too. If you're wanting to start one from scratch, make sure there's not one that's already there. Exactly. That's my biggest number one pet peeve of community. We have an audience question in person. I mean, I definitely do try to schedule to meet together with a relevant meetup group as opposed to trying to oppose them on the same night. We actually, the most recent DevOps meetup in Minneapolis, we had a local go meetup was just starting up and they were doing the, there's already a go meetup, but it was really defunct. So they were trying to start one that would actually meet and they were actually going to book the exact same target venue on the same date and time as us and they were kind of approaching it through a different silo and side target. And I suppose, since we were already existing and probably could have crushed them, we could have done that. And instead I said, come meet with us and we'll feature you. And I'm trying to get to a lot of the questions online.  So I just had a couple of quick questions. The first one is we have a, so I'm Corey, I'm from St. Louis. We have a Cloud Foundry user group meetup in St. Louis, but attendance has typically been pretty like small, like typically less than 10 and most of those people are pivotal employees. So how do we increase attendance? How do we reach a broader audience? I do like the idea of having like a Paz user group. But I guess the second thought is since most of the employees are pivotal employees or most of the attendees are pivotal employees. You know, I kind of get the feel, I guess, that it's like a pivotal Cloud Foundry meetup instead of just like a Cloud Foundry in general, we run open source. Is that, are there any other meetups that are having that kind of issue? Yeah, I know St. Louis pretty well because I used to work at CenturyLink and I know some of the guys that helped organize that one. That's where we always meet. Yeah, at CenturyLink, right. The best thing to do is look at your customer base and then look at other meetups that are going on and start having them cross post for you. Exactly, yeah, the cross posting. So if there's a Java, Node, Ruby, Open Source, anything that you can join and do a co-meetup on a particular topic, like for us, we did a Cloud Foundry for PHP developers, right? And that was a crossover that we had. And it made both groups larger. They both got to meet and learn the technology and that's what we wanna do going forward in New York is there's Java, NYC, there's NYC, Ruby, things like that and by joining with those groups, it's a good way to just cross pollinate and get people aware. And I think if you look for strong meetups in your area in related topics, so the Denver Java users group and the Denver Open Source users group are both kind of related to what we're doing and interested in. So we've actually gone and done presentations at those venues and what that tends to do is drive attendance back because they wanna go deep, perhaps on the Cloud Foundry side. And we're support each other's communities and so we help drive attendance for them and in return, we get something back and so it's a win for both. And really, you can't go wrong partnering with Docker, Docker, Docker. As we're bingo, folks. That's what I was thinking, like if I could go back and say, hey, you know, say the Cloud Foundry meetup, let's start talking about Docker, Kubernetes, or like some of the other options. Yeah, you put containers in your meetup and just tweet it and have people tweet it. Just containerize your meetup. Exactly. So we are an Open Source software project and so those other projects may sound like competitors but part of our strength is figuring out how to work with them and how to make those technologies work together if users are trying to use them both. So I don't think it's bad to like feature Docker at a Cloud Foundry meetup. When considering, I just came out of a great talk at Cloud Foundry Summit all about using containers, using Cloud Foundry as a container orchestration engine and how RunC is now in Cloud Foundry. Like that would be a great talk at anyone's meetup. You could get something like that. It was standing room only three rows back is what I heard. I have another logistic old question. How do you schedule the talks? Like is it always talks? Is it sometimes workshops? Is there one speaker, two speakers? I think like the Denver meetup usually tries to have like a user story and then a technical talk. What? So we have a pretty standard format in Lopec. I don't know if it's the right format but it's what we always do. So typically we have two speakers on a night. We will open the doors at 6.30pm and we have food and drinks available for people to arrive. We start the first talk at 7pm and we offer the speaker kind of 25 to 30 minutes with Q&A, quick break, second speaker. That's also 30 minutes. So we aim to be kind of done with the talks just after 8pm. Then we have a bit more time for networking and conversation and then people leave generally around nine. And then what we've started doing is once a year, so we do it in November, we'll have a lightning talks event and we tend to have between six to eight speakers, each speaker does five minutes and what we specifically try and do at that meetup is encourage speakers who have never spoken before. So we try to get first time speakers or kind of underrepresented kind of groups to kind of come, someone to come and speak. We had somebody who spoke at our lightning talks two years ago and she's now gone on to speak all around the world at different conferences. And she came back last week and gave a half an hour talk at our session and one of our kind of audience members said it was the best talk they'd ever seen. I think we also rotate and try to pick an introductory topic. So in January, we had a couple of our regulars give kind of a cloud foundry 101 talk and it was one of our biggest attendance events of the year because over time, it becomes kind of this pent up demand to do, you know, to really get into the basics and you gather people that are new and you need to come back and address that from time to time as well. Yeah, we do that too. The Atlanta meetup is very different than Seattle. Atlanta has not, you know, traditionally a little bit behind the curve sometimes and so we have to do, mostly just meet up and get to starting to build community. We're still very much in the building community phase there and so we'll do the 101.  Seattle were afforded better, you know, not better but like more speaker availability, it seems like because we do have so many of the vendors that are there in Seattle and we do, we have one speaker typically but we meet every third Thursday of Wednesday, when every third Wednesday, so. So we have another set of questions that relates to how do you get feedback from your meetups to the broader community? What support does the Cloud Foundry Foundation and the Cloud Foundry community offer you? So how does your meetup interact with the larger world of Cloud Foundry? Both directions. I'm asking you like four questions at once. So feedback, I try to email folks twice a month, like usually when we're announcing the meetup and then we tell them what's going on but after the meetup say, hey, here's the slides, you know, what did you like? What did you not like? You know, are you interested in speaking? We're always asking that as well. As far as foundation goes, Stormy's created, pulling together, the foundation's pulling together a list of speakers who people are willing to come speak at different meetups and things like that and so that's been helpful as well. Yeah, I'll put in the pitch, if you are a speaker and want to speak at a meetup, there are a lot of people looking for speakers so I can always connect you. Always, yep. So we have a question on the floor. Yeah, I'm just wondering, how big of a factor is a beer and a draw for attendance at these meetups? Is that to help with the attendance and was it a rumor that there was possibly gonna be something here later today or? Yeah, I told y'all to go to the bar and get a beer and apparently I'm the only one who did that, so. Yeah, so don't leave. Yeah, now we have beer, Pivotal does beer and wine and we provide the food and it's usually, people look forward to that conversation for sure, it's more of a festive. Yeah, you definitely have like, one of the best practices we have now is similar to Paula's where we have the pre-networking which is the drinking, the snacks, you do the presentation and then you have the Q and A and a little more networking, even if it's not the same venue, people are encouraged to kind of go to a nearby watering hole or something like that. But you definitely, it's table stakes now, it used to be you could just do ad hoc meetups and not have beer but you have to do that now. How you know your meetup is going well is everybody wants to get together after and go drink a beer. Something I think important to remember though is if you have delicious beer and delicious food and if somebody like, say me, I like beer but I don't always want beer and if I don't want to drink a beer or my friends who don't drink beer are there and like there's literally nothing for them to drink and it's like there's the drinking fountain, that's not very hospitable. So it's important to remember that not everyone's going to want a beer at any given moment and you have some other choice. We've had sponsors in our meetup in Denver that have signed up to either provide the drink or provide the food and so that's been a big enabler so that we don't have to necessarily go hat in hand trying to find people for that. We've had some sign up for multiple events or a quarter or two quarters at a time and so that's been helpful. So I'd like to hear from everybody on this next question and that's how do you know if your meetup is successful? Like how do you know if your community is growing and is vibrant and is a healthy, happy community? Kim, you mentioned that if they like to go out afterwards and hang out together, that's a good sign. Yeah, definitely. It feels like we haven't had enough time they're kicking us out. Let's go over here and go hang out and keep talking. So I think that's always a great sign. Yeah, one of my favorite features, actually I just discovered about meetup.com is you can set up for your group that anybody can schedule an event and once three or five people RSVP for it, it's automatically announced and sometimes that's happened to me. I'm like, oh, I didn't know that happened but it shows user interest. People are getting involved. They're coming up with topics. They're presenting, just being proactive about it and that makes me excited. One good indicator I find is the regulars that keep coming back. I think it's a really good sign when you've got the same. It's not always great but to see lots of faces who are continuously interested and keep coming back and then they're spreading the word and they're numbering a few more people along with them or you'll see someone who maybe came as a new person to Cloud Foundry and suddenly they're working at Pivotal and you're like, oh, I've seen your face before because you've been to my meetup and now you're working here, which is fantastic. I think another sign of health is when there starts to be an identity so that the group itself says, hey, we don't want vendor pitches. We don't want fluff. We either want substantive technical content or real world business stories but don't give us easy stakes kind of things and so the group begins to take on an identity and demand a higher quality of content, a higher quality of speaker, not the professional pitch but more substantive content and I think that's when we saw the tipping point for our meetup is when the group began to say, this is what we want and that wasn't it, sorry. And yeah, and I think that that's totally right and also per Paula's point, not just people coming to work at Pivotal though please come work at Pivotal, Pivotal.io slash career, she saw it was on the keynote stage this morning but for not just any specific company that may or may not be assisting with the meetup but people inside your community excited about the technology, learning about it and getting jobs throughout your community using the technology as you see that happening I think that's a sign that the meetup is functioning as within acceptable parameters because the whole point of getting people together in person is so that they can do things that they're going to do in person like get these new jobs. When I think the participants of the meetup begin to be recognized for, hey I saw you in the meetup, I heard that talk, I really liked what you said and then that becomes, you become known for contributions and your company or your individual brand is known beyond just that scheduled night of the month when you're having the meetup. So that is some tidbits to give you on how to run a meetup, hopefully you were inspired to either go to your local meetup or help start one if you don't have one. To wrap this up, I have a bunch of little Lego Cloud Foundry figures, some of them have smiles, some of them have frowns, one has a beard and we're going to do a Cloud Foundry meetup bakeoff.  So shout out your meetup.  What? Denver. Denver, if you're from the Denver meetup group, stand up. So there are four, five, six. It's all of ECS teams. Me too, seven, and Mark, eight, nine, 10. All right, any other meetup group, see a friend of yours, think you can challenge Denver? Oh, that's just sad. Yeah. Nobody's going to challenge Denver. Denver's going to get the little Lego figures. Plus the first couple of people to ask questions, especially the first person that said, when we're talking about community, what's the breakdown? You can come get your Lego creature. So thank you very much for joining us. The meetups are a super important part of Cloud Foundry. They are, I think, a really vital part of how new people join the Cloud Foundry community and how companies and individuals decide to evaluate the technology and find other people to talk to. So this is a crucial part of keeping our community alive and healthy, and I appreciate all the interest in it, and hopefully you are all inspired. You know all of these people's Twitter handles, they're all super friendly, they will all answer any tweets you send them. So thank you all very much, and enjoy the rest of the conference. Thank you.


Non-exclusionary timeout. This is just like timeout. Well, hold on, hold on, hold on. Stop calling it timeout. Use the full term and you'll understand why it works. Timeout from reinforcement. So probably positive reinforcement, right? Because if it was timeout from negative reinforcement, it would get really confusing and very difficult to pull off. So timeout from positive reinforcement, timeout from reinforcement. You'll think about that for a while and you'll understand why timeout from negative reinforcement is really challenging. But you could do it if you really were skilled. So non-exclusionary timeout as much as video is actually about, which is where instead of taking the person going up, you're in timeout, put you in a box, sit you over here, right? That's exclusionary timeout. You are no longer allowed to participate in whatever nice fun social event it is that we have going on or whatever. Like for example my kiddo, he gets a little out of line once a while, timeout! And I do it like that just because it's fun. So and then I give him the time, like timeout! Three minutes, right?  That's exclusionary because he's excluding. I could also say, timeout! Three minutes and then just turn my back on him or that's kind of exclusionary. I can just let him sit there and then not talk to him and direct the rest of the children and the family not to talk to him and direct the adults in the family not to talk to him and so on and so forth. That would be non-exclusionary. It happens in the classroom too. You can put like a timeout ribbon on the kiddo, right? You engage in inappropriate response and I put a timeout ribbon on you, all right? In other words, no matter what you do, you're not going to get any amount of attention for the next three or four minutes as long as that ribbons on or something like that. So non-exclusionary, you're not removing them from the environment but you are removing the sources of reinforcement for their behavior. Timeout!


The next question comes from Harry the horse are decentralized. That's a funny name by the way Are decentralized online exchanges possible with a fiat gateway? Harry asks Let me see if there's a bit more to that question. I just have to open it up With more adoption many startup projects have been created to address the issue of centralized exchanges by introducing various Decentralized exchanges from crypto to crypto pairings where the exchange trader or customer owns the keys the exchange wallet Is it going to be possible to have a decentralized online exchange with a fiat gateway meaning? Where you can exchange cryptocurrency for national currency or is this something that could never happen? Also, what are your thoughts about the future of decentralized online exchanges over the next one two years? I think decentralized exchanges are going to become a very big part of this industry in In two or three ways that might be surprising So let me start with the last question first the future of decentralized online exchanges I think is huge Primarily because we're beginning to see the ability to launch a couple of technologies that are really going to revolutionize things One of those is atomic swaps. We already have demonstrated Demonstrated applications that can do atomic swaps between different blockchains An atomic swap is where two parties each pledge On one side of a cryptocurrency in a way that they don't need a third party or escrow system They escrow each other and then The codes that is needed to release one side Guarantees that the other side can release their funds and if neither side releases the funds then They both can get a refund after a time. It's it's a basic smart contract using multi-sign time locks It's very very similar to the type of smart contract you see in payment channels Anatomic swaps make it possible for two individuals independently to swap to cryptocurrencies And swap them atomically meaning that it's all or nothing either both transactions go through or Neither transaction goes through and neither party can walk away and steal The currency so that's that's they don't have to trust each other. They don't have to trust in any third party So that's a big development. The other big development is The fact that lightning network can be used to do atomic swaps between currencies effectively You can create a channel where you send a payment and say Bitcoin and the other party receives it in litecoin So you can use lightning network as an overlay network to exchange crypto to crypto I think these two developments are going to be very exciting So now back to your first question, which is can you have a decentralized exchange with a fiat gateway? Yes, you can In fact, it already exists One example is bisque, which is spelt B. I s Q and Bisk is a decentralized exchange that runs a peer-to-peer protocol in fact, it runs over Tor and It allows parties to escrow and then exchange cryptos for cryptos as well as Cryptos for national currencies. Here's the problem though There is a certain degree of risk whenever you exchange Crypto cryptocurrency for a national currency and the reason for that is that the cryptocurrency side is Non-reversible even if you escrow it for a while at some point when you make that payment once you've made that payment It cannot be reversed on the other hand There is no way to fully guarantee and clear with absolute finality The exchange of fiat unless you do it with cash so if if you did a fiat to cryptocurrency exchange where Someone mailed cash through the postal service, which is probably illegal in many countries and I wouldn't recommend it You could have finality on the fiat side, but then that would expose the fiat Holding person to extreme risk because why pay the cryptocurrency you need an escrow on both ends The the biggest problem is that if you for example set it up So that someone makes a cash deposit into your bank account great Then you send them the crypto then they reverse the cash deposits You'd be surprised at how easy it is to walk into a bank and say that was a fraud. I got defrauded Here's my deposit slip. I deposited cash into this bank account And can you please reverse it and they will reverse it? They'll give you back cash or move it back into another account So if you're the person who just sent crypto you're out of luck like good luck arguing with your bank In fact the moment you walk in and say hey, I gave this person crypto currency in return for that cash They're probably gonna say oh well crypto currency. I heard that's illegal. So we're not gonna help you It's also possible to reverse PayPal transfers possible to reverse wire transfers Possible to reverse credit card card transactions And in fact there is no limit as to how far back in time You can go theoretically a bank can simply pull the money out of your account if you've already spent it from the account They will simply deduct the money. You'll have a negative balance and the next time you put money in there They're gonna take from that. So even if the month that money isn't in there. They'll just take from other money like your wages Or they'll simply put you in credit and then send you letters and eventually send debt collectors after you to collect There is no time at which you can say with absolute finality That a bank deposit bank transfer wire transfer credit card transfer or PayPal transfer is final No six confirmations Infinity confirmations are not enough for fiat. It is a soft promise and it can never be a hard promise And that's why fiat gateways are always risky. What do people who are using bisque do they take a risk and As long as it's a small amount that might be an acceptable risk, but that doesn't scale


Okay, so critical vulnerabilities in network equipment. We'll be talking about the past, the present, and what I think is gonna be the future. So Raynall already introduced me. So basically, you know, this presentation, it was a bit long, so I'll just skip these parts. What you need to know from this is that basically I'm a hacker and I focus on embedded devices in enterprise software and especially network equipment. So I've hacked all kinds of network equipment. And also before we move on, me with my colleague, Radik Domanski, we have a YouTube channel where we talk about our exploits that we use in the pontoon competition where we participate regularly. And that's it for the intro, so let's get started. What are we gonna talk about today? We're gonna talk about network equipment. So these are routers, firewalls, WAF, web application firewalls, VPN switches, and everything for home and enterprise. So as you can see on the screen, we got small routers like the ones you have at home, and you got like the big enterprise stuff. So we're gonna be talking about all of this. Or are we, actually? In fact, we're gonna be talking mostly about routers.  So routers and almost every kind of network equipment, the ones we spoke in the previous slide, are very similar. They have similar technologies, they have similar protections, and they have similar vulnerabilities. And this doesn't matter if we're talking about home or enterprise devices, a router, a WAF, or VPN applies. Okay, and then you say, okay, fine, but in that case, why are there so many more published vulnerabilities in routers than enterprise network equipment? The thing is for a hacker like me and you, it's very easy to go into a shop and buy $100 router, right? But if you're not a company and you don't have $50,000, or if you cannot go through the sales of these big companies that sell enterprise routers, enterprise equipment, firewalls, you're not gonna buy an enterprise class device, right? And this is why hackers like me and you cannot get our hands on this equipment. So this equipment is not well tested, especially compared to routers. And my goal during this presentation is to show you that I think enterprise network equipment is exactly the same as routers in terms of vulnerabilities, difficulty to hack all of this. And with that said, let's talk about critical vulnerabilities, mostly in routers, but also apply to the others. So before we start, some important definitions. So most network devices have two or more physically and logically separated domains. Let's take the example of the router, which is easy for everyone to understand. In a router, we usually have two domains. We have the wide area network, the one, this connects to the internet, do or to a wider outside network. And we have the LAN, the local area network. This is an internal trusted network, right? As you can see from this picture, these interfaces are physically separated, not only logically, but physically. And they have different trust boundaries. Obviously the LAN is gonna be more trusted than the one, right? So what you need to have in mind is that most network devices, whether enterprise or home, have this kind of separation in different networks. Sometimes the enterprise ones can have many more than two, can have 10, 20. In terms of impact, one side or external vulnerabilities are usually internet exploitable on consumer-grade routers. Although some internet service providers offer protections against this, we'll talk about these later. The same for other kind of enterprise network equipment, you know, whatever is the one, the outside network they're exposed, they can usually be exploited from that side. Whereas the LAN vulnerabilities are only usually exploitable locally, but locally, so to speak, right? So when you're talking about routers in particular, let's take again the example of home router, easy for everyone to understand. You have your LAN network where you connect your phone, you connect your laptop, you connect all of this, right? And the thing is you're thinking about your home and you think, okay, a LAN side vulnerability is not very critical. Okay, but what about if you're in a coffee shop? What about if you're in a corporate LAN with an enterprise device? Then we're talking about a big internal network. And so there, a LAN vulnerability is way more critical. Another thing to have in mind, some ISP distribute routers to their customers. So when you buy internet service, you get a router. So a vulnerability that is found in this ISP router means millions of customers, all the customers of this ISP which have the same device are affected. And as we know, during these pandemic days, I don't think there's no doubt that router vulnerabilities have become much more important. Moving on, let's start by talking about the past. And by the past, I mean before 2016. So in, let's start with CV 2012 5958 to 5965.  These are basically multiple vulnerabilities that result in pre-authentication, remote code execution. They were discovered by Rapid 700 in 2012. So the result is 23 million systems were exposed on internet and most of them routers. And the root cause is a software development kit reuse. And this we'll see is a recurring problem. So what does this mean? This means that there was a platform that was built with a software development kit. This software development kit introduced a vulnerability in every router base that was developed with it. And here we can see the vulnerabilities, like two of these, as I said, there are plenty of them. And if you can read code, you can clearly see this is a very basic vulnerability. It's a string and copy. This is a heap overflow. So basically it gets the data received with UUID. So this is a universal plugin plays a network protocol. You send a request with a UUID. This UID gets copied into the heap and then you take control of the device. So all of these were one exploitable. And in 2013, when this was found out, there were no binary protections on routers. There was no NX, there was no ASLR. And these days we still find plenty of similar vulnerabilities in some very low grade ISP routers because usually in some cases the ISPs distribute very cheap routers. And this was a devastating bug because like I said, there's 23 million effective internet devices.  There's no binary protections, memory layout. So you write the exploit ones and then you can own all 23 million devices. Not exactly that, but close. Now let's talk about an older but very interesting vulnerability called Ms. Fortin Cookie, CV 2014 9222. So this is a vulnerability in embedded HTTP server. It's called AllegroSoft Rompager. Again, this was exposed to the one. This embedded HTTP server is not used to run the router software but to manage the TR069 protocol which you use by the ISP to manage your router. So as you can see because it was used by the ISP was exposed to the outside, right? The vulnerability was fixed in 2005 but it was not propagated to the SDK users because again, this embedded HTTP server was part of the software development kit. So if you develop a router platform and use a software development kit, it embeds the HTTP server, bam, you're vulnerable. And it's a very interesting one. Unfortunately, you can't go into much into details here just what's on the next slide but it's an arbitrary memory rights through a cookie. And here you have the link to the YouTube talk. I highly recommend you see it. I think pardon me if I'm wrong but I believe it was Checkpoint who had this research which I think are one of the sponsors of Norsak. So here's a slide from their presentation and as you can see, arbitrary memory rights relative to a fixed anchor. What this means is that you see this cookie here there's this 10, 73, 73, 883. This is the memory address where you write and this value that the cookies set, oh my God, one, three, three, seven hacks is the value set at two. So you send an HTTP request to this cookie and you write this thing to this memory address. I mean, it couldn't be nicer as a vulnerability. Couldn't be more impressive. Again, 12 million systems were exposed at a time this was discovered, mostly routers and the root cause is the same as the previous vulnerability. Software development kits reuse of a vulnerable one. A recurring problem still happens to this day. Okay, moving on. Why are these SDK vulnerabilities so common in network equipment? So for this you have to understand how network equipment is done. So a lot of network equipment, not just routers but mostly low-end stuff, you know, like low-end routers, low-end cameras, low-end IoT devices are not produced by the company that sells them. So when you buy a net gear camera, for example, for surveillance, this camera was not produced by net gear. It was produced by usually a Chinese, Taiwanese, East Asian third party that then produces a base platform which uses one of these SDKs which it's produced by another company and then creates the base platform. And basically net gear dealing, whoever you're buying from just slaps a different shell on it. So it looks different, a different plastic mold. Slaps a different logo and a sell it to you for different prices. But underneath, it runs the same software, it runs the same things just with different logos. And as you can imagine, because this is used for cheap devices, these third parties are very cheap. So they hire employees on the cheap. So obviously employees who are paid cheaply, they're not motivated. They might be very junior, they will produce very cheap code. This cheap code will have lots of vulnerabilities. And again, these companies because they have such a high churn, they might disappear after two, three, five years. And of course, there's no support updates or fixes because the way these agreements are made between companies, net gear and dealing, they don't even get the code of the camera they're buying sometimes. They just get a support contract when the company goes bust and then that's it. So obviously as you can imagine, this results in lots of vulnerabilities. So things these days are starting to change. Instead of using third parties, these big companies like dealing and net gear for the mid-grade and high-grade routers, they're starting to produce them in-house. But is it really that different in terms of final effects? We shall see. So in the past as a summary, we got one vulnerabilities everywhere, all of these devices, no protection. Okay, and remember, I was mostly focusing on routers showing router vulnerabilities, right? And then you ask, okay, what about other types of network equipment? It cannot be that bad, right? Wrong. So here we have a vulnerability which published by Orange Psy. If you don't know who he is, I recommend you see him, very good guy, finds all kinds of vulnerabilities. And Meixang that found a vulnerability in a Palo Alto SSL VPN Terminator. So this is a high-grade enterprise device used to connect at an enterprise level. And what they found will shock you, is a format string vulnerability. If you're not aware of that, it's a very, very 90-style vulnerability, super easy to exploit that is almost impossible to find in the wild, so to speak, these days. And the way you exploit it, it could not be simpler. Here you can see here in the bottom, you just sent a post request to the SSL manager, and then in SF profile name, here this is the format string that will be used to exploit. This is trivial, and we're talking about, I'm not gonna lie, I have no idea how much this device costs, but I guarantee you it costs over 10K, possibly 30 to 50K, maybe even more, who knows. But this is like a top-notch enterprise device. So as you can see, clear example of what I just explained applies to everything. Okay, with that said, let's talk about the present. And by present, I mean from 2016 to 2020X, what this X means, somewhere in the next couple of years, let's say 23, 24, around that, you know. So things are definitely improving these days. We got NX, no execute, which is pretty common, and ASLR, but mostly on 32 bits. If you don't know what this is, NX basically is a protection, binary protection, that means you cannot execute code on the stack. So if you take control with a buffer overflow, you have to do some extra tricks to be able to execute your code. ASLR means that, again, when you have a buffer overflow and exploit it, it's very hard to find where your code is, but in this case, most ASLR is 32 bits, and all of these protections are relatively easy to bypass. However, they do add something, right? They increase the difficulty. Then finally, manufacturers start to understand they cannot leave the one doors open, the entrusted network doors open. This doesn't make any sense. So many routers are now locked down on the one side. And ISP have also improved, they offer better protection for their customers. Some ISP have what's called carry grade NAT, which is basically like a network address translation, like the one we have in your home that allows devices on the internal network to communicate with the outside. They have that for the ISP. But to simplify, it means that you on the internet cannot connect directly to an ISP customer. So as you can imagine, this offers some protection if you have a vulnerability on your external device, but your ISP doesn't let anyone from the outside connect to you. So now let's talk about a vulnerability I discovered in 2016, is CV 20166563. And interesting about this one, I just wanted to give it as an example because it's multi-architecture and affects a lot of different devices from the same manufacturer. So this affects D-Link over 10 router models. I'm not exactly sure how many, but I remember it was 10 or more. This is exploitable only from the LAN side, so also the quote-unquote trusted side, right? And it's a multi-architecture where you have these 10 devices, they have different CPU architectures. Some are MIPS, some are ARM. MIPS has only NX stack protection. ARM has NX and ASLR 32 bits. And this is a classic old school stack buffer overflow. We do an NX bypass using Rope and you do an ASLR bypass on ARM. So here is a very brief example of how it is. This is a bit simplified, but as you can see, you've got this parse input function. It takes input. This input is an XML that comes from the HTTP server. So you send an XML request HTTP server. Then there's a stack variable, which is 2048 in size. Then this input gets converted into an XML document and then it calculates the starts and the end of what's in between this action tag, XML tag, and basically uses string copy to copy into the stack var with the length it calculated. So basically this is how not to use string and copy because you are using the input, the length of the input instead of using the length of the variable. So typically when you have this kind of string and copy where the copy is size limited, if you do it right and you put the size of the destination variable, it can really go wrong. So this is a massive blunder. Anyway, as you can see is a relatively simple vulnerability or quite simple, I'd say. But here's the thing. I spoke about 30-bit ASLR. So as I explained before, the ASLR is basically a memory randomization technique which means that when you take control of when you execute your buffer overflow, then you need to execute your code, right? But you don't know where this code is because the location changes in memory every time the program runs. But when you're talking about 32-bit Linux, this is actually very predictable. So here on the right-hand side, you see an example that I run on a 32-bit machine and you can see every time it runs, the stack location only varies by the three middle bytes. That's it, everything else is static. So three bytes are supposedly 24-bit of entropy. In practice, due to some limitations, we end up only with 12 bits of entropy. This is 4,096 possibilities where our memory location can be. Okay, but here's the thing. If you send the buffer overflow and you crash the server because you didn't hit the right address, then you cannot exploit it again, right? But some servers, especially HTTP servers on embedded devices, network equipment, they use fork. So fork, so when you send a HTTP request, the server cannot just stop and process your request, right? What if other requests come at the same time? So what it does is it forks, it creates a new process to handle this request and then keep the main process keeps waiting for others. Every time you fork, if you crash a fork process, you're not gonna crash the whole process. What this means in practice, we can try and guess the memory address up to these 4,096 times and eventually we will hit the right address because there's very few possibilities. We're talking about on average 2048 requests. So this is a computer making these requests, we're talking about five seconds, right? It's trivial to break this. Anyway, this was an example of a vulnerability in the manufacturer SDK, as I explained. Now let's talk about another one. Let's talk about logical vulnerabilities. Another example, another vulnerability I found in 2018, actually two of them, one CV 2018 5999 authentication bypass and the other 6,000 Enviram variable configuration overwrite. So this is similar to the previous, the vulnerability is completely different than the previous one I explained. However, the effect is similar. It affects all mid and high end Asus routers. So you start to see a pattern here. Like the link, all these routers share the same platform. So whereas before we had manufacturers who use third parties that use an SDK. So when one router is vulnerable from one manufacturer, all the routers from all the manufacturers are vulnerable. Now the problem is slightly different. Now we have the same manufacturer. When you want devices vulnerable, all the devices from that manufacturer are vulnerable. So we'll touch more on that later, but for now, just bear in mind, sometimes you don't really need memory corruption to take over a device. So we need to speed up a bit, but anyway, here's a very simple example. Your authentication bypass is really simple. You send a request, and typically the request is, if your authentication fails, it sends you to the login page. But the way they wrote the code is super weird. If authentication fails and you send a post request, it still takes care of your post request and handles it before sending you to the login page. So this is how we bypass authentication. We cause authentication to fail, but then send a post and then we're in. And then the other vulnerability is a configuration variable override. It's a bit convoluted, but basically if you send to this VPN upload a post request, remember we bypass with post before, we can set any kind of configuration variable on the router. And using this, we can change the administrator password. So the attack sequence is very simple. We send an HD post to the VPN upload CGI URL. We bypass authentication. We override the router's administrative password. We send a configuration packet, and then we execute code in the login via SSH, et cetera. So a good example of a logical vulnerability chain. What about one side vulnerability is these days? Yes, we have firewall bypasses. And here you have a vulnerability we used to win Pwn2Own Tokyo 2020 November, which is a bypass of the firewall IPv6 handling. So I can't talk much about this now because I promised my colleague we wouldn't. We will release a YouTube video on it. But just bear in mind that this is relatively, what's relatively common is getting more rare, but even though the one side is more locked down, there are still ways to go through if you think like a hacker, I guess. So again, what these vulnerabilities have in common, there's no more multi-vendor SDK, there's no more multi-vendor vulnerabilities like in the past, but now vendors have a common platform for their devices. You own one device from a vendor, you own all devices from the vendor. So in terms of numbers, it's quite similar. It's just a different cross-section, I guess. So in the present, to summarize, we've got land vulnerabilities everywhere. And again, it cannot be that easy network equipment, right? Wrong, it is. Look at these very recent, March 10th, March 18th, vulnerabilities in F5 big IP appliances, another big manufacturer of enterprise equipment, trivial vulnerabilities, look at this. This is, okay, I think you should look at this offline, but anyway, it's basically a very simple exploit, the simplest you can imagine on this side. In here, we have an even simpler command injection. It's a joke of vulnerability, honestly. You wouldn't expect this on thousands of thousands of dollars enterprise device. And in here, we have more on Cisco devices, Dreitech core enterprise routers. So yeah, basically you can see the pattern here, right? So let's talk about the future. What do we have for the future? So land vulnerabilities will become much harder to find an exploit. Once we have more 64-bit processors, we'll have 64-bit ASLR.  You need an extra information leak, an extra vulnerability. So again, we up the skill level. So we start to have stock cookies, railroad, binary relocations, pointer signing, all of these are being implemented in high-end network devices, and they will soon start to cascade down to mid-end and low-end devices. But even so, you have to understand that manufacturers, they want to provide more features, you know? So a lot of these manufacturers, let's be honest, they're terribly incompetent, but a lot of them, they're not, they're just, you know, but they have to achieve a balance between usability and security. As security professionals, we all know that if you get more security, you sacrifice usability. There's no way to get both at the same time. You've got to achieve a balance. So that's why we have, there's going to be a trade-off, and this is going to introduce vulnerabilities. Because of this, but because there's going to be more high-end, more high-end binary protections, I predict the high-increasing logical vulnerabilities. So it'll be more like the one I showed before in the ASLR router, no memory corruption, bypasses, et cetera. Another thing to have in mind is that manufacturers are starting to feel the pressure from government bodies, especially in the U.S. So they're starting to have to do proper pentas, fuzzing, and spend some of their money to hiring good researchers, which they don't really like, to be honest. So what about one vulnerability is? Will this become impossible to exploit? Well, I think the common firewall bypasses like the one I alluded to, that we did in Tokyo, are going to be dead soon, because they're quite easy to patch. And manufacturers are starting to completely lock down the one side, the external side. I also predict that ISP attacks will become more common. So an ISP internet service provider has a huge hidden tech surface, a huge infrastructure. It includes a lot of specialized network equipment that has never been touched by hackers because let's say you got three grades of network equipment. You got the consumer grade that we discussed here. You got the enterprise grade that we also discussed here.  So if a consumer grade router costs $100, an enterprise router costs $20,000, $50,000, ISP one can cost half a million. So we're talking about the highest end of devices. And these devices, again, they have not been touched by hackers. And as we've seen in the previous slides, just because they're more expensive, doesn't mean that they are less vulnerable. In fact, I'd argue they are more vulnerable because hackers like you and me cannot touch them.  So next steps, what can we do as attackers? We can go down the layers a notch. So we can start attacking the IP stack, internet protocol, attacking Ethernet stack, attacking Wi-Fi parsers, Bluetooth, all of this. We're gonna have to start thinking about remote kernel exploits. And another thing we have to start focusing on vendor specific functionality. So, you know, vendors, they do a lot of customization. You know, they get Linux or they put it on their network devices and then they build the kernel modules. So they add kernel modules. They introduce proprietary network protocols to accelerate these protocols. They put these protocols in the kernel. So this increases a lot of the attack surface. And you see a lot of this in high-end devices, you know? And here's an example. So we can see an example of what I just said. So Wi-Fi compromised, another using AirDrop on iPhones, which is Wi-Fi too. We got a Bluetooth vulnerability. So I suspect these are the next juicy ones that we're gonna see. But again, these require a high level, a high grade of attacker. So let's finish with a comparison. On one side, we got consumer routers. On the other side, we got enterprise network equipment. What we got on consumer routers, we got shared SDK or platform. One device is vulnerable. All devices from the same vendor are vulnerable. Is this true in network equipment? Yes, it is. Palo Alto, Cisco, Barracuda. They have devices which share many, one platform shared by many devices. So we got implicit trust and less protection on the LAN siding routers. Do we have this on enterprise? Yes, we do. We got LAN networks. You got management networks, which have less protections than the one. Which by the way, you don't need. You can apply almost the same protections. On consumer routers, we got inadequate binary protections. We can SLR, no sandboxes, we have seen services running as root, et cetera. And yes, we do have this in the presence of equipment, sometimes worse than consumer grade routers. Consumer routers, we have recently reported 90 size vulnerabilities, like the Stack Overflow I described. We have that on network equipment. Yes, we do. Remember the orange side format string bug. Routers, we can get very cheaply and easy, available for everyone to buy enterprise equipment. Nope, we cannot. So I think pretty clear here, and I hope I was able to convince you that there's a clear pattern here. And there's a lot of these vulnerabilities just waiting to get popped, if you have the money and or the connections to get these devices. And of course, because we cannot not only think as attackers, if you work for an ISP or something like that, just have a think about this. Have a think about what devices, those black boxes that costs dozens or hundreds of thousands of dollars in your network do. That's pretty much it.


Originally, they couldn't pay the back out due to some deployment taskings, but the idea is we would find a suitable landing location. Handle the drop, these guys are static line, whichever they want to do. Once the link went onto the highway, they'd run a tactical LZ survey, and they'd shoot it back to us via data link, and then we can land.


So a few weeks ago, I finished my Ryzen 3,900X Linux video editing workstation with 10 gig networking. But I wanted to first talk about the layout of this, that's why I'm in a weird position so to speak. I have a triple screen setup and one of the things you're going to see when I launch some of this, I've condensed most things down to one screen, but a few things do launch on the other and I drag them over. But I've been really impressed with this system. So let's get into and talk about, you know, how this all works and real quickly I'll leave a link to this video. But if you don't want to watch it, that's fine. We'll just run down the parts list real quick here. So the Ryzen 3,900X, of course, the Ballistics 32 gig of 3,200 megahertz CDR4, the Cooler Master Hyper 212 EVO Cooler, which despite what someone had said the EVO will not tame that 3,900X actually works perfectly fine. So to DJV in-con, sorry, you are wrong. It works perfectly fine. I'm not, I have no regrets about these hardware choices. Yes, I did go with the Gigabyte X470 or Ultra Gaming, not the 570. So no, I don't have the full PCIe 4.0, which just wasn't a concern for me. I saved some money doing that because this board was on sale. Anyways, Western Digital Black 500 gig NVMe. And that pretty much concludes it with the one thing that I hope people have mentioned, I do have this Asus, and I've had this for a while, XG C100C 10 gig networking that is plugged into the Ubiquiti Networks US 16 XG. Now, a few people have comments saying that it throttles on them. It overheats. And I don't know if that's a Windows problem, but I have not experienced it in Linux. And what I was doing even before we started recording here is here is 3.8 and my computer is 3.9. So we're going to go ahead and I prefer to show the connection speed to it. So it's been really amazing. Let me show a scroll back. I've been running it over and over again just to try to get it. And of course, the computer has been on. I've been editing and still recording and doing everything across this 10 gig connection. It's not throttling. It seems to be pretty consistent at the full 10 gig speed without a problem. So I'm going to do maybe some tests later and see just how warm it gets, because I do know some of the 10 gig cards do have larger heatsinks or fans on them. But for daily usage, even peaking it out with iPerf, it seems to work perfectly fine. I haven't had an issue with it. So I get that out of the way. Now, as far as actual workload on this, a lot of my times I've been Caden live, but I thought I'd show something else that's pretty novel. I also do because this is my workstation I do everything on. I have virtual box, which I have pulled up over here. And I usually control it from one screen and launch it over here. So we're going to launch Windows 10. And I've opened up a few things, so it's not cashed or anything like that. This is to show how fast Windows 10 in a virtual environment boots right up with this NVMe drive is I could give you some benchmarks and talk about, you know, what exact speed it gets. But this is impressive when you look at it and say, all right, it's not just about speed. It's this. I do know Windows does this. And I think it's because I have a remote session that waits. It doesn't let me type right away. I don't know why, but it did that before I upgraded as well. It thinks before it lets me put my pen in, but it's responsive. Like it can do and switch other users like this user, but it won't let me type the pen in. I don't know. That's kind of puzzling. The keyboard is working because I could use the keyboard, but you can get an idea just how fast Windows. Oh, I just apparently decided to load an update, which is, you know, this is why I don't run Windows. I keep Windows in its own little virtual environment. So you can, we'll keep this going in real times. It should be almost there. Thanks, Windows, whatever you're doing. No, skip for now, whatever these things are. Here we go. Now we're in the desktop. We'll switch to the other user now. Actually, we'll just restart it. So it, yeah, someone else is going to create a restart anyways. Go Windows, go. And you wonder why I run Linux. So we'll let this reboot in real time here. But all of my editing workflow we're going to get into next. That works really well. I don't use Windows for anything other than usually in testing of things, seeing if they work. And sometimes I have to do some troubleshooting for a client. So I'll take a snapshot of it and run it inside of here. Oh, now it's logging me right in this time with this user. Yeah, whatever. You get the idea of how quick it can log in versus the user, the other user I have set up on here. And Windows is responsive as Windows is. I can open a browser, surf the web, et cetera, et cetera. It all just works. So that is one impressive feature. Let's talk about my actual video editing workflow, but we'll open up Kaden live for that, which by the way, we can launch that even while we're waiting for Windows to do whatever Windows is doing. So this is open now. Now all of my files reside on the FreeNAS that are connected via 10 gig through the Unify switch. And I've talked about some of my setup in the back before. So let's open up a video here and there, we just loaded that project. It's only 12 minutes of video and I only record at 1080, 30 frames a second. So the files are not massive files, but you get the idea here. It loads like really, really fast. And I've had no problem cutting, trimming, removing things through the video and doing the editing. It's pretty immediate with this. So we'll go ahead and we'll jump to something new. Pull in instead of that, we'll pull another project in. I'll see if we pull this up. Here's that video with the VLANs. Here is the workflow. If you're curious how it works, we record in the studio computer. It gets dumped to the FreeNAS and then I access the FreeNAS from my computer to pull in the different clips of the editing. So here's the HA follow up video. Pull that one in and we'll pull in the other one here. We'll drag this on there. You can see it just flows. Like we're not waiting for anything on this. And yes, you can do. My channel is pretty much all edited on Linux. I think of the 840 something videos I have uploaded, only a couple of them were done without Linux, maybe. Pretty much everything was done. I tested a couple of other tools trying to do something. And I don't actually, I don't know that I even left any of those videos up that I was doing for testing. But my production videos were all done with Cayden Live, about 90% of them. I was using OpenShot and I went back to Cayden, because Cayden Live was really crashy, tried OpenShot, moved back to Cayden Live for my workflow, love it. I probably should do some more tutorials on it because I want more people using it. I've donated to Code Sprints with them. It's just a great product. And it's so easy like to, a lot of my editing flow is mostly this. I look for dead spots going, I must have been umming or not talking here. So let's cut that out. Slide that over. We don't want the beginning of this one. So we can change back and trim this, trim that one out. But you're going to get the idea. So there's 10 minutes of video here, so we reduce it a little bit. And so there's eight minutes of video. Let's say we wanted to render this, we're going to hit render. I will choose MP4, the preferred format for YouTube. And we'll just call this. Let's add some letters after it. Render to file. And we'll actually do it like this. We'll pull up htop, give you an idea. So it's getting started here, pinning up all the cores, spinning them all up. And it's going to take just a few minutes to edit out this video. Looks like it's going to take about what lesson. It'll actually starts out with a high number and then quickly reduces once it kind of gets the calculation for just how fast it's going to render. But a 10 minute video seems to take me about three minutes, four minutes to render for every 10 minutes of video, depending if I've applied any extra effects to it. But the workstation is impressively fast. Now another workload that I do on here for content creation. I have a podcast, a Sunday morning Linux review. So we'll close this here. And let's pull up the Sunday morning Linux review. So go to here at a home, SMLR, the last episode, which I know is about an hour and 15 minutes long. We're going to open up Audacity. Now Audacity opens really fast, but it pauses on the logo. Other than that, yes, it launches really fast. So there's Audacity. Pull in the raw file. That gives me a little warning. Do you want to read the raw file? Absolutely. So there's an hour of audio. Whoops. We'll hit Control A, Effect. And the two things we like to do is we're going to normalize it. So we're going to normalize the audio. So that's going to take me laps time five seconds. All right. So we normalize an hour of audio in five seconds. And then we'll go ahead and Effect. And let's Compressor. Hour of audio compressed. And it's going to take about 25 seconds to get that done. And by the way, the computer is completely responsive while I'm doing this. So that's running the audio compressor here. We're still recording. Matter of fact, I'm also loading up the computer because we're running OBS, which is utilizing the screen to record on this. So everything's going really smooth. It's not like laggy or anything like that. And here we go. We have this done. And then finally, I always do my thumbnails in GIMP. So go ahead and open up GIMP. All right. GIMP opened up. Let's open up a file to edit here. And once again, this is how I do my thumbnails. GIMP just works. It's so fast. Of course, video editing versus graphics editing completely different when you're comparing it to. It doesn't take much power, relatively speaking. But no problem moving things around. In case you're wondering how I get things in here in my workflow, this is something that a few people don't know about. But if you typed in like Apple logo, then we go to an image search tools, transparent. I can take a transparent background and then while something has a transparent background that's an edit, paste as new layer. And we'll go ahead and resize it real quick. And you get the idea. Now I've quickly added in another logo or however you want. And then you just control the layers on there and make it look all cool. But I just wanted to follow up to say that, one, the system works wonderful after a few weeks. Two, I've had new problems running it on. Pull up the about page. Show you real quick. The Papa West in 1904 with the kernel 5 point. What is exact kernel on this one? It's 5 points. Let's say uname-a.  Now I know the video card is a weak point, but it doesn't really matter to me because nothing I'm doing other than driving these three monitors and recording stuff, it's nothing GPU intensive. I don't see any screen tearing. Editing your videos is no problem. I don't have any lag issues or anything that makes me think I need a newer video card. And Kaden Live has limited GPU support. So it's not like I'm really too worried about the GPU processing power. It's not something that seems to be a big priority in terms of Kaden Live's development process in doing that. So if they ever get to where they need GPU and I need a faster one, hey, I'll buy it, but for now it just would make no difference on my editing at all. They do have some ways you can apply some effects with the GPU, but it's a very beta feature and I found it to be very crashy. So I kind of skipped out on it because stability matters a lot.  So you save a lot and you don't want it to mess up. And I kind of comment on this because I was talking to one of my friends who does edit on Windows, not a YouTube friend, and they are complaining about how many crashes Adobe has and it's actually over the years, Kaden Live went from a system that crashed a lot to the last year has been amazing. We've watched the steady development of it and it just does not crash near as much as a matter of fact, it hardly ever crashes. There's only a few edge cases that are repeatable where there's a scenario I can do if I slice it a certain way it might crash, but it's not a way that I normally do so I just don't do it that way. You slice from the top instead of from the bottom. It was like a weird flip problem. I guess you could say, you always slice from the top and it doesn't crash, slice from the bottom and it may give an error. So those little workarounds have been pretty minor but as far as content creation, everything else as you may have noticed last couple of weeks I've been busy cranking out some videos and this system has been rendering all of them and just been trouble free and not noisy despite what people said about that Evo 212 my computer is about two feet between the microphone and the computer so you're not hearing it now. Even when I render something that's pretty big like a longer production or a lot of videos it hasn't been an issue. You hear the fan spin up a little bit but not enough that it would actually disturb me but all the parts I listed obviously are 100% compatible with Papa West. I mentioned that in my other build video but by in turn they're also compatible with Ubuntu so this Papa West is built on Ubuntu and it's a lot more than a facelift that's one of the reasons I keep using Papa West I've been really happy with it it's been great for it does a little niceties that they add on to the interface and with this latest one with new Nome and everything else sliding things around it feels a lot more not just because it's Verizon but when I went to the 19 version I'm gonna say it feels a lot more responsive a lot more snappy because I ran the Ryzen for a little while with the 18 version 18 long-term support version before I moved to 19. I just want to try it out make sure when they stability problems they don't want to change too many things at once because what I did was clone this so I didn't have to reset anything back up I just cloned my SSD to the MVME and then my friend helped me expand you can expand an LVM encrypted drive on the fly to the larger size don't ask me how do some googling or ask my friend maybe he'll help you too but Jay from Learn Linux TV he's probably, I don't know if he has any LVM tutorials but he actually helped me figure out what I was doing wrong when I was trying to expand the LVM myself and it just failed as I made some mistakes along the way sometimes you fricomit a command line switch or two but nonetheless a little Google foo and a little bit of Jay's help and I got the whole drive expanded so and everything's working great but that's what this follow-up video is just to say that yes it all works no it's not too noisy these parts seem to work really really well together so if you're looking for a Linux compatible system desktop to build this is great I'm not much of a gamer so I can't really speak to any gaming performance on it but I know that graphics card would be a killer hang up if I were a gamer all right thanks thanks for watching if you liked this video give it a thumbs up if you want to subscribe to this channel to see more content hit that subscribe button and the bell icon and maybe YouTube will send you a notice when we post if you want to hire us for a project that you've seen or discussed in this video head over to launchsystems.com where we offer both business IT services and consulting services and are excited to help you with whatever project you want to throw at us also if you want to carry on the discussion further head over to forums.lornsystems.com where we can keep the conversation going and if you want to help the channel out in other ways we offer affiliate links below which offer discounts for you and a small cut for us that does help fund this channel and once again thanks again for watching this video and see you next time


white things with a heart rate monitor. So are you saying this is the first analog watch with heart rate monitor? Yes, we believe this is the first analog watch with a heart rate monitor. What makes it exceptional is a 25-day battery life. So it's got a rechargeable battery that goes 25 days without between charges. It's monitoring your heart rate every 10 minutes, so that you can put it into activity mode where it's constantly monitoring your heart rate. It also is monitoring your activities. So this dial here is measuring steps, but when you do an activity, it will automatically recognize up to 10 activities. Things like swimming, it is waterproof. Swimming, soccer, ping-pong, running, walking, it'll automatically recognize that. How does it recognize your plane's ticket? It recognizes based on the accelerometers that are inside the watch. We've taught it different algorithms for the sport. And you have one color or? There's two different colors in the 36-millimeter model. There's this one here, there's black and there's white. And then we have a 40-millimeter model here. Same functionality, but with a larger bezel. So on the outside, you have this sort of chronograph-like feature. And you have a beautiful display. What's going on here with this display? So right now you see in demo mode heart rate. So this is 70 beats per minute. And in fact, I'm getting a call coming in on my phone here. It tells me my phone, I'm getting a call from a guy called Axel Meyer. All right, that's happening live. That's awesome. So it displays information. Yes, it does. It shows text. Yes, it does.  Just gives you the name of the person, though. It does not give you the details of the text. Maybe an update could have that. Potentially, yes. Potentially, yeah. So it scrolls. Now here's an example, lunch with Thomas. And does it vibrate? It does vibrate, yes. In fact, that's what set me off when I started vibrating here. So have you had vibration before and why things smartwatch? No, if not. So the first time you do heart rate, vibration, display? Yes. Do you still have a Swiss movement? Or is it not? This is not the Swiss movement. It's not like this one. This is not the Swiss-made version, no. This is French design. French company acquired by Nokia in May of 2016 and now formerly part of Nokia, yes. Nice. How much you cast? This is US$179 for this model, and the 40mm is US$199. Which is great. Yeah, we think so. It's like a swatch, basically. Quite better. You've got a little bit more going on. That's right. How reliable is the Y-Things? The first generation, very happy with that. Very happy, yes. Very popular, right? Very popular. If you look at our scores on either the Apple App Store or the Google Android App Store, four plus stars out of five. 100 million followers? 100 million users? Yes. Millions. Millions of white things, smartwatch users. That's right. And this is the newest one. Launched, how soon? It's today. Goes on sale today. So people can buy it right now. You can buy it right now. It's beautiful. Thank you very much. Very cool. And what's the software inside? The software? You mean the code? Yeah, it's just something that can be updated and where it works. It's all based on the app. No, no. It's an over-air through the app. So through the app that... So you've constantly got... Let me try it on to Apple Play. So here's the app. It goes along with it. Is that lots of new features compared to previously what you had? No, it's basically the same features, except when you connect to a Steele HR, you get the heart rate data when you sleep. You get the activity data when you walk and you go to activity here. So I'm currently at 6,772 steps from the day, out of a target of 10,000. Is that more accurate than a phone tracker for the steps on? I think it has to be because inherently it's on your wrist the whole time. Sometimes you leave your phone on the table, right? So I believe it is. But when you move your arm around, is that more accurate than... No, I can't come on that. So then you have the steps? Steps.  It also gives you... There's a phone call coming in from the boss, for example. Nice. Is there any chance that you can... Is there any chance you can configure what goes on on the display? It depends on what your smartphone. So just now I was getting a call from a guy called Axel Meyer. So it's just about contacts? And that's... Yeah. So it comes out of your contacts. So in fact, I'm calling him back. Yeah. So whatever comes into your smartphone device will show up in the short text on the screen. We can't have the watch to make a reply. No, you cannot. You can touch the button to turn it off. Now, when does it do the button? The button just basically stops the vibrating. If you have the alarm feature in the morning, it turns the alarm off in the morning. Or when you're going to start working out, you hold down the button. This is the demo model. It won't do it. But then you go into constant activity testing as well. So it's 25-day battery every 10 minutes? But every 10 minutes we check your heart. Right. Are you able to do a shorter battery life if you do constant monitoring? If you had it constantly monitoring, yes, your battery life would be reduced. Have you said it to constant monitoring at all? No. Oh, no, let me rephrase that. Assuming you never turn it off, then theoretically it would be constant monitoring all day. Yes. All right. And then the battery will not be in so long, will it? No, it will be shorter. I don't know the answer. Something shorter. All right. Would you simply recharge it with that? Well, you have two batteries in that one. One for the watch, you do it one for the day. And an electronic one. I don't know the answer. Can I give you my card? You can.


Okay, you know You're just so special and I think we're just really meant for each other really you think so yeah, I really do Would you want to? Do my girlfriend? Are you kidding? I'd love to of course I'm so happy for you guys I just really like her you know dude. I am so happy for you know jealous or anything Why would I be jealous? We're best friends.  Who does she even think she is dating my best friend? She's not even that hot Total seven. Hey, Cal. Hey Kenny Where's Kate? What did you want to talk about? I just feel like I'm holding you guys back You have Kate and I just feel like I'm third wheeling. It's not like that. He's really cool. I guess but He's a total third wheel. I mean just think about all the time we can spend together now Like imagine it, okay? You can go to law school and we can get married and I mean like I can stay home with the kids and We can just be happy together forever Wouldn't that be great? But I set you free. I've been looking in love in all the wrong places.


This pivot table shows the number of BCG, yellow fever, DPT, Hep B, Hib 1 and 3, and MR1 and 2 vaccinations by district in the animal region from 2017 to 2021. But what if we wanted to further customize the options in the table to change its appearance and include additional elements and add a desegregation so we can see certain data at a more granular level? Let's see how we can do this. Let's start by updating the pivot table options. First, we need to open the options menu by clicking on options in the menu bar at the top of the screen. In the data tab, let's tick column totals to add a sum of each type of vaccination. Then in the style tab, we can add a title. For example, number of vaccinations given by district in animal region, 2017 to 2021. And click update. Now we can see our title displayed at the top of the pivot table and the total number of doses given for each vaccine at the bottom of each column. Columns can be sorted by using the arrows next to the column headers from the lowest to the highest number or the other way around. To display the original order again, simply click one more time. What if we wanted to view the data by district and have subcategories in the rows that show the data by urban and rural classification? A desegregation can be added to the table to show this. In the left pane, let's scroll down to the your dimension section to find the desegregation. Note that the green dots signal what desegregations are related to the dimensions already selected. In this case, we could add IPD, OPD, ownership, type and urban rural. Click on urban rural to bring up the dimension selection box. Click the double right arrow to move all options from the left to the selected field on the right. Since we want to add the desegregations to the rows, click on the down arrow next to add to columns and select add to rows. Now the data are being displayed by district with urban rural subcategories for each district. In summary, DHS2 allows you to customize your pivot table further, adjusting additional table options and adding desegregations based on the selected data dimensions to change your table's appearance and the way the data are displayed.


This paper presents a new dataset of children's dental panoramic radiographs for Cary's segmentation and dental disease detection. The dataset was created using EISeg, an efficient and intelligent interactive segmentation annotation software, and LabelMe, an image annotation software. This dataset will be useful in developing deep learning algorithms for segmenting teeth and automatically analyzing diseases. This article was authored by Yifan Zhong, Fan Yi, Ling Xiaochen, and others.