I'm going to put it on the bottom of the date, right click and paste it one, two, three. I'm going to do the same thing. I'm going to add them up. So in order to add them up and flip the sign, make it a negative number, I'm going to say negative of brackets, the 30,000 plus the 68,000 plus the 120,000 brackets. First, a word from our sponsor. Well, actually, these are just items that we picked from the YouTube shopping affiliate program. But that's actually good for you because these aren't things that were just given to us from some large corporation which we don't even use in exchange for us selling them to you. These are things that we actually researched, purchased, and used ourselves. Acer 27 inch monitor. I've been using an Acer monitor as my primary monitor for a few years now. This is the first Acer monitor that I have used after having used a series of different brands of monitors in the past. The Acer monitor has been performing well and I'm trusting the Acer brand more and more as I use the monitor. I have a 27 inch monitor, which I think is ideal for what I do, which is of course the screen recording and the editing. If you would like a commercial free experience, consider subscribing to our website at accountinginstruction.com or accountinginstruction.thinkific.com where we have many different courses. You can purchase one at a time or have a subscription model given you access to all the courses, courses which are well organized, have other resources like Excel files and PDF files to download and no commercials. So all I'm doing is just adding up the 30, the 68, the 120, then making it negative. So that's a negative 218,000. If we credit something 218, we're going to have to debit something 218. I'm going to do that with a negative of this number. Take that number, flip the sign. You could just type in a positive 218. And what's that debit going to go to? And you might say, well, we paid for labor. That's payroll. Payroll. We know that payroll usually, if we think about the past problems that we've taken a look at payroll, it goes to payroll expense usually. But in this case, we paid payroll for the youth people's work to make inventory. And that's the thing we got to kind of wrap our head around when we start talking about inventory, because a lot of people just start to think about things like payroll and utilities as expenses inherently in and of themselves. But the only reason they're expenses is because we have consumed them in that time period to help us generate revenue. In this case, we didn't consume the wages to help us generate the sales in this time period. We paid for the wages to help us to generate inventory, these accounts. So we need to debit not an expense in this case, but an asset. That asset being the inventory, more specifically the inventory that's not yet done, that being the work in process. So work in process has a debit balance. We're going to make it go up by doing the same thing to it, which in this case would be another debit. So I'm going to copy that, we're going to put that in C, C 10, right click, paste it 123. All right, now I'm going to make this a bit smaller, we're going to post this to the general ledger. So I'm going to make it a little smaller so we can see the general ledger, I'm going to scroll over here so that we can see more of the general ledger as well as our journal entry, working processes here, working processes here on the trial balance, fourth account, working processes is over here on the general ledger, fourth account, we're going to scroll down to the next transaction in U 10. So U 10 equals that 218, that's going to bring this balance up to 651, which we can also see on the trial balance. We will then post the cash cash is here, first account on the trial balance, first account on the GL, we are in the credit side R nine equals and we're going to point to that 218, that's a credit cash has a debit balance bringing the amount down to 200, which of course we could see over here as well. Now we have affected once again the working process area, we need to back that up with the cost sheets as well by job and you'll recall that by job we have the 1415 and 60 broken out in this way. So we're going to post this 118, breaking it out into the 3068 and 120 in accordance with these three jobs. So let's scroll all the way over here again to our job cost thing where we have our three jobs those three jobs being 1415 and 16 as of the what is it that's 12, 112, we are going to scroll over to the direct materials column now and break it out in accordance to what we were seeing in our data. So 30,000 of the payroll is going to this this job and you might think well aren't we we're going to expense it sometime aren't we well yeah when we sell job for 14 or when we complete it and or when we sell the inventory related to what is being made in that job in the form of cost of good sold that's how we'll expense it. So then when we have that we have 112 over here and in column AO but also in the direct labor column we're going to put the 68,000 so we're going to increase that job and then we're going to scroll down here to job 16 on 112 and in the direct labor column we will include 120,000. Notice that that the payroll is not being allocated evenly here obviously in this case we would actually know what where each employee worked why because hopefully when we attract when we track the payroll we are recording which jobs these individuals are working on when we move to the overhead that will not necessarily that won't be the case and we'll have to figure that out but we can now see that the jobs add up to this 651 that 651 is also seen on the general ledger and is also seen on the trial balance therefore we're looking good they're going to bring it back up in the taskbar to 100% scroll over to the left and see what we have next kind of skip a line we are now on 116 where it says applied factory overhead based on predetermined overhead rate of direct labor all right so here's the thing that usually people get a little bit confused on and that's going to be the overhead so what's going to happen with the overhead is that overhead is going to include a bunch of stuff that we're going to include in there including down here we'll apply this stuff in there later which is the indirect materials factory utilities factory rent depreciation on the factory if you work any kind of book problem anything that says basically on the factory if you're working a job cost or a process cost then that's part of overhead because these types of things and some of these things again are some things that people just and just have ingrained in their head that they should be an expense for example utilities expense i mean utilities we usually think a lot of people are just going to say i hear utilities that should be a debit to utilities expense but that's not necessarily the case if we're paying the utility bill because it helped us generate revenue in accordance with the matching principle then yes it should be recorded in utility expense at the time we paid it or used it but if we use that utility in order to create an asset such as inventory in this case then we need to put it in terms of the asset it needs to be included in assets then it needs to be expensed when we sell the inventory in the form of cost of goods sold so for anybody that has kind of ingrained in their head certain types of expenses as always being an expense you got to kind of rethink that and say now i mean why is utilities expense this time it's utilities being paid on the factory and the factory is being used to make inventory the inventory hasn't yet helped us make revenue yet it's an asset therefore that utilities needs to be included up here in inventory now if you think about these things though if we have a warehouse and we're making a bunch of stuff in the warehouse and they're all different in size then we can't really just take these amounts for example like we can't just take these three amounts group them together and divide by in our example three jobs because remember the three jobs are all different in size so i can't just take whatever's in overhead and and divide it out by the number of jobs and we also can't apply the utility directly to a job i don't know how much of the lighting of the warehouse we spent on any particular job so then the question is how are we going to allocate utilities to the jobs i know that we need to but we can't do it evenly because the jobs aren't evenly sized and we can't apply directly to the jobs because we have no way to do so so we're going to arbitrarily do it in some way bigger jobs should get more of the overhead smaller jobs should get less of the overhead how are we going to do that and we're going to use some kind of cost driver to do that we're going to say how do we know if a job is one job is bigger than another job one way we might say we could say well if one job takes more labor hours than another job then that's how we're going to decide how big each job is in relation to each other that's what we're going to do in this example we could also if something is very machine intensive we can look at machine hours how many machine hours does one take versus the other so we came up with a 50 percent of labor and and that's an arbitrary number so that that i mean that number we came up with it's an estimate that we came up with it has nothing to do with labor overhead has nothing to do with labor or payroll that's just an estimate to make a see and see how large the jobs are so what is happening here is we're putting money into factory overhead we don't have any in there yet but we will allocate as we go through this job those things will be allocated in here in this example and then we're going to allocate it from factory overhead to the working process based on an estimate and that estimate is based on direct labor in this case so let's see what this is going to look like basically what's going to happen is raw materials is going to go up by us allocating all this other stuff that we think is going to be expensed in the form of overhead all this miscellaneous stuff we're going to apply that to the job when we allocate the payroll to the job when we allocate the labor to the job because we're using the labor to help us do that allocation so we have working process here it has a debit balance we need to make it go up by all this miscellaneous stuff that we're going to estimate that is going to be into each job we're going to make it go up by doing the same thing to it which in this case is another debit so we're going to copy the working process going to put that on top in cell c13 right click paste 123 now how are we going to calculate that estimate well it's going to be 50 50 percent of the direct labor so I'm going to just say it equals the direct labor we just did times 0.5 50 percent of direct labor enter so we're going to allocate 109 again this has nothing to do with actual labor payroll expense in this case all it has to do with is estimating how much of all that overhead that we are going to incur and just put into the overhead bucket we should allocate to each individual job based on an estimate that we have made all right so then we're going to have a credit for the same amount negative of this number and the credit is going to go to overhead now notice there's nothing in overhead yet and that's okay we're going to allocate it to overhead as we incur the costs and then we're going to apply them to the jobs based on a predetermined estimate and rate okay so we're going to credit overhead I'm going to copy overhead and we are going to paste it 123 right here all right so we're going to make this smaller back down to 80 scroll over here a bit we're going to post this out we're going to post this journal entry to the general ledger here's the working process here's the working process up here here's the working process on the general ledger we're going to increase it by the third amount that is in there remember we did raw materials then labor now here's the working process in u11 equals we're going to point to this 109 that's going to bring the working process up in the general ledger as well as in the trial balance then we're going to post the overhead here's the overhead here here's the overhead here we're going to go to the overhead that's like the third to last account right here on the assets so we are in the credit side this case so we are going to say equals and then in cell v 25 point to the 109 that's going to make this count go in the credit direction so it looks like we're overdrawn now because we haven't applied anything to overhead yet but there's the 109 credit then we also need to back that up on the general ledger so we're going to scroll over to the general ledger we have the 109 here we need to back that up on the job cost sheet so this is the general ledger we're going to back it up on the job cost sheet so we're going to scroll over to the job cost sheets over here we got job 14 15 and 16 so in job 14 as of the 116 in this case we're going to go over to the factory overhead and we're going to do the same calculation we did in the journal entry but we're going to do it by job in this case so i'm going to say this equals the 30 000 direct labor we apply to job 14 times point five and then so 15 000 of overhead we're going to apply there all this all the other stuff the bucket of stuff then we're going to go over here to ap 11 equals the direct labor of 68 times point five so we're just using the direct labor to allocate the overhead this case we have 34 notice we're not allocating the overhead evenly idea being that the jobs are different sizes idea being that this job's a lot larger than this job based on the fact that there's a lot more hours being spent on that job so then we're going to go down to aj 20 in the factory overhead column for job 16 equals the 120 direct labor times point five so there we have that and if we highlight the 15 000 the 34 the 60 it should add up to the 109 that we recorded on our journal entry if we add up all the jobs now we now have this uh 760 of that 760 should also be seen on the general ledger under working process right there it should also be seen on the trial balance under working process right there and so we are looking good i'm going to make it large again and back to 100 on the taskbar scrolling all the way to the left we can see our next transaction now so we are on 120 120 says we have indirect labor paid and assigned to factory overhead all right so we got indirect labor so basically the question being is cash affected and in this case we're going to say yeah cash is affected because we're processing payroll again so this is processing payroll we're going to simplify the payroll entry and just say that we are paying cash at the time we process payroll and cash has a debit balance we're going to make it go down by doing the opposite thing to it which in this case is a credit so i'm going to copy the cash going to put that on the bottom of the date right click paste 123 the credit will be for the 14 negative 14 000 we will then debit something for 14 000 now you might be thinking well we already did something where we processed payroll why are we doing this uh that was direct labor you told me that was payroll why is payroll down here again well we could have processed the payroll at the same time but the difference between direct labor and in this case indirect labor is that the direct labor we know that those are people that are working directly on the job indirect labor are things that uh we can't apply directly to a job so say we have a supervisor that's supervising a bunch of different jobs and we don't know how much time you spend on any particular job then we would just put supervisor salary into overhead and just allocate it based on this pre-determined rate that we had just we've already allocated using or if there are things in the factory such as janitorial service or stuff like that within the factory then those you know maintenance and all that kind of stuff of the factory then that type of thing we can't apply to a specific job as well necessarily and therefore we're going to put it just into this


It is time for another played lately and lately I have played cosy games and when we say cosy games I suppose we mean life simulators games that are inherently cosy and these titles that I'm going to talk about in this video they are cosy. So after making that Atelier tier list video that I made last on my channel thank you guys for watching that that was so fun to make after making that video guess what I did. I restarted Lulua but more importantly I restarted Lydia and Suell and I haven't played through Lydia and Suell in so many years it was probably 2019 last time I played it. Going back to it starting fresh starting all over again there were so many things that I had forgotten in the story and I had forgotten a ton of the smaller stories regarding all of the characters in the game and it was almost like the game was a new game now all over again after a few years that can happen sometimes when you go back to a game that you haven't played in years like this one and I don't know what it is but I feel like it is better than I remember and I remember it being really good but now I'm having such a fun time playing this again where you play these two girls you can control either one of them and I know I have been talking about this game a lot on my channel but now I'm sort of surprising myself all over again with actually properly going into it and do it all from start to finish all over again and actually now I would put this game in S tier I just had forgotten a lot and I think now going back to it that it is a really well balanced game still recommend that anyways that was just a quick side note I have played recently a game that's called Alba I've had it on my wishlist for a very long time and now I had my birthday and my sister bought an eshop card from my store actually eshagaming.com I forget mentioning that I have a store where you can purchase a nintendo eshop credit cards and right now I think I have a discount code actually I'm gonna have that in the pinned comment down below if I have currently a discount code you support my channel if you purchase your eshop cards on there just so you know anyways I got a eshop card from my sister pretty big one actually so I bought a lot of games that I had on my wishlist and like now is the time so Alba was one of them and it is a game where you play a girl taking pictures of a wildlife on an island the graphics are sort of simple but still they work it is very relaxing and it's just such a chill game there's nothing that's going to stress you out with this game there are NPCs and it's very wholesome and the island has several regions with the animals and bird species that you can take pictures of so it's sort of like you are collecting the species that are living on the island into your little book that's the game it wasn't expensive bought it on sale though it's a small game not the biggest game in the world but it is absolutely worth having a look at cute worth mentioning now another game that I have just started and I also bought this with the eshop card no place like home it's called switch up did a big review I watched that and they got further into the game than I did I have just started it so actually I have no opinion so far except for it is really satisfying to clean up your farm in the beginning hours of the game after that however I lost interest sort of thing but I will play it a bit more actually because I heard from some people that the further you get into the game the more satisfying and good it's gonna be but I don't know and yeah what do you think of no place like home also like a live sim crafting building relaxing game these days I actually played it on pc a year ago I want to say but now it has been ported to the switch worth having a look at also but guys most of all for the past weeks I have been playing a game that was released months ago but it went by me just like I don't know I don't know why I didn't pick it up back in the day back in the day I mean a few weeks months ago but I'm talking about wild flowers and it's spelled like wild flowers and I do follow a few youtubers that has been talking about this game why haven't I picked it up until now anyways I picked it up and I am not regretting my choices in life I've been playing that for the past couple of weeks it is a full on live simulator where you play as Tara a girl coming from the city moving in with her old grandma to this small island community type of place to help her out with the farm but also to escape the city life because she lost her job her fiance left her and the lease on the apartment went out something like a tragic backstory anyways so she moved in with her grandma to help her out because she's old and she's a widow too many folks take the easy way out these days now wild flowers it plays just like stodgy valley story of seasons and or any other traditional live simulator where as you do all of the things that you are familiar with such as tending to your farm growing crops going fishing going mining getting to know the town's people giving them gifts increasing their friendship level with you getting to know their stories walk around there is a day and night cycle the whole shebang and I have really grown to enjoy and like the residents of this island so far I feel like I've gotten to know most of them now they are so diverse and they are so unique but maybe most of all they're all so well voice acted that I feel a stronger connection to these residents in this game in particular because of the strong voice acting and you know what every single line in this game is voice acted that makes it so much more believable what they're saying and I feel like everyone has such a unique storyline every single one of them and maybe what makes wildflowers different from most other farming sims or live simulators that I can think of is that the people's stories they touch in on such dark themes and this put me so off we don't often see this happening in live simulators or cozy games I feel like but there are tragic themes to these stories which makes sense and is both more believable and realistic and the themes of the story they can be sort of like becoming a widow at a young age stories about not feeling like you fit in stories like life turning out not the way that you thought it would cancer among other things finding dating to be difficult these topics that they're talking about and experiencing and telling me about and you know it's unique it's like the topics of conversation they are on a much deeper level than I'm used to like for example story of seasons where every single villager just said ah the weather is nice there's just much more depth in the story lines in the wildflowers but my mind's as sharp as a mmm I is sharp as a attack don't interrupt other than that in this game you chop down trees you shop for seeds you do cooking you create work stations you can actually do a tiny bit of synthesis oh my god it is a game that is very easy to understand I would recommend this game to anyone that likes games in this genre stodger valley animal crossing the cozy genre if that is a genre and I just highly recommend the wildflower so far there are lots of things to do and collect lots of side quests and there is even achievements in this game and like I said it has a day and night cycle and weekdays like Monday Tuesday Wednesday you can also find a romantic partner but I don't like any of the options that I have as a romantic partner I don't like any of the candidates you know what the NPC that I do like he's taken and it's just the best NPC in the entire village he's taken but I heard that their relationship is not doing well you see there's so much gossip in this town also the villagers are talking gossip and you're talking about each other all the time and I'm like yeah mm-hmm I am living in this place actually it's really like drawing you in there is a stamina bar that decreases when you do things like mining and working the farm and it decreases rather fast I mean if you're planning on going into the mine and do a solid amount of mining I recommend that you bring with you some food some stamina recovering food or else you'll get nowhere I found a tiny bit of performance issues uh but that was only when it was raining otherwise I think the game performs good and looks good and looks sharp for the most part you can have your day speed at relaxed normal and challenging and you know sometimes you need to speed up the day because uh later in the game or midway in the game with the main story anyway there is a place at night where you have to wait until it is night time to do the some questing and stuff so then I speed up my day speed to challenging and if I'm going into the mine and I have a plan for the day I put it down to relaxed so that I don't feel like I am in a rush I am enjoying my time in this game so much I am immersed and I feel like I am losing track of real time in real life when I'm playing wildflowers and this game has impressed me I wish there were a character customization that I could customize my main character but you are playing as Tara this is the character it's sort of like the witcher you're playing as Tara there is no character customization unfortunately which I would prefer to be honest with you I wish also that it was possible to enter people's homes which you cannot do not as far as I know you can just walk up to the door and it's closed now I can see myself sinking a ton of hours into wildflowers I already have but I can see myself playing this way more and this is the type of game where you could easily crack a hundred hours I feel like now I want to know what you have been playing lately on your search and I want to know what you think of wildflowers because I just recently now a couple of weeks ago discovered it and I'm having such a fun time I feel like not enough people are talking about this game so I thought I would bring it to your attention also I recommend it and I definitely recommend it if you're into the aforementioned games like soju valley and story of seasons maybe even ruin factory but there are no fighting in this game anyways thank you so much for watching join the discord and listen to this grisk it's there I think yeah I will see you later there's a blog coming pretty soon so stay tuned I think it's because they're Dutch oh is Lena Dutch um no Norwegian but that's kind of close right not even remotely you're funny


There have been dozens of these risk-benefit analyses lately, looking at the nutrient and contaminant trade-offs for fish. Now, fish consumption provides nutrients, but all fish also provides methylmercury, a known neurotoxin. The more fish we eat, the more omega-3s we get, but the more fish we eat, the more mercury we get, too. Mercury is a cardiac toxin as well. So while fish omega-3s are decreasing our risk of a heart attack, the mercury in that same fish is increasing our risk of having a heart attack. So studies like this look through the various species. You know, salmon has less mercury than tuna, but tuna has less dioxin. As I mentioned last year, the only truly healthy fish in the world would be one made out of dark green leafy veggies. Once upon a time, routine childhood vaccinations used a mercury-containing preservative called thimerosol. I was always surprised by parents who fed their kids tuna, yet didn't want vaccinations because they didn't want to expose their children to mercury. Well, eating a single serving of tuna, which is about a half a can, is equivalent to getting injected with how many thimerosol-containing vaccines? One hundred, a single serving of canned tuna. Sure, dietary exposure to mercury may harm child development, but if we cut down on fish, the argument goes that we may get fewer omega-3s. So these researchers get out their calculators, in a city about the size of New York, if pregnant mothers ate lots of fish, because omega-3s like DHA are so beneficial to brain development, we would expect to see an improvement in 209,000 years of children's lives, what are called quality-adjusted life years. But at the same time, the mercury in that very same fish would damage 203,000 of children's life years. So, you know, they do the math, comes out positive by hair, and we hear on the news such-and-such medical authority says the benefits outweigh the risks, eat fish. Now, of course, this does not take into account the dioxins and PCBs, which tip the scale the other way, but more importantly, why accept any risk at all? By getting DHA from plant sources, we can get all the benefit with none of the risks, all the benefit without the hundreds of thousands of life years of brain damage. This isn't unlike the dairy and calcium saying. Every time they come out with yet another study linking dairy consumption with something bad, cancer, Parkinson's, you know, they get out of saying, stop drinking milk, by ending the article with something like, you know, but one has to balance the risk of cancer, diabetes, or whatever, with the risk of not getting enough calcium, as if the only source of calcium on the planet were dairy. Where do you think the cows get it from in the first place? Plants. And the same thing with omega-3s like DHA. Where do you think the fish get it from? Plants. And we can, too. Tiny little plants called golden algae.


Being productive is not a personality trait, it is a habit and this is a habit which you too can develop and stick to very easily. Hi guys, my name is Shachi and welcome back to another video. Over the last two years I have been managing a business and a startup. Honestly this did not lead me with much choice but to be productive. However this was not something I was born with. I have trained myself to be productive with the help of my mentors, books, blog posts and tons of trial and error. So in this video I want to share with you simple things that I have picked up over the years and try and do every day to stay productive. I know the word routine sounds boring but having a fixed schedule and time for things that need to get done will help you stay more organized and breeze through your day.  It could be to meditate, to journal or to just sip a cup of tea, whatever is your thing. The idea is to have a more relaxed and a mindful start to your day so that you can be your productive best. Similarly I like to start my day by filling in my journal. Writing a few things that I am grateful for and reading my affirmations gives me an instant dose of happiness. I also like to take out a few minutes to plan my day and list down everything that needs to get done. Having this task list organized makes me feel like I can take charge of my day and accomplish everything that I want. I feel I am at my productive best when the environment around me is conducive to work. So usually for me this is clearing out my workspace, removing any clutter, setting aside a bottle of water and playing some light music. When all these things are combined I get into the autopilot mode where my brain knows that it's time to work and to cut out any distractions. So I encourage you to find your environment, your zone where you can get into this flow state and recreate that for yourself every single day. It might sound dreadful to start your day with the most challenging and difficult task but hear me out. If you have to do the task anyway, why not do it first when you have more energy and more willpower. Personally I prefer to get the important things done before noon. This way the rest of my day is so much easier and also it gives me enough cushion to handle anything which might come up unexpectedly. I have made a video on how to organize a task list, I will leave a link for that above so if you are interested do check that out. This is something which I have started doing recently and it was after I read this book that is How to be a Bouse by Lilly Singh aka Superwoman. So in one of the chapters she talks about scheduling inspiration. Basically you set aside a few minutes of the day for yourself where you can either read or watch something related to your work which will inspire you to work better, to do better and also give you the tools and the knowledge which you might need. So I try and set aside about 15 to 20 minutes every day usually when I am having breakfast to either watch a video related to my work or to watch interviews of people who I admire. Not only do I love this me time but also seeing the amazing work that other people are doing inspires me to work harder and push more. Don't recommend multitasking at all with the exception of audiobooks. I want to read more books and obviously time is a constraint so audiobooks are a great hack for this. It is such a good way to make use of your time when you are running errands or doing any other mindless work. I love listening to audiobooks when I am working out alone or I am knocking off some work around the house. I use the app Audible from Amazon, it's a little on the expensive side but I get so much use out of it that I totally feel it's worth it. I will leave a link for this app download in the description box below. So Amazon has a free trial for the first 30 days for one book. So if you are interested you can check out this app and see if it works for you. So guys these are some of the things that I do to stay productive. It is not necessary that you have to do each and every one of these things but feel free to pick whatever works for you and work on that. Is there something else that you guys do to stay productive? If yes, please comment below and let me know. If you like this video, do give it a thumbs up and subscribe so that you don't miss out on any content. I'll see you in the next one. Till then, take care and bye.


What's going on everybody? Got Kyle here relating sports cars and we are ripping two boxes for CaesarD. Got one box of 2022-2023 Daunras Optic Mega and I've got one box of Topps Chrome Platinum Anniversary Light. Good luck Caesar. Let's see what we got. We'll start with the Mega. Let's see some nice rookies here for our pink hypers in here. So you can get a nice rookie, nice Paolo. Little Chet maybe. Good luck Sir. Kevin Porter Jr. This one is Chris Paul on the hollow. Usman D'Ang, first rated rookie. Got a Jimmy Harden Express Lane on the insert. Nice. We got a pink. This one is pink hyper. Paolo. He asked where we got it. Nice one there. Caesar on the rookie pink hyper. Paolo. Probably the top rookie in the set. Max Struse on the pink. Also my guy, go magic. Nice Paolo there. Got Hemi Butler. Barton. We got a Bobby Portis refractor or hollow. This one is rated rookie Tari Eason. Got T minus Tatum. Pink Hyper is Obi Toppin and we've got Eric Gordon. Pink Hyper Clippers. They got some really good cameras on this thing. Oh yeah. They got some good cameras. Oh yeah. There's a Musa Di Abate rated rookie. Got my house Luca. Got pink hyper Seth Curry and a Kelly Ubre. Pink Hyper Hornets. Got a hollow of Tobias Harris. Rookie David Roddy. Got Donovan Mitchell Express Lane and a pink hyper Donovan Mitchell right behind it. And a purple Express Lane. Jason Tatum. Nim Hard rookie. Got a winner stays of Curry. Or sorry that's Clay. Clay not Curry. D'Angelo Russell. Pink Hyper. And a purple. My house of Tatum. Couple purple Tatums. Packin' our optic. There's a hollow. My house Jimmy Harden. Philly. Anthony Edwards Splash. Nice one there. Jaden Hardy on the pink hyper. Rated rookie. Couple nice pink hyper rated rookies and Trey Murphy on the pink hyper base. Alrighty guys. Got one more for Caesar 2022 Platinum Anniversary Light. Thank you Sean. Taking Niners in the N.T. Full Case Tomorrow with Forrest. Appreciate you Sean. Looks like this one's going to be the last one of the night guys. I don't think where those last four couple spots are going to fill up. We'll get that one going tomorrow guys. That one will move over till tomorrow. The next couple. Got the Mega Dual Case. Got a Divisions Place and Patches and a Divisions of I'm At Collegiate. We're going to have to move all those till tomorrow. This will probably be the last box we rip tonight. Again we do have Sammy coming in at 10 a.m. He'll be ripping mostly baseball in the morning. He'll be back at 10 a.m. And then Forrest at 5. Adam Wainwright, Brandon Woodruff. There is a Minidiamond Black and White Minidiamond. Jim Tomey for the Phillies. These are the Light Exclusives. Mike Trout and Brian Anderson. Rookie Tyler Gilbert. We've got a Burt Bligh-11. Have her home Bligh-11. And Gold is Frankie Monta. Summer to 50. When it's 12 of 50 on the Gold Pattern. Frankie Monta's for the A's. Has been some nice color coming out of these um these platinum lights. I've been pleasantly surprised. There's a Refractor Tom Glavin. Jose Miranda and a Gary Sheffield. Rookie Spencer Strikeout. But a Carlos Delgado. Ron Sonto and Torkelson on the Rookie Base. Royce Lewis Rookie. This one there for the Twins. Portega and Rookie is Max Cranick on the Black and White Minidiamond. Pirates Rookie. Got Stan Musial. Salvi Perez. Got a little crimp there on the base. Got a Carlson and Green. Is Johnny Damon for the Royals. That's a weird one. Green Wave number 299. 57-99. Johnny Damon. I don't remember him on the Royals ever. Kyle Schwabber. Biaz. We got a Refractor of Patrick Wisdom. Cubs. Miguel Rojas and Gossman. Jackie Robinson. John Smoltz and a Base of Alfonso Rivas. Another Minidiamond coming. It is Frankie Monta's for the A's on the Black and White Minidiamond. Got the gold. Now we got the Minidiamond. Sopeta. Taya Oscar. We've got Stephen Riding's Rookie. Blue Minidiamond to 199. Yankees. Got Julio. And we've got a Austin Meadows. Ames. Got a Refractor Rookie. Paki Norton. Albert Pujols and George Springer. A couple packs left for you. Caesar. Appreciate you. Again guys, I think we're going to call it after this one. Tony Gwynn. We got nice. Cal Raleigh on the Extractor Rookie. Big Dumper. Not numbered Extractor Rookie. Marcus Simeon and Trey Turner. Another Minidiamond. This one is going to be Minidiamond Kike Hernandez. Enrique there on the Black and White Minidiamond. Matt Brash and Beltre. Jose Ciri Rookie. This one is to 150. It's going to be a speckle of Lee Smith for the Cups. Hunter Green Rookie. AJ Alexi. MJ Melendez. Got a Hollow Christian Pache or Silver. Ricky Henderson and David Cohn on the back. Right in there. Caesar. That'll do it for your two boxes. One was Domres Optic Mega. One was Platinum Baseball Light. Thank you. Thank you sir. We'll get these right out to you.


This talk today is about how we upset someone. And that's never a good thing to have to talk about. Because when you upset someone, it means that you've done something wrong. It means that you've changed something, that they liked. It means that you've broken something, they expected to keep working. And so this is where we start from. Poor Skalsak is very disappointed. Skalsak is probably not someone you've come across before. We certainly hadn't. So we dug into what he works on and checked out his GitHub. One of his projects is PyPyCats, which those familiar with information security will be aware of Mimikats, which is one of the most popular hacking tools that gets used. He owns the Pure Python implementation of that. He's also got proof of concepts for a Cobra's attack in Pure Python and also a couple of CVEs in Pure Python. Maybe upsetting this guy by breaking stuff is not actually that bad a thing. He doesn't seem to be doing nice stuff with Python. The way that we broke him is by implementing PEP578 for Python, which is auditing hooks and can be used for security transparency. So that's the subject of today's talk. We're gonna go into details about what was changed, what's been added, and how you can use it to make people like Skalsak hackers using Python very unhappy. So my name's Steve Dower. I'm a C-Python core developer and the original author of PEP578. Also worked with a few other people on it, especially one who acknowledged James Powell did a lot of the implementation work for that and was a big help. You can find me on Twitter at Zuba. I also work at Microsoft. Hi, I'm Christian Heimus. I'm author C-Python core developer. I work with the BDFL delegate, so the person that worked with Steve to get the PEP landed. Also, I work for Red Hat and you can find me at Christian Heimus on Twitter too. So today's agenda. We're going to first explain what are actually audit hawks and why should you use them, how you can use audit hawks to improve security of your programs. And finally, Steve will go through some Windows-based example. I'm going to go through some Linux-unix-based examples and we're closing with a summary. Oh, you got the clicker. Thank you. So a runtime, oh yeah, that's pretty easy. So the runtime hooks. So it's only a small fraction of things you actually do if you want to create a secure environment for your processes and for your services. It's not a whole solution, it's a small part of the solution. With the runtime hooks, the auditing hooks we have, you can see what the interpreter is doing internally, hook into different parts with the interpreter from which files are my process opening, which sockets I'm connecting and compiling, executing bytecode, importing models, et cetera, et cetera, et cetera. By default, these hooks don't do anything, so they're just empty stops. If you don't hook any of these auditing hooks, use them, they also don't impact the performance of the interpreter, which is probably something that several of you care about. And these hooks are designed for security engineers to inspect what's going on.  And as a security engineer, if you want to take care about creating a secure environment for your services, there are multiple things you should do. First, of course, please install security updates.  And then please install security updates. Well, then do something like use a firewall, restrict your processes, and yeah, install security updates. And then don't install random stuff from the internet, actually control what you deploy on your machines, inspect what you control on your machines, don't install like a new version or don't fall trapped for like typosquatting, where somebody has a high PI picture that sounds very similar, but has actually a typo. And yeah, install security updates, please. And maybe at the end, if you have done all that and even more things, then you may think about adding all these security hooks. So let's have a look at what hooking this actually involves. We have two sets of APIs for this. It is meant to be used as a security feature. If you're that committed to doing this, you should really be thinking about compiling Python from source, controlling those sources so you know where it came from, and possibly modifying the runtime itself. The aim of the hooks is to provide a C API to make that safe and reliable, so you're not constantly modifying the full source code of C Python. There's also a Python API for hooking into these events as well, which is very helpful for testing, and there's a few scenarios where that makes sense. But these are the general APIs. So you're gonna have some kind of callback, whether in C or in Python. And then it's a simple call, it's either PySys, add audit hook, or it's sys.add audit hook from Python. That's gonna give you a callback that is called on each of these events. These events can be called from anywhere. So they will get called on a variety of operations, variety of contexts that Python may be running in, certain locks may be held at very low level, and you do need to be careful about what you're doing it, but there are, for the most part, they're not that complicated to implement now that you actually get a callback for it. The pros and cons of each of these approaches are important to consider. Obviously implementing in C is more complex than implementing in Python, but the upside is it's gonna run faster, it's going to be harder to bypass for an attacker who may be executing code in your Python that you don't expect. If you've added your hook in C, you're still gonna get those events. There's very little that an attacker can do running pure Python code to stop you from receiving these events if you've written a C hook. But it does also require compiling and deploying your own copy of Python. Now, Linux users probably not at all concerned by that because you're almost certainly doing it anyway. People running on Windows Mac OS are less likely to be doing that, so that's a bit more of a step up in complexity, but it is worth it if you're looking to enforce stronger security boundaries. Doing it from Python, of course, is very easy, very convenient. You can do sys.add-ordered-hook-print, and that will give you a printout of every single event that's going on very simply. The downside is it's per-sub-interpreter. Again, if you're not familiar with sub-interpreters, have a look at those. They're a very complex area, but if you are using a Python hook, it's only per-sub-interpreter. You'll need to keep adding it to each one, and it does run slower. You may notice more of a performance impact if you have Python-based hooks than C-based hooks. What kind of events can you expect to appear while you're running? This is a small sample. That link at the bottom has the full table of almost the full table of events that C Python currently raises. Other implementations of Python may add different events, and certain libraries that you use can also raise events, or come back to that, but here's a handful of a selection. The built-in's input function is going to let you know anytime input is called. It's also going to send a separate message with whatever is typed in. Your production server is probably not using input, and if for some reason input starts happening on your production machine, you probably want to know about that. Things like exec-import-compile, very useful. You want to know what code's running, and you especially want to know if code that you didn't write is running. We have more on that, more on being able to prevent that in the first place later on, but this is the way that you can at least be notified that someone is dynamically compiling code on your production server. Socket new, and there's a range of socket events that will be raised glob-glob, just in case. That's actually a very common thing that attackers are going to do if they manage to execute code on your machine. They want to find out what files you've got there. They want to see what tools they have access to. They want to know what user accounts are set up. If you start getting events for glob, again, if you know that your app uses glob, you can probably ignore them. If your app never uses glob and you start seeing it, that's a good warning sign. So what should you do with an event? You get the callback, what are you going to do? The first option you always have is to do nothing at all.  You can log it. You can write out the details somewhere and keep a semi-permanent or a permanent record of all the things that your app has been doing. You can abort the operation. From inside your callback, if you raise an exception, most of the time it's going to interrupt the action. So if a socket raises an event saying I'm about to connect to this address and you throw an exception, it's just going to abort it. It's going to be canceled. Your code will get an exception instead and that socket will never be connected to. So there's that option. And you can abort everything. If there's an event that you recognize that you really, really don't want to happen, you can just call exit and tear the whole thing down. But the correct answer is to log it. And this comes out of an approach to security that's known as assumed breach where a lot of people and kind of the traditional approach to security is you set up a really strong boundary so nobody can get in and then you're fine. And as long as nobody gets in, you're fine. And it turns out that the attackers are better at getting in than we are at keeping them out. And you only need one gap in that wall for someone to get through. And once they're in, if all your defenses are in that wall, you have nothing. Think about an office building. Your office building has locks on the doors. That'll keep people out. But there's also motion detectors and security cameras on the inside which are completely useless if your doors are perfect. Why are they there? Your doors aren't perfect. People all get in, want to know about it. Think of these auditing hooks as security cameras or motion detectors inside your app so that you know when someone's moving about in there. You will see legitimate people moving about in there. You need to be able to filter those out but if you're not logging it, you have no chance. Logging everything is very important. And your first instinct is probably to filter out events that aren't that interesting, that aren't that relevant and say we don't actually need to keep this. We can save disk space, we can save network traffic by not logging certain events. That's actually a really bad idea. If you have complete logs, maybe you're not checking everything. Maybe you're not constantly reading them but when it comes to a retrospective analysis, when you discover your emails being published on torrent sites or wherever they get published these days and you realize that someone's in your system, how are you gonna find them? If you have all of the logs, you've got a chance of working backwards and locating what those attackers have been doing in your system. Anomaly detection is a growing field especially using machine learning to keep kind of a profile of what events happen during normal operation, recognize when that changes, even without someone having to review every single thing that's going on. And of course, incident response. If you have a live persistent threat inside your network and you wanna find out what that's doing, what services it's approaching, what IPs it's pinging, which Twitter accounts it's looking at for its next set of instructions, having all of these in your logs already will give you that information, will help you expel them nice and quickly. Premature or log filtering is going to cripple your defense. So log everything. And as I said, there's a way to create auditing events as well. For the most part, the intent is to listen to them. But if you're developing a library, if you're developing various extensions, then it can be very helpful to create your own events so that you know when these things are going on. So there's a C API, which is based on the Pi build value API. If you're familiar with that one, takes a format string for the arguments that are gonna be passed in and the name of the event. If you have the option to use the C API, use the C API. There is a Python API, sys.audit, which similarly takes a list of arguments. It's very easy to bypass that one. You can reassign sys.audit to another function and then those events go away. So it's very useful for testing, but if you can use the native API, that's strongly recommended. We recommend in the PEP that third party events should include the module name as part of the event name, helps namespace things. If you have two modules raising the same event for different purposes, that's probably gonna cause issues. So putting the name of the module that you're raising it from as part of the event name helps keep things separated so there are no collisions. And just as a recommendation, validate the parameters you're gonna pass in first, then raise the event and then do the operation.  But it gives the hooks a chance to abort the operation. So if you notice something going on, even if you wanna quickly deploy to expel a current persistent threat, then you may have a very specific case where you want to start raising an exception for a certain IP. And if you've implemented these events in a way that the operation is already going, you can't actually interrupt that with a hook that's going to raise an exception to abort it. So you wanna try and put the auditing events after parameters are known to be valid, known to be the correct types, the correct within range, but before you actually do anything with them. And next, Christian is going to tell us about how you can just stop code running in the first place. Yeah, so a rather special case, they should not hook but a new piece of code we added the IO open code function is, if you look at how usually binaries executed with shared libraries and native fixed code, the kernel on the operating system knows the difference between yet actually code that runs on your CPU and that's data for the code. But with Python, we have like this rather bad case that PyC files are considered data for the CPU in the operating system. And this IO open code function on the first step to teach the operating system in the 10 that we're going to open something that's going to be executable code. So this is a simple function that basically bolts down to just doing opening the path we path through for binary read only and returns a file like object. So it doesn't have to be actually a file object. We have some examples later on that uses bytes IO that looks like a file, but it's not taking a file. If you hook into the C API, you can override that, but you should only do that in the beginning before you actually start the rest of the interpreter. You pass in the callback and the callback gets called with the file name and additional user data. You can add custom information to your callback. And what can you do with the IO open code thing? For example, you can verify different attributes on the file. You can check properties of the file.  You're maybe opening a pipe or a socket or some kind of special file or file on a file system that you don't expect to load any code from. You can validate the content of the file. So you can compare it to checksum. You can do this like code signing. You can make sure that nobody, while you're working on the file, does something with the file. You can lock the file content before you load it. And instead of what I mentioned before turning the actual file, you first load the content into a memory buffer into a byte's IO and then do all the operation. Because if you read it for like two times, first time to do like a checksumming and the second time to actually turn it to Python, then there's a possibility that an attacker can use a time of check, time of use attack. So if an attacker can just intercept the second reading of the file and replace the content with some notice code, that's bad. So always first do something, read the whole content into a buffer then validate the buffer and pass down the buffer down. And there's some caveats. One thing is if you implement that in C, it's executed while the import hook is hold. So you can't do another import while doing this hooking. And some calls may assume that's a actual regular file that's backed up by a file descriptor or physical file on the file system. But all the Python standard import system doesn't assume that just requires a file-like object. Some additional things you have to do if you wanna validate the files and deal with the IO open hook is also, you don't wanna have any additional code in your project that like bypasses the whole IO open infrastructure. So in Python in 3.8, we replaced all code for importing and several other things like sip import and we plan to do that for pickle with the IO open code thing. But if you bypass that in your own application using like compile exec or exec file in Python 2, well. Other parts, you wanna make sure that you load file that come actually from the file systems. You can use introspection and other file system and operating system tool to verify what kind of files you load. So if you allow like dash C, where you can just pass an arbitrary Python code or do like curl some evil side, shell to Python 3, shell and data in, then the admin has no chance to see which code you're actually executing. And also restrict which kind of environment you have like the variables can play 20 tricks with your Python program. And also for which places you allow to load code. So maybe you don't wanna allow it to read code from like temp tier when temp you're the only place where an unrestricted user can store any files on disk or a home directory. Maybe you wanna restrict that. So now we come into Windows section. Where Steve will tell you how you can hook in all the hooks on Windows. Right, here is where we get to real kind of applications and a few samples of things. So I'm gonna go through three points of integration that exist in Windows that this enables which were previously unavailable. So these are operating system features that are really powerful security features. I suspect there's a very low number of Windows developers in the room because that's fairly typical for these conferences, unfortunately. But these are features that get cheers from the Windows security-focused conferences because they're really powerful at locking things down. With these hooks, with the open code function, these become available to Python developers. And as a security engineer in those contexts you can integrate Python code in your Python apps into the rest of the security infrastructure. All of these code samples are available at this GitHub repo and so you can go and grab those. You can get a copy of Python 3.8.beta.2 and compile them and try them out for yourself. So the first one is the Windows event log. The kind of canonical example of code that you don't want running on your production servers is something like this. And in fact, this is a, well, no, this is a great example. So you'll see that it's called S-Python. S-Python is kind of the code name that we've been using for a Python that has more things enabled. There's a lot of good reasons for a development cycle to have a Python binary that doesn't have these things enabled and use an S-Python binary in production that does have an enabled. That lets your developers use a whole lot of things that might otherwise be restricted. And then when you deploy, if you don't allow that Python binary to exist it also, it takes away an entry point. There's also some interesting kind of semi-research which I haven't linked to but I probably should have, where some would say this is security by obscurity where simply renaming your Python executable hides the fact that attackers can run Python when they get on your machine and they're just gonna figure it out and do it anyway. Someone did a study where they changed their SSH port by one and saw like a 99.9% reduction in attacks. And if you think that's a bad thing then I'm gonna disagree. If you can reduce 99.9% of attacks by changing the name of something then you should just do that. So anyway, this is kind of the canonical example. If you get onto a machine and you have the opportunity to run one command that command is very often, surprisingly often for most people going to be something like Python-C decrypt this base 64 string and then execute it. And quite often that string involves opening up URL lib and downloading more files and decrypting those and executing those. In this case it just prints hello, EuroPython which is a much better option than all the rest of them. But this is fairly common. Looking at that command you can't see what that's going to do. You don't know what that's going to do. And typically once an attacker is inside Python you have no idea what it's doing until you see the results being published on, what is it? What's the site with all the passwords? Have I been pooned? Have I been pooned? That's when you find out that someone's been doing this. But we want to find out sooner. So the Windows Event Log is kind of the central event stream service on Windows. It has a handful of integrations with other more advanced features that are really helpful. There's an Event Log viewer for starters which you need to be able to actually look at the events that are in there. The valuable ones from a security perspective, event forwarding, you can configure it to automatically send all logged events to another machine and that completely prevents anyone on that machine from clearing the logs because the messages have already been taken somewhere else. You have protected event logging where all events can be encrypted immediately with asymmetrical encryption which means you can't actually read back the log on that machine. You have to take it to a machine that's enabled for it. Clearing and modifying logs automatically adds in your event. So you will be notified if someone clears a log even if it's you. Because one of the best ways to find out that someone is doing stuff on your machine that they shouldn't be is your event logs get cleared. So knowing about that is helpful but it also gives a very simple API for logging the events in the first place. Which in this case, so this is my hook for when code gets compiled, these two lines and a little bit of boilerplate that's being generated elsewhere is gonna record the event. It's gonna record the code that's being compiled and the alleged file name it's coming from. The compile function takes a parameter that says the file name. We can't necessarily trust that but the code is legitimate. We know that that's what's being compiled. This is gonna lead to the event viewer where you can see at the bottom, the event has been logged. We're compiling from a string and there is the actual code that's been decrypted from that base 64 pass into exec. And so now because that code has been run through as Python, we actually have a record of what that was. And if that's been sent to a central machine, maybe we're monitoring a thousand machines but this gets red flagged on our central server and we can see that 10 of those machines are executing arbitrary code that they shouldn't be. Now we have something to start with. We know we're under attack, we can start investigating, see what it's doing, trace it down, kick it out. From the point of view of blacklisting or whitelisting code or allow safe listing or deny listing code, the typical approach on Windows is code signing. So in short, this is attaching a signed hash of the file so we'll make a hash of the file, we'll sign that hash with a certificate where the public key is on the machine to verify against but we've signed with a private key on a trusted machine. And then we can verify that on every use. And depending on your configuration, the kernel will verify that whenever you start running a binary file. Python now with the open code function can also verify its code files against cryptographically signed hashes. Unfortunately, Python files don't have a standard for embedding a signature in them, which is the typical approach on Windows. But we can use catalog signing. So a catalog file is essentially a list of hashes and file names for a set of files. The entire catalog is signed and we can refer to that to see whether the file we're looking at has been signed and approved. The standard Python installers on Windows for a couple of versions now have included a signed catalog file for every non-binary file in the package. So if you've installed Python on Windows recently, you already have one of these catalog files that you can verify every file from the distribution against to see if it's been modified or to see if something extra has been added or disallowed. And that file looks like this. So it has a handful of various properties. This one is signed by the Python Software Foundation as with all the files in the standard distribution. And that security catalog tab, which I didn't show because it looks like a random number generator output is a list of all the hashes. So this is the code for doing it. This is literally all boilerplate. There is nothing interesting here at all. You copy paste this from somewhere just like I did. This is the interesting function call where we go, hey, Windows, can you verify whether we trust this file? And it will come back with a yes or no. And if it says no, then you don't trust that file, you abort and you get out. And what this means is we can run our build of S-Python here that has this enabled and we can import URL. We can import async.io. Those are part of the standard library. They include pre-compiled binary files that have been signed. They include Python files that are included in the catalog. And because they're all there and they match, we're allowed to import them. And then if we try and import some unsigned file, we get an error message. The error in this case has come straight from the operating system. No signature was present in the subject. You can totally replace that with a different error message. Of course, this is not a built-in feature of Python at this point. You have to add this in based on our code samples if you like. You can return any error message you like at all. And bringing this all together. In the latest updates to Windows, to Windows 10 and Windows Server 2016-2019, we now have a feature called Windows Defender Application Control, previously known as Device Guard, if you've heard that name. This allows a kernel-enforced configurable policy for allowing denying applications from running. Which is actually just a short way of saying it's a massive XML file. It allows you to use either signatures or catalog files or file names or paths or other attributes to determine whether executable files are allowed to be run or not. It's already integrated with event logging and detectors. It provides good feedback for users. So you don't just get random error messages, you get helpful messages. One thing I didn't put on that list is your configuration is signed and includes the list of people that are allowed to sign replacements for that configuration. Which is a very nice feature. It means that you can't actually break into someone's machine and replace their configuration with one that allows you to do stuff, unless you're signing it with a certificate that they previously said was allowed to sign it. So you end up with this chain of allowed configurations that keeps things really nice and secure. So how this looks, on this machine, here's my Python install. You can see S Python towards the bottom there, but I'm on the regular Python. What I've done is I've explicitly banned Python.exe from running on this machine. Everything here except for S Python is signed with the Python Software Foundation certificate, but I've explicitly banned Python.exe. So if I try and run that, then I get this big pop-up message, which admittedly is not the most helpful message, but it's better than simply saying access denied, which is what you'd probably expect. And if I try and run it from PowerShell, then I get a similar message. Program Python.exe has failed to run. Contact your support person for more info. So this is an IT configuration set up for your machine that will prevent applications from running. Like I said, big XML file, this is about half of my part of the XML file that gets merged into one that's about 20 times longer that lets the rest of Windows run, because by default you can block all of Windows from running with one of these things. This is the interesting part. We explicitly allow the S Python executable because it's not signed. We allow anything signed by the PSF, and then we deny Python.exe. And just for fun, I've denied SQLite, Ctypes, and LibSSL because that was part of my example that I was demoing with. If you grab the sample code for this and try it, for starters, I recommend doing it on a virtual machine, not your main one. But then after that you'll find that you can't import SQLite or Ctypes or LibSSL either. And so in this case, if I run S Python, it will import a whole lot of modules. There's a lot of built-in modules that are signed by the catalog file that are approved here, otherwise we wouldn't have gotten as far as the rebel prompt. But then when I import my unsigned file, it tells me it's blocked by policy. Again, that's a customized error message. You can do anything you like there. You can shut down the entire machine at that point if that's what you wanna do. It's completely custom code up to you what happens when something fails validation. As an extra bonus, I can tell from within the executable whether policy is being enforced on that machine or not. So I'm actually using that in this sample to disable the dash C command. So this is the code from earlier that was gonna say a nice hello to everyone, but I've blocked it. I've said you're enforcing code integrity policy on this, so I'm not gonna let anyone use dash C. There is an option to go into what's known as audit mode, which doesn't actually block anything, but every time you hit something that would be blocked, it's gonna log a message. So you get a nice record of everything that people are running and you can go back before you start enforcing it and whitelist all of those things that should be allowed to run. In this case, I print a different message and do let you use the dash C. This is just proof of concept that you can tell the difference from within the program. You can behave differently based on how it's configured, which gives you a lot of flexibility to integrate Python with the operating system level protections that are available. As I said, all of these examples and in fact, all of Christian's examples as of this morning are also in this repository. Feel free to go and check those out and now we're gonna jump over to some of the Linux options. Thank you, Steve. So this is mostly on Linux. Some of the examples may work on MacOS or a BSC, but I haven't verified that yet. So, one of the points I wanna talk about is first of all, quick advertising from our talk tomorrow, de-tracing system tap. So I'm giving you a talk about tracing and profiling tomorrow. And we're more about sys-logging, just a quick intro. Steve already covered most of the logging for Windows. Sys-logging is kind of similar with some more feature set, but yeah. And how to do IO open code on Linux with kind of code signing. But so, some of the prerequisites to doing that is of course, place install security updates. If you take anything from this talk, it's the first point, always update your machines. So you don't wanna run your Python interpreter or your application as a privileged admin user as root because root usually can replace files and do other stuff. And lots of assumptions are you run a way that you can't modify like your binaries easily. You also want to restrict where you can write to, what things you can write and modifying your system. Again, with unprivileged users.  So there's app armor, there's SELinux, there's Tomojo, there are different kinds to further restrict what different kinds of application a special context can execute and modify and do on the system.  And just, so first point, system that in D-trace, it's a way to tall the kernel to log what's going on. Again, tomorrow I will show more details how to use these kind of features more elaborately, but as part of the PEP578, I added markers so you can actually audit. And if you run this script here that attaches to Python and use the audit probe and just prints out the string, the first argument of the string, and if around like Python, 3-H, C-pass, you see like, okay, in the end, surrounding a command here, it compiles something and then exit the actual pass. So that's the one to integrate with system D-trace. Logging, so SysLogging is very easy on most Unix systems, you have to first open the log file which is not necessarily required, but you can configure what you do. And this is probably giving some option that in case logging doesn't work at all, it's just like maybe down it still prints something on your standard console and on SDDR. And also it locks a pitch so you want to know which process identifier does something funky on your system.  Because if an attacker was able to modify you at the pre-turn away, then the cleanup, the shutdown and the exit hooks may do execute additional code, but you would just want to kill that one. And if you're running a container platform like Docker, Kubernetes, Potman, whatever, you have to set up your container environment to have a syslog endpoint in your container. By default, you don't get that on, as far as I know, most container platforms. So that's something you should keep in mind. So how could you implement IO open code on Linux because we don't have this fancy catalog file like on Windows, which is really cool? So I came up with a rather simple proof of concept that does some verifications. For example, one thing I want to verify is that my file is actually a regular file, not some kind of socket or a pipe or something special on a special file system. And I also want to deny any kind of non-executable file system. So don't execute something that's maybe stored on the proc file system. If you have a hardened system, you often mark your temp directory as non-executable. So you can't copy a binary to that execute that the kernel will disallow that and you can do the same kind of checking also manually. I do the usual rounds, I load my file into a byte saio and then use the OpenSSL libraries, which I'll use by Python anyway, to hash the file content and then very far the file content against a special property contained in an extended file attribute. The example is also on Steve's getup repository. So what's an extended file attribute? So extended file is a feature on Linux and also Windows has something similar with things called streams. It's kind of similar. So you just have key value pairs attached to your files or directories. There are some additional properties you can store mostly arbitrary data. There's a namespace, you have usually four namespaces, you have user, you have trusted, you have system and security. The three last ones are restricted to you for something, even a kernel policy to do something with that. So I used the user one and the user attributes are controlled by something called DAC, discrete access control, better known as the standard user group, other people read what execute bits. So if you can read a file, you can also read the user attributes, you can write to a file, you can modify or create or delete extended file attributes. And the whole concept is inspired by something called IMA, integrated measurement architecture, which is something like code signing and verification, which is currently under development on the Linux channel. And just to look at that, so it's how it looks on the shell. So I created a bunch of different files using extended attribute with a hash. This is one file like the OSPI and this is my user.org.python. So the standard suggests you should use some kind of an identifier based on your domain name you own. This is the hash. That you actually get F attribute, it's file attribute to the internal API, etc, etc. So it's a bit confusing, but not that part. So example, so if I have a like modified OSPI file that doesn't match, my example will just crash and tell me, there's a mismatch during the import. And then I have a script that can be used both to generate and update the hashes. Like after updating Python to a new version, you need to regenerate these. It's a very simple Python script that just creates a new one and then I can run my example again and just it just works. And the script is fairly easy. I just have a list of file names, Python file names. So I use the hashlet model to hash the content here with SHA-566 and then use setxutro to update the hash. Yeah, that's it. So there are some caveats. You need to, if you would use that in production, you need to actually protect the ones because a user or a attacker that goes control could in theory create its own Python file and add its own hashes. So other you have to use one of the protected namespaces which I can't use easily without using special powers or kernel policy. You can also do something like a signed hash but it's going to be slow if you do the signing for every file. So the catalog files, you have like a list of hashes. The whole catalog is signed one time you do every time getting big slow or if you run a container as a application, you can also do something like blocking the syscall. So there's a tool set on a Linux kernel called seccomp which blocks and disallows to execute syscalls. And if you have to block three different syscalls here, again, tomorrow morning at 10.30, I will explain that during my talk by the Q3. And there are also some open issues with that. So you can do something with lepreload or writing like parts of your program. If you want to test that with a container, so initially I wanted to offer a container, you can play around with that, but there's some problems with how you can store the user attribute in a container image. It doesn't require that. There's an issue of that. You can also be allowing user or attacker to write to procs-solve-mem which is just a file that is actually the whole process memory of your process. Let's get broke around that. De-lo open is something that we both facing issues on Windows and on Unix platforms is that's the call you use to open an extension binary. So if you have a C extension Python model or like a C type, CFFI, library U load, that takes a file name. And there's no easy way to verify the content of these binaries without being subject to a time of use, time of check operation. And there's fun attack called snake ito which abuses memory file descriptors and deal open and the proc file system to actually download the binary and inject some stuff. And there are probably many, many more things that can go wrong. Again, there's just a small list of things that can happen. There's currently an effort to implement a new feature on Linux kernel called omae exec. So that's a flag for the open sys call. It's a hint for the Linux kernel to tell them, okay, I'm opening a file, but this file actually may be something I'm planning to execute. It contains code. It comes from GNU Linux ClipOS 4, security distribution for Linux. And there are a couple of videos and talks about that topic. And with omae exit, the kernel knows, okay, this is a binary file that maybe contain code or a text file that contains code and you have to do extra checks on that. And then you can have the kernel security policy perform additional checks like requiring to have the expert, the exude a bit on the file or deny file opening on the actual file systems, et cetera, et cetera, et cetera. So closing summary, Steve. Sure, take it. First point. Yeah. So the whole idea here is that when your security is good, ordered hooks can make it better. There's a long list of things that as a security engineer you need to do to lock down your production systems. If you miss anything on that list, this point is not gonna save you. It's probably not even gonna help you. It's just gonna end up wasting your time if you missed anything earlier. These hooks are intended to provide transparency. Security is your job. Python is going to help you with that by making sure you're aware. You can see what's going on. And along with everything else on your operating system that's helping with that, it gives you that added information to make smart decisions and to make fast decisions when the time needs it. These hooks enable the use of operating system technologies that have often been around for decades at this point, but were previously unavailable to Python. They do require custom implementation. There is some work involved. We hope this whirlwind tour has been some inspiration and hopefully extra information for that. Python now gets to play with the rest of the operating system world as far as securing and hardening things. And of course, the most important point. Well, yeah, please install security updates, please. So thank you very much for coming. Here are some helpful resources. I believe we are out of time for questions, so feel free to come and chat with us outside. We'll be hanging around just out there. Contact us on Twitter. More would love to hear what you'd like to do with this, how you'd like to be able to use it, what you want to integrate it with. So please come and chat with us. Thank you. Thank you.


So out here in Tantan we're supporting all the live US forces and all the live missions as a role to medical company. In the event that there's any kind of emergency then we're here just for treatment. We have sick call hours, standard sick call hours in the morning and in the evening for anyone that's just feeling ill and then throughout the day really we're open all day for sick call but the whole intent is to stay open for emergency processes or in case someone gets hurt. We always have medics and docs on call. We always have our radiology on call. We always have our patient administrator on call and so we just have 24-7 operations going all the time. A patient were to come in. I have a bed and two other gentlemen that I work with that's gonna work as a team to make sure they have the best treatment possible. Whoever it is and whatever the needs are. A large part of it really is managing supplies, making sure we're not running through supplies too quickly, ensuring that the providers are aware of what supplies we have available to us and at what pace we're going through them. Other than that I delegate authority to different sections, different section sergeants. Here at the role too I hear I'm here supporting some of the the physicians and nurses so some of the responsibilities that a medic like myself might have would be you know grabbing some some vital signs, pushing certain types of medications, also treating some small some smaller things like sprained joints and little sicknesses. We're that insurance policy that you hope to never ever use you know if we if someone does get sick or really injured that's what we're here for. We have that higher training so we can utilize our skill set but for the most part it's we haven't had anything that's been super detrimental but thankfully we've had been able to come through and use some of our skills people come through and have gotten sick and we got bumps and bruises we've got cough colds we've got something going on but so far it's been pretty low key that's what we like to see. Honestly it's a great opportunity to to learn to work well and play well with other people and that's that's what's always been just the positive the most positive takeaway for these types of exercises for me. Going through as a unit you help come together as a unit you start trusting each other more start building that those those bonds that go on forever it's awesome. I think number one we're we're building great relationships with us and all the guys around us wherever we are I think that's a huge benefit and also we're getting experience wherever we are where whatever we do we get to set up our stuff we get to play with it and you know see what works best for us and getting that really good hands-on experience so we can most effectively treat the people that stand in need. I think it's really easy just being in our one state doing the same thing routinely in the same train with the same people you you get accustomed to doing the same thing routinely but coming out here to a new environment with the new mission set with new people you kind of see your your mistakes and hang-ups very very quickly and are able to adjust and adapt accordingly so hopefully we can take those back home and change how we operate for the better.


Everybody force and Blake here ripping 21 22 NT basketball hobby to box number two I'm gonna show the results real quick on screen There's a link in chat for them and you can always find on the website late in sports cards calm at any time any time Let's do it two boxes.  Yep All right, force has been teaching me how to open NT. So I'm gonna try to do it this time without him having to yell at me Boom keep everything on camera They guys NC in prison basketball two box mixers come up in a bit getting real low 7 and 15 to go on those Okay, it's only one Boxing good point Nothing on top Here we go. All right starting off we have We have a mellow for the Lakers to 99 on the base 98 of 99 Nice mellow there. We have on the printing plates We have a Steven Jackson for the Warriors Black plate one-on-one nice. What was that out of a Immaculate the standard I remember that was nice. Oh We got for the Hawks Jersey treasures at a 99 tray young Nice ice tray there You know who's insane is that Pete Crow arm strong guy for the cubs. Oh my gosh. She is insane He's so good. We have for the Yeah for the Blazers Buck Williams on the patch. Wow, look at that. That's a sick patch You can tell that's old you can tell that game warring. That is so cool. Yeah, he said PCA rich peaker arm strong Yeah, he's insane That's a nasty. Yeah, that's a nasty There's a really good raised player to Oh Carson Williams Oh my gosh, you know who's actually the best put his first round pick last year, right? Yeah You know actually the best header testing Chris dad, you know him for the Orioles. Yeah, really? Oh my bro Yeah, he is impossible to get out. It's insane We have for Pistons, right? Yeah. Pistons Detroit Pistons Sadiq Bay. Nice. Nice a second year. Yeah, nice second year Sadiq Bay That's nice card coming up.  Congrats. Who has the nuggets? Nuggy nugget nugget. Oh Denver nuggets David M. Congrats David M. Nice We got for the Bulls 97 99 Yokey Noah Classic Jokey man, probably the best for the Bulls, right? Yeah Maybe a Celtics jersey we got for the Suns Jay Crowder 1299 hard to imagine it's not hard to imagine. It's not a Celtic and it is Yeah, it could be anybody Place for a lot of team nice Jay Crowder. Yeah, I was a powerful boom Boom bones is sick. Thank you rich. I appreciate that and we have for The Pacers Stephen Jackson nice Warriors earlier. Yeah, I was about to say that's my second Stephen Jackson in the box That's really nice. Yeah This is nice, right And we have one of these called again Material dual rookie material duals nice one Josh Christopher on the rookie solid hit Rockets nice one Rockets Real nice card Looks like two different same color patch, but like two different materials on the patch, which I always like Oh Yeah, she could have been jazz I was gonna say he played for like everybody. Yeah, all right guys. I'll finish it up here. Thanks again Now you're doing good, I was like I was like four minutes Josh is pretty quick That was a sick Sam's here player Josh Christopher. Yeah, he likes doing that scratch Josh Chris I Have to kick it. I hear Dwayne ask for his name and immediately think of Sam I don't know if that's a good or bad thing, but You got a carousel of hurt to ten there you go calves Dang the gold foil on national treasures just looks right. It was great with the cabs, too Basically a color match. Yep printing plate is Lakers Jerry West from impeccable The logo man Okay, see rookie Jersey or not rookie. Sorry non rookie shy Gildes Alexander to the 99 He was Tatum here, right? Yeah, yeah, no, was he Lucas here? I can't it was 1718 1819 Dual patch rookies. I hear Williams Grizzlies. Nice. I hear there's some like Little damage along the bottom frame there Yeah, I'll get an empty box wrapper for the Grizzly spot there. It's like the cut was a little rough Big jump rich I can't find another half of any box for some reason Kings rookie signatures Davion Mitchell 5 of 49 Nice hit Kings Did not expect to see him live to be honest not at all Live and on card nets Kevin Durant signatures 23 of 49 boom Sick, hey D Willie with the nets Rich gets his nicknames from 2017 cupcake cupcake.  They'd be too good, man. I would Ricky triple jersey Hornets Kai Jones to 99 The heat would for sure win at least if you went there as long as he's healthy Jumbo jersey retro materials Rockets Ralph Sampson to 99 From the haters What's your name for a ride? Actually, you probably can't even say that in chat probably not allowed to yeah Got a rick berry 1 of 49 on the auto for the uh dubs Did you look at his hair there? He's in a hurricane or something. Yeah And on the back we've got an adrian danly jazz treasure to the hall auto to 99 I think he plays for Brooklyn too. Yeah, I think Kyrie could get traded. I don't think Katie's getting traded to be honest I don't think Katie really wanted to it doesn't seem like you wanted to leave.  There's too much there Turning plates for Jerry West and Stephen Jackson. That's warrior Stephen Jackson Relics Ralph Sampson Kai Jones Zaya Williams cycle to salixander jay crowder jokinowa Buck williams trey young autos jazz adrian danly Rick berry davion mitchell steven jackson as a pacer there sadeek base second year the kd auto to 49 for the nets Josh christopher jewel jersey rookie auto rockets to 99 An rpa nugget true rpa pulled by blake. That's bones highland Nice bones. There we go more two boxers coming up. Thanks everybody