I'm Jennifer Granick, I'm a criminal defense attorney and I practice out of San Francisco, California. I'm going to talk to you today a bit about the laws that are related to hacking and I'm going to go through the fourth and fifth amendment in a very brief and sketchy way just to give people some idea of exactly what their rights are because certainly we have laws that criminalize things we do but we also have laws that protect the things we do so we'll try to look at the laws something that both is forceful good and for evil. With me today is Grant Gottfried, he is a policy analyst and I'm going to be turning over a portion of our time today to talk about the law to him he's going to discuss the electronic communications privacy act which is a law that protects your data privacy it basically email privacy so I will take questions during my speech if anybody has them. The first thing I want to do is I want to address some questions that were raised and I apologize for my complete lack of visual materials I am a leadite when it comes to PowerPoint and I forgot to tell our fine helping people who are helping with the AV stuff that I require overhead projector so you guys are going to have to imagine what I'm talking about as we go along which should be pretty clear. The first statute that you need to know about when you're talking about the federal hacking law is section 1030 we heard quite a bit about it this morning so I'm not going to really get into it but I do want to address a couple issues that were raised regarding 1030 this morning. The first thing is the question of what is unauthorized what is authorization and this is a very serious issue. I practice in this area and have represented several people who are charged with this crime so what I can tell you about authorization is this in practice the way that the courts are dealing with authorization is that if the victim says I didn't need for him to be able to do that he wasn't authorized to do it that is basically enough. So we're not really talking about a heavy standard for authorization. This raises the question that was discussed before that a gentleman who was sitting somewhere in this area this gentleman right here raised which was an excellent question it was my question but he asked it a lot better about an anonymous FTP server that's set up in a certain way it's set up in a way that the person who established it doesn't think that people have access but in fact that people do I encounter this all the time where permissions are set a certain way or the system is configured in such a way that with no tools without breaking anything people have access and the question is since the permissions were set up to allow access did the person have permission to access the system and as technical people you probably think the answer to that question ought to be yes but in practice the law seems to be answering that question no depends upon what was in the mind of the victim so that requires us to be something of mind readers at times is sort of unfortunate and then let's refer now to the very gentleman whose question that was he's saying does the law protect the stupidity of the person for setting up their server in such a way that people have access when they didn't need them to and at least as far as the criminal law is it seems like the answer to that is yes and unfortunately that requires us as law-abiding citizens to be something of mind readers where we're really trying to guess what it was that the victim meant for us to be able to do now there are some situations where you are have permission to do something you're able to do something but you kind of know that the people don't want you to do it and I had a case like this where somebody was ISP was running a buggy version of web server software that allowed you to type a certain URL and number of keystrokes into the go-to box on your Netscape navigator or Internet Explorer if you use that product and it would reveal to you the encrypted password file which then you could copy and run loft crack against and get a whole list of passwords and it was you know easy to do I could do it really anybody could do it but because they basically the way the court looks at it is you're supposed to know that you're not get supposed to get these people's password file so it is unauthorized in that in that sense I just want to run through a few other things about 1030 port scanning is okay under the law so far somebody asked about what if whether a failed attack would not be illegal under 1030 because there's no damage caused because you failed well the law does not reward stupidity when it comes to the defendant we have a word for failed attacks and it's an attempt and attempt crimes are illegal so if you attempt to break into a server and that is a violation of 1030 even though you fail you can still be prosecuted and then finally there was the question about juveniles which I was very concerned with I don't want anybody at this conference to come away from it with the idea that because they are under 18 they can break into people's boxes with impunity okay first of all we have state laws that prohibit that so do not do that because you can be prosecuted under the state law second of all I understand that the people from the FBI and from the Department of Justice have said that federal authorities cannot prosecute juveniles under 1030 but I do know for example and you all may have heard of the case involving the Cloverdale kids and this I think it's the solar sunrise case the greatest attack on Department of Defense computers that we've seen today 14 year olds from Cloverdale California and they were prosecuted and ended up getting convictions for that so there I'm not sure exactly what the answer is to that and why it is that federal authorities are saying they can't prosecute maybe they were prosecuted under federal law but through the state system maybe they were prosecuted under state law and I'm going to find that out but please please do not think that being under 18 is a pass okay tell your people who aren't in the room now and finally the right just a question about viruses writing virus or other dangerous code it's not illegal posting viruses or other dangerous codes are not illegal both because the law doesn't cover it and also because there are these cases of actual court rulings that say that code is speech and as speech it's protected under the First Amendment that we have here and enjoy the pleasure of in the United States so posting it under normal circumstances would not be illegal now there are circumstances I can imagine under which you would post code that would in her criminal or other legal liability for you for example if I posted a little link to it or download here and I said download this it's going to give you this cool neat program that's going to do something fun for you and I'm encouraging people to download and actually it's going to break their system that's the circumstance where I have the intent to transmit it I'm trying to get it to transmit it to other people's computers that wouldn't be okay but if I put up a warning like be careful this is very dangerous I'm posting it for research purposes people should be aware of this I mean you put up you know disclaimers and you're responsible about it then you should generally be a pretty okay and it's probably something of a fact specific circumstance with regards to that so those are the things I want to just say about 1030 you sir I think it's one of those prayers because you're talking about whether you know only knowingly transmitting it or intending to transmit it to cause the harm and I think it's a question I mean a trojanized program being out there without any warning I think you're really really suspect I'd be I'd be concerned basically you know these are all a lot of the technology moves really quick and there's not a lot of case on this unfortunately not many of these cases go to trial so we don't get a lot of court rulings or anything on it so oftentimes we're sort of dealing here in kind of a legal gray area and I think that that would be kind of suspect or dangerous behavior I'll take one more question please before I move on the question is and how how far will you know where the user who's Cusa is unwittingly gaining that unauthorized access and there's gonna be a question of you know know what the user knew and there's also going to be a question of how they could have known because another aspect of it is if it's so easy to get in that you don't even know that you're not supposed to be there like if there's a big welcome banner but in the person's subjective mind they're like well everybody's welcome except for people from New Jersey and you're from New Jersey and you just happen upon the site you know talking about it's not purely subjective in the victim's mind and your question was also related to how far will they go when the information is classified and the person doesn't even know the value of what they might find on the server and there you know obviously the government's very sensitive about classified information but generally they'll just look at the overall case and see whether they think they have enough evidence to meet all the elements and there is a knowledge element you can't simply be you know typing in your sleep or having no idea what you're doing and still be convicted does that answer your question okay let me move on and then we can what well I don't see how there's any I mean that's something that's open to the public so I don't see how the access is unauthorized there so maybe I don't understand your question but yeah that's what I'm saying is that if it's open to the I mean that's basically what I'm saying there is subjective in the the what the way that the courts have dealt with it is that if there's some well I think I answered it basically the way that the courts have dealt with it is if there's something that you kind of are supposed to know that you shouldn't be having like the password file even if it's otherwise very easy to access the courts may say that that was unauthorized access or you exceeded authorized access by getting this particular information and so the fact that permissions are set in a certain way or that something is open to the public is not necessarily the be all and end all of the question but if you have something that's anonymous FTP open to the public regardless of what's in the person's subjective mind that's something that's so obviously meant for public consumption I don't think they would be able to meet the unauthorized access elements of the crime and let me move on to some other statutes that I want to cover because I've got a lot to do here in a little time credit cards pin numbers blue boxes these are all possession of these things is all potentially illegal under 18 USC section 1029 which prohibits the unlawful possession of access devices pin code is an access device as is a machine like a blue box the calm mark of this crime is not just possession but in possession with intent to defraud now intent to defraud is not something that is necessarily as hard to prove as you might think because the way that courts often look at this is if you possess something and there's no real legitimate reason for having it it's susceptible to only one use and that is an illegal or fraudulent use they're going to argue that you possessed it with intent to defraud and often we've seen the prosecutor use things like people's books or manuals or other things that they're interested in you and have somebody who's got a blue box and then they've also got you know cellular phone hackers Bible or something like that and that becomes you know very powerful evidence that the person is possessing with intent to defraud it's not evidence of one's curiosity it's evidence of one's criminality so you need to be careful of things like that another statute is misappropriation of trade secrets this is 18 USC section 1831 what's a trade misappropriation let's just sum it up as theft although there's a couple of different things that fit under that term but let's just talk a little bit about what trade secrets are a trade secret is all forms of information that the owner has taken reasonable measures to keep secret and which derives independent economic value actual or potential from not being generally known to and not being readily ascertainable through proper means by the public there's your definition of trade secret and for many people this is like what else would you want to know except the trade secrets but you've got to be very careful when dealing with this type of information particularly in the employer employee context this comes up quite a bit either when somebody reveals something unwittingly or moves from one employer to another employer and has had access to proprietary trade secret information so that's just something to be careful about the criminal copyright law is at 18 USC section 2319 this prohibits unauthorized copying of copyrighted materials that are in value of excess of I believe it's five hundred dollars is the limit nowadays regardless of whether you're copying is for profit or not so that's regardless of whether you're selling it or giving it away basically if I have a copy of Microsoft Word and I make one for my dad and one for my sister and criminal so be careful with that one as well and intersection of our access to electronic communications which for an example is email or wire communications telephone calls is criminalized under 18 USC section 2702 and 2511 I just want to point out that this is really the law that criminalizes sniffers okay because a sniffer is capturing electronic communications as it comes across the wire and I want to also point out that the federal sentencing guidelines which tell you how much time you're going to do in the joint for having a sniffer are very high the base level if you don't know much about the sentencing guidelines this won't mean much to you but the base offense level is nine so you're already like way up there in those federal sentencing guidelines it's hard to get back to an area where you're going to be able to get probation for a situation like that so sniffers very bad very bad I'll take the question over again the question is if it's illegal to read somebody else's email how come the boss can do it and I'll cover that yeah I know Grant's going to cover that but in short it's the it's the business provider business exception to the statue but Grant will cover it in a little more detail and then finally I want to mention wire fraud which is 18 USC section 1343 okay wire fraud is one of the broadest crimes we have and basically it requires a scheme to defraud and the defendant transmits a wire communication and furtherance of that scheme okay so what does that bring to mind what about social engineering can social engineering be wire fraud I think that there's a good likelihood that social engineering can be prosecuted under the wild wire fraud statutes and in fact that was a substantial part of the case against Kevin Mitnick so if I have a scheme to defraud which is to obtain something I can't get like trade secrets from Nokia Motorola and I make a wire communication which is a telephone call to people saying hey you know can you set me up an account and that's supposed to help me get into the company so that then I can get the information out we're looking at wire fraud so wire fraud very broad and it can apply to a huge range of activities you gotta be really careful about something like that as well I'll take this question okay he asked me about he said well I said code is covered because that's a First Amendment thing but what about reverse engineering and this is a very good and complicated question there is a statute that relates to reverse engineering and into the digital millennium copyright act a relatively new and extremely complicated statute and this is where the DVD suits are coming from and basically what happened there is they had DCS DCSS encryption for DVDs which prevented you from playing them anywhere you wanted even from country from what machine sold in one country to machine sold in another country people reverse engineered it and cracked it so that they could play their DVDs on machines you know any machine they were they had whether they were in France or in the United States or in Norway and there are provisions of the DMCA that prohibit this kind of circumvention of copyright specifically so that's a problem with reverse engineering there's also been movements in the World Intellectual Property Organization and in the United States Congress to have laws that in effect would criminalize reverse engineering and the industry has been pretty responsive and vocal to trying to point out to legislators who are not very knowledgeable about this kind of thing how these laws could affect reverse engineering and creativity so it's kind of a gray area there's a lot of different laws that apply to it but it's not as clear as the code circumstance is but we're litigating things on that topic right now and it's it's a that's a pretty dynamic and exciting area of the law but definitely an issue I wouldn't stop reverse engineering anything right at this point in time but be aware that there are legal issues associated with it I'll take one more question the question is why does this apply to people overseas why can't you just leave the oppressive United States and go do it somewhere else and the answer to that is because a lot of these laws are are multilateral we have the World Intellectual Property Organization Treaty or the WIPO Treaty which covers a lot of these things and there's a number of countries that are signatories to this treaty which also follow this law so there are international inter intellectual property laws for example that deal with this kind of thing so it's not just a question of the United States borders but if there is other there are other countries that do this I mean there are also countries that don't enforce intellectual property laws as a matter of course and those may be more of a safe haven for this kind of thing but as a general rule it's not just about the United States there's other other jurisdictions that prosecute you as well one more question about the law and then I'm moving on to the fourth amendment so if we can affect other countries can other countries affect us and the answer to that is yes I mean we sign these movies a couple different ways first of all we can sign multilateral treaties where a bunch of different countries agree that this is the law that we're going to follow also we can through politics influence the laws that other countries pass so that their laws work clear more accurately reflect ours we have some influence over things like the Council of Europe which has a effort to make a general cyber crime statute cyber crime laws that will cover the Europe's cover Europe as a whole and we may also have individual treaties with other countries individual other countries which say that they will extradite people back to the United States for certain types of crimes so there is the long arm of the United States law can reach beyond our jurisdictional borders under certain circumstances and vice versa often because these are multi you know these these treaties go both ways so let's move on to one of my favorite topics and hopefully one of yours the fourth amendment the fourth amendment is the right to be free from unreasonable searches and seizures the hallmark here is unreasonable so it's not the right to be free from every search and seizure but only those that go beyond the pale of reasonableness the first question that you ask yourself when you're saying is this search illegal and by search what do I mean I mean the cops knocking on your door and coming inside I mean them stopping your car I mean them frisking it or looking in your purse which actually happened to me last night because I left my bag at the craps table when I came back it was gone they told me it was at security and by the time I got to the security they had everything that was in it like laid out on the table and they were inventorying it which is like a nightmare for me and that's why I dream about that at unfortunately I got there just in time and they gave the thing back to me but so the question is a reasonable expectation of privacy and that is there is no reasonable expectation of privacy that fourth amendment does not apply you have it in your house you have it to some extent in your car and your personal effects in your handbag and your wallet but you don't have it in everything and here's an example of something that you don't have a reasonable expectation of privacy in your trash so all that dumpster diving that you're doing is great and fun because you don't own nobody owns that anymore once you throw it out you've given up your ownership interest in it and it's fair game for anybody in fact Microsoft's trash is fair game for Oracle to dig through so you can dig through Microsoft's trash too and you should be on at least a sound legal footing as Oracle is of course the flip side of that is that the law enforcement can dig through your garbage so if you've got anything bad and there you might want to invest in a shredder but basically that's the first question reasonable expectation of privacy if there is a reasonable expectation of privacy the next question is is there a probable cause and probable cause means is it more likely than not that this is going to be evidence of a crime or evidence that you committed a crime so it's very is it probable that you know there's going to be evidence of a crime so it's just basically what it means and the question is the basic one it's not an extremely high standard for law enforcement to meet so if there is probable cause you move on to the next question which is is there a warrant because for searches to be legal under the fourth amendment there has to be a warrant based on probable cause now let's say there's no warrant then the question if there is a warrant then generally the search is legal unless there was something wrong with the probable cause or something wrong with the way that the warrant was issued but let's assume that there's no warrant because the vast majority of searches that occur here in the United States occur without warrant and the question is is there an exception to the warrant requirement and there's a couple of characteristic exceptions to the warrant requirement that we see all the time and I'm just going to mention a few of them the first one is the vehicle search okay this started out as a not so broad of a exception that has grown into a huge exception the basic thing you should think of is that when you walk down the street you enjoy the pleasures of the fourth amendment but the interior of your car is a fourth amendment free zone okay you don't have it there it doesn't exist there once you get in your car you're basically fair game there's a couple of reasons for that but the case law on this from the supreme court has gone so far that a passenger in a car is no if there's probable cause to believe that the driver of the car has committed a crime then the police may search the personal effects of the passenger of the car even without any reason to believe that the passenger may be involved in any kind of illegal activity so interior of car is not your safest place to be if you're hoping for the protections of the United States Constitution the second major example or exception to the warrant requirement is consent so if you let the police into your house and you've consented to it it's not unreasonable now why do people consent to be searched consent to be pat downed consent to let police officers into their house well the primary reason is because this is what police officers are trained to do they're trained to get information where otherwise they wouldn't be able to get it and believe me they're very very good at it they play upon people's need either fear of police or fear of authority or desire to appeal to appease authority in getting people to consent oftentimes i've seen where even when the person stands firm and doesn't consent to allow the police to search they'll just search anyway and then say that the guy said it was okay but where the law operates as it should um if there's no consent and there's no other exceptions and there's no warrant then there's no search and finally the other really broad category is the category of exigent circumstances um which is anything that creates such a sense of emergency that the search is authorized this can be anything from a public safety exception where if they don't do the search somebody might be injured to the situation where they knock on the door of a crack house and they hear the toilet flushing and they think that there's destruction of evidence as they flush the narcotics down the toilet that also has been held to be an exigent circumstance which would allow the police to then bust down the door and go into the house and if there's not an exception then it is an illegal search okay so that's basically a very sketchy version of the Fourth Amendment. I'm going to take two questions and I'm going to skip the Fifth Amendment because I want to make sure that Grant has time and then we'll definitely have a good period for questions at the end um so uh the gentleman in the blue shirt he's asking me whether compiled binary is also protected speech the same as source code and um I would say that the you'd have to take a look at the exact language of the case which is the Bernstein case but I think that uh basically the case has a rather broad holding which says that um because it's expressive because code is expressive it is protected speech and I think that both those examples are expressive it doesn't necessarily matter matter exactly what form it comes in as long as it has the expressive element do you need to follow up on that well I think the opinion compares the code to the wheel on a player piano which to the you know naked eye doesn't seem to mean or do anything we don't really know what that is or what the music is but it nonetheless is a uh is something that is the it creates the expression in the player piano so I like I said I think that it also would fit in under that because I think the analogy to the I think the analogy that the court's making between other expressive things and code fits for uh fits for that as well um you with the reddish hair is that okay that I said that okay okay he's asking me about um the I said that the cars with huh I said that the car he asked me about the car and what I said about it being forth amendment free zone they asked me about other things like a motorcycle or a bike and the trunk of a car and the trunk of the car also is that you know sort of fits in the the exceptions developed and initially there were different rules for the trunk of the car for the passenger compartment and all of that but generally I think and could then containers in the trunk or containers in the uh glove compartment and all of that but I think the easy answer to that is that once it's in the car um you're really looking at it being something that's searchable I can walk down the street with a box and it has first fourth amendment protection but when I put it in the trunk of the car it's gone now the sad thing about this isn't motorcycles or bicycles the sad thing about this is mobile homes okay in which people live and just by the very nature of the fact that it is mobile courts have held that the vehicle with exception to the warrant requirement applies to that even though it's somebody's house so if you can drive it away they can search it I know the law is not often definable by these very bright line rules but that's a that's pretty much basically true so um because of my time constraints I'm going to turn it over to grant right now and um we'll probably be able to have about 10 or 15 minutes after four questions bicycles and motorcycles you can move it you can search it thanks jen for a job well done as always and we will be taking more questions at the end what is akba it's the electronic crime prevention act and before I go into too much detail I have a question for all of you and that is how many of you have set up run a pop 3 imap bbs that you can send emails on or any type of email server that's a good percentage of the room you're going to find out very quickly why you care about akba and one of that is the key terms the key term in akba is electronic communication service and that is it's very well defined 2510 any service which provides the users there of the ability to send or receive wire or electronic communication the other one is remote computing service which we don't really have enough time to cover that means that every one of you who raised your hand you are regulated by akba whether you realize it or not another key term is an electronic storage and you might think that it means any data stored electronically because that would make sense well you'd be welcome it has a very specific definition and it is very key to understanding akba and it is any temporary intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof or basically that backed up so how is email protected well it's misdemeanor as it was covered to access a facility within or an excess of authority and thereby obtain alter or prevent authorized access to wire or electronic communication in electronic storage it's interesting to note here that you had it is both of those you have to access it with without or an excess of authority now there's some exceptions and this covers one of the question that the gentleman over there had was that the criminal provision does not provide to the provider your provider can read your email all it wants but there's more specifics about that that we need to get into in a minute but i'm going to cover the government first obviously the user the user has an exception if the message was intended for that user and the government if it follows the proper procedures with the provider so the provider can read all of your email but can the provider give that email to the government the answer is it's distinctive between a provider to the public and a provider to the private now a public provider is AT&T hotmail yahoo and anybody that you can buy an account from essentially or any free email provider those are providers to the public they cannot disclose content except to those shown the addresses otherwise authorized by certain state statutes lawful consent or necessary to incident to the rendition of service or to prevent the rights or property of the provider that means that if it finds an email that it feels that it could be liable for it can disclose that under the statute it can also disclose to a foreigner or to law enforcement if the contents are inadvertently obtained and appear to pertain to the commission of a crime so what does this mean well I sent you an email the email gets to the server but you're you're not at home you're out partying so you don't read the email that night where your isp backs that server up and puts that over here right now it is an electronic storage referencing the key term next morning next afternoon you wake up and read the email you decide I'm going to leave this email on the server now it is not an electronic storage why because you had an opportunity to protect that email by deleting it downloading it whatever but you decided that it wasn't important enough so you left it on the server so therefore is no longer an electronic storage the backup from the night before that's still an electronic storage but the email that you left there is not private providers schools your employer any system that does not give accounts to the public have no prohibitions on disclosure your workplace can turn over your email to law enforcement any time it freezes unless it has other civil contractual with the with you no um because it's still limited to those enrolled within the school and I had that exact same question and I looked into that wondering and the answer is that they are private providers there was a case actually Anderson versus somebody or another that questioned on what provide private provider is microsoft.com's internal email even though it accesses the internet is counts as a private provider so whether or not it accesses the internet or not has nothing to do with it all it is is who gets access legal access to that email who are accounts handed out to yes doesn't matter if you if it requires tuition then uh you know if it's something that not anyone can just get it's a private provider there's no disclosure on pro there's no prohibitions on disclosures I cannot stress that enough what would it have to turn it over unless it depends and there's no prohibitions on disclosure oh I'm sorry the question was that the employer would be advised to make a policy that says that it's private that depends on the employer and what they feel I know there was some and Jennifer might might remember this as well there are some instances in which the provider might be liable for email that one of its employees send and so that's one of the reasons why they have complete access to disclosures to view your email or whatever it's it's up to the provider there really the government there's three levels of access there's basic subscriber information other subscriber information and content and all three of these require different levels to obtain first is basic subscriber information the government can obtain without notice you'll never know with a subpoena your name address local and long distance telephone toll building records telephone number other subscriber information in originality such as ISDN numbers or in the length of service and types of services utilized all of the subpoena you'll never know about it other subscriber information this might be they want to know whojondo at aol.com is sending email too because they know he's sending kitty porn and they want to know who it's being sent to that they have to get a court order for this and this came out of this was actually a step up from what it used to be it used to only be a subpoena but this was this was put in as a result of CALEA which is a separate law and it was a compromise which actually put this up to a court order and there's a special it's actually a little bit different from most court orders that it has to be relevant and material to an ongoing criminal investigation and lastly there's content and a governmental entity can only require the disclosure of content of an electronic communication electronic storage 180 days or less only pursuant to us warrant there's never been as far as I'm aware any time that the 100 that they've searched they've wanted email older than 180 days but the law specifically does make a distinction between email less than 180 days or older than 180 days if it's more than 180 days in storage then they have a few more options they can do it without notice to the subscriber with a warrant with notice to the subscriber with a variety of subpoenas or they can get a court order under the previous statute and delay notice using 2705 once again this has never come up as far as I'm aware and this is an yes Steven, are they not? no they're not and but there is a what I'm about to talk about right here in the preservation of evidence he asked our public providers do they have to maintain mail for 180 days and the answer is no but there is a law under 2703f and this is remember all of you who raised your hands are regulated by ACPA this applies to you a provider upon request of governmental entity which all it has to be is a letter shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process that means if the government sends a letter to AT&T saying we're going to go get a subpoena we want you to hold on to those records they then do have to hold on to them for 90 days and then at the end of that 90 days they the government can request an additional 90 days with a separate form yes he asked Noyes was up here earlier with the remailer and said that she doesn't keep any records the answer is if there's no records to keep then they can't preserve them can I let me just add a little bit to that if I can the thing with that is they can ask you to preserve records that already exist they cannot ask you to intercept records that are forthcoming because that would be an intercept under the under title it would be a ECPUB it comes under this statue but it's like a title III intercept where you need to have a different standard to collect prospectively content because really what that is is that's an intercept and to intercept electronic communications you need a wire tap warrant which is a warrant plus minimization and all these other things so no they cannot force her to create the records you can only ask somebody to preserve records that have already been accumulated right it is you don't have the ability to do it you haven't done it so they can't force you to do it prospectively if you hold the records for five days then if they send you a request within those five days you're legally bound to hold those records that are already created for 90 days while the government goes and resists yes it's important alter by alter the system that I'm using in my own expense at your full shift that's the law that's the law I don't make the law I don't yes she was asking is there a provision regarding credit cards if you accept e-commerce information do you have to keep those records I believe it's not under ECPUB but it's under I believe that it's there that I do not remember the stashing number are fed he's saying that you can charge the government for your costs for having to store email but let's move on because grants that a lot I'm I'm almost done yes what is this is they're not turning anything over at this he asked what kind of authenticity is required they're not turning anything over at this point they're just have to preserve it as long as it's from a legal governmental entity they have to preserve it for that number of days nothing is being turned over to law enforcement at this point they just have to preserve it with their within their own servers as you said there's one last slide and then we'll be done is what what happened about equity violations constitutional violations are subject to the usual sanctions but civil remedies are only available for non-constitutional violations under 27 or 7 that means you can sue the government that's it there's no criminal violations other than already specified under 27 or 1 now both Jen and I will take I just want to before we go for the question I just want to say one thing ECPA stands for Electronic Communications Privacy Act Provision Act Privacy you sure? Electronic Communications Privacy Act okay let's take questions you'll be next but you sir let's say he asked me will you be forced to provide the key to your encrypted data and unfortunately the data let's say I sent a PGP you would probably know okay and some reason your brother wants to take a look at it and basically you might apply or apply or you would email is it critical? are they going to are they going to require to how can they get if you have encrypted stuff and you've got the key can they force you to turn it over and this is something unfortunately I wasn't able to really touch on that the Fifth Amendment would apply in some ways to this so if the key if the passphrase was solely in your mind then I think the case law is pretty clear that the government can't force you to tell them what the key is because it's in your mind and that is forcing you to produce something that may be incriminating or not and that is that is it goes contrary to the Fifth Amendment the cases are a little bit difficult more difficult if it's written down for example if your passphrase is written down well in PGP you're not it's not the passphrase um let's take let's take this gentleman who I said could be next uh he asked is the web resource regarding more information about ECPA there's the basically where I would go is the usdoj.gov they they have some information there it's not extreme depending on what you're looking for you might just want to look at the statute but if you're looking for case law and stuff I don't know of any other websites other than the governments that it's the computer crime and intellectual property section of the the Department of Justice has a website that has a lot of stuff about that on it um cyclecrime.gov can we have the gentleman in the hat yes you so he's a lot what he wants to ask me about is a little come through on the law enforcement so they say that you know you can't come into somebody else's box if they don't mean for you to be there what about if I don't mean for law enforcement to be allowed into my box can I sort of reverse the 1030 on them and that's going to depend upon a lot of that's a very good but complicated questions going to depend on a lot of things in terms of uh how they gained access what kind of information they were accessing and um whether they had any court authority or anything like that but law enforcement's not allowed to break the law any more than you are and if the access is truly unauthorized then uh no they wouldn't be allowed to do that but do keep in mind that sometimes the what's good for the goose is not good for the gander and law enforcement may receive a benefit of the doubt where you would not as a as a citizen so my answer is yes maybe okay I'm going to take two more questions I'll take this eager gentleman right here he asked me whether the law allows the defendant to hire a forensic expert to testify for them about how the evidence was collected or anything like that and the answer to that is yes in fact um that's a constitutionally protected right under the sixth amendment part of having the right to counsel is the right to have somebody who helps your counsel with understanding the technical things and this goes to the question that was asked by the lady over here earlier often you know attorneys can't know everything so oftentimes we do rely upon our experts to help us with the difficult technological issues it's hard for us to be uh knowledgeable in all the areas that all the times so uh one last question I'll use sir but then yes you grand do you want to answer that or do you want me to I'm sorry can you repeat the question he asked whether or not if there is a corporate use policy or some agreement with the users that the network's going to be sniffed does that make it okay for them to do it right if the others are trying to do the right next year yeah there's this you're going to just some civil law there are you asking it float let me just answer it since we're the answer is yes you can yes the reason is because it's actually not a 1030 violation it really is an ECPA violation and the EPCPA has a very broad exception for the service provider provider it also has an exception for consent so there you've got both you've got the service provider accepting and you've got consent so you want to sniff your own network you go right ahead same thing in corporate realm same thing yeah they can inside of a corporate if they tell you you have no expectation of privacy you have no expectation of privacy and they tell you you can't then you're then you're going to get fired yeah you get fired but you're not going to get permanently prosecuted it's your terms of employment you'd be fired I'm going to accept illegally one more question from this gentleman here just for the how of it so the question is can the government go through hotmail's backups and access email that I've deleted from my personal inbox with the proper authority yes it's a 2703d court order I'm going 2730d it's over within 180 days it'd be if hotmail keeps all that which I seriously doubt they do okay so hotmail it's not all that safe I want to thank everybody for coming I know that there's a lot more questions


Hi, everyone, and welcome to the OpenStack OpenSnack. I'm Amy Marish. I'm a Principal Technical Marketing Manager at Red Hat. And I serve on the Open Infrastructure Foundation Board of Directors as well as the Technical Committee. So let's go ahead and talk about OpenStack. And what is OpenStack? Well, OpenStack is infrastructure as a service that utilizes a common API and authentication to control large pools of compute, storage, and networking resources in one or more data centers. Now, more recently, you can use third-party services like Kubernetes or Cloud Foundry in addition to the OpenStack SDK and Horizon Dashboard to manage your bare metal virtual machines and containers which reside in your environment. Now, OpenStack is made up of various projects that comprise different component areas in order to create a comprehensive cloud operating system. Now, some of these components are compute, which are NOVA for virtual machines and Zoom for containers, for example. Now, we've got storage, and we've got Swift for Object, Cinder for Block, and Manila for Shared. Networking is neutron, but it also contains Octavia, which is load balancing, and Designate, which is DNS. Now, we've got a hardware lifecycle with Ironic for Bare Metal and Cyborg. And then we have various deployment lifecycle tools that you can use to deploy your clouds and maintain them. Where did the code in OpenStack come from? Well, over the years, there have been over 110,000 contributors, 486 organizations, 186 countries, and 23 million lines of code. So who contributed to Xena, which is our most recent release? And during the recent Xena release, we had 680 contributors, 125 organizations, from 125 countries, and 9,775 commits for 1.4 million lines of code. Now, there's several different ways you can contribute it to OpenStack. You can do code, documentation, and translations, or you can mentor, give operator feedback, or help run meetups and events. And for more information on how to contribute to OpenStack, check out HTTPS docs.openstack.org slash contributors.


Okay, so welcome back to the last lesson of the workshop, it's so many people today, so exciting, so brilliant. So what we're going to do today is the second part to JavaScript and of course deploying your website live on the internet. So there's some housekeeping words, no food or favorite drinks here, and Wi-Fi society is named up. Password is password, so if you're shy or for a while reason you don't want to raise up your hand, feel free to ask any questions through the last lesson. So again, for the fourth time, my name is Queeran, and I'm an open source advocate. I'm very interested right now I think. Then the student who is sitting in front of me is what in our talk will be helping out, helping us out today, and we also got another guest Josephine here who scores. They'll be helping out today, so there will be more hands-on activity today and more leeway for you all to do whatever you need to do. So just a quick recap of what we learned last week. So last week we talked about sessions, how it works, how we initiate a session, how we can assign session to a particular user, how we assign, how it is a super global variable by itself, and how it works eventually. And we also talked about how to store the system data through what we call a database, which is essentially a server that has the capability to read and write data on a table based format. So we talked about relational databases, and of course how we will look back at something like that. We've got index here, we've got index, and your particular columns, and our roles as your data set. And how PHP data objects work, actually this is just PDO, PHP page. So we talked about how we can use the PHP data objects to initiate connections to different kind of databases. So including today, we are going to connect L and L when we do outside the government. We are actually not going to connect to my SQL database, but we are going to connect to our favorite small company, Microsoft's SQL Server. So there will be some differences you will see later on. Of course, how we use preparations in PDO, and later on we run SQL to do this in this manner, which allows us to prevent SQL injections. And of course, we've got our standard EFL statement, logical statements in JavaScript itself, which looks synthetically similar to what we have in PHP. As for the dollar sign, we have a replaceable bar and a space there, as you can see. And if, and we don't have an else if in JavaScript, an else space if, right? So we also talked about anonymous function within JavaScript itself. How we can create anonymous functions without even naming a function itself. And we also briefly, and we went through how we can do form validation in JavaScript. How we can use event listener such as the document.braining. And of course, listen and attach a listener to form forms and listen for submit event. All right, so open up this bit.ly2ci, it's a capital I, I-E-Y-E-N code here. And you, you see the last week's code section. Open it up and let's just open it up here, right? So when you open up, you'll see a code box here. And we have our code anywhere account set up already, right? Everything is set up already, I think. Let's see if it actually works. Okay, so it actually works here. We don't need to spoil anything. So the previous code is actually down here, I think. Did I put every single thing? Was there anything missing? Did I miss all of that? Hold on. Okay, so I'm missing the app.js file. I'm just going to add in now. Okay, so, okay. I'm going to add in the JavaScript file for now. Table, table, table. I can see, oh, sorry. Okay, there we go. By the way, the Wi-Fi SSID is ninja. Password is password. No capital letters, just password. So under assets folder, we create another folder called JavaScript and we create the file name, app.js as well. So I'm just going to copy this part of code here first and put it right back in. So this is what we previously had for our assets. Our app.js file. There's a capital I, not an L. Okay, so some of you are looking forward to it. So anyway, create that file first and we'll briefly continue on from where we left off last week. So last week we talked about form validation and how it works, how event business works and all. So what we're going to do for the second part of JavaScript is we're going to learn JavaScript validation and Ajax and implement both of this into our existing blocking and registering system and see how it works. So previously we had this kind of data in our login HTML file, right? So if we go to login.html, we need to add that in first. What is login.html? There we go. So remember that, and you might have noticed that I actually that there was no cardboard because the cardboard is kind of the other end, right? So we won't be doing any cardboard right now. We're going to do that at the end. So let's include it into our login.html first. So go to login.html first and we're going to type in this thing, right? We're going to attach or include our JavaScript file into this login.html first. At the bottom of everything, below the bootstrap, absolutely at the bottom of everything, we included our assets, a JavaScript file. So what we're doing here is that we're loading the JavaScript file into our, you know, into our file itself, right? So right here, right, the screen would be able to do its execution at all. Yeah. So if we go back to add.js here, we see that we've got some sort of something here sent. Let's go to login.html first. So here, after we have added this thing here, can you see that we've added this here? Okay. So we have added this in here, right? Everyone is here, right? Everyone did this? All for this part, right? To your login.html file. Okay. So everyone hates our main status. Everyone is done already. So I'm going to move on to this f.js file. So right here, right here, we're actually attaching it to a non-assisted ID which doesn't exist at all. We're going to change this part a little. This is the form value that I talked about last week. So when we do like this form, space form equals $this. It's actually talking about, it's actually the event element itself. So what this would be, right? It would be essentially this thing here. It will be the form itself. So this is actually referencing towards, not referencing, but it's making a copy of the data of this object, the submit of the event object, right? So when we listen for an event, and then as an event that occurs, it will send an event object with all the origin and all that. So the origin and the source of everything is the form itself, right? So it's calling this. This is the origin. Does this sound confusing? It's okay, right? So this is the origin. So the origin is the form itself with all the data that it has submitted along with the event. So this would contain, this event object would contain the event data. So the event data itself will have all the values that they have submitted here. So if we go back to dongle.his.mail, we've got two inputs here. The username input, as you can see here, and the password input, right? We've got two inputs here. So in the form here, we will have these two data. So when we call to the form.data, right, we are re-serializing the data that we retrieve. So serializing is taking the data that was given to us and putting in the name, the key value for that. So remember how the way it works, right? So in p3 arrays, we've got a key and we've got a value. In JavaScript objects, it's similar. We've got a key and we've got a value. So right here, we've also got what we call an array with the key being the name and the value being the value being submitted and being inputted, right? Everyone, click on what form.serialize array will contain. So let me just type, but don't type this out again. So I'm going to remove this afterwards. So I mean, as for this part, I'm going to type in some data to how it will look like, right? So when we submit, using a parcel, right, we will essentially get an array of this. So form data will become like that. Right, it is something like that. Let me just double check the jQuery API. We look at a jQuery API itself. Oh, yeah. Okay, that's just different. So it's actually, so essentially your data will become like that. Right, so we will have an object. So remember curly braces in JavaScript is referencing to objects. It refers to objects. And within the object itself we call a name and we call a value. And the name would be username, right? Because down here, we put in name refers to username. So let's say I put in the username value that I key in would be w0, if you are sure. Something like that. Then it will give me the data like that. So that would be what form data will contain. Essentially an array of objects that was submitted through the form. Okay, cool. Everyone clear what form data will contain? Okay. I'll pick that as a yes, I think. Okay, then if you have any questions, just raise up your hand and ask. So this is how form data will look like. So let's get a clearer picture of us. Instead of attaching to an ID, let's try to attach this to a very generalized form itself. So let's just attach it to every single form that is available on the page. So something like that. So we've got form.subname and you'll call with this option. So let's alert something. So we've used alert before. So let's see what happens. Right now it says the screwing itself up already. Let's see if nothing dead is running. Okay, same. Okay, that's good. So when I submit this, I have to get this. You saw that? Literally just press the locking button and it will alert this up. Let's take our jobs before I see what happens. So we attach a listener to every single form we have. So let's look at the forms we have in... So logging itself, we've only got one form. Can you see this form here? So our form element, we've got action, logging.kd, method, pose. Then we've got the input here. We've got input here. We've got action tree inputs. So one is submit, the other is login. So... Yeah, this is the kind of data we'll be getting. All right. So this is our form. Let's go back to our JS here. So our JS, we went to... When we click on the locking button, it summits the form, right? When we click on the logging button, or when we hit enter, it will log in. It summits the form, and when the forms get submitted, the event listener receives an event. It saves all this data into a variable. Okay? It mirrors it into a variable, and then it alerts this thing called form submitted. Right? So that was what happened. Right? So then it comes out form submitted. Then it will continue with action, which is to actually send the post over, right? So when it sends the post over, it will go to the login.jp page, which is just what we actually had previously, right? So it's not changing anything. It's just alerting you when you press the submit. Nothing has been changed. Right? We have not modified the experience yet. We are still moving the data over to the other page. Right? So let's modify it further. So here we do some form dedication, right? We previously talked about form dedication of how it works. So we do a four-each loop, and then we loop through every single data. Then we verify the data, right? So let's try that here as well. So let's do a four-each loop as well here. So right now you still remember I just now typed out how the form data will look like, right? It's an array that contains a lot of objects, right? Three objects essentially, because we've got three inputs, which is the first, is the username, second, is the password, and third is the submit itself. Right? So let's loop through all these data. So if you look back to our first, our second section, our second workshop, so we talked about how PHP when we first did the login, we had a PHP login.php, right? Then we use a four-each loop. So it's very similar to what we did before, right? So it's very, very similar, just that right now we are doing it at the front end in JavaScript. So we are just validating the characters, number of characters and send them over to the front end. So let's see what we can do. This is how four-each should look like. The brain is not working in the morning, so pardon me for my brain not working. Oh, it's a oh, okay. Oh, it's a capital. Okay. A bit different from how we do it in PHP. So in PHP, we do a four-each something edge, right? So right here we are inserting another anonymous function and this anonymous function can accept a parameter. The parameter will be our data itself. So something like that. So within this loop itself, right, we would have this data over here which would map towards let's say it goes through the loop and the first one it hits is the user name. The data would be, so when we call to data.name, it would give us username. When we call to data.value, data.value, it would return us the value for the input. So let's take a look at how it would work. Right. This is we are validating the username data. So when we look at data.value, it will be the data we get from data.value data.value key. Right. So when we look at the data.value, it will be towards, it will get this value here and data.name is essentially the name that we get, right. Then we check, we check the characters, number of characters we have. Right. So how do we check number of characters we have on the string? It's through the dot line function. Smaller than operator, we check number of characters we have. So right here it is smaller than 3. So it's 1 or 2. 0, 1 or 2. So this three numbers or anything that's literally below 3 it can be negative, right. But it's not possible to have a negative here. Right. So let me let me refresh this page a little. Let's just see how it works first. So username is too short. Right. Then after that, after it says that username is too short, it will tell us that form submitted. Right. So when we click open again, it will tell us form submitted. And then we go to login.tp. But I'm still not modifying anything. We're just catching listeners and doing alerts. Right. So in our form issue, we call the normal function and supply data into this parameter called data. And we check whether the name, the input name is username. And then if it is, if it is username, we check the value. We want to check the length or length of the input that was given to us. Right. So I input something empty just now and of course that was given characters. Right. So it's of course shorter than three characters. So let's see what happens when I type something over. Something like that. What I do is it will tell me the username is too short. It will tell me that the form has been submitted. Like that. Right. So we pass the validation here. We pass the validation. Then we move on to form submitted learn. This is how we do our form validation. But you would have noticed that our form is still getting submitted even though the validation has failed. Right. So how can we prevent that from happening? How can we prevent our form from getting submitted when the validation has failed? So magically here in our submit listener and our function itself, it will pass us the parameter called an event object. So within the event object you will be able to prevent the event from happening. So we're going to be able to prevent the form submission form actually happening. So how are we going to do this? Well let's type some code first. So down here we supply the parameter called event. So we've got this thing called event already. So down here if we want to prevent the form from getting submitted, we call to a function that prevents the form from getting submitted. Which is called the event. Prevent default. This prevents the default behavior of the form. So the default behavior of the form is to submit data. So down here we want to prevent the form from submitting any data when the validation fails. So what do I mean by this? Let's take a look at how it will look like. Save the file, refresh the page and then we get this same login form and we press login. It tells how user name is full shot. Form submitted. And we see that we remain on the same page. We did not move to login.php. Previously when we submitted the form, no matter what happened, even though we had alert and all that, we still move on to alert.php login.php and the form still gets submitted. When we use the event.prevent default behavior, it prevents the form from having its normal behavior which is submitting the form. So down here calling to event.prevent default would prevent the normal form submission. So that's how we prevent the form from getting submitted when they fail validation. So let's say we pass the validation and what will happen? Of course the form will get submitted and we go to login.php immediately. So when we fill the validation there will be a full shot remain on the same page. You'll see this behavior happening right now. So magical isn't it? This is all happening on the JavaScript which is what which is literally the front end of the page itself. Nothing is happening on the server literally nothing is happening on the server. All this magic is all happening on the browser itself because it's JavaScript. Let's go through the code again. So first part we listen for the document that will be ready. Then we'll listen for a summit event from any form that is on the page itself. And when the event is heard by this event listener it will then accept an argument named as an event. And then this event will be used to do several things or to get data to call the functions or to set data and so forth. So here we call to this actual form itself and then we get when we encapsulate with the dollar sign and the bracket it's actually our selector. I previously mentioned about the query cycle which looks like that so it gets the element object. So here we got the element object of the form. Then from form itself we got the element of the form then we get the data out of it we get the serialized data out of it so we get the rate of objects with the key values of name followed by the name value followed by the input value then we do a forage loop through we loop through every single data that was passed in right then if the data if the data is the username then we check for the the length of the input if it's smaller than 3 we prevent the default input of a submission and we alert the user and tell them that username is too short. That is what is the magic happening down here in the app.k as well. So that was quite simple wasn't it that was really really simple but we did a lot of things we've learnt so many things just through validation itself but we want to do more than just that so we want to give even more immersive login experience and even more immersive and engaging refrigeration experience that allows us to stay on the same page so how do we do that so we've got this magical thing called ATX so in the early 20s we've got this small company named Microsoft they were the first to push out the standard of ATX request through iFrame so that was how we initially had this ATX technology it was pushed by this small company called Microsoft and it was pushed out onto the browser Internet Explorer and of course it got really popular most of the sites nowadays use a lot of ATX so let me do a very very quick demonstration of a website of a very small company that uses ATX if you go to google.com which is a very very small company that is not very well known and when you type something like that when you type in G you'll see that happen so we instantly get some search results here we get some search results here and then we type in O O G L E so what it's doing here is that it's listening as well there is an input listener that text for key for key press so when we when we take the key it will do a lookup how does this do the lookup the page doesn't move at all so it sends that ATX request to search for the data so in the background itself you don't see up from here but we've got ATX request so how do we know that there is an ATX request well I'm not going to lie to you or anything I'm going to literally show it to you how it looks so now here we've got our typical forms we've got our typical requests and when we type something let's say when I type something here look here look down here can you see this can you see it I suggest you all to move forward a bit so when I type in when I just click on that thing it really sends a search an empty search you can see down here it sends an empty search and then when I type K it sends another search and I've cut something it sends another search request then we get a lot of search here so all this is happening through what we call ATX so it's happening but we don't see it it keeps your interaction on the same page so literally you're on the all the same page itself we've not moved from any page we've not been redirected to let's say search.tsp something like that so this is a very prime example of how ATX works who doesn't know so we're going to use what this small company here do we're going to copy that but instead we're going to implement it on the login form and registration form instead so let's look at how we're going to copy Google so in jQuery we've got this API called the jQuery.axx and it supplies you can supply an optional an optional set of array data called settings I think it's yeah so down here we send an object method, post, url this data this and then we listen for it to be done this is what we call back but done is actually a callback thing that does an anonymous function and accepts the input of the data that was sent over right so it looks a bit confusing okay and of course it is so we're going to make it a lot easier for ourselves first through just sending our request to the login so we can supply url we can supply method we can supply data so it's literally the same as our form just that we are our login.html form just that we're putting it in the JavaScript format so how we're going to do this is we're going to type some code so down here we're going to move this event for moving this to the port so at any time even if the validation has passed we don't want the form to be submitted right we don't want the form to be submitted because we want the data to be sent through our Ajax call right so let's see what will happen then so down here after with with so called validated our data we're going to do an Ajax call so $.ajax followed by the parameters which is an object so let's make it a bit clearer so we've got far settings equals empty object and then we call this and then down here we're going to set up a callback to a anonymous function that accepts that accepts an argument or message and we open up the function with curly braces and also like that right looks just okay looks like better now so in settings itself we need to pass in 3 days the URL which we're going to submit our data to the method type which is supposedly post and of course our date our actual data itself so let's fetch this data from the form right so so do you see that our login.html our form here has an attribute remember that this action here is actually an attribute which we mentioned in our first action class is an attribute method is also an attribute so we need to fetch the attribute here from the form so it looks wrong this is so furlough so we've got this platform called stackworld which you can search for any kind of answers and you'll probably get ah, there we go okay, that looks wrong for right now so we're getting the method here and then after we want to we call our method attribute already here we fetch the attribute here then we want to get our what's next what is that? action we want to get our next action which is action right, so we call to our data here we've got our element here so we're going to call to we're going to serialize our data so you would have noticed that it's a little different here so serialize an array is getting an array whereas serialize itself is only returning an object right so there will be some difference when we serialize it into an array versus serializing it into a JSON object right, so down here we've set our settings our three main settings that we need method action and data and all of this is just taken directly from attributes method form attribute which you can see is down here our method form attribute here which is pose so down here is pose followed by our action which is login.php right, if you look to here we've got login.php followed by our data which is form.serialize which is an object that has been serialized from the inputs that we've given so let's see what was given to us when we press the submit button so this is one of the ways you can debug or you can use console.log as well so let's refresh our page a little I'm going to just briefly show you what happens so when you submit our form here we can see down here it's send a pose request to send a pose request to this request you are all here which comes it sends login.php did I do something about here action so this is not supposed to happen so when to send a request to login.php this is weird we want only a minute it's supposed to send to login.php but it doesn't want to send to login.php so it's method it's not action it's supplying the url for us for please for us to submit our data but I really need some sleep or something so yeah, so it's url so right now when it's changed to url we refresh this page a little and then we press the submit button and then we get our data out like that so we literally stay on the same page we didn't change the page at all the page didn't change to login.php the page didn't change to login.php at all but it's still sending a request to login.php so I don't think we need to stringify this let's see what happens when we don't stringify ok so our page itself on the login.php page itself it does the validation of it it checks whether the username is off-assisted then it tries to login so let's try to login with our valid data here see, now we get this in here, logged in as my username but we still stay on the same page we still stay on the same page so this is how we are able to do what Google do when we do our search data it stays on the same page and then it gets our data to send so this magical thing we have right here is what we call AIS I am going to copy this data over and put it up on the Google.form so I I am editing the data here ok, so how do we implement this same thing this thing to register.php as well how do we do this for register.php as well well if you go to register.html and it scrolls all the way to the bottom just edit the same screen then it will be the same for register.php so when we click register something like that I just submitted a blank user registration so we could do a user registration here and we stay on the same page right, you see that we just need to edit the script tab and then it references the same F40S because everything is off nothing here is being hard coded everything here takes the data from the HTML file itself right we didn't change much we didn't need to change or have a separate JavaScript file so it gets the data from our login or register from the HTML page it just maps it through our sectors and then it submits the data as per usual it submits the data as per usual it's literally the same thing as what we have done without JavaScript just that for now when we edit in JavaScript it's not redirected by not redirecting the users the user is not being redirected to any other it's not being redirected to login.php they stay on the exact same page, that's it that's the only thing we are adding in here and then it sends the request in the background to the agent called it was amazingly simple and fast there wasn't any major issue here and let's move on to our actual site this is the part where it gets a little tedious of to actually deploy it so what we are going to do here is that we are going to use we are going to revisit tp little and we are going to use what we call tp environment variables we are going to use the top code to github and of course we are going to do some environment configuration and hook up hook up github and azure so we are not going to buy and hooking up people but we are using webhooks on github and azure will hook up to the webhook that github has so it will isn't for any push event coming from github and when there is a push notification received from azure site it will then deploy the code that's what we meant by hooking up people alright so we are going to revisit tp again and use environment variables so why do we why do we want to use environment variables anyone know why no okay so so let's go to our topic of tp first as you can see here we've got our tp data object holds is local holds database is this username is root and the password is this but when we upload our code to github right so we are going to use our public repository so it's going to be public and we don't ever want to upload our password or credentials to the public right so no same man here or no same person in fact should be uploading passwords to the public and allowing the public to fill it so we want to make use of environment variables and since tp is tp is a scripting language it's going to fetch the environment variables and then it's going to be able fetch all of that data and put it in here so that we would be able to upload our code without any passwords right so no passwords will be uploaded and later on as those part we will be able to configure some environment variables so where will we be storing our so called passwords is that we are going to store these so called passwords in our azure deployment configuration which is kept private on azure right so I think I haven't said what is azure so azure is actually one of the pairs it's not tst but rather paah right so pairs is this so pairs is a platform as a service and we've got multiple other platforms as a service as well so well known platform as a service would be like Google Cloud Platform and we've got HeroCoup Cloud Platform as well and we've also got OpenShift, OpenShift Cloud Platform and finally Azure Cloud Platform so all this kind of cloud services they are actually a platform so pairs is essentially platform as a service right so that's what pairs represent so azure is a pairs and it can be interpreted as pairs as well because I find it okay anyway so it's a cloud platform so what is this cloud thing so it's not the cloud that we see when we wake up in the morning right so I don't think a lot of Singaporeans actually look up in the sky quite often right we usually look down at our phone and then we look at the floor we don't usually look up the sun or anything right so it's not that weather cloud that we see that we don't see it's actually just servers right so it's kind of thing of it, it's a code name for servers that is deployed and configured in a certain manner that allows horizontal scaling blah blah blah so I'm not going to go into too much of this marketing nonsense it's essentially just servers right so the cloud is just servers so we're not throwing our code into the blue sky we are uploading our code to servers and we're going to do this through Git and Azure simple isn't it right so it's really really simple and we're not going to even use FTP or SFTP or what so nonsense we're going to use Git then you might be questioning what the heck right how can we do that through just simple well we're going to start changing our files right so since the SQL server that we're using from Azure is the SQL is the MS SQL we're going to use the same PTO or PTP data object but we're going to change from MySQL all right so we're going to use both to SQL server and the server being the database host database being the database name followed by the database user and the database password so let's this part is a bit brainless so we can just copy it copy it okay so where is the okay so down here back at the login we're going to change our login first so down here we're just going to do this right so down here we're getting an environment we're getting an environment variable right so actually an environment variable is also a super global array just like post just like get just like request just like session all of these are super global variables but the way we're going to assess this environment super global variable is through this function called get environment right so remember to delete this old MySQL okay try to log in right now it's not going to work on code anywhere so if we go here that's not going to work anymore right it's just not going to work because it's different already right so we do have some sort of an issue which is that our server here is running MySQL whereas the server that we're going to deploy to is running Android right so how do we know that the code works when we deploy it right so we want to make sure that the code works before we deploy it right so usually we're going to use usually people will use what we call the CI continuous integration and we're going to do CIC which is a continuous deployment right so when we come to CI we do what we call testing so this test that we do are automated right we do unit testing through Travis CI through Jenkins through GitLab CI through various ways which we can test code right so if you visit TravisCI.org TravisCI.org you'll see this guy who is wearing a hoodie and who has great color beard or something actually it's showing up my code already so fast okay so the scene is manual oh it's so irritating so it shows by oh so much crap here oh okay anyway so if you visit TravisCI okay let me open a private info so when you visit TravisCI you'll get you'll see this test and deploy with confidence right blah blah blah blah blah but unfortunately we're not going to cover unit testing we're not going to cover testing in this session but this is I'm just mentioning this so that you'll know it exists so typically a CI CD workflow we have is before the code deploy gets deployed to the server or to the cloud if you want to play that game it goes through unit testing which tests if the code works before it gets deployed into production so we've got to always make sure that our code works before we deploy to the production so unfortunately since we're not going to cover that it will not work here we only know if it works when it gets deployed to Azure right so right here we get four environment variables dbhost, dbname dbuser, and dbpart and down here in dollar sign dp our variable here new pvd data object xpnode server, server equals dbhost which is here and the database is here our user is here our password is here in the environment variables so right here we have not specified any environment variables we have not specified any environment variables but what we can do is that we can we can use this function called boot boot empire to specify our variable I mean our super global environment variable but as I said earlier we're going to only specify the environment variables on Azure right yeah so this variables they don't exist there's no values right now so they would only exist when we deploy it to Azure simple as that understood okay so we have got four blank variables that are more consistent and we're going to do this for register.php as well copy this code I'm going to paste it into our ninja turtle teenager anyway so go down here and you see pasting this bunch of code and then I'm going to go to register.php I'm going to do the same here right so this is we do the same for register.php as well so now we can introduce our environment variables into our environment so we're going to do we're going to do our code uploading to github right so how do we code to github this is a part where it gets a little interesting and a bit difficult as well so go to github.com have you all logged in our register or whatsoever if you have not logged in please register and so what is this github thing right so github is a proprietary service is a proprietary service that is a proprietary github service that supports open source software development right so github essentially makes use of the gith technology so gith dates back to when Linus Taubros I don't even know how to pronounce his name when he started the Linus project so when he started off with the Linus project when Linus started off with the Linus project he started coding and things like that and he collaborated his code with people SGM we've got a version numbering checkout systems in the past but he felt that it was a mess when he did last year collaboration with people all around the world on the Linus project it was a mess and this needed to be fixed so he introduced he started he started off the key he started the github as you can see here it's a version control system that allows people to collaborate their code with version numbering and it is able to handle even different kind of code comments so let's say if the code collapses with another code so let's say right now there's this set of code and then person T uploads another set of code and it's different set of code right what will happen is that they will not get committed it will essentially require a deep merge it will require some merging and some manual changing right so this prevents like problems with actual code base right so it's a really really need to to allow last year collaboration so today we're going to learn very very simple github commands so we've learned them already so we've learned HTML we've learned CSS we've learned JavaScript we've learned PHP we've learned SQL and now we're going to learn a little bit on github so the first command you need to know is githab so the term really just githab the second is gith commit right so githab what github does is it adds the file in the deep repository and then it adds it into a tracker right it gets tracked and then it gets add to the potential commits that can be done right so after that when we do a gith commit we're creating a commit file that means we're going to commit this set of files that we've added in and then we've got deep push which is essentially a way for code the commit to be pushed to the server so when we want to add commit push it's going to upload the server to github right so other than github there's also other open source tools out there such as deep lab so deep lab is one of the another platform for which people can upload and manage the repository right right so this one is open source and not github right but github is more popular so we're going to use we're not going to be hipsters and we're going to use something more popular right so if you're registered you can do your own github from now you will have a name there and you will have a username right so I hope you can commit it anyway if everyone registered your github account or registered your github account yes or maybe okay good so now that everyone of you have registered your github account we're going to authorize code anywhere to use github so if you're going to code anywhere put it here put a code dash and then you go to my account you'll see that there's everyone at the network do you see this so you'll see that there's a different kind of connections connected account you can do so you can connect to you can connect to github you can connect to github you can connect to google, facebook, digital, motion, one drive everyone here so let me show you what I need to talk press this small little icon over here press this and press account dashboard and then open up this dashboard here and then click on the account and click on to connect I'm disconnected okay I'm going to disconnect first and then I'm going to connect so when I connect at time it will connect me and that's it everyone connected has everyone connected that github account good that was so easy wasn't it there's a few clicks actually for those who have not authorized code anywhere so if you have not authorized code anywhere you have to go to a screen that will ask you to authorize code anywhere and you just click on here and on so afterwards you will see that under the github profile here is um github so I think it's under settings and then if you go to github account under settings you will see that okay you see that we've got this thing here as we've added in so you have to code anywhere SSHT with the fingerprint and all yeah so the fingerprint is somewhat like a hash of the key that has been generated right so codeanimere.com would then generate like a key SSHT and then it will then update that key to your github profile so now that your github profile has that key you can then deploy the code from codeanimere.com to github so let's go back here and we see that with link file now with SSHT inside we're going to open up terminal and wait for terminal here so let's see if I've got gith in here if we save gith we've got gith installed already so everyone open up the terminal into this here as everyone open up terminal good so now that you've opened up terminal we're going to type some commands in right so we're going to check whether we are github repo by typing gith status this is protected with more so small so when we type in gith status it will tell us not a gith repo or any of the parent director so we're not github a gith repo we're not created a gith repo where's my mouse can you see I see my mouse so we're not a gith repo or anything we're not created a gith repo or anything so what we're going to do now is we're going to we're going to go github.com we're going to do it in a more you know way which is more friendly ok so right here now we are in github.com I'm going to make this page bigger so do you want to go to github.com so press this thing it will say create new right here so click press that thing the plus sign and press new repository right so repository is where you pull up your code and everything right so press new repository click on the there and it's going to say repository right so you can always put up a random name so here it's recommended supreme octo carnival I'm going to just put it up so I don't know what that means but I'm just going to put it up supreme octo carnival everyone has put up their repo name already so select your own as yourself and then create a public repository so everyone of you here have a free account so what this free account allows you to do is to allow you to upload your code into the public so my account is not a free account so I can actually I'm going to do a public one right so the license so there are different kind of licenses you can choose it's got a restricted restrictive lab and it's got a complete lab so the most left and the most liberal license is the MIT license which allows anyone to make use of your code right the more restricted a restricted lab license to be something like GTL so the new GTL 3 is a version 3 license which is a restricted lab license requires the user who uses your code to share your code if they make changes or if they call and also to retain the license itself so what this means is that if let's say I'm a private company and you put up your code on the public and use a GTL 3 license I can't use a code I could but I'll be I have to share the code if I make any modifications but if I'm using if you are using an MIT license and I'm a proprietary company I can take all the code I can take all the code and then I can modify it to whatever I need and I can sell it right so different license brands different brands so I'm not a lawyer or anything and I would spend a lot but you can you can consult a lawyer so I'm going to put up I'm going to put up an MIT license so you can put up no license as well so what no license essentially means you copyrighted your work right so without any license by default your work is copyrighted and if anyone copies a code you can sue them so that's how licensing engine works so we've got we're typing our key repo name we're selecting topic we've selected MIT license and we create repo repository and we're going to do some stuff here so we've got an actual repo here alright so now I want to pay attention for a moment we're going to look at this down here we're going to create new files find new file and code down this repository so down here select so by default they will say it's 20 ps I want all of you to use clone with SSH so click on this copy copy this and then code down so we have copy all of you copy this down here, other clone here initially you will have use page 20 ps but then click on the use page and copy this go to your code everyone copy it so now I'm assuming that everyone has created down repository on GitHub and yeah so now go here we're going to type G we're going to paste while the copy just now control shift D no paste so I want this essentially there's something like that alright I'm going to bring some water taste it with your hand if you have any problems alright so yeah you don't understand so this is magical key clone thing that we have right here so this is clone thing alright so clone is a way of replicating something right so in the past we've also replicated ships right we've clone ships for so we've done that in real life right now here we're going to do it on the virtual space we're going to do it on the internet we're going to clone the key repository that we had so this here this is a pretty good idea because okay so it's going to clone it's going to create a directory then you're going to move you will have to move all your code into that directory right so how are we going to do that you're going to clone it first right so key the enter key and then you do the most scientific and most technologically advanced way of copying things from key so it's going to use an empty directory because it's free of no kind of code so it's going to copy over and then this SSH key into the RSA links of known holes right so this is also a dirty stuff we don't need to know that then when we cut LSKL when we cut LSKL we're going to show a list of repository stuff here a list of directory stuff here just index login.html login.html blah blah blah blah and we got this supreme also playable down here right we created a new folder called the supreme of this name is so weird I'm going to give it the test for all of us already test for HTML first and I'm going to cut that memory so down here we've got we've got our full folder assets and the deep folder so right now we're going to move all our code into that directory and how we're going to do that so there's this magical command in the list called empty which is to move files so we're going to use that magical command to move files because it's into that directory right now let's see okay let's see let me just read the hell okay it's going to move everything okay so we're doing that R we just need the wall cut so I think we can we can remove that R and hit like that okay so we're going to get this error in more than an error so when you hit LS we're going to have one single so I'm going to show you that let me clear up so right now we're copying all our files and moving it over to this folder called supreme of no carnival replace supreme of no carnival we have given to your kids so not everything we've done but now we're moving all of our files over into this kit report right here anyone okay okay I'm going to go around and if you need anything that's the list I've got here I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I