For Microsoft 365, 2013 has turned into quite the year where Microsoft give it yet take it away like so many other tech giants going on and on and all in on AI. They've given us co-pilot for Microsoft 365 and there's been plenty said about co-pilot already and that's not what I'm going to focus on in this episode. Microsoft 365 has also taken major services away announcing the end of life retirement timelines for three major services throughout the year. SharePoint 2013 workflows in April and recently the SharePoint add-in model in Azure Access Control Services. As a long time SharePoint developer and customer, I understand that these announcements will have a significant impact on all of our work. So in this episode, I want to provide clarity on why I think these announcements were made and what the timeline for the implementation looks like for all of us. It is crucial for us to understand the implications of these retirements and explore different migration patterns to ensure a smooth transition. I'm also going to cover the various tools and services available today that can help us customize SharePoint in a much more modern way. Hi, I'm Andrew Connell and if you're new here, please be sure to hit that subscribe button to stay up to date on all my videos for full stack Microsoft 365 and Azure developers. The SharePoint add-in model was introduced in SharePoint 2013 as a replacement for the fully trusted farm-based solutions and partially trusted sandbox solutions that all developers like us would use to build solutions for SharePoint. Microsoft's motivation for creating this model was to remove developers' code from the SharePoint runtime and to separate SharePoint from hosting all of our custom solutions. The goal was to move the custom solutions for SharePoint outside of the SharePoint process by offering two options, hosting solutions in the client's browser or hosting them outside of SharePoint altogether. This change made SharePoint a more cloud-friendly platform, allowing it to be hosted as a SaaS-based service without customers' code affecting the hosting of the SharePoint service. Now using the SharePoint add-in model, developers could create two types of add-ins. We had SharePoint hosted and provider hosted add-ins. The add-in model relied on Azure ACS, not to be confused with Azure Container Services. This is Azure Access Control Services. I'm going to cover the Azure ACS retirement at the end of this video very briefly. The SharePoint add-in model depended on Azure ACS for security and permissions. Now Azure ACS was used as the app authentication solution at the time SharePoint add-ins were introduced in SharePoint Server 2013, which is what SharePoint was based on at the time for SharePoint Online. Now Azure ACS was used by SharePoint Online to provide authentication for provider-hosted add-ins, and it was used to grant apps access to SharePoint Online with app permissions and granular scopes. But just a few years after SharePoint add-ins were introduced, Microsoft publicly stated that the future of Azure ACS was Azure Active Directory. Now as a quick aside, if you remember from earlier this summer in July of 2023, Microsoft announced a renaming for Azure Active Directory. Azure AD is now referred to as Microsoft Intra ID. That's the new product name for it. You'll see those two names used almost synonymously in various places and the documentation is things that cleaned up. But officially today, as of this episode, Azure AD is called Microsoft Intra ID. Now technically, Azure ACS has been retired since 2018, but it didn't affect SharePoint. You can always refer to this post that I'm showing you here that explains why this retirement didn't impact SharePoint add-ins at this time. Now SharePoint add-ins were not a widely adopted by customers initially or in the following years. Now this was mainly due to the fact that an installation of a SharePoint add-in resulted in the creation of an app web where the SharePoint add-in was actually installed. And the app web was essentially a special sub-site within a site collection. But the challenges putting add-ins in these sub-webs made applying site customizations to existing SharePoint sites a less preferred option compared to the alternative solutions like farm or sandbox solutions or using things like the content editor web part. And what that meant is that customers didn't really rely on SharePoint add-ins to implement many customer requirements. And thus this hurt the adoption and it set Microsoft back to the drawing board. Now eventually Microsoft introduced better ways to customize SharePoint and create apps, particularly through the SharePoint framework. As a result customers started to abandon the add-in model for new projects and opted to use SharePoint framework to address their needs. However many existing add-ins they still remain as they continue to function effectively for their specific solutions that customers created them for. Until the retirement notice was announced and thus it set a finite timeline for these solutions. Now maintaining and running the SharePoint add-in model that has become expensive for Microsoft and it seems that Microsoft wanted to transition existing customers to other options that were more suitable for cloud-based customizations. But customers were limited in their choices as SharePoint add-ins were only the only option for deploying things like SharePoint 2013 workflows and apps that leveraged Azure ACS for authentication and permissions to talk to SharePoint. Now with the deprecation of SharePoint 2013 workflows and the guidance on using Power Automate for workflow-based solutions, Microsoft is now phasing out the add-in model along with SharePoint 2013 workflows and Azure ACS. So what does the timeline look like for the SharePoint add-in retirement or end of life? Microsoft announced the retirement of SharePoint add-ins in November of 2023. In March of 2024 Microsoft will stop accepting new add-in store submissions from customers. This means that you will no longer be able to create and submit new SharePoint add-ins for purchase or installation in other customers' tenants. A few months later in July 2024 customers will no longer be able to install add-ins from the store into their SharePoint online tenants. And additionally, any new Microsoft 365 tenants that are created after November 2024 will not have the SharePoint add-in infrastructure and services enabled and running. This is going to prevent the creation and deployment of custom add-ins directly to the tenant's app catalog or the site catalogs. So that means that starting in November 2024 the only way that you can use SharePoint add-ins will be if the tenant was created prior to November 2024. In this case you can still create and install SharePoint add-ins directly into your tenant using the tenant app catalog or the site collection app catalog. But you can't obtain add-ins from the store. Now approximately a year and a half later in April 2026 that's when the SharePoint add-in infrastructure and services will be shut down across the entire platform including both existing and new tenants in SharePoint online. So what does it mean? It means that you must migrate your add-ins prior to April 2026. Now this timeline it's going to align with the retirement of SharePoint 2013 workflows which will also be shut down in April 2026.  But I'll come back to that later on in this episode. Now that you have a comprehensive understanding of the implications and understanding the what, the why and the timeline of the SharePoint add-in deprecations. Let's explore how we can migrate our existing solutions that utilize SharePoint add-ins to prepare for this transition.  It is crucial to consider the impact that this is going to have in your environments. First let's discuss the SharePoint add-ins themselves as some of the decisions made will directly affect those. Next we'll examine the various types of SharePoint add-ins that can be created. And then we're also going to address the specific scenarios that you may have questions about and how these retirement notices are going to be implemented and how you could address them. SharePoint hosted add-ins allow us to create custom solutions that run entirely in the client's browser. This means that our JavaScript, images and HTML are all deployed and hosted by SharePoint and SharePoint simply loads them in the browser when it's requested. So at a high level if you have a SharePoint hosted add-in it's recommended that you migrate your project to use the SharePoint framework because both SharePoint hosted add-ins and the SharePoint framework deploy their code including HTML, JavaScript and images to SharePoint which is then going to serve them up in the client browser. Also when a user visits a page where the solution is being used the actual application runs in the user's browser, again not in the server. Because both of these solutions run exclusively in the browser they inherit the same sign-in credentials of the current user and do not support scenarios such as elevating privileges. Both SharePoint hosted add-ins and the SharePoint framework can be installed from the SharePoint store or side-loaded to the various SharePoint app catalogs for deployment, development and testing purposes. Now I cover the SharePoint framework extensively in my course Mastering the SharePoint Framework. If you're interested in learning more about this check the notes below the video and in this episode to learn more about that course. And if you're migrating reach out to me I'll give you a special discount on the course as well. Now let's discuss SharePoint provider hosted add-ins. A provider hosted add-in is registered with your SharePoint deployment and your site collection. It requires you to deploy all the code to your own cloud resources. For example if you have created a web part as a SharePoint provider hosted add-in you're going to set it up as a website solution and deploy it as a cloud resource using something like an Azure web app. The most important point here is that you as the developer are responsible for deploying and hosting the SharePoint provider hosted add-in separately from SharePoint. Now if you decide to rebuild your SharePoint provider hosted add-in as an API there are various options for deploying the code such as using Azure Functions, Azure Web Apps, Azure Container Apps and many other non-Azure options and solutions. Now ideally you should secure the endpoint where the SharePoint provider hosted add-in is hosted using Microsoft Intra ID. Now if you have a web part that is part of your SharePoint provider hosted add-in you're going to need to port that as a SharePoint framework based solution as well. Now the SharePoint framework can then call your custom API using the SharePoint framework's HTTP client API if the API is anonymous and unsecured. If it is secured you can use the Azure AD HTTP client object if it's secured using Microsoft Intra ID. Now to retrieve data from your SharePoint site with your new SharePoint framework web part or any other SharePoint framework component for that matter you're going to use the SP HTTP client API to make requests to the SharePoint REST API or you can use the Microsoft Graph client API from the SharePoint Frameworks API to retrieve data from SharePoint using Microsoft Graph instead of using the SharePoint REST API. Additionally there are other options available for retrieving data such as using the popular open source library P&PJS which can use both the SharePoint REST API and the Microsoft Graph REST API to retrieve the same data. It's just another option for accessing data and it's up to you if you want to use it. Now that we've discussed some of the high level considerations let's examine some specific scenarios that you may encounter with migrating your SharePoint add-in based project. It's important to note that many of these SharePoint add-ins were built years ago and may utilize older technologies that were available at the time but have since changed or been retired. So let's start by discussing some data access scenarios. Now previously to retrieve data from SharePoint lists and libraries you may have been using a camel based query. That's a collaborative application markup language. It's an XML based language that is used to submit queries to SharePoint endpoints. You might have also used the client-side object model also known as the CSOM or the JavaScript object model known as the JSON to issue these requests and queries that were written in camel. But going forward it's much more recommended to replace these technologies with REST based OData queries and you can achieve this using any of the APIs that are provided with the SharePoint framework as I previously discussed in this episode. Now if you're working with a SharePoint specific endpoint you can also use the Microsoft Graph client API in the SharePoint framework SDK which is going to leverage Microsoft Graph to get access to the same data. Now if you're using Azure ACS for your custom solution and need app-only permissions you're going to need to migrate to Microsoft Intra ID and you can learn more about how to do this using this article that I'm showing you for guidance. Now one thing to note is you will see this article referred to Azure AD and Azure Active Directory just know that that is now called Microsoft Intra ID. Now for apps that leverage granular permissions using Azure ACS that allows you to grant things like read, write, manage and full control permissions to specific site collections you're going to have to take a different approach because Microsoft Intra ID by default is going to grant these permissions to all site collections in your target tenant. So to work around this you can use something called resource specific consent also known as RSC. Now in this scenario you're going to register your Intra ID app and grant it permissions to specific site collections similar to what you did with Azure ACS but you're going to use a special permission scope called sites.selected. Now let me talk a little bit about these things called app parts. SharePoint app parts enabled us to create web parts using the SharePoint add-in model that can be used in the host web of our site collections and these app parts should be rebuilt as SharePoint framework client-side web parts. SharePoint add-ins also allowed us to customize a classic site's list or library ribbon bar by adding buttons or to the context menu on a list or library that's also referred to as the edit control block or ECB menu. Now these customizations should be rebuilt using the SharePoint frameworks list view command set extensions but unlike the SharePoint add-in the new SharePoint framework supports other types of customizations for lists and libraries such as creating field customizers that replaces the old JS link technology we used to use and list form customizers where you can replace the new or edit forms with SharePoint framework-based forms. Now let's discuss a really big topic, remote event receivers. Now we can break them down into two different categories but first let's talk about some common aspects that we need to consider. Remote event receivers allowed us to receive notifications when events occurred in lists or libraries and apps as well as during the application lifecycle with our SharePoint environment. Furthermore, remote event receivers provided us with a SharePoint context when they were called. Now these supported both asynchronous and synchronous events and this synchronous capability of some remote event receiver events enabled us to block certain events or items from being added or edited in our registered lists and libraries using the SharePoint add-in model. Now although these remote event receivers have not been recommended for a long time they still work but the current recommendation is for developers to transition to using webhooks such as SharePoint webhooks or Microsoft Graph webhooks. Now however there are some differences worth noting between remote event receivers and webhooks I'm going to cover that in the next section. Now let's look at two different scenarios when it comes to using remote event receivers for lists and libraries. Now we used to have the ability to handle both synchronous and asynchronous events as I mentioned a second ago but in SharePoint and Microsoft Graph only asynchronous events are supported. This means that we can only work with remote event receivers to receive notifications when an item is added to a list or edited on a list. We can then run some logic to determine if the item should be saved or not. Now that's only with remote event receivers. Unfortunately I can't use remote event receivers or webhooks for custom data validation. Unfortunately we can't use remote event receivers or webhooks for custom data validation requirements. I was a common use case for the remote event receiver synchronous events that addressed for us. Webhooks are inherently asynchronous meaning they only notify us after something has already happened. There is no synchronous option available for us to migrate our solutions to and thus we're going to have to explore different alternatives that we can come up with for implementing those data validation checks. But just know there is no solution today to block something from being added to a list or be edited from using one of these event models here. We're just going to have to come up with a different way to solve that business requirement. Now another difference is that we don't receive any data or context when an event occurs and depending on the specific event we're listening for we're simply informed that something happened to retrieve the data for an item being added to a list. Now we can use the Microsoft Graphs data query capability to retrieve the changes that have happened since the last time I ran that query. Now if I was previously using remote event receivers for listen libraries I'm going to need to migrate those solutions to use either webhooks from SharePoint or webhooks from Microsoft Graph. Now these webhooks are set up on a subscription basis so you subscribe to the specified event and then are notified when those different events occur. Now it's important to note that you're going to need to maintain the subscription as it will expire and be removed by Microsoft automatically. So be sure to keep track of the subscriptions lifetime and renew the registrations accordingly. Now let's discuss the other type of event that we had with remote event receivers, app lifecycle events. Now the app lifecycle events included app installation, uninstallation, and upgrades. And these three events with these three events SharePoint can notify a remote endpoint whenever an app was installed, uninstalled, or upgraded. And they allow us to perform various actions to implement different solutions such as creating a list or a library for the app or executing a provisioning process when the app was installed or maybe even a cleanup process when the app was uninstalled. Unfortunately there's no published app lifecycle event available to us with SharePoint framework and Microsoft Graph based webhooks. And this is a feature that I've been begging Microsoft from for a long time. So if you want this feature, it's important to let them know about your interest for it as well so that they can prioritize it. In the meantime, if your solution requires an additional setup after installation or cleanup, after the uninstallation, you're going to need to implement a process that checks if the prerequisites are present. For example if they're not present, you can provide an alternative setup experience using the client side code on the first run of like a web part or an extension. This code can then perform operations if the current user has the necessary permissions like creating a list. But if not, you can alternatively use client side code to call a remote API that you create. Within that remote API, you can use Microsoft Intra ID to obtain an access token with elevated permissions and then use that access token to authenticate against SharePoint REST APIs or the Microsoft Graph APIs to perform the necessary elevated operations. For the sake of completeness, I do want to briefly discuss the retirement of Azure ACS. The retirement of Azure Access Control Service follows the timeline that is very similar to the retirement of the SharePoint add-in model and the retirement plan for SharePoint 2013 workflows. The retirement plan was announced on the same day as the SharePoint add-in November 27th, 2023. So here's how it works. In November 2024, any new tenant created for SharePoint Online or Microsoft 365 will not have Azure ACS enabled. This change only applies to tenants that were created after November 2024. Existing tenants created prior to November 2024 will still be able to use Azure ACS. Then in April 2026, Azure ACS will stop working across all tenants in Microsoft 365.  Why? Because they all are related to each other. In order to be able to use a SharePoint add-in, you are in use the permissions associated with an add-in, you set up the permissions using Azure ACS. To deploy a workflow, you have to deploy a workflow using a SharePoint add-in model. So when ACS goes away, the add-in model has to also go away and the SharePoint 2013 workflows, again, they also have to go away as well. And that's why they're all being retired and reaching end of life in April 2026. So what guidance do I have for preparing for the retirement of Azure ACS and how should you migrate these solutions? Well, we used Azure ACS in two different ways to obtain tenant-level permissions or site-collection-level permissions in our SharePoint sites. For an app-based permission for SharePoint, such as sites.read.all or termstore.read.all, it's recommended to use the sites.selected permission to apply specific permissions to a subset of site collections instead of having those permissions applied to the entire tenant in all site collections in the tenant. But to obtain permissions for just lists or sites on a granular level, you're going to use resource-specific consent, RSC. Now that's currently a work in progress and it will allow applications to access only a specific SharePoint site or list instead of entire site collections. Now this specific feature is not yet available in production as it's currently under development. So what do you think about the retirement plans for SharePoint 2013 workflows, Azure ACS and the SharePoint add-in model? Now I've only covered some popular aspects that often arise when people migrate from their existing SharePoint solutions that utilize SharePoint 2013 workflows, Azure ACS or the SharePoint add-in model to newer, more modern supported patterns and technologies. I am sure that there are plenty of scenarios that I have not addressed in this episode. So what specific scenarios are you interested in? What aspects would you like guidance on as you move forward? Let me know by dropping a comment below the video or schedule a 101 call with me. I would be more than happy to discuss your projects with you and help guide you in your migration as I offer coaching and consulting services as well. Now I reference a lot of links in this video and you're going to find all of them in the article on my site that I've linked to in the description below the video. Now if you found this video useful, please give me a thumbs up and subscribe by smashing that big subscribe button below the video. So you'll see when I publish more videos for full stack developers on Microsoft 365 and Microsoft again. I'm Andrew Connell. Thank you for tuning in and I'll see you in my next episode.


From VOA Learning English, this is the Agriculture Report in Special English. Farm to Table is the name of a movement that encourages people to eat locally grown food. The Farm to Table idea has become more popular in recent years, but there is also a group that brings Table to Farm. This traveling group is called Outstanding in the Field. It says its mission is to reconnect people to the land and to honor local farmers by creating a restaurant without walls. Jim Dennevin got the idea for this kind of culinary adventure, as he calls it, ten years ago. He recently prepared tables for more than 100 people at Brier's Farmstead in Virginia. He and his eight-member crew arrived the night before. Chefs from a local restaurant prepared the dinner. Jim Dennevin says the mission of Outstanding in the Field is to bring people closer to where food comes from and hear the stories directly from the farmer. Jim Dennevin's brother is a farmer and he himself is a former chef. He thought the idea of a meal served right at the farm made sense. So he traveled across the country and set up tables at farms and ranches. Guests bring their own plates to the meal and when they arrive, the farmer shows them around. Matt Saccini and his family operate Brier's Farmstead. He hosted the Outstanding in the Field event. He says the event connects his family with a lot of enthusiastic people. It is a great way of forming relationships for the future. He says his type of small farm business thrives on relationships. Jim Dennevin and his team have served almost 13,000 people. He plans to expand the operation. He says he is planning to go to Asia, Africa, New Zealand, Australia and South America. For VOA Learning English, I'm Alex Villareal.


Hey, what's up everybody John Hammond coming back at you with a couple more videos for the junior CTF capture flag competition I'm recording this one now Separate from what I had been recording the other videos. It's been a few hours. I managed to solve a few more challenges. So up on the school board I'm back in the top 10 tied with the open to all teams. That's kind of nice and ahead of One of our rival teams. So that's that's good stuff and good news Um Anyway, I want to showcase some of the new challenges that I solved and here we'll move along I want to show off the hackers blog. It's a 500 point web challenge Um, so the description the description here the challenge prompt is hey stranger. I need your help Um, blah blah blah. I'm trying to hack this blogger's website Uh, but I can't believe you're so good at take a look and you've got to be using the vpn to do this so the vpn is a another challenge That I don't have a video yet for but it's not very hard to showcase. I'll go ahead and uh down and get there Junior cpf it's in the team And then we have all of our Things so you can just sudo open vpn to get the vpn running So once the vpn has a connection set up, um Now we should be able to actually access that web page So I just use open vpn to do that now. I can access these pages. So here's the hacker's blog and it's all in russian So, uh, uh, I do not speak russian Nor can I read the language or anything like that. So this is kind of a difficult challenge for me to solve. Um, so Uh, big credit and kudos goes out to some of their friends and some of their individuals I talked to this challenge, uh through with and stuff like that So I looked at some of these pages. I try to look around to see what all these things were Looks like a bunch of posts. I'm assuming because of his blog thing So I can control you and view the source. Um I don't see a whole lot of interesting things in here initially I'm seeing how they're stretching the background image. This all looks like regular html So nothing particularly interesting there Some of the russian text which I can translate if I needed to And I see password here, so I thought that was interesting I selected that and translated it which you can do too. It's just a google search to google translator Um, but it's just for like, okay people using default passwords on routers and stuff like that. So a red herring And other posts and other stuff I noticed each of these posts have a specific id So if you go to one of them, it's id equals five or id equals zero up in the URL like the get message you pass through it So if you try and give it an id number that doesn't actually exist like zero or 99 It just redirects you back to the home page. So that's nothing really interesting there But I kept Viewing the source. I saw an interesting thing here and that you can comment on these on these You can give it like a name I'm assuming a name based off this and a text. So I thought that was interesting I didn't initially play with it a whole lot until I went back to it later on But I'll I'll try and talk more about my thought process when I was going through it because I looked through all these challenges and stuff All these posts all these messages that people have been posting Um, and at the very end of the page that I was on and as well as the home page It looks like all of them because of the footer they have this html company that says secret admin panel And this is very clearly base 64 with the equal sign there the trill equal sign So I copied that and just took a look at it Uh We get a prompt that we can look at So I'd echoed that into base 64 to decode it and it gave us the ip address with a new page admin 64 641 blah blah blah so I copied that And went to the page and there's some russian text orders. I don't know what it was so I I google translated it Google translate Okay, so it says invalid username and password access is denied so I didn't actually at any point enter a username and a password. So I was like what the heck Uh, how do I how do I get into this web page? I tried passing around like a username variables and password variables in like the get HTTP variables Uh, I even tried doing it with curl. I would just try and send like Post data with a dash d flag and send username and password that way. Uh, that didn't get me anywhere um I even tried to find I saw those numbers were weird. So I tried like an admin dot php page, which is a thing Um, I tried google translating this too But I couldn't get any actual output of it when I had googled this Like I did just google that uh text itself I think earlier. I saw ended up seeing like Some github thing that was defining this is the error message for like, um, Authentication not found or like wrong bad username and password stuff I saw in github for php stuff. You define the other language, but again, that was just a a red herring So what I eventually ended up doing Was testing around with those, um input boxes those messages you could post those comments You could leave on some of the some of the posts here. Um, so what you come to find out is once you leave a message here um If you were to post it the message that you receive Is actually, uh, it tells you like, hey, please wait for an admin to review your message So this russian text here if you check check that out in the translator Just please wait until an administrator approve your messages. So that gets me thinking. Okay Um, can I do some like cross site scripting stuff for xss? cross site scripting, um So if the admin views the the message if the admin looks out I wonder if can I steal like the admins cookie and that kind of setup To be able to see if the admin cookie has any valuable information Like a flag or credentials that I might be able to give to the admin page Because I apparently need to be able to give credentials to the admin page So, uh, that was the idea the plan of attack and I'll showcase it to you and what I ended up doing here because I have a cookie catcher set up Which um, if you don't have one set up for yourself You should for some ctf challenges and I'll show you how I have set have mine set up Um, but it's on a domain that I own. It's on a website that I own just called like my name Like johnhammon.org And there's nothing on the page. It literally just says oh, hello there. Um, but it is a php page that Excuse me that it grabs your cookie and stores it in another following page called cookies.html So it grabs an ip address and the cookie and I tried to get date and time in a website referrer But I actually think I just left those blank Um, so there's a bunch of things you can scroll through as you can see how people Or bots like I try to look at my domain and do interesting things. I saw I have some interesting results like Like pizza imperial and I think there's another imperial one Yeah burger imperial so those are those are funny And there are a lot of these results from different ip addresses So you'll see interesting things I guess when you set up a cookie catcher like that to see bots scanning your Your your domain. Anyway, I want to show you how this is done. So I'll Move over to that box. This is just a go daddy domain that I own It's a regular web server. So I have the uh index.php, which actually is the cookie catcher What it does is it grabs a http variable Um The cookie in this case it tries to grab an ip address from the server Um php variables here and refer and stuff like that and it opens up that cookies html file and it writes on it With a it depends on a cookie And all that stuff all in html and I close it and then it just displays on the screen. Hello there So it doesn't do much of anything and the commented lines aren't necessary. See I don't have the date I just have a period here. So those aren't really necessary. All we're interested in the cookie and that's just how we get it I just pass it in as a get variable when I do my cross-site scripting, but that's how it's done That's how I I I receive it and it's added to a log that cookies that html file So when it comes to the actual injection that I have I take a note of here in my cookie catch dot javascript. So, um that I'll showcase it for you here the syntax that I actually end up doing for the javascript cross-site scripting is uh Just a regular dog me location like to redirect them and I give them I pass in the html get request variable Cookie in this case and I have it escape their actual The document cookie So if an administrator or a bot or an automated administrator or whatever the case may be for the challenge purposes goes to this web page and they are All of a sudden injected with my cross-site scripting Javascript and I redirect them to my domain and have them pass in their cookie. I can see it. I can log it Now I saw in the telegram chat in the in the conversations for the ctf In like the irc channel equivalent, um the hint that they released for this hacker's blog challenge is that redirection is not allowed They've they blocked redirection. So this document location syntax and javascript wouldn't work for me So I The little bit of research I talked with some friends and we could get this idea and solution So you actually create a new image and set up the source for it and that should be able to Get and he just encodes it the actual document cookie the same way. I think I do with escape I don't know the difference between those two functions admittedly Um, but this is what we ended up rolling with if redirection is not allowed So this is our xss or javascript We can inject and place in our comment because assuming that it will actually read the html and interpret it In the wrong way. So they get redirected to our web page and our cookie catcher Which uh, you can set up very easily if you wanted to again with this code or um, just googling cookie catchers And knowing how to set them up Just going through some guides and some tutorials. So they're they're cool. They're interesting I think yeah, this is even the exact code that I stole and copied All right, so let's do it. I want to showcase this for you guys. So Let's say like my name is john and I want to post in this xss payload. I can go ahead and submit this Oh, did I get an error? Probably because it wants me to wait some time Okay, yeah, I tried over to comment within a 10 minute delay so Because I posted that one earlier It's not going to really let me do it or showcase it to you But I still have the cookie and everything saved. Um, so What happens is you would go ahead and submit That payload of the actual JavaScript xss payload And you would get the same response. Hey, please wait for an administrator to actually look at this And then you monitor and keep track of your log Which I suppose you could use mine even at the very very bottom I have this new cookie that I saw From a random IP address and an interesting website But I have this this one was new earlier today when I saw this challenge and it has a login and a password for the cookie So awesome, uh, we can just add these and create these now We can go ahead and Create these for the challenge because if it's just going to that admin page that we wanted Was it six four one six four one? I don't remember What it was Okay, thankfully, I still have it We can go to this page And with our cookie we can go ahead and set these up in the cookie manager For firefox We'll search for this domain. Okay, it looks like I don't actually have one. So I'll have to add a new one So we can say new cookie For I guess the password is the name of it, right? We'll set the value in here domain should be This guy And the path can be anywhere for the entire domain And that will set up another cookie Which is they said what they wanted login equals admin. So Login content can be admin again for this domain path of any type We can save that now. Ideally, we will get our flag when we refresh this or something and we don't Fail So it doesn't seem to work well enough for me when I'm using the cookie manager one I don't know if I can get the domain or whatever the thing right So, um, I actually just went ahead and did it with curl and that seems to work just fine for us. So if I Just curl that address And I pass in a cookie variable now we can use what we're given just straight up real easily Just copy it. Oh, I didn't mean to invoke firebug there and paste it in Now and reload the page. Hey, we get a flag Uh, one true hackers elite xss cross-site scripting. So that's it Um, using our cookie catcher and just passing in the cookie that we get from the admin that visits the page Um, we do get our flag with taking advantage of that admin page We saw earlier and taking advantage of the cross-site scripting that we that we found in the comments So that's it. That's how you solve that challenge. It was a good challenge I honestly used to struggle with it for a long that while because uh, I was can I wasn't convinced there was xss I wasn't convinced there was cross-site scripting in the comments And I didn't I really didn't know what to do with that admin page because I couldn't get a login I couldn't give it credentials at all Uh, at least seemingly um But we uh worked through a little bit more and we ended up getting it. So awesome. Awesome Thanks for watching guys. Hope you enjoyed this one Pretty uh pretty nifty 500 points here and uh, I'll try and showcase some other cool challenges in a future video. So see you soon


Welcome back after Thanksgiving. I hope everyone had a wonderful holiday. I'm very happy to be here today. I know this year I was pretty happy on Thanksgiving to have joined the Marianne family. So I've really enjoyed the past six months that I've been here so far. If you haven't met me before, I'm Carolyn Craven. I am part of the medical retina team with UBI-DIS and ocular oncology and a little pathology on the side. Today is our annual retina grand rounds and so we're gonna split it into kind of two parts. The first part will be presented by our wonderful fellows. We'll start off with kind of a nice smattering of retina that you might find in my clinic with the side of genetics. So we'll start with Dr. Koehler. That's okay. Hi everyone. So this will just be kind of a basic introduction to what we do in our retina department when we get referrals for inherited retinal disease. I have no financial disclosures. Inherited retinal disease is a very broad topic and it's becoming more difficult every year as the number of genes that are identified for different inherited retinal dystrophies expands. In our clinical exams, while they are great, they can only get us so far. And that's because there's so much heterogeneity in the field of genetics where multiple genes can give rise to a similar phenotype or a single gene can give rise to several different diverse phenotypes, one being PRPH2. So ultimately we rely heavily on genetic testing when evaluating these patients and maybe the diagnosis of just like retinitis pigmentosa is not sufficient anymore for these patients. And to explore that idea, I'm gonna present a couple of cases. The first is this 23 year old male who was referred to us. He has mild nyctalopia and photophobia and he has two uncles who have some sort of vision problem and his brother seems to have problems with nighttime vision too. So already there's this theme of male predominance in this family. You think about an excellent disease with this patient. Vision's very good. He's 20, 20 in both eyes and he has some constricted visual fields to confrontation. And when we work these patients up we get a lot of imaging for many different reasons but optosimaging is extremely helpful in these cases. And you can see in this patient he has this blonde fundus but there's particularly a lot of choreoretinal atrophy in the mid periphery and encroaching on the phobia as well. And it's fairly symmetric in both eyes. This is also identified on his wide field fundus autofluorescence which you see these patches of hypo autofluorescence and also this ring of hyper autofluorescence in the macula of both eyes. And then OCT imaging is critical. We wanna look at the anatomy of the retina is particularly the outer retina and you can see at first glance it may look fairly normal but there definitely is easy loss and ELM loss temporally. There's also trace amounts of intra retinal fluid near the phobia in both eyes. And visual field testing is also critical for these patients. They may not complain of visual field loss but sometimes we find that they have only like 20 degrees of vision and they're driving. And so having this to just alert them and also to follow is extremely important. And you can see this patient has constricted visual fields in both eyes with various scatomas. So not surprisingly, we recommended that he get genetic testing and we'll touch a little bit more on this later but he underwent in vitay testing through a saliva swab and that showed a CHM mutation which is diagnostic for coridaremia which is consistent with his clinical picture. And that's a very critical point that we'll also talk on in the next case a little bit about the genetic testing being consistent with the clinical picture. So coridaremia is rare, excellent recessive as we expected from his family history. And it's this result of a CHM mutation which is involved in intracellular trafficking in the RPE and photoreceptors. And it typically presents in the first and second decade of life. And this is also critically important because these patients are young, they're starting to learn how to drive or they already are driving. They're also maybe in high school or getting ready for college and thinking about what careers they wanna have. And so having this knowledge of what sort of genetic disorder they might have and arming them with that so they can prepare even if it's for decades ahead so that they at least think about that when they're considering a career path because not all career paths are good if you're going to lose your central vision in a decade or two. But these patients can retain very good vision, 20, 20 vision even into their fourth and fifth decade of life sometimes. But there is hope for these patients. There are several clinical trials ongoing for coridoremia. One recently finished that was looking at a viral gene vector. And the FDA is always interested in visual acuity and improvements and not a loss of visual acuity but it's kind of hard to study that in these coridoremia patients if you only have a year or two of data because if they retain good vision for decades it may not be the best identifier for their disease course. But there are other clinical trials still underway one of which the Moran is a part of with a 4D-110 viral vector which is intravitual injection and we have a few patients involved in that trial. And then it's also extremely important to look at the natural history and that can empower patients to know what to expect. And so that's also why we get so much imaging when they first come in and we wanna follow them every year or two to see the changes and to at least describe to them and show them what's happening if they're not aware but oftentimes they have a general idea that they know each year their vision is getting a little bit worse. And there are other clinical trials going on elsewhere. So the highlights of this case is just that genetic testing can be extremely helpful for diagnosing patients. It also helps you identify family members that are at risk and for family planning for these patients whether they want to have kids or if they do not. And also the genetic testing is extremely important for identifying if they would qualify for any clinical trials. So our case two will touch on these topics a little bit more and go into a few other ones but this involves a 38 year old female who was referred for peripheral pigmentary changes. She's completely asymptomatic. She had just gone in for updated glasses and got a dilated eye exam. Her vision is 2020 and 2025 full visual field to confrontation and her macular fundus autofluorescence looks pretty normal overall as does her OCT. But you can see on Optos imaging that she has diffuse peripheral and mid peripheral pigmentary changes with a fairly hard demarcation line that's pretty close to infir arcade. And this is also evident on the wide field autofluorescence and her visual field testing showing significantly constricted visual field particularly in the upper field. ERG showed reduced amplitudes in both photopic and scotopic lighting. So for her, you know, not surprising differential inherited retinal dystrophy but you might be surprised that I put allergeal syndrome on there. And this is why the clinical exam is still extremely important for these patients. So briefly, allergeal syndrome, I know as a resident, this was always sometimes frustrating to get these consults in the NICU to evaluate and try to diagnose babies with this. But it's an autosomal dominant inheritance pattern. Jague one is one of the mutations that's responsible for greater than 90% of these cases but there's also this other mutation notch two that's present in about 7% of patients. And this encodes this transmembrane protein in the notch signaling pathway but these patients can have multiple systemic issues related to this disease as well as many different ocular findings. And so using the exam to identify some of these abnormalities can help you decide what sort of genetic testing to obtain. And I bring this up because looking at Dr. Bernstein was part of an article that looked at the systemic and ocular findings in allergeal syndrome. And you can see that the auto fluorescence looks fairly similar to what our patient has this hard demarcation between hypo auto fluorescence in the periphery and normal to hyper auto fluorescence closer to the macula. So we refer this patient for genetic testing and also to social work and possibly low vision if they are interested at this time but they don't always pursue that right away. But I bring up this example because there are so many genetic retinal panels that are available and we rely heavily on Emily Spoth our genetic counselor to choose the panels but it also is in discussion with us about our clinical findings and our differential. And so this just shows through blueprint genetics some of the various panels that they have available and there is some overlap between these panels but one of the panels is the My Retina Tracker program panel which comes at no cost to the patient and covers 351 genes including some mitochondrial genes and 351 gene sounds really good and might be enough but not always in every patient and they also get genetic counseling as part of this program. The print out this is not for our patient but just an example comes like this there's a lot of information here but it essentially says what mutation they have whether it's pathogenic whether it's a variant of uncertain significance and it gives you an idea of their clinical report the mutation it describes families that might have this the studies that have been that have undergone to determine whether it's pathogenic or why it's a variant of uncertain significance and the ultimate conclusion. And so most of the time our genetic counselor will go over those results with the patient but this patient she had previously undergone My Retina Tracker program paneling but that does not include the notch two testing she had a couple variants of uncertain significance which are seen in Usher syndrome but her clinical exam is not consistent with Usher syndrome and then she also had this SLC2 for a one mutation which is seen in congenital stationary night blindness but that's an autosomal recessively inherited disease and this would not be responsible for her findings. So her clinical exam given the thought that this could be allogial syndrome she needs further testing and we advise that she get notch two testing and we're awaiting those results but it just kind of highlights that even though we have great panels and they cover a lot of genes you still have to perform a really good clinical exam to evaluate these patients to determine what genetic panel would be best for them and also keeping a database of the community and these genetic mutations that are common in the community can be extremely helpful for knowing what patients would benefit from future clinical trials such as we have the Luxterne sub-retinal injection that's available for RP-65 patients and certainly there will be other gene therapies coming down the road in the coming decades. So with that, I'm gonna hand it over to my co-fellows and Dr. Craven who will build on these ideas as well but I welcome any questions, yeah. It's not been amazing to me people with such profound visual flip effects would be totally unaware that they have that problem. Yeah, I think support for us understand there's work needs to be done is but I'm confident that the brain it kind of fills in these gaps and it just kind of averaged out like it doesn't have a blind spot for instance and it takes a little from one side to the other. It's so we need to be aware that often these people don't have an idea how dangerous they are although suddenly we could get with that axi if they have a patient that happens once.  He had profound visual field defects. There was no way he should be driving. He had no idea. So patients often aren't aware of that aspect little macular change boy they see that immediately but a lot of peripheral fields until it's very advanced they have no idea that defect is there. I would agree 100% with that. I'll let Dr. Bernstein comment. Yeah, I'll just kind of comment and I think that there will be more in the upcoming talks but our genetic counselor is a really great resource and we really need to use her even more than we are. She keeps a great database, she's very knowledgeable and interact and most of her work is coming from retina but there's a lot of other genetic diseases out there and the other specialties and you just, she will help guide you through it. Now we're lucky in retina that these are covered by my retina tracker so it's, this is $1,000 worth of testing that they get for free and they, all they have to do is fill out some online surveys and that's about it and patients all wanna do that if they're interested but it has to be retina, they will only pay for retinal degenerations and other things. We don't do it for AMD, et cetera. So just use her and I get more than enough referrals from all of the Intermountain West for all the inherited retina diseases. There's huge amounts but she really helps support what we have but for the patients that do come in, they have to be warned this is a half day to a one day visit. There's so much testing that's going on that they just have to be, they have to come in with reasonable expectations when they're coming in and we're not gonna solve everything but we can solve a lot. I just briefly wanna say like in regards to the other genetic testing, you can see like through blueprint genetics, a lot of it is retina but there are other subspecialties identified on here, even like a cataract panel for genetic testing. Oh yeah, it wasn't what I was gonna say but Paula, I mean I think in pediatrics we see a lot of patients who have these kind of vague complaints and then have some retinal changes for which we suspect a dystrophy and I have been sending these, a lot of these drunken families both and I feel like before her, I would sometimes try to find which panel to order which was kind of difficult to navigate and now I'm just having her not only select the testing, I mean I just simply just send them to her. Is that the right process or do you want me to send them to you first and then you guys kind of involve families both? Do you have any preference on that? Okay, I guess it's louder here, I don't know if that one's even working but online, okay, all right. She will just work with you. I don't think every retina, if you are a good, if you feel confident that there's a retinal dystrophy and you feel confident in your practice that you can manage this, you can order the testing with her. So because the wait list for me is three to six months now for a retinal dystrophy for an inherited retina disease slot and I'm trying not to get overloaded. I can tell you that a lot of your schedulers try to sneak them in and then I get three new inherited retina disease patients at one time in a clinic and no one's happy with that, so. If you're ready to share the burden. Yes, yeah, I'm ready to share the burden. So if you feel comfortable, she will guide you through and go through which panels and what can be done and the costs. She has enough time to do that. Okay, I feel like I'm sending her maybe one or two referrals a week because with the cataract, with the congenital cataract, I send those to her. A lot of the abnormal genetic congenital stuff that we see, I find she's been incredible for. Yeah, and she has the capacity and the desire to do more, so. Okay, and one other just kind of question or thought. I feel like the most sensitive screening question I've had for my pediatric patients for whom I suspect a retinal dystrophy is Nicolopia. And is that seem true to you? I feel like that's very, at least for classic RP that will be their first symptom. Gotcha, and what's interesting, just having had Halloween, I feel like I'll see one or two cases almost every year of parents who found their kid was blind on Halloween because they had actually never been out past dark. And then on Halloween night, they just suddenly are just lost and they can't, they can't see that, you know, because they just usually not letting them stay out till that late other night. So, interesting aside. To kind of follow up on that, I think there's a lot of kind of good points that were brought up here. One was what Dr. Wilson was bringing up is patient awareness. And when we have our patients who have developed symptoms as a child, they've really adapted and they don't really know what they've lost unless it's very profound vision. And so some of the patients are really shocked when they hear about their diagnosis and what they're trying to tell you. Our next case, absolutely, absolutely. That would be exemplified by this next case and this inability to really process and kind of claim these diagnoses. And it's hard because it's such a radical change in the patient's expectation for the next couple of years to decades of their life. And sometimes this requires multiple conversations with them. Sometimes it requires talking to their families and kind of the art of breaking bad news and kind of asking the patient, how do you feel about this? What's your awareness? Do you feel safe driving? And kind of get them to come to these conclusions to hopefully they will admit to themselves that yes, maybe they're not the safest or their spouse is saying, I'm terrified when they're behind the wheel to get them to genuinely stop driving and making these lifestyle changes. Emily is a phenomenal resource. I got my start in medicine actually working with genetic counselors at Ohio State and it's spending time with them and seeing all the work that they go into taking care of these patients is really impressive. And so a lot of times we think about making these diagnoses and it's getting to the point of just getting that test result. But what genetic counselors do is they do a lot of work upfront with the patients before even getting to the point of collecting the swab and sending off the sample. And so they really kind of brace the patient on what to expect and what type of results they might find and how that might be applied to their next visit and their future care. And so there's a lot of involved conversation with Emily and the genetic counseling upfront and then also after the results come back and in the future. That's very helpful and it's also helpful to kind of revisit genetic counseling with our pediatric patients once they become adults because some of these topics might have been discussed with their parents or when they're teenagers and they're not really paying attention but once they get into further into their adulthood some of these concerns might surface a little bit more. So with that, Dr. Fuller will present our next case. If you've lost the mouse. All right, thank you. Yeah, great turnout, great comments. You've all pretty much given every point I want to make in my talk, which makes it easy. We're also running a little bit behind so I'm just gonna try to get through my slides pretty quickly. And I guess one point I'd like to make on the front end is Dr. Bernstein's really busy with IRDs. He and the fellows and the residents on service all feel that's the text and all the staff. But this patient is someone that Dr. Bernstein saw and then also Dr. Craven saw. So I guess if there is some kind of maybe urgent need or maybe as also as another resource someone, I don't know how much you're wanting to like advertise yourself as an IRD referral physician but Dr. Craven's amazing. I've done practice in my fellowship training and I was very proud that at Groening Memorial Hospital I was able to kind of bring blueprint testing to this underserved population. And we found in our, in my general medical retina UVitis clinic over a dozen patients in a year that ended up having an IRD that really changed the course of their treatment and expectations. So I do have one IRD slot a week, not including the macular degeneration patients that gets the appointment. So it is an ongoing kind of balance like Dr. Bernstein was saying is that these patients take a lot of time to get through just imaging before you even start talking to them. But so I do see some IRD on the side. Yeah, and that's really the point of my talk is to highlight just the spectrum of imaging that we do for our patients. And also to highlight Emily Spoth, which we've already done but her contact information will be up here at the end for the community and even RAN people. And then also to highlight how genetic testing is useful, although not always I'm diagnostic. So I've no financial disclosures. I'm not talking about the Love Island show from Mallorca. Talk to this patients from Tahiti. You know, this is a book about Tahiti by Robert Langdon. But you know their name of Tahiti is the Island of Love. So this is a 65-year-old female from Tahiti she was complaining of as Dr. Dording said, Nick Tilopia, although she didn't notice it on Halloween. She also is having trouble seeing lines for the past year while driving other various, you know, visual functions or visual tasks. She has a history of diabetes, A1C controlled. She has a prior ocular history or diagnosis of age-related macular degeneration, non-exidative, she's taking IRDs too and last on outside ratness specialist a year ago. Her visual acutin the right eye is 20, 25 minus two, left eye is 20, 30 minus two, pressures are normal. No APD and anterior segment exam is unremarkable. The posterior exam, whereas, you know, James's case, two cases were kind of from the outside in, this one is clearly more from the posterior pole radiating outward. So you see this RPE changes and RPE loss and atrophy of the macular of both eyes as well as these, you know, yellow deposits in the posterior pole and then also mid periphery. This is an OCT scan that highlights the RPE loss and the outer receptor loss. You can see at the fovea, there's some preservation of the ellipsoid zone, which, you know, speaks to the patients relatively preserved central visual acuity. Here is the macular funnous autofluorescence which shows a patchy multifocal areas of hypo autofluorescence in the fovea and in the posterior pole extending to the outside the arcades as well as areas of hypo autofluorescence. This ERG, it's not gonna go into all the details but it essentially shows cone and rod dysfunction and definitely in the right eye and also signs of rod greater than cone dysfunction in the left eye. Dr. Bernstein also will sometimes get dark adaptation results or testing which just shows how symptomatic they are from their nyctalopia or if they're, you know, nyctalopia is a subjective experience for patients and so this gives a quantitative measure. If a patient's rod intercept is greater than 6.5 minutes then they have a positive or an abnormal dark adaptation test result and this patient didn't have that. This is mya microprimetry which basically tests visual field at very specific points within the macula. Most patients, if you can see my mouse on here should have their results being here in this bell curve but all these patients results are not in the bell curve and so this patient has abnormal kind of visual function in the macula as a result of the atrophy from her condition. This is a really cool scan. It's a high resolution OCT. So in comparison to the standard OCT that we get you can see a greater definition of the retina layers. You can see kind of more clearly how the RPE and the ellipsoid zone are preserved kind of right at the fovea there whereas here it's a little bit less distinct and yeah, just a really interesting scan to get and something we do for our patients. This is a fun test that is not a great result for this specific patient but this is macular pigment testing. So a normal macular pigment does not look like this and even this is not classically abnormal but except for the fact that the software is not able to get a proper standard deviation for the range of macular pigment for this patient the machine is trying to compare areas where there is macular pigment areas where there isn't in these rings and as you can see from all the blue and the green off to the left it's not able to really to get a good reading for this patient which makes sense because she has diffuse RPE loss. So her macular pigment testing is gonna be pretty abnormal. To Dr. Olson's point, this is a visual field where there's the central scatomas in both eyes but with both, sorry, in each eye but in both eyes, she's actually functioning pretty well. So I think these patients do compensate with both eyes open and do fill in the gaps by these little micro saccades. She had vitamin A testing which was slightly high so her vitamin A supplementation was stopped to avoid toxicity and she did get genetic testing which was inconclusive. She has pathogenic variants in PDE6C which is autosomal recessive and then she also has a surround sec, a pathogenic variant in PDZD7 which is autosomally recessive for non-syndromic deafness. So these are heterozygous mutations for recessive inherited rental degenerations. So looking a little bit deeper on the PDE6C this gene encodes the alpha prime subunit of cone phosphodiesterase and is mutations of this gene are associated with cone distribute type four. It's located on the QRM 23.33. If you look at the PDZD7, this gene encodes for a ciliary protein which is homologous to proteins which are mutated in usher syndrome patients. And if you look at the location it's on the QRM 24.31. So some usher syndrome patients can have an RP type phenotype. This doesn't classically look like that but is there some interplay between those two mutations? They're kind of closely together although I think chromosomally they're actually they've been out light years apart but probably on the order of something like that even though they look close on the screen. It's hard because these genetic tests they don't track all of the pathogenic variants. We're still learning about them. I'll kind of skip Dr. Craven kind of mentioned some of these factors. She can talk about it later. There's several papers that get into this variance of uncertain significance and different rates of these and different racial and ethnic populations. And this study said that there are higher rates among Asian, black, Native American, Pacific Islander and Sephardic Jewish individuals. I do think Dr. Bernstein does a really good job of even when he has nothing definitive to offer like in James' first patient. He tries to help these patients have hope in future advances. And I think this is one thing for this specific my specific patient is that even though the genetic testing didn't find her pathogenic variants necessarily it did add her information into the pool of the database for these genetic these inherited rental degeneration patients. And so this paper highlights that the disparities are hopefully gonna be mitigated over time as genomes from our individuals from these different groups are sequenced through large scale projects and as laboratories continue to share their information through ClinVar. So, you know, this patient although she kind of fixated on and didn't really had to have she has made major cognitive difficulties and it was hard to kind of counsel her on her condition at the same time to her and the family members that accompanied her I think keeping her in this database that Emily's both keeps can hopefully help in the future if anything does come up. So again, I just wanna highlight that Emily's both is a tremendous resource. You know, Marianne please people please refer to her. Also, I've seen some people from the community send patients directly to her and that's completely appropriate and encouraged. Here's her email and her cell number. She told me to put this up there. She wishes she could be here but she had another meeting that she at this time that she can't move. I just wanna say thank you for the to Dr. Bernstein, Dr. Craven, Emily and my co-fellows for the care of this patient and just want to end with that. There any questions? All right, and I think Dr. Craven might mention a little bit more about the some of the specific nuances of the care for the specific patient. So I think this is an interesting patient for a variety of reasons. One, the exam is so striking and so kind of what was brought up earlier getting genetic testing outside of your like dedicated IRD clinic. When you see something that seems and feel acts like a duck, cracks like a duck, you can go ahead and test to see if you can find that answer. You don't necessarily need all the advanced testing. That can always be done at a later time once they do get to an IRD clinic but sometimes I find the most valuable test and image is just the fundosado fluorescence. If there's one test that I never wanna give up it's that fundosado fluorescence. And then with this patient, she really exemplifies how we still have a lot of limitations to genetic testing at this point. I'm very grateful for Blueprint to be offering free testing for these patients. It makes it more accessible but it also kind of widens the net to really help facilitate getting just more data points to expand our awareness. And then the last thing is this patient came in and she did a lot of research on her own and Google and these patients are really fearful because they're losing vision. And so we have to be wary of what they might do and on their own to try and kind of improve their vision. So she was really fixated on having a vitamin A deficiency. And I always test for that in Nectalopia if you can find a reversible, easily treatable cause of vision loss. It's always good to rule that out but she had come with four bottles of vitamin supplements and that could actually be harmful, toxicity-wise for her. So I think having these conversations, this was a nice patient to present. So thanks, Spencer. Presenting another classic patient that might come into my retina clinic as one thing and turn out to be something totally different. Yeah, so I think the case that I wanna highlight, hopefully just kind of put together some of these things we talked about about the importance of kind of all of your information, your clinical history, really comprehensive exam and multimodal imaging and genetic testing to sort of get at what a diagnosis is when you're considering on the differential inherited retinal disease. So this was a patient, a 29-year-old woman who was referred for anterior uveitis of both eyes. She had no past medical history but she was diagnosed at age 11 with retinitis pigmentosa, which was diagnosed while she was living in Colorado in the setting of chronic nyctalopia. She wasn't on any medication. She didn't have any sort of obvious notable family hysteria than a great-great-grandfather with blindness of unknown etiology. She was Mexican-native American heritage. She grew up in Colorado and had no other high-risk exposures. On exam, she was 2025 in the right eye, 2020 in the left with normal intraocular pressures, no afferent pupillary, no relative afferent pupillary defect. And then jumping to her exam, she did have some signs of chronic anterior uveitis. So she had mild AC cell and flare in her left eye while on topical steroids. She had some structural sequelae with posterior synechia in both eyes. And then she had a fair amount of vitreous cell, one plus in the right eye and two plus in the left eye without haze. So this was her fundus photo of the left eye, which just highlighting, kind of showed this impressive sort of lobular, multi-sort of lobulated distribution of coriorutinal atrophy with associated bone-specule pigmentation within the atrophic areas. And there was some waxy appearing pallor of the nerve and some vascular attenuation. And then also I'd highlight that more peripherally, you have some of these more punched out coriorutinal scars in the left eye, sorry. And then this was the right eye going in reverse in very similar sort of symmetric appearance, also highlighting that this patient had a PSC cataract. And again, the sort of lobulated distribution of coriorutinal atrophy with bone-specule pigmentation and these more peripheral punched out coriorutinal scars. The autofluorescence corresponded kind of to that distribution with hypo-autofluorescence within these areas of atrophy. And then the OCT showed what corresponding to that was just sort of diffuse outer retinal atrophy sparing the central sort of foveal distribution with a cystoid macular edema in both eyes. Fluorescine angiography showed essentially large window defects corresponding to these large areas of atrophy without any sort of notable peripheral vascular disc leakage or active retinal vasculitis. Her goldmine visual field showed what one might expect with these sort of paracentral scatomas related to the coriorutinal atrophy and then full field ERG showed sort of generalized reduced rod and cone responses sort of generalized retinal dysfunction of both eyes. So getting more into sort of then digging into the clinical history. So again, this patient reported longstanding nycrolopia since childhood in which this diagnosis of RP was made. But she also had several other features that sort of lent itself towards a different diagnosis. So she had vitiligo involving her neck and her face. She had areas of poliosis of her eyebrows and eyelashes. She had prior instances of alopecia that were involving patches of her scalp and groin area. And she had chronic headaches with pretty significant high frequency tinnitus, all of which as far as she could remember started kind of after or kind of in the context of when her vision issues started. So this patient was referred for genetic testing which ended up coming back negative for any explanatory mutations for this patient's phenotype. She had two variants of uncertain significance, one of which associated with Usher type 1D and then the other one associated with cone rod dystrophy and retinitis pigmentosa. So this patient was actually felt not to have retinitis pigmentosa but actually sort of manifestation of chronic VKH or vote Koyanagi-Harada disease which is a bilateral granulomatous pan-uveitis that in the acute phase presents with these sort of multifocal exudative retinal detachments as well as typically other extraocular findings including neurologic and skin findings that our patient had. And it's more common in Asian, Hispanic and Native American ethnicities as consistent with our patient. And really the findings of it, again getting towards what I'll talk about is just sort of the differentiating features sometimes of overlapping with inherited retinal disease is that depending on the stage, the findings can differ. So in the acute phase, you get this, again these sort of acute pan-uveitis with these active multifocal serious retinal detachments and corral thickening, but in the chronic phase which is typified by sort of this chronic atrophy related to autoimmune destruction of melanocytes. You get this generalized retinal atrophy with a classic Sunset Clofundus and you get depigmentation elsewhere such as classically described of the peri-limbo region and then on the skin involving, you know, vitiligo-poliosis alopecia. And so this patient actually met complete criteria for VKH based on all these findings with her chronic choreorentinal atrophy with this numular choreorentinal depigmentation, RP, clumping and then her neurologic and skin findings which were all very consistent with VKH. So I wanted to sort of use that to sort of lead into just talking a bit about kind of the mimicers and things that one might think of on the differential with inherited retinal disease such as retinitis pigmentosa. So RP is a group of progressive inherited retinal diseases that's characterized by photoreceptor degeneration and pigment accumulation. And with that being a group of diseases it's characterized by a very large range of both genotypic and phenotypic diversity as we've talked about. And so patients can present a sort of variety of ages, rates of progression, degree of visual impairment and so forth.  So I think the first sort of instance in which it might be a bit more straightforward to think about a sort of the things that can mimic RP is this entity call of unilateral RP which is actually felt to be quite rare. It was sort of on the order of around a hundred cases that have been described in the literature. And it's thought that true unilateral retinitis pigmentosa as a genetic disease is felt to be from a somatic mutation during embryogenesis that ends up affecting one eye. And so this was a case describing one such patient in which a patient over 10 to 20 years developed progressive retinal atrophy loss of ERG responses and concentric visual field loss and nyctalopia with a completely normal other eye. But in most cases, there's an alternative explanation that can be found for these patients with described unilateral RP. And so the things to think of would be things like prior trauma and retained intraocular foreign bodies that can cause chronic inflammation and then sort of the other things to think of are again chronic uveated conditions, infectious ideologies and toxic exposures like medications and so forth. And so unilateral RP as an entity is again defined by the typical RP findings in one eye with a completely normal contralateral eye including examined full field ERG and then the exclusion of infectious inflammatory and vascular ideologies that also can cause RP like changes. And in addition to one time point, this is something that should be followed over time because some patients with RP can develop, can be just sort of asymmetric in each eye as a current. So one eye can develop findings later on that might actually be suggestive of true genetic disease. And so these are just some examples of that. So this is the left sides of perhaps more a clear etiology of a patient who had an intraocular foreign body that developed these characteristic sort of pigmentary degenerative changes, diffuse unilateral subacute neurorhetonitis or DUSIN which is related to nematode exposure can cause chronic changes simulating RP unilaterally in which case is only about 25% an actual worm or nematode can be found in the retina. And Azor is a common one as well as a uveatic or inflammatory disease that can both spread and involve a very large portion of the retina either from around the nerve or extending centripetally from the periphery and eventually developed these bone spiculite changes and coriorentinal atrophy. And typically at least to start 60% of the time will be unilateral. And so again, this is looking at kind of a table of a case series of patients that had other etiologies that were found in patients who had RP like presentations. Now just highlight this to say and to kind of go reinforce what we've already talked about which is the importance of clinical exam, your multimodal imaging and history. And so patients who present, for example, unilaterally a very late onset rapid progression who have associated risk factors such as medication exposures or cancer history or patients that you would want to think about potentially an alternative explanation especially if the clinical exam findings are not typical for an inherited retinal disease. And then the last thing just to talk about is that there's interplay. And so there's increasing amount of literature looking at the inflammatory and autoimmune mechanisms that are associated with inherited retinal diseases. And so you can imagine that as cell photoreceptors might be degenerating or related to genetic process that you have a secondary autoimmune or inflammatory response that then might contribute to some of the findings that you see in these patients. And so there can be a lot of overlap with uveidic patients. And so this is just another case series looking at patients with bilateral RP like changes that were found to be related to ultimately uveidic conditions. In most cases intermediate or posterior pan uveitis. And I think just to take away again is that there's several features that are just really important to think about and the importance of these very extensive kind of comprehensive evaluations for these patients. So history-wise differentiating between the two the degree of vitritis tends to be more prominent in uveitis as opposed to IRD. But vitritis or some amount of vitria cell can be seen in up to 40 to 50% of patients. It tends to be low grade without snowballs or snow banking. But can overlap between the two. Retinal vascular leakage can be seen between the two but tends to be more severe in true inflammatory or uveidic disease. And then as in our patient the distribution of pigmentary changes which in contrast to a genetic or kind of classic inherited retinal disease in our patient being more multifocal he's punched out lesions and multi-lobulated and then your genetic testing. And so genetic testing doesn't exclude the possibility of an inherited disease but can help confirm a diagnosis if you're between if it's unclear and if the clinical picture is consistent. So that's everything that I have as far as our patient. So this patient again with a suspected VKH diagnosis was started on immunosuppression and she had a significant improvement in her headaches and tinnitus and her active intraocular inflammation supportive of that as our diagnosis. One thing I wanted to bring up for our first years Marcus did a really nice job about highlighting the importance of history. And for our first years I wanna make sure you know how to kind of elicit some of these symptoms with a patient who has a raw dystrophy and nyctalopia. They're not gonna necessarily come in saying oh, I can't see in the dark. They might come in and say, oh, I can't drive at night and it might kind of sound like cataracts. So some of the classic questions you can ask are if it's a clear night, are you able to see the stars when everyone else would be able to otherwise see stars? Or if you're in an unfamiliar environment like a hotel room and the lights are off would you be able to navigate that? And a lot of patients will sometimes even volunteer that description of oh, I'm at a friend's house and I can't navigate in the dark. The same thing with kind of day blindness and cone dystrophy is people might not always complain of things being washed out or having light sensitivity. You might see kids that are squinting a lot and it might actually be that they finally get better vision from limiting the light entering their eyes and recruiting more of their rod function. So if you kind of really listen to these kind of descriptions that your patients are giving you that can really start leading you down the road of considering an IRD or something else. Okay, so in our last 10 minutes I'm gonna kind of switch gears. I thought it would be good to address where we stand with geographic atrophy. I know that a lot of patients are starting to come in and ask about these new injections and this might be something that our comprehensive doctors and our optometrists and everyone in between might start getting patients asking questions about these. So I thought it would be good to kind of address kind of the changes that have been happening in this landscape. So you're a little bit more aware of these questions and answers. I do have some disclosures. I'm a sub-investigator for some studies that don't really are not relevant here. Just to start off, I have this patient came in. I was told by another doctor, maybe I should consider having that new medication that they're seeing on the TV commercials. So the next photo is not gonna be any surprise to you. It's geographic atrophy. It was a 65-year-old white male who'd been following with his local eye provider for a long time for a couple of years and he had started to notice his central vision. He was declining, but he had never really seen a retina specialist because he was always told there was nothing that could be done for this. And so more recently, things have changed. And so with the recent developments in medications, he came in for a second opinion. And so here the OCT really demonstrates the geographic atrophy quite nicely with the darkening around the main lesions and then the hypotransmission defects in his central macula that are affecting his fovea. So he had 2,100 vision in his right eye and 2,070 vision in his left eye. So we discussed these new medications. And so 2023 has been really exciting. It's been the year geographic atrophy has had treatments finally come to market. So we have a peccidicoplane and a vasin captain. And so this is really exciting because over the past 20 years, we've not really been able to offer our dry AMD or geographic atrophy patients anything more than a rut. We have seen some exciting advances in our wet AMD medications and treatments that have come a long way. And so although these are the first drugs that we have out to treat geographic atrophy, we have had some trials and tribulations with them. There have been some concerns and some risks that have come up. And so I talk about these with patients and be very cautious in who's going to be a good candidate for these medications. But I also use the example that we have to start somewhere. And so we started back in 2004 with our early anti-vegeth agents and look at us now. And so hopefully this will continue to develop these medications for geographic atrophy. And so these are acting on the complement pathway. Like I mentioned before, these patients aren't necessarily being followed in the eye clinic because they have always been kind of just dismissed and said, there's nothing to be done until you convert. But geographic atrophy, some patients, it can be kind of slow, but in other patients it can progress quite rapidly over the course of a year or two years. And so these medications can really make a difference for these patients when it starts to approach their fovea. And so we're finding with C3 and C5 complement inhibitors, we might actually be able to slow this rate of progression. And so we talk about, I know Taylor Swift might be having her era of her chief's era, but I think we're more excited that we're in her complement inhibitor era here as I try and follow Spencer and her up-to-date findings. So AMD, it's a complex disease. There's many things that contribute to it. And so we're starting to really appreciate the inflammatory component. So we know diet smoking exercise, but we also have the lipoprotonaceous deposits that are sub-rentinal and sub-RPE that can be inflaming the RPE and causing accelerated damage and causing overlying damage to the RPE and photoreceptors. And so this is a target that we've found in cadaver eyes and testing changes in complement levels in these layers of the retina. So looking back at the complement cascade for medical school at a really basic level, the complement pathway is part of our innate immunity trying to attack and protect us from outside invaders. So it's trying to light cells, it's trying to kind of take care of damaged cells, it's trying to incite inflammation to help attack an outside infection. And then it also wants to clear these complexes. And so when this goes awry, it can be causing damage to the RPE and photoreceptors. And this is why this is a potential target. These three different pathways of this innate immune system kind of converge at the C3 convertase as well as the C5 complement. And so going through, we have Pixita Copeland, which was the first medication to come to market of note. Both of these medications are injected a 0.1 milliliter volume of medication. And so it's a little bit higher volume than we're used to. This medication can be dose every four weeks or every eight weeks. It has had some adverse events with endophthalmitis, intracular inflammation, ischemic optic neuropathies, and then a higher level of CNV conversion to wet AMD. And so I'll revisit this in a minute, but the second medication that's come to market is Avacin captain. This is the C5 inhibitor. This is also a 0.1 milliliter injection. So far it's been dose every four weeks for the first 12 months, but there's been recent announcements. I don't know if they've been formally published that we're still seeing a effect at every eight weeks of dosing. We're also seeing at 24 months that the slowing of progression in these patients, that benefit is actually doubled as time goes on. And so although these injections will kind of have to be done forever in these patients, there might be an acceleration of benefit as time goes on, but there's also data that says if we stop them, we can very quickly over six months lose any benefit that we have gained. With this drug, there has not been any endophthalmitis reported with it or any significant intracular inflammation or any ischemic optic neuropathy at 12 months. At that 24 month mark, there was one endophthalmitis and a mild intracular inflammation that was not vasculitic. And so a little formatting issues here. So a couple of months after Pixita Copeland came to market, there was an alarm that there were initially six case reports of a retinal vasculitis that there were initially six and now that there's been eight, five of these have been inclusive vasculitis. Three of them have been not inclusive vasculitis. We didn't really see these in the studies, but of course this is something that we fear, especially as we might be treating our patients better. I, these have been all seen within the first one to two weeks after the patient's first time injection. Overall, this has been a fairly low rate, but still very much in the front of our minds. That we have to look out for. In review, there's been no change in formulation between the study supply and the commercial supply to explain these cases. The company did stop distributing kits with the 19 gauge filter needle. They were distributing both 18 and 19 gauge filters. It's not unsure if this is the cause, but something we consider. Overall treatment considerations for our patients, these drugs can increase the risk for conversion to wet neovascularization. We can't necessarily do planned injections. We still have to monitor for this conversion. We also have to monitor the optic nerve with these higher volume injections that might be stressing the optic nerve. We can monitor with OCT, RNFLs and auto fluorescence more than we would with our wet neovascular degeneration. It's okay to continue injections if you've seen mild inflammation once it's quieted. And if they do convert, it's okay to treat them with anti-vegetation currently. And so as we kind of navigate these risks, we look to our patients who are gonna be at higher risk for fast progression, especially if they're at an early age. If they have certain characteristics of their geographic atrophy or features on imaging that might pretend a more aggressive course, they would be good candidates for this, but we do have to make sure that they have proper expectations that this slows progression, but it does not stop it. And so they still will continue vision loss and then otherwise need these injections long-term. Future therapies, kind of just real briefly, we're trying to do a wide variety of treatments. There's other modalities that are being tested, targeting the complement pathway. There's also genetic therapy that's both targeting optogenetics and trying to kind of restructure and repurpose working parts of the retina, but there's also gene therapy to help incorporate instructions on making some of these inhibitors to prevent the need for ongoing injections. And then there's also kind of repurposing oral medications that are widely available and easily tolerated. So we have a lot of exciting kind of potential in the future. Some of these studies are being done here at Marianne, but hopefully we will see as much advancement as we've seen in what AMD that we'll see in geographic atrophy, but we do have something to offer our patients with very specific considerations. So I don't know if anyone has any other questions or comments that I know we're a couple of minutes over, so I appreciate everyone's attention. This is great, thanks.