Good afternoon, guys.  My name is Andrew Gavin. I'm with Verizon Business and I have with me Michael Bauchamp and Charles Smith from NTNET security. And we're going to talk today about how you can use OpenDLP to through Metasploit with existing Metropeter sessions that you might have popped. So without further ado, we'll get going. Just a brief before I get going, everything that we say up here is our own. We're not here representing our companies or anything. And if you use what we talk about today to get in trouble, that's not our fault, so don't try to blame us or anything. So what we're going to do today is to briefly go over what OpenDLP is. I've given talks about this before, so I'm only going to take a couple minutes on that. And then Michael and Charles are going to talk about the limitations of using OpenDLP for pentesters and how they got around that. They basically built this new middleware to integrate between OpenDLP and Metasploit and it's really awesome. So we've got a few demos for you and we hope you guys like this. So just a brief recap of OpenDLP. It's a data discovery tool and it is written in Pearl and C for the different components released under the GPL. So it's free and open source. And what we're going to talk about today is just strictly the Windows agent scanner. OpenDLP has support for agentless scanners for file systems and databases but that's not what we're going to talk about today. So just to show you what it does, I'm not going to talk to these slides here. I'm just going to show you the, to walk through it. There's the mouse. So the first thing you want to do is you want to create a profile. This is the old way of doing it, by the way, not the cool new way. So we'll just name this DEF CON agent second type. And we want to scan. The scan type is a Windows file system agent. So the user name is developer. And what's the password? One, two, three, four, five. Okay. So the same password as my luggage. MS home. So we've got some dummy stuff in a directory here. We don't want to do a full scan because that might take an hour. So just documents. We'll scan for some fun regexes. So Amex, Discover, and this mouse. Mastercard, SOCH visa. And we have to fill out our basic auth credentials. So DDT and open DLP agent. Fill out that garbage. And we submit our profile. So this is what we can reuse all the time. And what we want to do next is just start a new scan. And just fill out the name of the scan called DEF CON. And we want to do the DEF CON agent. And then the IP address is 56.102. So we'll start that. So now in the background what it's doing is it's pushing all these files over SMB to the Windows system that we want to scan. And it's going to start that off as a service. And it's going to run at low priority. It's going to limit itself to a percentage of that target system's memory. So it's not going to totally destroy and crush the box when you're scanning it. Every so often it's going to call back to the web app with results over a 2-way trusted SSL connection. So you can securely transmit results. And this should quickly finish. Oops. To view the scan. So it's running right now. It should finish in a little bit. When it's all done it's going to send a message from the agent to the web app. And the web app is going to automatically uninstall it as a service. It's going to delete all the files that it had, like its binaries and its DLLs and things like that. So if we just wait here, here it's done. And you can see that it's found what it thinks are social numbers, credit card data, all in these plain text files data at rest. So you could click on these files and it would open that file and you could verify whether it's actually a social number or whatever. So with that, I'm going to hand it back over to Michael. He's going to talk a little bit. So under the current implementation, you know, we found that we had, A, we had to have passwords and, you know, necessarily we may not through a PIN test. So what we've tried to do is set this up so that we didn't have to have domain admin all the time because you have to set up a profile per password. So let's say we don't have domain admin now. For each system we have, each password we have, we'd have to set up a new profile and, you know, generally we're just lazy. So that's not the way we want to go. So the goals of this project were to be able to scan machines for sensitive data both with and without credentials. We wanted the tool to have minimal impact on the user so that they aren't really knowing that these things are going on. Even if we have permission, you know, we're not trying to kill the machine. The tool must clean up its deployed files so that we don't have a lot of residual files sitting around and minimize risks of leaking data. So if we don't need to, don't pull the files off of the actual system. And, you know, just not necessarily, you know, a hard requirement, but we wanted to do this with an open source kind of tool and give it back to the community. So what we found is, you know, we pretty much had the tools we wanted. We had OpenDLP. We've been using that. We use Metasploit often for pen tests. And, you know, with these tools, why go learn something else? So is there a way we could make these things work together and give us some ability to do the tasks at hand? So OpenDLP was just about the solution. You know, as we said earlier, you know, we had to provide credentials during a pen test. We may not have the credentials. We may have the hash. We may not have the domain admin. Even if we get the, you know, can get a hash dump, we may not be able to get the domain admin if they haven't logged into that system. While we can use the system accounts, also it's kind of cumbersome.  So no credentials, you know, it's not a problem. You know, Metasploit can do this for us. We go and we break a system. We have metterpter session running and we can basically use the metterpter session to download our deployed files, execute, install services, delete services. You know, anything that we needed to do for OpenDLP we can do through the metterpter session. So, you know, it was just generally, that's a great method. Then we had RPC. So because of the Metasploit RPC we could communicate to the system under test with OpenDLP and control everything that we could from the console. Well, most everything you can from the console. Why Metasploit? Well, it's this tool we had heard of and it was pretty cool. So, you know, we're seeing it has an RPC interface, like I said, you know, has many routines to elevate privileges. We could download, upload files, execute applications on the target. You know, deploying services was crucial so that we didn't have to also distribute like sc.exe to these systems and now we're a little bit closer towards having a fully open source capable offering. And for now we'll turn this over to Charles who did most of the implementation and let's go. Thanks, Mike. So as you can see OpenDLP and Metasploit together satisfies those goals Mike was just talking about. We can deploy with Metasploit without any kind of credentials. And there's an added benefit that whoever's using OpenDLP to deploy has no knowledge of any of the credentials for those popped boxes. So there's an extra layer of security there. We have one profile which can deploy to hundreds of interpreter sessions all at once if you want. And the big thing is there's no changes to Andrew's agent. That code remains the same. It doesn't care how it's been deployed. And here you can see the typical OpenDLP setup as it is now. The pen tester here hits OpenDLP by his browser, which then deploys with SMB. Periodically the agent running on the target posts back results to OpenDLP and will even tell OpenDLP when it's finished and it'll be uninstalled by SMB. Well, we've gone and removed this SMB and replaced it with RPC communications to the Metasploit RPC server. We can do all the exact same things over this RPC. So I will send a command that tells this to create a new directory on the target and then a Metasploit RPC will use an interpreter session to create that directory, copy files into that directory, start a service, run the sc.exe executable and start the service. And the agent still posts back with HTTPS here. So that's unchanged. So to do this, I created a Perl module called Metasploiter.pl. And I modified a bunch of the OpenDLP web pages, the web app pages to include all this integration, creating these directories and uploading these files, just like it's done with SMB currently. I also created a Ruby module that's installed in Metasploit. But I'll go over that a little bit more later. Right now we're going to concentrate with an interpreter deployment. Since OpenDLP is written in Perl, I figured I should probably learn Perl. And I did. And so then I created this module. And it's pretty much, it's a standalone module actually. It's not tied to OpenDLP. It encapsulates the RPC functionality into a request and response interface. I send a interpreter right. And I, inside the code, I continually pull and wait for the response before I return. So it's synchronous. It's a general use class. And I hope you guys will actually take a look at it and use it because you can use it for a lot of different cool stuff. But because it's general use, it left a lot of code still in the web app pages because I have to use it to create directories and all that. I just can't say, hey, start. But it does parse all the responses for you and everything. And so here are the highlights of this new module. I can use it to log in and acquire credentials. I can get the current Metasploit version, list of the sessions and details about each session. I can interact with sessions with interpreter reads and writes as well as synchronous writes, upload and download files, create and change the remote path, change the local Metasploit path, remotely execute applications on the target. And I can check if I'm connected to an Armitage console. So this is a quick sample of the code. I don't know how well you can see that. But I wrote code here that will authenticate with the RPC. You just give it the IP address and port, log in and password. And it also works over SSL. And I have set it up so that if it's successful, it will return zero. That way you can choose how you want it to die. And Metasploit or the RPC is all over HTTPS or HTTP, which means that once you log in, you get an authentication token back. And we hand all this inside, but that authentication token is only good for a short period of time before it expires. So we also have the ability to acquire a persistent token. And as long as you continue to pass that in your transactions, your login won't expire. We can also create a list sessions method, which will list all the sessions on the Metasploit system. And get session list will return that list as an array of hashes. And this code here just walks through that array and prints out the IP address and some info about the host. I have a method get Metasploit version, which will get the current Metasploit version, obviously. You can change path. I have a method called send and wait, which will send a command and wait for a response. And get command response will get that response. And then you can release the persistent token to log out. And this is what the output of that little application looks like. And this is just a subset of the code that's in there. You can see you can do a lot of really cool stuff with this if you want. So this isn't perfect. There's a bunch of... I mean, it's pretty slick, but right now it uses interpreter to deploy. And interpreter sessions have no way of authenticating a user against the current session. That means you can't have two people accessing it at the same time because the way interpreter works, you send a request and it outputs its output into a buffer. If two different people send a request, the response to that, the output gets put in the same buffer. So the first person who reads from interpreter gets all of that output. So if I send a PWD and somebody else cats a file, the first person that requests a read gets all of that data. So really the only way right now to keep from having this error, this problem, is to be like, hey, guys, I'm using session 3. Don't mess with it right now. And that's not exactly ideal. The other thing is the RPC is a command interface only. You can't transfer files over it. Basically, what you can type into an MSF console are the only things you can send and receive from your host to the RPC server. So you can upload files but they have to upload from the Metasploit box to the target. Likewise, when you download, they download from the target to the Metasploit box. What this really means for users of open DLP is you can't just click on a file and download it like you can with Gav and stuff. So this is a problem because in addition to those original goals, we really want this to work with Armitage. Because Armitage is just neat, gooey for Metasploit you guys might have heard of. It's used by a lot of pen testers. I think we even use that maybe. So it doesn't play nicely because even though Armitage has a nice deconfliction server, we totally screw that deconfliction server up. Our reads will pull stuff that's meant for Armitage. And Armitage doesn't really like not receiving its responses. So as a stop gap measure, I created a little method that we'll check to see if Armitage is currently using the RPC connection that we're connected to. And it just returns true or false if it does. But still, all I can do is display a warning in open DLP saying, hey, you're connected to Armitage. You might want to consider telling people not to use it right now. So that really wasn't ideal. That's not what we wanted. So what I did, I needed a solution for that. And the solution was to build a post module in the Metasploit. Because that offloads all the deployment to Metasploit. It does all the work. I can just say, hey, start it. And I created this module called it openDLP.rb written in Ruby. And it's installed in the Windows Gather directory. I also created a Perl module which interfaces with this Ruby module. The Perl module is obviously installed on OpenDLP. And the only purpose of it is to connect to the Metasploit Ruby module. It's not a general use class. It's very specific. It overrides the Metasploit or Perl module I made before. But it actually only uses a narrow subset of that. All the interpreter stuff is not used at all. It's strictly communicates directly with this new post module. So the first way we decided or I decided to do this was I wanted to use the regular RPC module .execute command. But it didn't work. I mean we could start the module but we couldn't tell when it had finished the execution and we couldn't get any output through the RPC. This is a limitation of the RPC and we thought of other ways to do this modifying Metasploit and such. But really the easiest way, again we're lazy, was to create a new console. And because I create the console I get the ID. It's mine. It's tied to a user. And it's got this nice little busy flag. So if I start the the post module just as if I would from a Metasploit MSF console, then I can tell when it's finished execution and I get all that output. And this has the added benefit of being able to hack around and let us download files as well. Because I can control the output in Ruby I'll read a file off the off the target system. Base 64 encode it and throw it in some headers and then print that all to the console and that allows me to fake it to be able to transfer files over the RPC. So it can work just like Gavin's stuff. And so this post module has six different actions. I can deploy, which will create a directory on the target system, upload the open DLP files, execute the archive, write a configuration file, and install and start the service. I can independently start and stop the service with this module. I can delete the service, uninstall it. I can remove all the installation files and again I can read a file off the target system. And this is the post module that's installed in Metasploit. So I created this new Perl module to interface with this. And this module does all the work of creating a console and executing the post module inside. It's really easy to use. You set the module name, the configuration string, which we get from open DLP. We just base 64 it and set that the source path, which is the path on Metasploit where the open DLP deployment files are located. The remote path is the installation path and the session ID is a session you want to work. We want to deploy this too. And this is probably going to be really hard to read, but it works just like the previous module. You log in and authenticate, but now you can, you set the module name, and in this case it's windows gather, open DLP, and check to make sure it exists. Then we set the source and remote path, the configuration string and the session ID, and just call deploy open DLP. It handles creating the directories, installing the service, and everything. And it returns zero if it was successful. And we can download files just as easily. To get the contents of a remote file, I call the method read file. It returns zero if successful, and then call get file data to get the contents of that file. So to add support for Metasploit, I had to change a lot of files in open DLP. And although I created the interpreter-based deployment first, the post module is obviously better because it's less code and it deploys without messing up your interpreter sessions without any kind of concurrent access problems. But I left them both in open DLP because honestly I didn't want to lose the interpreter-based deployments code. The Metasploiter Perl module is really useful and I wanted to share it and give it back to you guys. Even though it's not as efficient and doesn't work as nicely. So I could go over all the code changes I made, but I have a feeling most of you would get up and walk out right now. And you can just download them and diff them and see all the coolness there anyhow. So I'm just going to go through the GUI changes and I'm going to make it kind of quick. So I had to update profiles because now our profiles have to contain login information to the Metasploit RPC server. Just the host and port, user and password. And again, open DLP deployment files have to be on the Metasploit box. So you have to copy them off of Open DLP and stick them in a directory on Metasploit. Because I can download files with the new POST module, but I can't upload them the same way. So those have to be there and that's the path that you're going to deploy from. And then I also have a latency in timeout which you can more or less ignore. And here's what the new profile page looks like. And you can see all of this here is the new Metasploit stuff. And then after here we get the installation path and from there down it's the same. And I have both the meterpreter deployment here as well as the POST module. They look identical. I also made changes to the start scan page because the way Gavin stuff works you have a profile and then you have to put in the IP addresses manually which is if you only have system credentials you have to put in a new IP address for every profile and you have to remember that too. A domain works a little better but you still need to know those IP addresses beforehand. Well deployment with Metasploit uses sessions. And those sessions aren't like IP addresses they can change. If a box uses connection and you have to repop it the session ID is going to change. And we can't use it by IP address either because you might have several different exploits running on a particular IP address but only one of them is suitable to use deployment for. You have to be able to get system with that exploit. So instead I created a new page which will list all the current sessions and allow you to pick and choose which ones you want to deploy to. Again we're lazy and this makes it a lot easier. So when you start a new scan now you and you choose either a Metasploit agent or the post module agent you'll get a little screen like this with a get sessions button. And you press that get sessions button and you're redirected to this landing page where it shows you all the currently open sessions on the Metasploit system. And you just choose the ones you want and press start scan. And this brings me to the start verify page. This is the page that does all the work down inside. This is where everything where the deployment happens where directories are created, where files are copied and the services are started. I just load the configuration parameters out of the profile and deploy to either Metasploit or post module based on bridge. And then I'll display a detailed output so you can determine if if it doesn't deploy correctly you know why. And it ends up looking a lot a lot the same as Gavin's stuff. You see here I guess you might not be able to see but it found two sessions and it tried to deploy to both. It started attempted to start and then it started. I changed the view results page again with the IP addresses the session IDs can change unlike the IP addresses session IDs can change. So when you go to look at your results if the session ID is changed you now have an orphaned results in your database and no way to get those files and view them. This is because the files stay on the target system they don't get copied into open DLP. There's got to be a way to reconcile the orphan scan with the session it belongs to the new session. So I created a page here in view results it checks to see if the session is currently active and if it is if the IP address matches. If neither of those conditions are met it'll give you a little warning message and a button that will allow you to update. I can show you here see the session IDs are mismatched says the session has died and you won't be able to download files. If you click update session ID it'll give you a list of sessions that currently have a matching IP address. Then just click the update database with new session ID button and it will update the database in the session ID with the session ID and you'll be able to now download files with that results again. I also had to change download file for the interpreter based deployment because files can't be downloaded with the interpreter based deployment you can't get it all the way to the OpenDLP web app. What I do instead is I use that path to OpenDLP files on Metasploit where the deployment files are located and I create a path under there using the IP address the session ID and the profile name and store the file there so you can get it off the Metasploit box later. Again the post module deployment doesn't have this restriction and this is what it looks like for a interpreter based. The path in green if you can read it is where it will save a file to. I made some changes outside of the Metasploit functionality because I was doing a lot of work on this and had lots of failed scans and I had to go through and clean up the database manually sometimes because I get so many failed scans in there. So I modified the delete scan page so that I can select multiple scans to delete at once and I can also delete scans that haven't completed yet and this is useful if you put in invalid credentials for the patchy credentials to connect back to open DLP and it just sits there and continues to run and it's an orphan scan. Now you can delete it and this is what that looks like. You can now you have checkboxes and can delete multiple scans at once and if you click this display in complete scans button it'll show the incomplete ones as well and I made a little sidebar as well which will allow you to manually manage the agents installed on remote systems. You can start, stop and uninstall agents outside of the normal open DLP workflow. This is useful if you start a scan again but you had incorrect credentials or it didn't work but left installation files still on the box and now you can go through and clean those up remotely without having to use Metasploit to do it and that looks like this. It just shows you the session IDs open and you can pause, resume or uninstall and this is also useful if you have like 50 scans running on somebody's network and you only want them to run at night you can grab them all and pause them all or delete and uninstall them all in one fell swoop and that's what it'll even tell you if it was installed or not when you try and uninstall it and that brings me to the live demo so we have I've already created a couple of profiles here and this is the post module on all the Metasploit stuff we are going to use SSL on this and do a limited subset here so that it completes pretty quickly yeah oh yeah the uh in the profiles the uh the username and password here which were for domain are now blank you don't need those don't use those at all so to start a new scan I'm going to choose a post module deployment and I'm going to call get sessions here and this shows two sessions and if you can see here these are the same sessions open in Metasploit I'm going to select both and start a scan and this will take just a couple of seconds and here we go we have two successful deployments and um we can view the results here post one has started and both systems are currently running and I can open up you can see that the agent is currently running now I can go over here to uh the manage agents if I want get those sessions and pause that agent and he's been stopped actually it looks like he may have already finished yeah they both completed so quickly I couldn't show you that but now with the post module I can view these results and download them just like a windows agent scan and I can also if I want to make sure that there's no more Metasploit installed on those boxes I can try and uninstall the agents again and it'll tell me if they're if they were installed on there or not you forgive me for how slow it is I'm running four virtual machines and here we go it tells you that open DLP service wasn't installed and I can run through here with the uh interpreter deployment and deploy in the same way and here we go you'll notice that the logs are different because of the different deployment type but that they both did deploy and start correctly but the difference here when you go to view this is second to complete ah all right now it's completed now if I want to grab that allow.txt file it has downloaded it to the interpreter or to the Metasploit box so it's downloaded allow.txt on session 15 to open DLP which is the directory for the deployment files with the session ID and the IP address and I can show you that right here and here we've got the meta reg is the name of the profile session ID and then we've got the allow.txt and I can also show you here I have this old profile and this one has a different session now I can just click update session ID here and it'll give me a list right now there's only one with that matching IP address I click update the database and again I can view these files now and so this is where you can get the new open DLP Andrew released this yesterday yeah yesterday this was released and you can download it and play with it right now source code and binaries are there as well as a virtual box and this is us thank you for your time


All right. I guess we can start. So welcome everybody. My name is Alexei Krobrov and I'm an open source science director at IBM Research and our discovery team and my colleague Tim Boneman is the community lead who is going to co-present with me. So maybe some of you have seen us at the open source science booth. So I will explain what open source science is and what relationship to IBM and non-focus it has and a map of science is a project of open source science right and it's an initiative. So it's a working group and I'm going to talk about the ideas and the data and the goals of this project and hopefully some of you can join us in it or send some folks who can benefit from this right. So open source science is an initiative which is IBM's open source strategy for science right. So I joined IBM Research three years ago versus a technical lead for quantum ecosystem development and then we started a new team called Accelerated Discovery which basically solves hard problems of humanity with science such as material discovery, carbon capture materials for fighting climate change, new drugs to fight cancer and diseases, model climate change for sustainability research so basically really hard problems which involve on the one hand involve deep science right you need to model climate data you need to model chemical materials and obviously there is a lot of work for machine learning and AI and now foundation models on the other hand you need to use a lot of software you need to use a lot of tools and it turns out that scientists approach software differently than professional software engineers I wonder who here comes from a scientific background or who had substantial kind of scientific background at some point I know Harold had some others right so just to take a pause okay and who likes science who likes to who cares about interesting problems solving the science right so I guess the there is motivation on kind of both sides of this because scientists really need open source tools right scientists usually do not have too much money and scientists work collaboratively so scientists are wired by their DNA to do to use open source on the other hand the difference that scientists have against kind of traditional open source developers such you know is often the Bay Area and I come you know I spend this both the grounds right so I've been in startups I've been in Amazon and I've been at you know scientific labs developers generally have the mechanisms of data exchange wired into them you know to find blogs you know to find tweets you know who to follow right you know who in your area is an authority so a conference like this is our professional tool of destination of information right like you know you come to the summit like this is divided by tracks is divided by area you like JavaScript you go to just open open gs summit you like machine learning yeah you come here right you generally know where to find stuff and you know where to present stuff so scientists do this for the areas right they do this for subject research they they have conferences for physics and they have conferences for chemistry and plasma physics like and and so forth and they have you know the american you know chemical society has a massive congress in the same place with data bricks because they they are in the summit but you know in we attend both and they're extremely different right if you put up an open source science sign at the data bricks conference you'll see a lot of people if you do it in a chemical society they'll get all your swag and not necessarily ask you right because then like looking for chemistry not necessarily software yet so what we need to do we need to connect scientists with open source developers in an efficient fashion so what we've done so our strategy is basically community centric we created open source science at non-focus abm is a general sponsor of non-focus for many years and so we inherited this relationship and upgraded it and non-focus who knows about non-focus let's say this who knows about jupiter pandas non-pi sci-pi any of this right so all of you generally know the projects which sits under non-focus and nobody knows that you know they are under non-focus so that's a non-profit set up by travis elephant to host non-pi non-pi is the most installed open source project of full time compared to according to metrics it's the foundation of any data science library in python right and basically over the years there is about 80 different projects including scikit-learn pandas right which is huge and used everywhere but non-focus is kind of small compared to links foundation and people most know its projects so we have this initiative there is a top-level group spanning basically all activities and the goal is to first we need to understand the communities of scientists who use open source software so the goal of this is to accelerate science with software not produce more software with more software which usually software people do right like you have two pieces of software there will be third piece of software to connect the two pieces of software so we have a self-perpetuating you know virtuous ecosystem right but scientists generally don't care about software like if all the software will disappear and cancer will be solved cancer scientists will probably take the deal right so it's kind of the the in for us it's very hard to comprehend right because we live in software and we enjoy software so it's like to see somebody whose end goal is not better software about something else it's it's it's new and and scientists are basically very passionate about their scientific research so they will use tools whatever necessary they will use paid windows lab software because that's what they have and if they cannot use it you know they'll not usually try to break it right like you need their colleagues who research software engineers uh it's a new term kind of emerging who basically care about science but no software no hardware no data pipelines right so so we need to find these people and and we go off to them in the same fashion that we do software engineering communities like this one right you find people who are passionate about domain so if you want to do a conference on big data you find people who are good at spark right and like uh and Hadoop previously and and you you find you know interesting topics they usually do in the companies and you invite them to share and they come and share right because uh this like the people like to share best practices uh if you you know look for open source science people you find scientists who are good at software and this is a very tricky situation because they need to know enough about the domain right to have kind of bird's eye view uh to kind of do really impactful things it's easy to find kind of graduate students focus on their own little niche it's harder to find somebody who makes choices and drive some impactful software and so and so far we're basically spending here has been started at sci-fi in uh Austin uh which is now a major non-focus conference and uh it's so this is i think the trick so this this is very much social engineering so once we have the communities right so we have interest groups by by vertical uh and we find the right people right then we basically uh want to find what is that gender what what field uh what software can advance this field forward right uh and and basically identify gaps and needs right so some uh research needs features and existing software projects and some projects don't exist and to be created so like lab view eliminates uh lab automation it's a windows program which uses rs 232 port right like it's hard to find people who understand how to replace it by an open source piece of software and most science are not interested in this right so a lot of lab automation actually the kind of top nerds in lab automation apparently they use lab view and they extracted weird data into an excel spreadsheet like this is the top automation and now so data is liberated and now can be put into csp file and now can be put through some motions right like this is the level uh a lot of stuff is in completely proprietary equipment like camp speed makes this amazing ai driven robots right but it's all call source they have some uh open source pieces but that's not how they think right like it's not the main goal so uh in the so once we know right we have the communities of open source developers and scientists who hear about specific verticals uh now we have uh we identify some needs and gaps and then next phase we could direct resources to this because there is now huge amount of grants huge amount of initiatives in europe and then the us you know nsf or acd horizon 2020 so all these initiatives uh u level government level regional level right they direct funding to open source science so science has an advantage over industrial open source that science is generally an expense nobody expects to make money in science science is government spending in general or non-profit spending and charitable spending so most science is financed by governments so for instance nasa is ahead of everybody else in cloud in open source as if compared to government agencies and the reasons nobody will sell you galaxy data right like it's free you'll not make money out of it usually so and but also it's the vast amounts of data right so they had to figure out how to handle this data and process this data on a government budget right but the government kind of pays for uh equipment so they approach cloud they create workflows right and they're not don't necessarily come to the things people use in silicon valley because very often they're not aware of this and they do not have incentives to come to meetups in silicon valley so it's very interesting that the information on science spreads through usually the verticals so whatever chemists use now is used by chemists and what's even more interesting so the scientific python ecosystem so this is a scientific python project which is another top level project of navocos and so that's been going on for many years jared millman is one of the co-founders and uh this folks basically created jupiter right so um there is a lot of great foundational projects we now use due to scientific python community so uh scientific python community uses desk for concurrency and in silicon valley we have ray for training elaps right and when ray folks present to sci-fi literally you can find users yet right because desk emerged through the vine as a way for sci-fi people to to do concurrency and and so so you you clearly see it's it's not always a technical in this case it's just not a technical choice it's a question who knows who and people who did desk they operated in the community for a long time same thing with jupiter so people who do jupiter hop come from the community right so the tools are self-selecting most non-use in the situation you know is an industry where you have tight competition benchmarking it's not it's not uh necessarily uh you know the case in science so so these are the interest groups we have so far we have uh groups on chemistry material science healthcare and life sciences climate assembly they reflect IBM's priorities and research and everybody else is welcome to stand up their own groups so we have currently folks you know who want to do more space and then we have horizontal groups which span technologies so reproducible science everybody cares about reproducibility everybody means different thing right to to scientists five years of reproducibility so that's something we we are very you know active in uh we sponsor the first ACM conference on reproducibility which was held in june at the university of california on the cruise and we have an interest group on this and the another interest group in the map of science right and so map of science is an effort to map all of open source used for science and so this will be the the next part i just briefly mentioned so well this is our partners non-focus is the eye of us around the world so if you have an ospa usually we partner with ospas and IBM works with a lot of companies and directly so we can bring this and this group is called future software so these are actually representatives of innovation ministries and government agencies around the world which met in amsterdam last year and now they're meeting in montreal and they're basically drafting amsterdam declaration sustainable research software so the idea is that research software should be done with community it should be findable it should be you know built according to the best standards and that way it will persist and so we we actually find that it's extremely well overlapping with our mission right so once we map and we find where the software is and which software actually drives science it brings visibility to to to that software and hopefully makes you know brings the resources to make it sustainable so this is a bunch of organizations supporting us so what is the map of science so when we started this we understood that basically we want to get to the future where science is driven by open source where open source mentality drives science and open source mentality means you know people are basically you know rewarded on merit right if you contribute code everybody recognizes useful you get a lot of you know acceptance in the open source project you contribute your open source projects is used by multiple organizations there is clear ways to see validation and and merit in in open source which is often harder to get in traditional science because a lot of it is kind of social trust network which is kind of like a church right it's a hierarchical system which evolved over the centuries and a lot of knowledge is kept by senior scientists and kind of junior scientists apprentice and kind of earn the the trust of the community which has its own important merit but these two systems are now bound to collide right and so inevitably open source will disrupt science it will not supersede it but the kind of merit system which comes from open source will more and more connect right interweave with scientific recognition and so now a lot of scientists junior scientists who do software they complain that their software is not recognized as contribution as much as papers but it will change now you know you can cite software in the Journal of Open Source Software you can make publications and hopefully that will be more and more counting as as results so what are the objects in the map of science it's it's hard to drive this by product market research as startups do right like usually if you have Uber for pets you kind of have an idea you can hire a product manager and they will interview a bunch of pet owners and you know what do they need you know from an Uber which will drive them about here there are multiple incentives multiple views so we need to hypothesize we need to basically do it in a kind of stiff job fashion right we need to put it out and we need to get users to it so the entities we have are papers people right that's traditional science then we want to know teams and labs which people these people live because usually labs have a theme and they have an organization it matters where organizations are because usually the funding and the priority are dictated by their national affiliation their national kind of agenda but also different universities are famous for different things like schools of economics you know if you want to study specific kinds of economics you go to a given university University of Chicago does it one way University of Pennsylvania in other way and so different universities are known as sites for excellence in different sciences right you do material science you go to University of Chicago and University of Illinois and so forth and so we need to know these organizations of course OSS projects so papers now started to site OSS projects it's not uniform there is no way like to standardize this people are starting to do the noden do is but again there is no widespread practice most normal often you will get a URL right and actually sometimes you need to normalize the URL and sometimes the URLs are duplicated like repositories can be forked so so there is another layer you need to understand what projects are and if you can identify them then sometimes you have initiatives you have you know some universities have a whole labs like Berkeley has a rise lab which produces rain but it also produces other things right and previously they had the amp lab which produced spark and messes and tachyon alexia a lot of three kind of startups which came out of amp lab so you need to know kind of the overarching kind of agenda of a lab and then of course there are grants right and academia everybody spends their time writing grants and if you are an administrator you actually want to know which department is most effectively attracting grants to do research and then if you show that all these grants is spending a lot of this is spent on software you'll get an equivocal bind from from the administration because they may not care about your priority but if you see you are attracting funding very successfully you're funding students and you are actually finding open source into your university they will pay attention so this is what the University of California is on the cruise has done they looked at how university commercializes intellectual property so there is an IP transfer office in every university and you can actually now you know attribute the income to open source used in the grant which was used to produce this IP right so this is a very innovative way to come to the administration with you know a table showing that millions of dollars were received due to open source that way you'll always have attention of you know any kind of administration so so this is a very important thing and we'd like to be able to do this right and so the users are as I just described some kind of administrators supervisors who actually drive activities in science scientists themselves who need to discover open source used in the area if they're not yet fully familiar with this if their small group is maybe isolated maybe they start now they may not know this they may just not be users of open source or software in general they maybe start now and developers right there are personal developers who kind of tire to write ads and you know as David Parton's famously said you know the best minds of our generation are put to follow clicks online is this a good use of our time and he called in 2015 for developers to fight cancer and actually you know some of the developers joined some of this biotech labs of course very few but this is kind of for some people it's a meaningful activity and they're looking for it maybe as a part-time hobby activity they want to make an impact in something uh affecting scientific research right so so there is a lot of important motivation open source developers are motivated by you know passion so so this is a very good way to give them a way to apply their passion to to something meaningful so in our team we'll talk a little bit about a prototype of science that we built recently uh do you want me to go to the browser or the way okay all right let's see I think I need to first get out of here and then I can go here I think probably can maximize that all right great hi everyone so I recently had a chance to go to Greece for a conference that brought together 300 computational chemists and I just started to ask them do you use open source in your work what kind of tools and it was very interesting and so we just started to create a bit of a demo uh that we can use at events like this and at the booth to get you know the conversation started so we're using a tool called kumu and uh basically we just uh plug in these uh these tools this is like the first iteration here you can see maybe um dimly there these orange dots these are uh open source tools that are used in computational chemistry and then I went ahead and pulled the list of contributors from github and gitlab and so after just a few more tools being added you can see that there are people emerging that are contributing to more than one tool these dots in between those uh little bubbles there and uh fairly quickly you get the view this is like 17 tools and I can enlarge it here and you can see there's people obviously that are contributing to more than one some even more than two or three uh projects now that is not in itself an earth shattering insight um but if you look here in the um in the bottom corner there those are actually two papers and here we see these are four authors that have uh you know published both of these papers and if you zoom in what you can't see yet because we're using the real names from archive and the usernames from github um but what I have confirmed manually is that one of these at least one of the authors is also a contributor to this uh project and so now with uh I need you to use your imagination uh imagine a you know uh uh a map that has you know hundreds and hundreds of open source tools in a domain and maybe tens of thousands of research papers um and more fidelity in terms of you know the the people knowing like who's the main contributor who's just an occasional contributor um and maybe you can even double click on some of these people and see find out more about them see which communities they might be involved in or where they hang out online where they discuss their science and hopefully it will on the one hand increase um or improve discoverability of existing tools so you don't always have to reinvent the wheel all the time um but also it might encourage people to just connect earlier in the scientific process with the folks that are already in their little uh area of interest um and um I hope that makes sense as a as a concept of course we're you know a lot a lot more work to do to to flesh this out but um uh it definitely helped us to get feedback uh talking to these scientists uh as they imagine how they would use such a tool and uh and we could discuss some of the uh the use cases you know that some feature requests and some uh questions around tools that aren't strictly open source but are free for academic use and so on so it's very helpful exercise to get this get this going uh we are currently finishing up the um high level concept for this map and uh we'll move it forward from there right actually I'm going back to the um were there more slides I think so yeah 15 minutes left so let's use it for um for a discussion right so I wonder you guys are all you know OSS or GS right so you kind of understand how it sort of works and a lot of you have scientific interests right so we kind of right so we think why do we need this when we tell these two folks that we want to build this and the reason very simple we want to go somewhere you need the map you cannot you cannot find out how to get from A to B you cannot draw out unless you know where A is and where B is right or B is we know we want to be in the beautiful world where science is permeated by software and everybody is a developer LLMs can give it you know to us in some way but uh not immediately and not meaningfully yet right so we need to to build this map but exactly the details different and kind of folks generally people agree this is a great idea and if this is not a research project this is not a PDF this is not something we want to do once this should be a living and useful portal and so initially when we actually started we were very ambitious we thought we'll need to build a portal for science there is no social network for science if you think what science is exchange information generally go to LinkedIn and they go to Twitter so Twitter is a machine for URL exchange right people professionals generally share URLs on Twitter so that's how you find software that's how you find papers right so 60% of kind of scientific URLs between scientists contain tweets contain a URL right we thought of you know things like scientific bundle if we build this map we can let people put together papers ideas code and maybe send it to other people and say hey what do you think of applying kind of this algorithm to this data maybe data sets right data sets should be indexed of course as well so so that's kind of the general idea and uh we're gonna have the first workshop funded by Chansey Kerberk initiative they had quarters they basically selected 50 top researchers in bibliography meta research uh an open source for science and this is going to be run in redwood city in the headquarters this is by invitation only uh if you want to be invited to the next one let us know uh right so this is so and this is gonna be hackathon so we're gonna build a chunk of this uh we're applying for grants with non-profit foundations to get developers to do this right because it's it's a build intensive project uh these are our communication channel so just leave it here as our URL if you go to this URL which is our name and also our URL you can sign up for the newsletter so but I just wanted to kind of leave it here right and ask you guys uh what do you think if you have questions if you have suggestions if you have feedback and maybe we'll use this remaining time as a Q&A and discussion because we really want to know you know the opinion of this group and don't be shy any any kind of question if you didn't understand something or you object to something it's also it's all good okay we have a question good hello um thanks for the talk that's great um it sounds like you need to motivate the scientists to actively um yeah do something to enhance this map of science right uh how do you tell and I would like to motivate the people that are already swamped with paper deadlines and work to do and so on excellent questions uh do you work with scientists do you know because it's very deep you you get at the heart of the problem I've uh been a scientist but um I switched to industry by now very good yes so that shines thank you for that right so this is very typical and so this summer we did open source science on rails we went from chicago open source science symposium we started to sub-in Austin and by the on the way we started by St. Louis University so the incoming dean of engineering used to run open open science foundation from work right which was basically this kind of software it's kind of replacement for lab notebooks so it requires scientists to go back and file their research and of course what happens they stop doing this right like scientists have enough stuff to do then to fill out forums and like I mean it's generally it's thankless tasks to to ask people to classify themselves come up with anthologies right like if you like anthologies is the end of this like once you start to argument anthologies things are done right so so we want to very carefully avoid this so we thought of different technical approaches so first of all at IBM we have approach called deep search and many others like this exist so now you can basically slurp the whole archive.org into a search engine and then you can brute force extract mentions of of URLs right so and then you you can use classification to understand what the paper is about it's already has some classification to begin with right so you can basically pretty reliably extract URL links and search engines and scientific meta search engines were doing since 1997 I was in the group which built the original sites here right which was the meta search engine from scientific literature so so you can kind of we could have bought them up right like parse the internet now you there are companies like source graph there is I think was a company which is a sponsor here which basically you know given the code base right like understand the dependencies and obviously you can piggyback on the supply software supply chain work right so you can kind of say okay like give me the links to software from papers extract automatically then go parse the dependency graph and give me dependencies and classify this right so this this is a legitimate direction the problem is if you look at github it's littered by like dead repositories which are clones right then scientists are the last people to kind of think of carefully maintaining deduplicating the reporters there students use them right for the class projects so so I think the source of truth is hard to find so so we realized very quickly we do need some seeding so we need basically this interest groups which we have as a social backbone of this initiative we want them to do something of this nature right so very simple ask is ask a scientist give me five tools you or your colleagues are using let's do ask them right let's not overburden them but like we're not chemists until we started to look at chemistry we didn't know you know about rdkit and rdkit turns out to be number one package used by computational chemists to the tune that you know a company syngenta which is a fertilizer company now has a full-time person and supports rdkit because it's used by computational chemists like this is the kind of stuff we want we want open source which is judged to be critical by practitioners and obviously like a few people cannot find it all of this like you need to delegate it to you know people in in disciplines and so our job is kind of to find the right folks then who can ask the right questions and even not just all just two of us but the respective chairs of interest groups so we kind of first of all we believe we do need this kind of good working organization which will properly like eventually whatever stuff you find humans need to review it right so we need to work on this one approach is obviously map people want to be on the map so research gaiters like if you guys publish any papers anywhere you're receiving spam but from academia dot edu and the research gait who says you know hey john smith is it you who wrote this paper cited by john doe you know in this conference and of course you're now very curious what they said about you right and and then you want to go there and say pay eight bucks a month and we'll tell you right like this is obviously a growth hack and we'll not charge them eight bucks so hopefully people will come but there are many ideas like we're open to ideas you know we kind of think we'll have kind of champions of open source and science what passion is enough to give us some thoughts top down we can then use data mining to link it from both them up and we're very open to ideas like if you know good ways to motivate scientists connect with us and let us know other questions or any ideas or feedback i mean does it make sense would you use this map for instance to help a science project so we need to motivate open source developers to so all right so that's basically our context if you guys have ideas you know they have the same like good ideas come on the way out if you have feedback if you're interested if you have colleagues in science and open source who cares about science right send them here and we basically are set up to welcome people we had our table we're going to be wrapping up but we had our booth we had basically how many people came to us and learned about us thank you for doing that so and we'll be now on like i think hopefully at many of the Linux open source summits we also pay data conferences they are run by no focus so if you see a pay data meet up in your area come see highs and send people so we're very tight with the pay data network which is now around anywhere like the around padded in new york there is padded global we just held padded Amsterdam so that's a very fun place for open source science and data science thank you very much


The study conducted in Russia showed that elevated levels of non-high-density lipoprotein cholesterol, non-HDLC, are strongly associated with an increased risk of cardiovascular events. This suggests that non-HDLC should be included as a component of cardiovascular risk assessment tools such as the SCOR2 and SCOROP models. Continuous monitoring of endpoints is necessary to establish stable associations between non-HDLC and cardiovascular outcomes. This article was authored by S.A. Shalnova, V.A. Metalskaya, V.A. Kutsenko, and others.


Summer has arrived and Appalachian Wireless has a great sell on the world's hottest smartphone from now to the end of the month. You can get the amazing iPhone 13 for more than half off because we are you. We are Appalachian Wireless. A ribbon-cutting was held for Pikeville's newest local business. Coffee Guy Cafe located right next to Barista Nutrition was welcomed by a crowd of coffee lovers on the morning of July 15th. The Coffee Guy Cafe was originally opened in Pensacola, Florida and the Pikeville location is the first franchise of the coffee shop. Well, we have a pre-existing business and in that building that we were in, we had the opportunity to expand and rent the other side. And when we did that, we spent the last several months just asking our clients that we already had on a daily basis, what else would you like to see in the community? And we heard coffee and sandwiches a lot. And so when those kept coming up, we had already formed a really great friendship with Mark and Megan. And so I contacted them and visited about what they already do in Pensacola. And that's when they offered us the opportunity to become the first franchise with Coffee Guy Cafe. A lot of work has gone into renovating the former acupuncture office into Pikeville's newest small business. So the other side used to be an acupuncture and so it was all offices and stuff in the back. And so my husband, who is an extremely talented carpenter, really just took it on himself and remodeled the whole thing. We really love a rustic country-themed look and so that's what we went with. Coffee Guy Cafe has a wide variety of hot, iced and frozen drinks for nearly any occasion. They also offer food ranging from sandwiches to waffles. You can find Coffee Guy Cafe across from the Pikeville City Park right next to Bear's Dead Nutrition. For Mountain Top News, I'm Kelsey Dean.


Here are nine lessons from March Madness underdogs. Number one, they live by the mantra believe or leave. Number two, they use their timeouts to calm down, rest and or strategize, not to ruminate over mistakes or live in the past. Number three, they break the entire game down into many four minute games. They only aim to win the next four minutes. They don't focus on winning the game. Number four, they don't worry about the play that just happened. They put their focus on the next play, the play right in front of them. Number five, they have incredible bounce back ability. They respond well after a turnover or a miss shot. Number six, they know basketball is a rhythm game. Their team's goal is to establish ours and disrupt theirs.  Number eight, they acknowledge that it doesn't matter who scores, all that matters is that we score. And number nine, they are crystal clear on what they do well and what their strengths are and they stick to their game plan. Enjoy the madness, my friends.


Hi YouTube family welcome to today's video, which is going to be another installment in cheaper, but better I wanted to do a dedicated video specifically for one product that I have in here because you guys had asked me about it About it so much, which I'm going to leave till the end, but I had found so many I'm always looking for that now What do I reach for from the drugstore that I have the equivalent to in high-end makeup? But I like the drugstore better not just because it's cheaper and which is a big huge incentive for me But also because I just think that it performs better. So I've got quite a few of those for you today I hope that they will be helpful to you Please give this video a thumbs up if you enjoy dupe videos. I enjoy bringing them to you So let's get on with it The very first thing that I want to tell you about is the Anastasia Beverly Hills lip glosses This has been some of my very favorite lip formulas ever because not only are they a super nice Feeling super nice consistency, which is a little bit thicker without being heavy I just have liked how opaque they are They're just one of those lip glosses that you can put on like a lipstick But you have this shine, but it's gonna last and they're just beautiful colors Now you guys the new wet and wild liquid cat suit glosses These are basically the same thing now These are not gonna be the exact colors that this one is probably the closest color that there is And I'm not gonna be referring too much to too many colors in this video But I will throw them up on the screen But the way that these perform as far as it being that opaqueness, they're so beautiful in their colors I do have a mixture of the these two colors right here on my lips today And I just love it. So I would say that they absolutely rival that these are $5 I believe the Anastasia ones are 16, but they shine so pretty and they're so opaque And I am just absolutely in love with them. So that was my first discovery this week I think you guys are just gonna love those my my next discovery. I was super excited about, okay I've told you guys over and over again how much I love the Marc Jacobs Highliners and I do This is a really great gel formula They're so pretty and my very favorite color in his whole entire line is called jasbury And it's partly because it's in between Like a purple and a mauve color. I just think it's one of those colors that is just absolutely gorgeous Well, I ran across this one from L'Oreal. It's just called red But when I put it on here, it doesn't look like it's red It does have a little bit more of the reddish tone to it than jasbury does jasbury has more of the mauve tone to it But when I get them on my eyes, they are so close you guys But the formula is so much the same now those two will sit down the the Marc Jacobs gels will sit down And they are waterproof and they are wonderful and this one does the same thing I just really like it. It's called the infallible pro last long wear eye pencil This one you do have to sharpen manually and the Marc Jacobs is an automatic So that is kind of a difference there. It never bothers me to sharpen mine So that's not a drawback for me, but it might be for some people, but I have been enjoying trying several different ones Okay, one of my favorite Clinique cheek pops is called pansy pop and It is just kind of a it looks almost like a lilac purple color when you get it on your cheeks It doesn't look like that and especially if you're doing more of a lilac Lavender look it can be one of the most pretty blushes on and I'm gonna have to darken it up because it's pretty light So it's one of those colors that you have to be in the right mood to use, but I I love it It's one of those that I just I've reached for over and over again But recently I found this one I think I showed this in a haul to you guys from the Butter Blush from Physicians formula and this one is called rosy pink and what's so funny about it is that it's not really a rosy pink It's really definitely along the lines of this color of this pansy pop and when I saw him I was like, okay. Well, they don't look exactly like in the pan, but boy on the cheeks when they're sheared out and What they give to you is so much the same now. I will say that I believe the Butter Blush to be a better blush It's more saturated. It's a softer blush and for me. It's easier to blend. I do love my clinic cheek pops There's some of my very favorites I have a few of them, but I would say that I if I had the chance to I would purchase this one over this one Plus you get that yummy island coconut smell with this one You don't get it with the cheek, but that's not the reason that I brought it to you guys attention It just really is a gorgeous gorgeous blush and I like it better and I reach for it more Okay, one of my favorite pressed powders is the it CC airbrush perfecting powder and I think I have mine in light Yes, it's been light and I really like this you guys It just sets my makeup down with a little bit of creaminess that most loose powders don't give you and I do have the problem With my skin being dry. So it's nice to have a powder. That's a little bit more on the creamy side But I think that I like the flower illusion powder better Not only does it have that same creaminess to it I think it's even more creamy when I stick my finger in here Not only does it have the creaminess to it, but it also gives a little bit of luminosity to the skin that the it One doesn't I have this in another color too for my summer color, but I thought I'd bring my spring color out So what I wanted to show you is not necessarily the color just that I even though I have absolutely loved the it CC powder, I love the flower illusion powder better for me. It just surpasses it It's just so much better and I reach for it because of its creaminess Whereas I'm kind of shying away from this one although this one has been my favorite for years So really have been enjoying this powder if you guys haven't had a chance to try it try it I think that you will love it. Okay. These two right here are not the same color I'm just gonna tell you right off the bat. This is the Laura Mercier Ultra long wear concealer. I have really liked this. It isn't super drying. It's right in the middle I like the coverage of it This is more along the lines of a really bright summer color that I was wearing last summer But the texture of it is super light and it just blends out really well really creamy really nice But I think you guys again, this is the flower beauty light illusion concealer. I think I like this one better I think it has a little bit better coverage. It has the same texture It goes on the same way that same lightness without being too drying It goes on that same way I just think it out performs the Laura Mercier Really well and again like I said, we don't have the same colors here But I think that I like the flower beauty one better for one It doesn't seem to crease and the Laura Mercier one will crease by the end of the day the flower one doesn't crease on me I've been using the flower one over and over again And the other day I pulled this Laura Mercier out one to just you know, try it because I was doing a little bit more Self tanning and it was a little bit more along the lines of the color. I needed but I just thought wow I think I really enjoy the flower one better And it seemed to last longer throughout the day and give me the coverage I need another one that I want to mention to you guys the hourglass veil mineral primer is such a beautiful primer you guys it is one that you put it on and It blurs everything and makes everything look so pretty the way that it feels and what it does on your skin One of you guys had told me that the Nyx Angel veil is a dupe for it And I do feel like that it really is But I don't feel like it's a hundred percent a dupe The Nyx Angel veil feels a little bit more hydrating to me, which personally I really do like but if you wanted a 100% dupe, but you didn't want to spend the super heavy price tag This one is from Mali and it is her perfect prep primer It is also a little bit more on the expensive side, but it's so much less than the hourglass So I'm gonna make sure that I list all three of these for you guys But this one feels like it is more of an identical dupe to the hourglass one for me Um, I just really like the way that it blurred out I love the way that it filled the pores, but I also love the weightless feel the angel veil feels weightless too Don't get me wrong. I feel like these two are really a dupe for this one But if you liked Mali and you wanted to try it, I feel like it's just a tiny bit More of a dupe than the angel veil like I said, I feel like the angel veil is a little bit more hydrating For me, that's a plus so with the hourglass mineral veil the Mali was a no-brainer dupe It was just exactly spot-on. Okay, the last thing you guys have asked me about over and over again And I just barely was able to get my hands on it last week. So I've been giving it a really good try This is what I found the touch of silk canvas primer I really love this stuff you guys and I have used this and used this and it's so nice on the skin And it blurs those pores so well And there's a tiny bit of cooling effect when you open it up and when you start working with it There is a little bit of a there is a little bit of a Citrus fragrance in it not too overwhelming or anything But it does have a little bit of fragrance in it But you guys kept asking me is the elf poreless putty primer the same as the touch of one It doesn't have a scent at all. So that's the first thing but Side by side comparison of the ingredients They might take one ingredient and have it the second ingredient Or take another ingredient and have it the first ingredient between the two of these But the side by side comparison in the way that it worked on on my face and the way that it felt was absolutely identical So for me, this is an identical dupe. Yes, it is an identical dupe Now what I found more than anything is as I compared those two ingredients because when I say something's I want to be able to look at the ingredients and say, okay. Yes, it is identical Especially for something like this So as I looked at them, I even had my son who is really into those kinds of things where He like can analyze products and different things and see how they work He even looked at it for me and he was like, yeah, mom Their the ingredients are really really close. And so I was like, this is cool This is really really cool because this is something like 56 dollars Something like that. I'll make sure I throw it up for you right here. And this is eight dollars I happened to get my hands on this on a fluke you guys. I have been on the wait list for this primer for Since christmas time on the elf website and it's always been out But I found it at walmart I just kept browsing walmart and seeing if I could find it like every day And it was at my local walmart. So I like ran and picked it up immediately. So, yeah It's not on the elf website yet that I know of I haven't gotten a notification and I haven't found it at Ulta, but I stocked walmart until I found it Now I would bet that elf is working overtime to try and get this back in stock for you guys because it is a hot ticket item But I wanted to make sure that as soon as I got my hands on it that I told you guys that Yes, this was a dupe and make sure that I brought that to you guys because so many of you were asking And I'm happy to tell you that yes, I feel like it's a hundred percent a dupe for the touch up primer So that's everything for today's video. I hope that you guys did enjoy seeing the dupes Please give it a thumbs up if you did if you're new to the channel Please subscribe before you head on out of here and don't forget to hit the little bell So that you guys can be notified of any future videos that I have Thank you guys all for spending a bit of your time with me today Do you guys know of any dupes that you absolutely love? I'd love to hear from you and I might include them in a future dupe video if I get a chance to try them I do appreciate all your well wishes these past few weeks while I'm struggling with while I've been struggling with My health. Thank you so much for all of your support and your love. I love you guys all so very much I hope that you're having a wonderful day and I will see you all in my very next video. Take care. Bye. Bye


Gonna be first to get an error pack. Yeah, yeah, yeah, well it's actually- We found something! All right, you guys want to see it, huh? You guys want to see the starlight? We'll show it off. We finally got one after many, many packs. There's no in second inch. Oh, please, don't say that. Why'd you say that? Why would you even bring that card up? That card's so bad. You know it's gonna be that one now. We've already jinxed ourselves.  It's time. We saw the starlight border. We know that this is a starlight in this pack. Stars aligned. You can look over there. You can see a little bit of shiny right there. Yorishou of the Aqua. A double Yorishou of the Aqua. Is that a good sign? Scareclaw decline. Nice. Kashtira Ogre. The decisive battle of a Golgonda. We've got Nechuria, Mowcricket, Amazon of Secret Arts. The next card is the starlight, guys. Here we go. Starlight Rare. Oh, jeez! No!