Thanks a lot for coming along. This is a presentation on layout paragraphs, a new way to manage paragraphs. Now, for those of you who know me, you probably know I'm a bit of a paragraphs not I seem to do a presentation on it at least once a year and it's 2021 so it was time to roll out another another presentation. So this will be a demo of the layout paragraphs module, but it could also be called a brief history of layouts in Drupal. And so what I would like to do before I jump into the demo is just sort of share a few of the ups and downs of layouts and presentation and you know how do we get editors to build pages in Drupal just some of my experiences. Over the years, I flip flopped left and right pretty much every year and I'm sure some of my experiences align with with what how you've been feeling as well so what I'll do is I'll just jump in and just go through a few of the basics of layouts and just my experiences. So I came to Drupal in round Drupal six Drupal seven and you know back in those days, you know you had PHP templates, you know rendering nodes, you had your data you had your template and you rendered it. It was very theme focused. It was kind of like a very pure approach. And you know the theme and you what they wanted and the theme got that, but the downside of it was that there was this very low editor control, it really was here you have the design, you have the implementation and that's it. The site builder and theme that the editor really sort of played quite a low, a low small role in this setup. Display Suite was an awesome module. Once again, it was theme of focus but it introduced the concept of layouts, it gave site builders more options, and there was some sort of editor controls in there but once again very very small it really was a theme as tool. So that were just sort of some of the groundwork modules that were, you know, in poor approaches that were in place for say Drupal seven. And then of course we have panels and panelizer sort of came on to these a little bit later sort of like always a little bit skeptical of panels you know some people turned their nose up at it some people really, really really liked it. So I was a convert once, you know I got into it. And I think that the real sort of breakthrough with panels was that it did try to open up things to site builders, and a little bit to editors. So suddenly what you had was you had you know site builders working in a UI, working with layouts and different parts of the, you know the page and basically placing blocks what they, how they like so the site builder really got a huge boost here. I've got powerful exclamation mark because you know panels had features then that I don't think we've still we've really got now. I'm thinking about things like the access plugins. You know page manager and sort of these mini panels and there's this huge amount of flexibility that was in there. You'll also see I've given this one a little score here and there is method to my madness I will come back to that score at the end, but basically I'm giving panelizer a 69% score. And then the paragraphs module came along 2014. It was like a sort of new on the scene and of course it's grown to huge prominence. I'm giving a ticks in everything because I do think it addresses requirements for theme and site builders and editors. Like, you know, the first real time that you know editors are able to start creating components that they that they would like. I've done the UI. It's never really been a great user interface. I think we can agree with paragraphs. The nesting that you will find in in paragraphs, the display and you know that you're not really getting a what you see what you get experience with those so that's that hasn't been good that aspect but pretty much everything else was great. Then triple eight came along something bad happens, you know, we lost a lot of the modules that we knew and love. Speaking from my decisions like I was starting to use the lightning distribution and it because it was supporting panels in those very early days. And it was pushing people to using this system called IP, which is basically allowing editors to move blocks around in the front end. I'm giving us a very low score 39% even though it was meant to be editor focused. The UI was very complex. It was not stable. It was buggy. It just didn't really work so I felt like, you know around 2016 just took a huge step back, you know we had this amazing ecosystem. You know with with paragraphs and panels in triple seven that took so many years to build up and then with triple eight we had to learn all of the lessons again. Paragraphs didn't go away. I mean that that community was still consistent. There's still relative stability there. One of the other modules I was playing around with at this time was called the bricks module. Not many people really got into bricks. But bricks brought layouts to paragraphs and it basically you had the layout plugins that were exposed and bricks could make use of use of those and basically you could put paragraphs into it. It was a really good concept. It brought structure to paragraphs that weren't existing there previously. But as an implementation I even though I kind of love the approach of bricks I just don't think it was perfect that the UI was not really there and you know it was a little bit glitchy as well. And then of course we had layout builder ushering in a whole new era. You know when I first saw it at Drupal con there was basically us and ours from the audience as people watched in or as you know blocks were dragged around and placed into different regions. My contention with layout builder is that it is still a site builder tool. I think it's done a great job at sort of unifying how we do layouts across all the view modes. I don't think it's convenient. I don't think it's ready for editors, and I think the way it's sort of developed over time it's just feeling incomplete to me and that that's a little bit of a shame. That's just my feeling I just feel it hasn't quite got to you know it's where it could be. It's still getting a very good score though. What did we do at morphed we switched everything from paragraphs to blocks at this time and so that meant a lot of our components were re implemented to be blocks to use this new, this new paradigm. But as things would have it as just like well we moving to blocks we've lost a whole lot of stuff with paragraphs and then we you know we switch back to them. So this is great. We've now got a unified way of doing layouts. We've got the editor focus with paragraphs is basically getting ticks and I think you know we're back at 78% here on my scoring I think we've reached a really like a high watermark with the tools that we have available now but it's not perfect. And that's where the layout paragraphs module is coming in. We've got the unity of the layout builder. We've got the flexibility from paragraphs, but the layout paragraphs module gives us a better UI and we'll be seeing that soon. So I'm calling this double plus good 81% I think this is very interesting and that's what I'm showing it to you tonight. So where all these numbers come from. There is method to my madness. I think like last week I just said hey why don't I just make a spreadsheet for this. So across the top I've got the all the different paradigms there over the years and down the left hand side, hopefully you can see this. So I've got the text or aspects of the systems power stability, FEMA control site builder flexibility, editor power editor experience, as well as the health and momentum of those modules, or those systems. And I've also waited them, and I've waited editor experience very highly, as well as the editor power and site builder flexibility they're the things I've waited. And that's basically where I got the scores from so you know you can see the scores down here. I think the funny thing is this like over the years we've we've kind of reached high points like in 2014 and Drupal seven with paragraphs I thought that was, that was a high point. So in 2019 with, you know paragraphs and layout builder I think that's a high point, and the low points panels IP and you know it's kind of weird how everything kind of fast to be destroyed to, you know to be made new again. And here we are in 2021 I'm really giving it the big sales pitch here hopefully not too much, but I think this layout paragraphs module will change things for the better. Now, flip over to a development site that we've got. And I'm not saying this is perfect guys it's just a dev site as it has not been released, but I will show you the module in action. So, I've come across we're just looking at a demo page for different components. You know we've got different banners. We've got accordions. A lot of this stuff will be familiar to to you, you know videos charts, a fast facts block different lists of things. So we've got a slide show heaven forbid. You know interesting tile layouts, etc, etc. Okay, so we basically got a number of components on this page that have been built with paragraphs and you know layout builder is in in the back end. Let me show you what the UI looks like for a complex page like this right so we will scroll down here to the components. What we are seeing here is a visual representation of the paragraph. Okay, so it's not just like the that simple little preview that you would get maybe a title or a few little lines. We're actually getting. The preview so there is obviously there's a full rendering of that that component in here so there's been a little bit of trickery behind the scenes to make sure that that theme is working properly here in the admin theme, but essentially you know what you see is what you get on this one. So what I'm going to do is I'm just going to add some content and we can just sort of see this in action and of course, this is where the demo goes awry. But just say we're just making a little demo page here will skip the body will come to the components and this is what we're all here to see. So the UI is different with normally with paragraphs you'll see like a hey add new paragraph and you would select what you want. But here we have a new option and a new UI. So firstly with the UI you'll notice that there's an icon so each paragraph bundle has a little icon that you can upload that is a pictorial representation of it. I think you agree that that's just a nice incremental improvement, but we have this other special paragraph so this the layout is a paragraph but it's a special one. And that's at the top and we can select that. So when we select the layout, we then get the options now we have to find a set of very simple layouts not too confusing no bells and whistles, but just simple options for editors to pick so you can pick the layout. And then it's just a normal paragraph and you can add other stuff into it so there's a few little doodads that we have at Morph but I'll just save that. Okay, so what we have now is a layout. And you can see we have two regions in here. So this is a proper layout plugin being rendered into the page we've got a 66 or a 5050 kind of situation here. And then we can add content in so I might just add some some content in here we'll just call it left. And we'll just chuck that in there. Okay, some of the usual stuff just save that we have left you'll see that that is sort of looking as you would expect and then why don't we just do a little node list in here so add a node list. And we'll call this right. So no less is just a little component that we use you guys have probably got something similar. You use it to fairly similar common pattern. So let's just chuck a test article in here and maybe a test, a test something else test person will make them basic cards and in this case we will just drop a this is not a proper layout it's just a class that we're dropping on that. So you can see here we've got the node list basically we've got two entity references pointing there displayed in its own little layout. And this is all looking quite nice. We'll just make this to say a landing page will publish it. We'll see what we get. So there we have the left on the right and the the the two items, the two items there. Just if you were interested about how you might style that it's interesting to know that this, this component here, whilst it is a, it is a layout, it is also a paragraph right so if we want to put a color palette on that. So what we're doing here guys is just dropping a class onto that paragraph. When that renders out, you didn't get the preview there but when that renders out you will get the, you know, those classes been dropped on. So we're very much using the paragraph paradigm still to drive all of this, but we're getting that the power of those layouts inside. I'll just show you one more thing. One more paradigm to layout builder where you have the concept of different sections or stacks like a layer cake kind of approach on the design if we wanted to put another, another layout in here we can just come in and do that and let's just say we're going to chuck a three column, a three column in there and let's just make that a dark background, and we'll do save. So, we've got the three. So, I'm just going to just, if you just bear with me I'm just going to turn out a bit of a bit of content here, you'll see this title field is a is a remnant from the old paragraphs world where we'd always want to have a little display title there's really no, no need for us to, to have that anymore. So yeah of course we can just keep in coming and creating content here. Sorry to just do that one. So we will just do that we've got one and two just going to save that guy. There we go. We've got one and two different backgrounds. That's, that's quite a pleasant experience. And then when we, if we want to come in and sort of change things around. We can grab this little handle here. Come on. Move it into the left. That should be able to do that is that working. No. Okay. Yeah, typical. Okay, so we'll move the left down there and then we can move the one back up into should be able to move the one up into there. Okay. Okay, that has not worked so well so we've got the right left. Okay, so what we've moved and move that component there, but you can see that we can basically move these things around between different sections. So there we go. So that's just targeted that down there so we've been able to basically move the sections around we can move the the components around inside. And you can see we've kind of jumbled them. We've jumbled them up there. You would not be able to do that with paragraphs normally normally paragraphs are kind of lists of things and if you had different sections that would be, you know, a difficult thing to achieve. So that's, that's basically the demo in a very quick nutshell there. I'll come back to my presentation. I'll just complete that with just a few a few ideas. Firstly paragraphs and layout builder. Obviously I like that. Maybe you don't maybe you're big fans of layout builder and you like working with blocks and layouts and I think that's acceptable approach as well I'd love to hear your thoughts if if you think that is superior paragraphs, a nice solution. They're not perfect. They do have problems and really the editor experience was bad with them. I think layout builder had promise it still does have promise but I think at the moment it's fulfilled. And I think the main question we have to think about there is who is lay out what is there. Who is layout builder for editors or site builders. At the moment I think it's more for site builders rather than an editor tool. I'll be interested to hear if you've had success. Otherwise, layout paragraphs does bridge the gap, and it provides a UI which is good and reliable. I don't necessarily think it's perfect but I think it's like just leaps and bounds ahead of what we have there and it does bring that extra flexibility of bringing layouts into the node edit screen. So that's it. Thank you very much.


That many, huh? So this is going to be kind of a non-traditional presentation. You know, actually I had this really great, like, 300 pages of data collected from stuff I had done against NFR and Black Ice and a few other IDSs. And then I got to talking to Chris and Robert and all the people who run this company.   And then I saw Robert's presentation and everyone else's like that. Well, this has been done already. I mean, do you guys really want me to rehash all the Tay-Chick and Nushim stuff? Yeah, no. Yeah, maybe.  So I really, you know, so I really didn't want to rehash all the Tay-Chick and Nushim stuff. So I, like, literally, seriously woke up this morning not too very long ago and sat down and had a conversation with a few people. And I put these slides together in, like, about 25 minutes. So I hope you like them. And if you don't, I'm sorry about that. Although I do have, actually I have a lot of cool stories, but I'm going to tell the first one. So we went to, we went to Sans Network Security a while back and we were in a 20 by 20 booth across from Network Associates.   So we had about a thousand shirts printed that said, So much to their dismay for about the next two days, about 500 people were walking around in shirts that said, We're watching your network.  So to take it one step further, Hopefully I won't get sued again. Their attorney sent us a letter and told us that we had been violating something to do with their slogan or what have you.  So we're watching your network. So if anyone, this is a really interactive session as you can probably tell. Shit, I may not even talk about technology. If you guys have any questions, feel free to ask them. And if anybody asks a good question, I've got about 15 shirts I'm going to throw out. Except for the guy who wrote snort. That's a good question. I'll get to that. So also I have these little, have you seen these little pins?  So although, so I don't have many of those, but I don't have any monkey stickers either. So you guys will just have to deal with the one on stage.  So, and you know, you guys thought you might want to go see Simple Nomad.  Okay, so I swear I may not even talk about any of this. So I've been thinking a lot, and I think everyone else at our company has. Also, I'm not going to try and pamper our technology a whole lot too. So although I do have some slides that were created by our graphic artists. So you're going to see a lot of, like, Everworld logos and stuff. Couldn't be helped. I like barely know how to run PowerPoint. So some marketing gim. What's that? Oh yeah, there you go. Good call. Who has time to do that though? Oh yeah, that's probably true. Next time I'll use Magic Point or, you know, if they ever get around to getting star office or something working on OpenBSD or if anyone could ever make it work, send me email. So, anyway, back to the slides. So Feynman, who I think everyone probably knows who that is, Richard Feynman, fantastic physicist, really great work. Work that was totally accessible to everyone. He said something that I think totally sums up how I feel about network security and how I feel about the stuff we're doing and how I feel about everything everyone else should be doing. Which is basically, man, I'm going to bag on NFR. I hope that's okay. Which is basically to, you know, to imagine and think about things which are there, not to imagine or think about things which are not there. So that's sort of, I think this quote sort of summarizes about the next, I don't know, probably before slides. So I'm going to talk a little bit about domain specificity, which is the idea of understanding what it's like on a specific network in your network infrastructure. I'm going to talk about false positives and how a lot of IDS technologies are basically generating an incredible amount of false positives right now, in my opinion. I'm going to talk about hybrid IDS. I'm going to talk about high-speed network monitoring. And then I'm going to talk a little bit about active packet scrubbing. And if Teichik's in the crowd, he's going to scream and yell and throw stuff at me. So let's hope he went home already. Okay.  Moving on. Okay. So a typical network infrastructure. You know, you have multiple network segments. You have numerous critical servers. You have Firewall VP and other protective technology. You have multiple locations. You have functional groups, right? So it looks very simply. I told you there were graphics from our graphic artists, so. Here. Yeah. Well, I figure it pretty much sums up most of the firewalls on the market anyway, so.  Don't worry, that's natural. Yeah.  Don't worry, that's natural.  Don't worry. That's natural. So anyway, your network. See, I told you there's going to be hyperworld stuff everywhere. So basically, you know, in your network environment, this is a really simple diagram, but you have hopefully a co-location facility somewhere. Maybe it's overworld. Maybe it's someone else. You have, what was that? No, it's interactive. You can say snort. I said snort. I'm like, hate.  Does that mean anything to anyone but you? Sorry, sorry.  Tourette? All right, somebody escort the guy with Tourette's out of here. He keeps saying snort. I don't know why. Oh, is it? Oh, it's the guy from Genocide 2600. Oh, well. There you go. Okay. So, no, I swear I'm going to get through these.  In our case, our scanner is called Swarm. So, of course, I have the Swarm logo up here. And you have a management console. And theoretically, you're not using some crappy product. We're multiple scanners or multiple IDS. The scanner report back to the same management console. Or are you? Anyone? No? Okay. So, what do I mean when I say domain specificity? Well, I mean that networks are constantly changing probably. Right? It's always something. Someone plugs something in. Something changes. You know, that sort of thing. I mean that the environment, if you're more than a few class Cs. So, someone want to answer, how many class Cs do you think one administrator can actually manage and keep track of? Zero. Zero. Is that what someone said back there? That was funny. Four. Four? Yeah, not many, right? Just a couple? Yeah? So, I say that the environment must be understood through automation. Not people handing information around, right? I think you have to have some sort of automated tool constantly monitoring your network. Currently, you know, currently it's interesting because there aren't really any scanners that do that, right? Most scanners. Not to name names. Most scanners, you know, you just put on a laptop. You deploy them.  Scan the network. And then, you know, you walk away with obsolete results a few minutes later. So, I have this idea of you have to automate the process of understanding your network with technology, not with people. Okay, moving on. And then, of course, track each change on the network. No, it's going to get more fun. So, then I thought I'd quote Rainham.  Did anyone see that talk at Black Hat? No?  Open source is bad.  Don't release anything.  Basically, I just summed up like about an hour of hands meandering.   Yeah. And our lawyers are bigger than your lawyers. So, you know, there you go. So, but I'm going to quote them anyway, but not in that respect.  Hey, I figured stuff out.  Right. I figure most of the suits would only come to this, right? Pre-advertising. Pre-advertising. There you go. So, yeah, for Rainham too. Look, I'm actually quoting him. So, the ultimate IDS would not only identify an attack, it would assess the target's vulnerability, target's vulnerable, modify the administrator if the vulnerability has no fix, it would include directions for applying a fix. Is this my beer? Sorry. Can you guys tell I have like ADD big time? I'm sorry. Who are you? What am I doing? All right. So, thank you. Someone in the eyes of the channel. And he's... He's on my team, guys. You can have a bottle cap. There you go. Actually, there's free beer over here, right? Goons. We have a real problem. There's not enough beer here. Someone bring more beer. Okay. So, now you get to go home and go, you know the founder and chief scientist for Everworld? I saw that dude drinking on stage. Yeah. Everyone's like, dude, I want your job.  So, what do I consider false positives when it comes to IDS technology? Oh, by the way, someone keeping track of time. You? Good. You give me like a five minute warning. Good. Okay. So, what do I consider false positive when it comes to IDS technology? Well, it occurs to me that the word intrusion detection actually means to detect intrusion. Maybe I'm crazy, but that's what I'm thinking. Not that I'm crazy, but that it means to detect intrusion. So, then it further occurs to me that if you're going to actually do that, like detect intrusion or detect an attack, that I would consider false positive any time you detect an attack that's destined for a host that doesn't exist, right? So, like if someone, like RFP, runs whisker against my network. Did he announce whisker? Did anyone know? Yeah? Whisker 1-4? Yeah, good. If he runs whisker against my Class B and my Class B is only 5% populated, then why am I trying to detect attacks on 95% of that network? I mean, unless I'm running like a flight recorder or, you know, I'm trying to keep track of every single thing that happens on my network, why am I recording attacks to hosts that don't even exist on my network? So, I call that a false positive. If you alert and wake me up at 3 in the morning, my page are going off because you say that there's an attack, you know, because it's some high profile attack. You say that there's an attack to a host on the network that doesn't exist, like it's old really fast. So, of course, the natural extension of that is ports that aren't open, right? How can I have an attack that's not for a port that's not open? I mean, this all ties back with, like, understanding your network, right? So, how many of you actually deployed in IDS? Yeah? About half? Good.  I have a client, I swear to God. They installed a leading commercial IDS. A, A leading, not B leading. Now, if it were to be leading, I'd just say real secure. So, anyway, they installed A leading IDS and they put it in their network and they put it on their backbone and they have a lot of traffic. And so the first thing they noticed, of course, was that, you know, because they have about 70, 80 megabits sustained on the network, they had to put in about 10 sensors, right, with a load balancer. Okay? Second thing they noticed is that they had to put those sensors on, like, E-450s with half a gig of RAM each. The third thing they noticed, the third thing they noticed is that they could do aggregate across 10 sensors about 70 to 75 megabit per second before the sensor started falling apart across 10 sensors on the E-450s. You probably know who it is by now, right? Like everyone. So, the other thing they noticed is, and this is just, God, this is classic, the other thing they noticed is about two days after they put these in they had them sending pages to their pagers and their pager company called them and said, you know, I think 3,000 pages per minute is a little excessive.  And I was just, like, righteous. Where can I get one of those? I didn't realize that they made systems that tested the pager infrastructure. Okay, so, where was I even? Services that aren't running, right? I don't want to know about attacks that are destined towards services that aren't running. Let me give you an example. Despite what InMap says, just because I have port 80 running does not mean I am running a web server on it. Agreed? Yes, good, good. Despite what InMap says. So that brings us into invalid services, similar kind of thing, right? And then I'm going to take this like a step further. See, I like to say I was going to talk about Tachik and Nisham stuff, but now I'm just rambling. I was going to talk, so improperly ordered fragmented constructed packets between the nids and the target. Okay, what do I mean by that? Well, who's read Tachik and Nisham's paper in Search and Evasion to Mild Service? Okay, the Riverworld guys have anyone else? Still our check. Okay, yeah, you don't count anyone else? Yeah, a few people? So, hang on.  This is my copy. And it's got my notes in it. So, I've like underlined some stuff that I think is relevant. Well, here's a Network Associates white paper on high speed IDS.  So, I just, I hope there are no attorneys in the crowd.  Alright, so Tachik and Nisham's in Search and Evasion to Mild Service, autographed by me and with notes. Anyone want it? Anyone who hasn't read it? Alright. Yeah! Toss it out, Brandon. I'll give you a beer for a curse. Yeah, is it an import? Yeah.  Anyone else have an import? Microsoft action figure board. You have a Microsoft action figure? Oh my God. This just keeps getting better. Oh, totally sold. What's your name, man? Dude, this is elite.  Bounce right off the ceiling. Good.  Oh, I don't know, which one is this?   Yeah, he's in the, what is this? Yeah, it does see MCP on his little backpack. Oh man.  Yeah, I know. Oh my God. Yeah, really, that's true, that's true. What was it that he said, what was it that Petrelay said? He said, I'm not saying that Bill Gates is the devil. I'm just saying that he and the devil met, they wouldn't need an interpreter. Sorry. Okay, so here's the concept. I may actually get this out. So the concept is that if you have a scanner on your network, and it doesn't have to be the river world scanner, and you have a management console and you have an intrusion detection system, how are you going to mitigate this? How are you going to mitigate the idea of not having open ports, not having open services, of not getting alerts when packets are destined toward machines that don't exist on the network. And so cleverly, I have constructed a real-time communication between the IDS and the scanner. No, I know it's groundbreaking. The idea, right, is that the scan, kind of back with a lighter. Dude, pink Floyd's over there. So the idea, right, pretty simple, pretty hard to do. The idea is the scanner would grab information about the domain, therefore creating domain specificity. Therefore, the IDS would have an a priori knowledge of the network, and when something happened, that came in because you know which hosts are alive, what operating systems they're running, which services are running, which vulnerability exists, you don't get inundated with false positives. Pretty cool, huh? Moving on.  He's a certified badass, and in fact, there's a sticker on my laptop that says badass, and I got one for him too. Yeah, ooh, badass sticker. So here's the idea. I swear I was going to talk about high-speed nets, right? Did anyone actually read the abstract for this talk?  So the idea for high-speed nets is that you have something, see Steve's freaking out, oh my god, so you have something that does, you get as close as you can to the kernel when you're listening to packets, see I'm just going off now, and you expose information to user line better like with LivePeak, similar to what LivePeak kept us, copy as few packets as possible, and you have a large shared buffer space with information, state information, right? So can you tell that this is one of the original slides and all the other ones are just shit I made up? Yeah, good. So the point of this slide though, if there is one, is that at some point here between now and OpenBSD 2.8, if we get around to it, right? Ludwig, myself, and Solar Check are going to try and commit kernel patches to OpenBSD that allows you to do about 300% faster packet capturing on the OpenBSD system. And Theo said that if we don't do it, he will, and then we won't get credit. So I think I might do it. Oh yeah, well-designed hardware. Totally forgot to put that in there. Okay, did anyone know what active packet scrubbing is? Yes, maybe. Okay, aside from you.   There you go. Okay, so there's another concept. See, originally this started out as stage of connoisseur, but now it's just like whatever John's going to rant about now. Active packet scrubbing is a way of synthesizing information onto the network so that you guarantee that as packets come into the network, they go through a gateway, and that that gateway scrubs the packets so that you prevent things like stage of connoisseur style attacks. Let me give you an example. Let's say, for example, that you have a buffer overflow or, well, let's start with buffer overflow. Let's say you have a buffer overflow and you can trick the IDS by inserting like a NOOP into the buffer overflow. Okay, right, simple. Well, active packet scrubbing is a way of synthesizing all that information so that those NOOPs get pulled out and so that everything that goes into the target network or everything that goes out of the target network looks exactly the same, right? So the idea is because... this is just an opinion. I'm about to state, like everything else hasn't been. The idea is that because intrusion detection systems are fundamentally flawed, that in order for you to have an intrusion detection system on the network that will try and keep up with all of the information that actually gets blasted into that network, you're going to have to do something kind of interesting, something like a router or a gateway that does packet scrubbing that sanitizes packets so that if Rainforest Puppy comes out with a version of Whisker that puts a bunch of slashes and all kinds of crap into a URL, this active packet scrubber cleans that up so that the target information on the target network always looks the same, right? Follow me so far, good. So you can also do some cool things like maintain heuristics to prevent odd packets from being on the network, right? If you monitor network traffic over a month and then you see some packet that you've never seen before that has no possible destination, you can eliminate that packet. Shunt it, log it, move on, right? And then it prevents unusual or abnormal information from passing in or through out of the network. And I said, okay, we have a question. Is this a firewall? That's a good question. I thought I could go back to the slide with a firewall if you need a refresher. Now, that's an interesting question. Now, the question was, is this a firewall? And I should... Is that a good question? Should I give him a shirt? You give it to someone else, okay. Here's the idea. There have been a lot of papers written about this concept of distributed firewalls. I think even Cheswick and Bellavin put together something that said distributed firewalls. Here's the idea. Originally we had routers and gateways, things like that. Then we moved toward firewalls. What is a firewall? Nothing more than a really smart router. It's a router with more advanced access control lists, things like that. So I think Cheswick or Bellavin, I can't remember who, probably Cheswick, postulated several years ago that there was this concept of what he called a distributed firewall. The distributed firewall would be a system that would sit on the outside of your network, act as kind of a gateway firewall, or a gateway IDS, would communicate with the other firewalls in real time and sort of maintain sanity on the network. And that notion was further emphasized by Tehchik and has been talked a lot about, well, not a lot, but has been talked about somewhat with the packet ball concepts from Honeymoon and the things Doug Song has been talking about and as well Vern Paxson has written a paper about this notion of scrubbing packets as they come into the network. So the idea here is that it's not a firewall, it's like the next step. You have a firewall and then you go forward and you have something that does reactive access lists. Reactive access control. So is it a firewall? From one perspective it is because it does routing and it passes traffic through. From another perspective it's a lot more evolved as a mechanism for preventing crazy traffic on the network. I believe that the technology today has not exists but only in limited areas. The question of bandwidth is a good one. How much bandwidth are you asking about? T3 or T3 or just rational bandwidth? Yeah. What is rational bandwidth? The technology exists in two forms. In one form I have about 2100 lines of code that I am debating whether or not I should check into the OpenBSD source tree to do this very thing. And then the selfish person in me is saying or should I release that as a product and keep the doors open? So I don't know. The technology exists somewhat. It exists. Certainly I know that Vern Paxton has worked on some of it. I spent about 3 hours talking to Doug. I know he is working on some things like this. But I say I have about 2100 lines of code that actually for the most part does this that I may check into the OpenBSD sources. So good question though. Good question. The question was how do you suggest that we regulate which is what packets are considered odd and which packets are considered normal? And in my opinion the only real way to do that is to maintain some sort of heuristic information about how the network is structured. How are you going to do that? Well, you are going to have to do that by maintaining something like a continuous scanner that keeps track of what the network looks like so that you at least have some knowledge of the network. And then with IDSs or with systems that have been deployed for some period of time so that you can maintain this heuristic model. See, here is the thing. I talked earlier. I mentioned automating with technology or automating with people. So no matter what you do, this is an opinion. Again, caveat, big time opinion. No matter what you do you are going to end up spending about 4-6 weeks tweaking a system for your environment. Period. Get ready for it. Deal with it. There's nothing between you and it working other than a little hard work. That's the way it is.  Or are you going to automate that with some sort of system that will keep track of your network for you and maintain heuristic information about the network and then know what something odd looks like because unfortunately and I love this company they don't even afford to create another counterpane where we have a bunch of people monitoring traffic all the time. So I like counterpane. Have a question? Two parts for this. As long as the first part isn't bullshit Just the ideas or for the whole network? Yeah, good question. Second part is if they're for the whole network how do you make sure that the scrubbing doesn't break something? Good question. I didn't say this was going to be easy. So it's destined for the whole network the idea is to maintain a network that keeps these synthesized sanitized packets within it, right? That's the first part. So it is for the whole network and how do you maintain some idea of what real traffic looks like? Well once again it has to deal with having some understanding of the network by way of tools to give you this a priori knowledge about how the network looks, how it acts what operating systems on it, what applications are on it things like that. So there is a potential for that? Absolutely. Just as there's a potential for killing someone if you have a gun and don't know how to use it. I mean, all technology whether good, you know however it looks or however it feels can be good or bad depending on how it's used. The idea here is that as I said before I'm not saying this is easy but I am saying that this is how I think we should move forward. So let me see one quick. Wow, I'm at the question section already.  Good question. See how many shirts I've left. Let's see a few questions. Anne, you want to hand out shirts? No. Here comes Anne, the token Heverworld chick. Dude she's totally elite though. Like she can reassemble out of order fragmented packets with overlaps in her head. So should we let her decide who asked interesting questions and who doesn't or should we let me decide? Okay, so you. The fed guy.  I'm sorry, you had a question.  No, so I think the question was what was the first part? Aren't you putting blinders on by ignoring three of these? So the question was aren't you putting blinders on? See I'm rephrasing it exactly so that I'm not hiding from it. Like other vendors.  See what happens. The question is aren't you putting blinders on by ignoring what might be legitimate recon work on your network? By having something that only identifies active attacks in progress. And what I have to say to that is yes, and you know what, I'm doing it on purpose. I think there are general purpose tools like network flight recorder, TCP dump, snoop. There are tools that absolutely that is their job in life. Maybe snort. That's their job in life, right? To catch everything. Or in some cases to catch everything until you hit 20 megabit and then drop everything. But okay in all cases. But yeah, I'm absolutely ignoring the things that I don't care about. Marty coined a term that I think is very cool and it's called SIDS. And the idea is that you only care about maintaining intrusion detection for a network picture for which you understand the targets on that network. And I think that's obviously the natural evolution of this. Good question. The guy in the hemp B-shirt thing. What is that? Okay. You. That's an excellent question. The question is how do you deal with fragmented packets across this packet scrubbing environment when you have sort of no real idea of what kind of path the packets are going to take. And the answer to that question is the only way you're going to do this and do this right is if you have a system set up where the system communicates in real time. Like Cheswick mentioned this notion of a distributed firewall and what I have to say is that the system will not work if you just put a bunch of islands on the net, right? Not too much. Bruce Sterling who? Never mind. Yeah, so the idea is that these systems have to communicate in real time. They have to communicate with an upstream management console. They have to communicate with the scanner. They have to communicate with the IDS. The idea here is that the IDS, the firewall, the packet scrubber, these sort of things have to be a part of the network infrastructure, right?  They have communicating between these devices. And you know what? I'll even plug us just for a second here. We absolutely plan to release our rules language as open source as well so that other vendors can adopt this real-time communications. Was that a good question? You gave me a shirt, right? Yeah. The found stone action figures? It's funny. Hi, I'm Joel Scambray. She just asked if it was the found stone action figure. Good God. That was the camera. Oh, those stuff. Oh, I see what you're saying. So, correct me if I didn't understand the question. The question I believe was if you use OpenBSD's bridging as you use what was the other portion of that to communicate? Oh, the OpenBSD bridging as you're scrubbing. Yeah, that's a good question. Using OpenBSD's bridging as scrubbing is a really, really, really, really good first step. Unfortunately, things like whisker, things like adding a backspace in a Telnet stream for stream reassembly as you saw maybe from Graham's talk. It's not going to solve problems like that. It's a level of granularity where you're doing active scrubbing on not just the packets themselves but on the content payload. But that's an excellent first step. Did you give him a shirt? That's good. That was a good question. Okay. The guy in the green thing that exploded. Which one? Oh, cool. Orb rules. But I didn't go to the concert because I didn't get any sun. My question is related to Never Hair. It seems to me that the large focus with most IDS systems is on exploits. I agree. I actually have been to your site and read some of the white papers there. However, when you're looking at internal user detection the stuff I care more about is an administrator all of a sudden telling any server that they are. Right. The other problem is related to Do you want a mic if we're going to keep talking? The other issue is with a switch network and with switches it's becoming increasingly difficult to monitor all the traffic that goes across a single switch. It's impossible for us right now. Okay. There's a switch on the bottom. It's not too complicated. Okay. The question was and I believe I'm interpreting this correctly but it is my universe where I'm at center so I'm going to say what I want. The question was people are spending a lot possibly too much time just looking for exploits and not enough time looking for what would be traditionally considered anomalous behavior. When someone's doing something from a system inside that they shouldn't be doing it from and this anomalous behavior should be taken into consideration a lot more and not only that but if it is taken into consideration how in the hell are you going to manage it because of switched environments and the complexity of that. Those are all good questions or comments I think. I do think people are spending an awful lot of time playing the counting game counting how many exploits they each have.  Everyone is so freaking jaded they've been lied to by vendors they've had vendors tell them what is complete bullshit and so when you come in of course you're like hey how's it going you know we have this thing it does some stuff and it's pretty cool and they're like yeah right prove it and you're like no look I have this model of cool predicate calculus based out whatever prove it and so so then you have a situation where at some point it's okay for a vendor to stand on stage that their you know 46 laptop does 148,000 packets a second and you're like what is that the fucking magic laptop you have there chief did I I'm sorry is there an e10,000 under the under the stage the hell are you talking about 148,000 dude your 46 can't even move a pointer through memory across 148,000 structures in a second shut up I'm sorry did I even answer the question okay so so I think yeah well thank god we have a good attorney right yeah so I totally agree you know even though I get up here and I joke and I have a lot of fun it is DEF CON so deal with it but I totally agree I think people spend I think people spend an awful lot of time thinking about exploits and they should be really thinking about their network and this concept that I threw up of domain specificity it's the idea that you need to know your network before you know how to protect it right how can you protect your network if you don't even know what's on it I mean the idea of coming in with an IDS when you don't understand your network and just turning it on and saying well you know it's not really doing what I want is ridiculous right I mean the concept here is you need visibility on your network before you can before you can even add an IDS so once you do add an IDS or once you do add this packet scrubber or once you do add some sort of reactive system then you have a great ability right you can start grabbing information and maintaining some sort of map of everything that's happened and so you know exactly as you said you know if some crazy person in marketing who's never run SNMP before is suddenly firing up the latest like ADM scanner that does SNMP you know grinding across public and privates you know you know if they're doing that right because you have some understanding of what's going on in your network so I totally agree people spend way too much time thinking about exploits not nearly enough time thinking about how can I get an understanding of my network that makes sense how many shirts do we have left how much time do I have okay cool I got plenty of time to rant oh hang on I don't know if I don't know if you get to answer a question oh okay so just for those of you don't know this is the guy that I just call bullshit on oh p2 400 single processor okay so you're not like forcing processor affinity or anything crazy like that okay it's got a 32 bit onboard Nick do you want a mic so this is the fun stuff where like the vendors actually come up and start like you know duking it out so for those of you in the audience take a picture now it'll never happen again the next time one of us will be dead it'll be Nick tomorrow morning at dawn so anyway one of the latest developments we've done with our ideas is credit a custom hardware driver this notebook happens to have the one card that we support which is a 3C905C from 3com so it's basically what he said earlier hang on the hardware guy what was that it's 3C905C I'm sorry okay and what was your driver for that okay the issue with this car is that we wrote our custom driver just like you guys are doing your kernel mods we wrote a custom hardware driver we bypassed the operating system completely so anyway this is all theory like you know this is like crap right so what I'd like to do is to ship you guys this notebook and have you run the test that you want to run whatever you want to run and then publish the results I'd love to do that luckily we're in the bay area so I can like just send it across the bay send you guys the notebook if so I just I just want you guys to know obviously I have some respect for network eyes so I wouldn't be blowing them so much crap right if I didn't like them I'd just ignore them and also I mean we're a fair company I haven't come up here and said anything totally crazy I totally would be willing to take you up on that that's awesome and I'm big enough that if I publish the results if I find out that the results are true and that Robert's right I'm on our front fucking page no just well just posted a security focus or something like that so and and we'll maybe even get security focus to link to it or something yeah absolutely absolutely absolutely cool thanks man I can give a team now it's got provide good information no problem I think that absolutely one more thing on this t-shirt is I came from Network Associates from Network General which started the original Cybercott Monitor Project and they got actually Cybercott Monitor 1.0 was actually licensed from Wheel Group so then Bill Larson CEO of Network Associates bought out Network General and then Cisco bought out Wheel Group and those two John Chambers and Bill Larson got into like a little tiff and they basically had to pull the Cybercott Monitor 1.0 product off the market where we're watching your network or who's watching your network campaign came out so kind of screwed it meant that they weren't watching your network so then like the SNI folks got together some haystack people with the sniffer drivers they sort of clued together Cybercott Monitor 2.0 which I've never seen in real life anywhere I don't know if it really exists so being the founder of Network Eyes do you want to fuck me I'm lead stick what a great sport you guys should just give him money because he's such a good sport about it I love that we have two shirts left how many shirts we have left okay we have three two three we have two shirts left two more questions uh okay that guy looks like he's going to ask something hard do you think that's that's a really really good question I personally believe that today right now that the IDS technology needs its own box I think that there are too many demands on what has to happen when a packet goes from the kernel to the decode to the fragmentation reassembly to the detection engine for it not to be on its own box now I don't think that that's going to be true in the future excuse me too much beer I think that in the future yeah like I said I got like two hours of sleep last night look at the monkey um monkey yeah I do think in the future you'll be able to do something cool like put a daughter card on maybe you know a Cisco or you'll be able to put some sort of blade inside of some sort of chassis and do it all in the blade when things move toward ASIC that but right now man we are so in our infancy we have people claiming all kinds of things and I've never in real life seen an IDS with all the rules loaded perform at above no matter what the hardware is perform it above like 20 megabit per second with one exception and that exception is freeware I mean snort is the only thing I've ever seen go above 40 megabit sustained good question so if anyone wants to help you know Marty write a better faster detection engine I'm sure he'd I think he'd be for that but at this point I mean it's like you know you're running the race and you look back and you go man all those guys with money sure are fat and slow alright hit me yeah you that means ask a question doing a mic so the question is that most systems today don't deal with spoofed attacks very well and do I have an idea of how to deal with them more appropriately see this is going to be where I sound like a broken record you're like too late the idea here is if you know once again if you know what the traffic on your network looks like and you have some understanding of what normal traffic looks like and you model normal traffic then there's one way to guard against spoofed attacks the other thing you have to do is you have to just do what a lot of stateful inspection firewalls are doing now and that's just maintain some sort of rational state about how connections are coming in I will bet you money in the form of this one dollar thing that says fuck me I'm leading that still are checking to give you a much better explanation of this than I can my idea is fairly simple I'm a straight forward guy I think maintaining state on the network having a really good understanding of what connections look like and not doing stupid things like ignoring checksums ignoring packet IDs I mean if you just keep a rational idea of everything on the network I don't think you're going to have nearly as many spoofing problems as people have today so good question so I'm out of shirts but I do have one pin so yeah you've had it for a while what's up good question his question was basically I've listened to vendors before and BS when is this all happening am I being fair I mean probably putting orange in your mouth but they're mine worth so as I said before the the concept of doing high speed intrusion detection is while not exactly completed it's not vaporware we have it in beta I plan on releasing sources to the open BSD source tree to do high speed network interaction our products already do interoperability we're releasing like within the next few months we're releasing an open source rules based language that allows you to communicate with systems in real time so we're talking about 60 to 90 days away from an open source rules based language I also plan on making the modifications that I'm talking about about 2100 lines of code I plan on making those modifications to the open BSD kernel to allow some you know maybe not super robust but certainly some first step packet scrubbing to occur so I think by November 11th which is the release of open BSD 2.8 you're going to see an awful lot of this technology in the stock open BSD distribution yeah in the back good question the question was basically if anyone didn't didn't hear it although he's in the back there I'm sure you all heard if I did the question is basically if you do active packet scrubbing you're in a position where all packets have to go through you so you have this real problem of being susceptible to distributed and out of service tax things like that you're going to have the exact same problem that you have with a Cisco router Cisco routers have about 32 megaprams sometimes more but you have a situation where you have to maintain state on that Cisco router and the Cisco router itself is actually in my opinion a lot less robust when it comes to maintaining some rational understanding of what's going through the network and maintaining some rational idea of how to recover with a distributed and out of service I mean let me give you an example I mean you can put a PIX on a network and I'm not just bagging on PIX it's a lot of stuff but you can put a PIX on a network segment and no matter how you configure it if you run in-map if you run a send scan a fragment in send scan from in-map either through the PIX or into a network that passes through the PIX that doesn't exist and the PIX has to maintain all of that state at some point it's going to fall apart just like everything else the idea here is with active packet scrubbing you at least you at least know what you're getting into you at least know that you're getting into a situation where if packets start going crazy like someone's running in-map to host that don't exist because you have this understanding of the network you can at least drop those connections in favor of ones that aren't that aren't irrational so I think it's a lot it's a lot more rational approach to the problem okay am I time up do you want to give that to that guy that's a really good part okay yeah we got in the back you gotta fuck me I'm a lead sticker or pin that was a good question sorry right so the comment was Cisco changes their filter list actively based on certain types of signatures I totally agree they change the access control list I absolutely agree that's not what I'm talking about what I'm talking about is scrubbing the packets and the packet content and the packet header so that you sanitize things that go into the network so that you guarantee that everything that comes into the network is sanitized and I agree that Cisco does some of this but what Cisco certainly does not do is maintain an active understanding of the internal and external network segments that are connected to and modify whether or not they're holding packets or modify how packets look or modify packet destinations things like that based on a heuristic understanding of the network okay and one more question then I'm out of here um yeah go ahead I hope so question was do you see real-time scanner moving toward integration with host-based systems you know I absolutely hope so I hope that people take the rules language that we're proposing and modify it and add to it and create a consortium and spend four you know years arguing about how it should be set up and then in the meantime rational vendors do what everyone else does which is just implement the damn thing and get to a point where we're actually maintaining visibility between the host's understanding of what's happening on the host, the network's understanding of what's happening on the network and the IDS's understanding of what's happening on the network from you know a historical model so that's it for me thanks guys you've been wonderful


Greetings fellow learners! This is going to be the first video in a playlist of videos to get up to speed about deep learning and neural networks. But before we embark on our journey, I have a thought-provoking question for you. What is the most important AI in your life? Or phrased in another way, what AI do you use on a daily basis? Is it chat GPT? Is it the self-driving car feature in your Tesla? Or is it perhaps something more inconspicuous? Please comment down below and I would love to hear your thoughts. Now, this video is going to be divided into three passes. In the first pass, we're going to go through an overview of what neural networks are. In the second pass, we're going to dive into some concepts. And in the third pass, we will code out your first neural network in PyTorch. Also, pay attention because I'm going to quiz you along the way. Now, let's get to it. What is the difference between AI and neural networks? AI is a system that can perform one or more tasks. And to solve these tasks, AI systems can be of different types. Neural networks are a type of AI system that was inspired by neurons in the brain. Now, other types of AI systems could be role-based systems, machine learning models, among many others. But overall, these AI systems can take an input and return an output. So in a mathematical sense, AI systems are functions. Now, because they are functions, they can solve tasks of the form determine Y given X. So that means that they can solve, for example, any of these tasks. Now, these are still just a drop in the bucket of all the tasks that AI can solve. But I think that this is a good starting point. Quiz time! Have you been paying attention? Let's quiz you to find out. Which of the following tasks can be solved using neural networks? A. Generate a response given a question. B. Determine a credit card score given a person's transaction history. C. Determine a home price given home information. Or D. All of the above. Now comment your answer down below and let's have a discussion. And at this point, if you think I deserve it, please do consider giving this video a like because it will really help me out. That'll do it for quiz time for now, but pay attention because I will be back to quiz you.  So this is a diagram of a neural network. Each circle is a neuron that has some inputs and outputs. And each edge connection connects these neurons and has some weight, which is some scalar value. Now, we mentioned before that the entire neural network is a function because it has an input and an output. But because each neuron also has an input and an output, then each neuron is also a function. But what is this neuron function? Well, it's an activation function. So moving on to activation functions now. So here's a diagram for neuron. It has inputs A, B, and C and weights W1, W2, W3. The neuron function is a function of some of products of inputs and their edge weights. And this function is an activation function, and it can typically be one of these. So why do we need activation functions? It's so that the neuron and also hence the neural network can pick up on complex patterns in data. And that's how neural networks can solve complex tasks. Now on to the next concept, which is a loss function. The loss function is a function that quantifies how erroneous the prediction of a neural network is for a batch of examples. So the loss function is a function. That means it has inputs and an output. The input to the loss function is typically two parameters. The first is the prediction or the value that is predicted by the neural network. And the second is the actual ground truth value. And the output is a single number that quantifies this error. This error is a loss. So the loss function can be, for example, cross entropy loss for classification problems or mean squared error for regression type problems. But this is non exhaustive, and it can be almost anything that you decide to formulate it as. And this is kind of the role of a machine learning engineer to try to sometimes engineer these loss functions depending on the task to solve. Next concept is back propagation. So back propagation involves taking the loss and computing the gradient of the loss with respect to the parameters of the model. This gradient is computed from the last layer of the network to the first layer of the network. And hence it is called the back propagation of errors or in just simpler terms back propagation. Now, why do we do this? So let's say we want to train a neural network to predict whether a given image is either a dog or not a dog. The neural network's intelligence is all in the edge weights here, the model parameters. They are randomized initially, and so it's a dumb neural network. And we want to modify these edge weights so that they can perform the task. And this is why we need to train the model and back propagation is a part of that training process. It's used to adjust the weights of the network so that the loss is minimized. And in the math world, this requires taking a derivative of the loss with respect to the model parameters, and hence back propagation is required. Next, let's move on to optimizers. Optimizers define how neural networks learn. So first of all with back propagation, we computed the gradients of the loss with respect to the parameters. Now optimizers will use this gradient in order to update the parameters of the network. So they're like an algorithm that determines the update rule. Any one of these here can be the optimizers, and we typically use Adam. Now let's talk about regularization in neural networks. Sometimes AI systems can overanalyze training data to the point where they start memorizing that data, and they won't be good at predicting on unseen data. This is overfitting, and regularization is a technique to decrease overfitting. In neural networks specifically, one way to regularize is through a technique called dropout. Dropout involves randomly turning off neurons in the network during the training process so that the neural network can learn along different paths, mitigating memorization and promoting generalization. It's that time of video again, have you been paying attention? Let's quiz you to find out. What is the primary purpose of the loss function in a neural network? A, to initialize the weights of the network. B, to quantify how erroneous the network's predictions are during training. C, to determine the learning rate of the network. Or D, to introduce non-linearity to the network. Comment your answer below, and let's have a discussion. That'll do it for quiz time for now, but do pay attention, because again, I will be back to quiz you. Now for pass three, I wanted to walk through some PyTorch code on how to code a neural network. But first, taking a look at this original image, this is an image that you typically see of a neural network in textbooks and literature, but it has a few problems. So first of all, data here, it almost looks like it's just taking in one input at a time of vector size three. However, in practice, we would pass in data as batches, taking advantage of parallelization in neural networks. And also, this image has the neural network parameters represented as edge weights, but in practice, the edge weights and the model parameters are represented simply as a tensor of values. So keeping this in mind, it'll become more clear when we see this in code. So we can begin by importing some libraries, and we're going to work with the iris dataset, which is basically a classification dataset to determine, depending on the type of sepal and petal lengths, what is the type of flower it is? It's one of three classes. And so we have 150 examples with four features, and there's 150 labels accordingly. We then split this data into test and train sets. We'll convert all of these examples into floating point tensors. We then initialize a batch size to be five. This is because, as mentioned before, data is not just passed one at a time to a neural network, it is passed in batches into a neural network. We then put all of our data into dataset and use data loaders. The goal of these is that dataset provides an abstraction for handling features and labels easily, and data loaders makes the dataset iterable and allows batching and shuffling of data in the dataset. So it becomes more streamlined. So in order to create a neural network, we first need to extend the class torch nn module, and we will then override the constructor function, as well as a function called forward. This will define the forward pass. So in the constructor, we're going to define individual components of our neural network. So we define the first layer, the activation, in this case, we're using relu, and then the output layer. And for the forward pass, we basically take our input X, we pass it into the first layer, then pass it into the relu layer, pass it into the second forward layer, and then we have the output here. We then initialize hyperparameters, depending on the dataset that we have. For example, we have an input size of four because we have four features, the hidden layers, there's going to be six neurons in the hidden layer, and number of classes is three because there are three categorizations right here. We'll initialize a learning rate, which defines how fast we want this network to learn. Then we define number of epochs, which is how many times are we going to look at all 120 examples in our training set in order to learn. And then we initialize our neural network accordingly. Now we'll determine a loss function. Now, because like I mentioned, that this is a classification task, a common loss function is the cross entropy loss. And so we initialize that here. Next, we define an optimizer. The optimizer defines how the updates to the model parameters are made. And so we use something called the atom optimizer. We pass in the model parameters and an initial learning rate. Next, we actually have the training code. So for each epoch for every batch, we will load one batch of data, that's like five examples from the train loader. We will make a prediction. We'll pass in the prediction along with the actual label into our loss function and generate a loss. This loss is then we perform some back propagation in order to compute the gradients. And then optimizer.step will actually make the updates in the model parameters so that the neural network learns. And we keep repeating this again and again until the 1000 epochs are complete. And we keep printing out the loss over some uniform increments of time to see that the loss is decreasing over time, which means that the model is learning, which is good. Next, we'll do some model inference with the test data where model.eval is set to, hey, we want to set this model into evaluation mode or inference mode. We iterate over the data, make some predictions, determine whether it was correct or not, and then compute the simple accuracy. In this case, we got every single example predicted, correct, which is good. Quiz time. This is going to be a fun one. Have you been paying attention? Let's quiz you to find out. The algorithm neural networks use to update parameters is defined by a, the loss function, b, back propagation, c, optimizers, or d, regularization. Comment your answer below and let's have a discussion. And like I mentioned before, if you do think I deserve it, please do give this video a wonderful like and hit subscribe for more videos like this. That'll do quiz time for now and also for this video, but before we go, let's start with the summary. Now, putting it all together for the training process, we want to train the neural network to recognize dogs from not dogs. We pass in a single image to the network, the network generates a number that indicates the probability of a dog along the way the network might have activation functions to help recognize complex patterns. It could also have dropout to help us prevent overfitting. Now, this prediction along with the actual label is passed to the loss function in order to generate a loss. This loss quantifies the error of the network and we want to adjust the weights of the network to minimize this error. And hence we back propagate this loss to the network and compute the gradients of the loss with respect to each parameter. And then these gradients are used by the optimizer to determine exactly how the neural network weights should be updated. And after rounds of training, the network will be able to take an unseen example and make predictions on it. And that's all we have today. So this just stretches the surface of building neural networks. So I hope it's a good starting point for your neural network journey. Now, if you do think that this was a little bit really surface loving, you wanted to see like a real neural network in action, check out my playlist here where I code out a transformer neural network from scratch for translating between different languages. It's a fun watch. It might be more complicated than this, but it's pretty cool. Thank you all so much for watching. Please do consider giving this video a like if you think I deserve it. And I will see you in the next one. Bye-bye.


People have a love-hate relationship with Lycra. Either you love to wear it or you're hating on people who do. The average cycling outfit consists of a zip-up jersey with rear pockets and a pair of padded cycling shorts. Together, this is called a kit. A step up from the shorts are cycling bibs, which make you look like an old-timey wrestler, but it keeps the padding in place during long rides. One positive about wearing a kit is the ability to carry your tools and accessories in your back pockets. You can fit all of your tools, a spare tube, and snacks into the back of a jersey. Lycra is comfortable, like a second skin, and when you're spending an entire afternoon in the saddle, you need as much comfort as possible. Lycra is also aerodynamic. It cuts down on the wind drag. You'll feel a difference, especially if you're used to wearing baggy t-shirts when you ride. Lycra is a technical fabric that wicks away any sweat so you'll stay cooler during training. Also, remember that confidence is everything. If you look fast, you'll feel fast. Try it out for yourself. Thanks for checking out another episode of Pure Fix TV. If you have some cool picks of yourself or your friends in your best Lycra outfit, use the hashtag Pure Fix when you post to Instagram, and maybe we'll share yours on our Instagram. Subscribe to the channel for more videos and make sure to follow us on social media. We'll see you next time on Pure Fix TV.


Okay, we're back live inside theCUBE. I'm John Furrier, the founder of SiliconANGLE.com. This is theCUBE, our flagship telecast. We go out to the events and extract a signal from the noise. This is an independent media operation in theCUBE, SiliconANGLE.tv, in partnership with our analyst team, wikibon.org. Dave Vellante, who's with me here to summarize and talk about news around the web and give our opinion and analysis of what's going on in the tech business and general business and tech. And we want to bring that to you. We would not be able to exist. It wasn't for our great underwriters and supporters of our mission at theCUBE. And that's IBM here at IBM Edge. So watch their ads and watch our ads of our sponsors because we are ad supported and that funds the independent analysis. Our goal is to get the signal from the noise and share that with you. We're here at IBM Edge. Dave, what do you think so far about the IBM Edge event and what's happening out of the first morning segments? Well, John, this is obviously a storage event, but I think you cannot talk about an IBM Edge storage event without talking about IBM and the company. IBM is a 100 plus billion dollar company in terms of revenue and it's got over a $200 billion market cap. So it's trading at over two times revenue, which is quite impressive for a company that's largely known for its services, but IBM's investment in software has paid off considerably. Contrast that, John, with Hewlett Packard. It's a $120 billion revenue company and it's trading at about 30 cents on the revenue dollar. And it's a stark contrast. So maybe IBM is high, maybe HP is low, I don't know, but there are two BMs in the industry on two completely different vectors. IBM is like a battleship. When it moves, it moves very slowly, but they have a lot of power. The company is a great company. IBM is professional. I mean, we've heard some of the guests here on this morning articulate.  IBM is a great company and they're fantastic. I mean, it's East Coast, it's New York based. It's kind of like the apple of the East Coast, but it's not as flashy, but they have a lot of meat on the bone as we always say. So very impressed with IBM in general as a company. One thing that's very lacking with IBM that I would say is that their marketing is very weak at the solution level. I mean, they do a lot of global marketing. You go and watch the Tiger Woods golf tournaments and whatnot, you see it's smarter planets. Great brand marketing. Great brand marketing, but in a solution area like storage where it's so strategic Dave and there's so much change going on, they don't have a lot of that marketing, but their story's kind of coming together. So that's kind of a criticism of the past, but I see this show as IBM moving out of that, speeds and feeds, storage only conversation to a much broader portfolio as Ed Wall says. I think that's really smart. The customers that they sell to buy from IBM from different divisions. So I think that coordination message that the new CEO Janie is bringing to the table is very strong. I think if they can pull that together and amplify that story and create that umbrella messaging across the different business units, I think they're going to have a winner because they got the packages there. Yeah, I think if you're a partner of IBM, a channel partner or a solution provider, on the one hand, you're concerned because it's a complex organization. On the other hand, you're excited because of the massive install base that IBM has. So what I see happening at Edge is IBM is reaching out to its both customer and partner communities and it's reaffirming its commitment, not only to the IBM solutions oriented approach, but specifically to storage. And it's, as we've been talking about all morning, trying to get its storage mojo back. Well, I'm going to be giving a talk to a couple hundred of IBM's business partners, executive partners, system integrators, channel partners and what not tomorrow afternoon. I'm going to talk about what we mentioned earlier, the four horsemen of disruption within IT transformation, which is cloud, mobile, social and big data. And that really is the ground zero of what's happening with the change right now. And we talk about Facebook going public a couple weeks ago and everyone's watching that kind of as a bellwether of the future, stocks down right now, but I'm bullish on Facebook going forward. But Facebook represents a new generation of infrastructure. And I think the story coming out of IBM Edge here is a validation to our analysis and coverage over the past two years with theCUBE around cloud, mobile and social, but more importantly, that fundamental business opportunities are going to be shaped by the intersection of business requirements and IT solutions. Not just a passing needs back to IT and having that being serviced. A real intersection of the two we heard from IBM's youngest VP ever earlier. She said that these big data requests are coming from business line managers, not IT. So that to me is fundamentally a trend that's been validated. I think IBM's direction with the battleship that's pointing in the direction of the marketplace they're going right down the right track. Yeah, and you look at a company like SAP where it's Sapphire three weeks ago, and clearly SAP has that strategy selling into the line of business. You mentioned the Facebook IPO. I as well was very bullish on that. And I think I miscalculated. I mean, I thought that Facebook would be the next wave. We saw Netscape, we saw Google. I thought Facebook was going to lift all ties. What I miscalculated, John, was the degree to which Facebook was going to price that IPO. And frankly, overpriced that IPO. And most IPOs come out at maybe in the low teens, maybe the mid teens, good ones come out in the high teens. Maybe every now and then you'll see one come out in the low 20s pricing it at 38, was it? I think the market's had a little backlash. And since then, we've seen the exact opposite effect as to what I thought would happen. Now, source, a lot of that, of course, is Europe dragging on the market. But a number of companies have pulled back their IPOs and are really rethinking the public markets right now. And I'm hoping it's short-lived, but I'm not so sure. I think IBM's going to be fine. There's no doubt in my mind from a performance standpoint, business fundamentals, they're going to do well. The challenge that you brought up really was how can they balance profitability in the short term and long-term positioning? And I think you're hearing that investment. But it's an exciting time. I think what's happening right now, Dave, is that fundamentally on a global scale, open source technology, lower cost nips, computing power and storage and networking converging together is creating literally the perfect storm of innovation and disruption where new solutions and new use cases are coming out. And we're covering that, even in the news, related to that, new possibilities are emerging. Good and bad, bad being, depending on how you look at it, I just tweeted about war games, right? War games is happening. We have, for the first time in our history, cyber war officially sanctioned by the government. And today in the New York Times, again, another story about cyber weapons warning, cyber war warning. So there's a warning, but it already happens like a tornado that's touched ground. So that is a real change to how we operate our society and our government, but ultimately that's the same for business' days. Big data is that theme, is that hype term, is that categorical description for the complete transformation of all the value activities within these businesses from how they build products and how they acquire customers and how they service them. Productivity enhancements are changing. Big data is really a productivity boom for the marketplace. And we haven't seen that kind of productivity since the PC industry when the whole idea of putting productivity in the hands of the people. And I think the big difference between now and when we watch the PC industry, we saw a major structural shift in the industry where the industry went from largely competing like IBM had at the time with the vertical integration strategy to one where competition occurred on individual layers of the value chain, Intel dominated chips, Seagate dominated disk drives, EMC came out and did its thing with storage, Oracle with databases, et cetera, IBM and services. And now we've seen that industry recoless, reconsolidate. And you really have five or six major companies that are controlling the chess board. I've called it an oligopoly many times. IBM is one of those companies, but essentially it's IBM, HP, Oracle. I guess I would put SAP and EMC in there, but certainly Microsoft and Cisco and Intel. And those guys control the chess board. So John, what I'm saying is to your point about big data, it's the next inflection point. These companies, you can use their cash reserves. I mean, IBM's got $12 billion of cash on the balance sheet. Cisco's got cash, Intel, Microsoft, they can use their balance sheets to acquire where they have holes in the portfolio. And so unlike the PC era where companies like DG and Wang got totally head faked and got blown away, these existing oligopoly whales, these behemoths, are I think much, much smarter and have many more resources, not the least of which is its large customer base to respond to these industry trends. And it's almost like John when you have two arm wrestlers, and they're of equal strength. And one can't beat the other, but they stay in the middle. And I think that's what you have. You have a balance of power in the industry. On the one hand, I think that's very good for customers. On the other hand, sometimes it's bad for innovation, but that's why we have such a vibrant startup community, of course, in Silicon Valley. Well also, the M&A market is hot too. I'm on news hitting today that the deals confirm that salesforce.com is buying buddy media for $689 million in cash and stock. And what's interesting is that that's a great example of salesforce.com retooling to get a position in the growing, changing dynamics around social CRM, social everything, right? So obviously they're retooling. Salesforce is really not in a position yet to deliver the kind of scale that IBM does, for example, but they're changing. And I think that is an indication that the complete reconfiguration of the architecture of infrastructure, which powers the application market, is all centered around data. And this changes everything. Privacy, compliance, solutions, mobility at the edge. Advertising. Advertising. Talking about buddy media, who is buddy media? Buddy media is a startup that grew around social infrastructure. They started a little bit before the social media trend, so they kind of backed into providing fan page support, YouTube fan page support, but really smaller in comparison from a functionality standpoint than a company that we've been following on SiliconANGLE called This Moment. As you know, when we see a company we like, we like to ride that horse like Millennial Media. So This Moment is super hot, right? Thismoment.com is probably the best social infrastructure company. It's called ThisMoment.com. And what This Moment does is they power social infrastructure for the largest brands. Hunger Games and films, like Hunger Games, they made a huge success, but it's not about a marketing gimmick. They are actually powering with complex technology and solutions to actually provide infrastructure so that marketing people can run targeted ad campaigns using social channels through a diverse set of content types. So the old days of advertising were changing where you had a copy strategy and you had a campaign, you might have had a few versions of that campaign for the different demographics and psychographics, but now with the web, the way it is, you can target people down to the thousands of different campaigns going simultaneously. That's really hard to execute on. And then having the analytics behind it, that's what ThisMoment does. So Buddy Media selling is really a good call for them. I think it's a great move. So I think that they were going to lose share to ThisMoment. So congratulations to Buddy Media for selling. Great exit for the founders. I really like that company, like what they've done. So it's great stuff for them. But again, ThisMoment is a startup. They just got another round of funding. So that's going to be another company that we're going to watch. Skyrockets are the top of the charts. Millennial Media is another hot company in that space. I mean, a little different. Yeah, well, Millennial, we follow when they were startup, now they're public company. They're the number one independent ad firm for mobile and ranked two globally behind Google. And so, you know, they're powering the largest mobile campaigns, install apps, et cetera, for mobile and great, great successor about the entrepreneurship. But again- These are not household names. They're coming out of nowhere and they're getting, you know, billion dollar valuations. Yeah, I mean, and Facebook obviously now growing up, they're public. But the challenging of the status quo really is about the disruption. To me, IBM is vulnerable in this area. So the news that we're talking about today in context to IBM is interesting because IBM has legacy. I said, I used the word legacy early in the cube this morning. Boy, the IBM executive was like, you can just see like, oh, no, no, we don't use that word. Legacy is a fact. Legacy is legacy. Whether it's kind of viewed as negative to IBM, I think that they don't want that term because it kind of has a negative- Now, why do you say IBM's vulnerable? In what sense? Well, they have incumbent solutions, data warehousing. So the customer base is moving everything over to lower cost, higher performance with open source. So for example, it's although it's not ready for prime time, batch processing going real time with Hadoop challenges the solutions for filing, data warehousing, business intelligence. So you could do the same functionality with a lower cost solution with Hadoop using open source. That's the trend in the open source with Hadoop. So that challenges IBM. So IBM is vulnerable there. So I think if IBM's vulnerable, John, I think the vulnerability is organizational because I think the IBM's combination of cash on the balance sheet and R&D gives it a leg up. I think IBM's biggest challenge is it can't move fast enough. Well, I didn't say IBM's weak. I said IBM's vulnerable like all the incumbents. But here's how I see it. EMC under Pat Gelsinger's leadership is doing a fantastic job in this regard. And I see IBM doing the same thing with their portfolio messages. They are absolutely setting the stake in the ground to their customers that we are doing big data. We are the store for you. We can solve your problems. That's a really new approach and that's the right one because what that's going to do is give the comfort to the customer that, look at no matter what the alternatives are, we can do it for you in a reliable way. Yeah, there might be some projects that are done with open source. It's kind of like non-core activities and still has a chance. It's not going to kill open source. They're not going to kill it. They're going to just establish their leadership by using cross functional tools. And IBM's been very active in open source. Years ago, Steve Mills said, I'm going to invest a billion dollars in open source and of course it was a fight against Microsoft but it's paid off in other ways. At the end of the day, customers have a choice where to buy stuff Dave, right? So like public cloud is a great example. Private cloud, which vendor can serve you best? And that's what customers are looking at is IBM the best vendor for me. And the answer is in most cases, it might be yes. Or are they strategic? Or just like going on the cube. Nobody ever get fired from going on the cube and nobody ever get fired from buying IBM. All right, so we got a wrap. This is SiliconANGLE.TV's theCUBE. We're live from IBM Edge. We're in Orlando. I'm Dave Vellante. I'm here with John Furrier and we'll be right back after this word.


Hi everyone, Joe for jaspyscasewrakes.com coming at you with the brand new 2020-2021 Panini Crown Royale basketball Eight box pick your team number two half the second half of that case We popped open a little bit earlier all card ship a lot of great stuff in here ladies and gentlemen, so let's get to it There's the official list right here Thanks everyone for spending a bit of your Wednesday with us. I appreciate that So think Brian Watford ended up getting the last two teams. Yeah, so he's got double last-bought mojo That's why he has a little star next to his name 60% of the time Last-bought mojo hits a hundred percent of time now remember I marked all of these two Right here. So, you know that these all come from the same case All right, so Jesse figured out. Oh, it's just so just a regular crystal variation. We were wondering What what this was called right here? I guess it's just Just a regular crystal parallel Cracked ice or whatever you want to call it It's they call it crystal in this said my second-year John Morant There's John wall to 99 so use a blank card to slow play the hits a little bit. There's a manual quickly rookie relic Playing some good ball for the Knicks who could be could maybe chop the world in the playoffs Adrian with the New York Knicks and Back here is Tobias Harris 90 out of 99 Jersey and autograph for the Sixers. That's gonna be for Cody This year this the year that six the Sixers do it. Was that even on the checklist though?   All right, and we got Josh Green Dallas that'll be for For who who a Lynn with the Dallas Mavs Then we've got Matt Bonner 62 out of 99 night to the round table Jersey and autograph for the Spurs Patrick with the Spurs Yes, it was the kaboom was Luca Donchick popped out of the first half of the case There's LeBron and there's Wendell Carter, Jr. To 99 Adrian with my Lakers LeBron gonna miss another couple games with that ankle So bothering him and the Wendell Carter, Jr. Will go to Jason and the Bulls We've got snow globe that looks kind of cool Steph Curry to 75 That's for Yuji and the Warriors The relic is Devin Vassel for San Antonio Pat and the auto is 8 out of 49 old David Thompson Featuring one of my favorite logos in sports the old ABA Denver Nuggets I think maxi the minor or something like that. It's pretty awesome. See where that shirt every once in a while Who is that another kaboom card? Yes, and a redemption. Wow. All right, so there's Cole Anthony read to 49 For the magic that's going to be for Ryan Redman with the red parallel slide that right up there And the kaboom card is Donovan Mitchell Cody and the jazz Nice now they say that oh by the way the Nuggets Jeremy 33 gets the David Thompson die-cut autograph They say that's ultra rare Maybe it's only a couple a case. Maybe the rookies are even more rare rookie kabooms There's CJ LB airs the throne relic for Matthew and the trailblazers and the redemption is gonna be Is gonna be silhouettes prime Nikola Vucevic Which must still be Must still be Orlando magic edition, right? Yeah silhouettes card 16 Orlando magic and that'll be for Ryan Redman with Orlando. All right next box And remember pick your team three will be from a fresh case You'll see how many kabooms we can find in there. There's the deep Bay to 99 rookie royalty die-cut and To 25 we got Aaron Naismith for the Celtics Chris parent. All right, and we've got Nikola Yolkic That coat of arms relic looks pretty cool. I'd like to see like a one-of-one. What does that look like? Denver That's gonna be Jeremy 33 That's really cool. All right, and the on a graph is Xavier Tillman Rookie Otto to 99 for Adrian and the Memphis Grizzlies Sorry You gotta buy him in the whole case buy him in first half second half avoid the heartache I always shake that one of these days something is gonna fall out Nexra pack or something like that All right, there's Carmelo and There's rookie royalty RJ Hampton 49 for the Nuggets here. We've got Julius Irving Hall of Fame class of 1993 The goat boss man says His goat. Yeah, he's pretty good Pretty pretty good Cody with the Philadelphia 76ers and the autograph is Tyrell Terry 11 out of 75 rookie die-cut Otto for Huilin and The Mavs. All right second to last box. Let's see what we got. We've got to 25 rookie royalty precious to Chua For the heat serenity The heat out of 49 Nikola Yolkic Red parallel for Jeremy 33 in Denver There's Jay Sean Tate in a Kongu I think I grabbed all of them. There we go. Demontus a bonus precious to Chua and Your relic an autograph is gonna be the relic first is Hachimura nights of the round table Die-cut and Jersey for Brian in the Wizards and the autograph is gonna be obi top and nice 63 out of 75 die-cut autograph Rookie die-cut Otto for New York Adrian with the Knicks Nice Mix playing some good basketball I'll be topping a few breaks out in the playoffs. I mean some playing. Okay, breaks out in the playoffs All those New York fans will be all over that. All right Steph Curry We got Luca Donjich in 99 test of time is that parallel James Weissman for Eugene and the Warriors and the test of time Luca Donjich 82 out of 99. That's kind of a cool Cool little look here Ten and two are they all are these always ten and two? So your hands on a steering wheel All right, the relic is LeBron James nice coat of arms relic For Adrian and the Lakers that ankle that's got to heal up Otherwise Lakers are never a tough time in the playoffs All right, and the last one is for the Timberwolves That's Jaden and McDaniels 19 out of 75 Rookie Otto for Matthew Shearer and the Minnesota Timberwolves and there you have it ladies and gentlemen Nice quick fun a little break from jaspercasewrakes.com. We've got more in the store So check it out. I'm Joe and I'll break more hoops with you next time. Bye. Bye