Good morning everyone. I'm excited and honored to be speaking here at Rubyhack as you might be able to tell I'm losing my voice but I'm going to try to make it all the way through so please bear with me. So today I'll be discussing Ruby web application security focusing on defense and depth security controls that make it more difficult for attackers to exploit vulnerabilities and to limit the damage of vulnerabilities that are successfully exploited. My name is Jeremy Evans and I maintain numerous Ruby libraries, the most popular of which is SQL, the database toolkit for Ruby. I also maintain a web toolkit named Rota and an authentication framework named Rota that builds on top of SQL and Rota. I work for the government department in Sacramento and one of my responsibilities is operating as the department's information security officer. So I'm responsible for all of the information security in the department including the security of our web applications which I'll use SQL, Rota and Rota. Now Ruby web application security is a fairly wide subject area and you want to prevent cross site scripting usually by escaping outputs in templates. You want to prevent cross site request forgery usually by using form specific or session specific tokens. You want to set an appropriate content security policy header for detailed control over where the browser can load content from and you also want to prevent SQL injection either by escaping input or by using prepared statements and bound variables and all of those are important but that's not what the focus of this presentation is. So this presentation focuses on defense in depth approaches for web application security and what does a defense in depth approach mean? Well it means instead of just focusing on prevention you also focus on hardening, mitigation and containment. So no matter how hard you try to prevent vulnerabilities you should assume that your application will still be vulnerable somewhere. Even if you use secure coding practices in your application development you are all relying on libraries and those libraries may also contain vulnerabilities. From a security perspective it makes sense to assume that attackers will attempt to exploit those vulnerabilities. So you need to have a strategy in place that makes general classes of vulnerabilities more difficult to exploit and that limits the damage of vulnerabilities that are successfully exploited. Now some people talk about information security as though it were binary and that you're either secure or you're insecure. I think it's better to think of information security similar to physical security. So consider the safe long used to secure physical valuables. So safe manufacturers don't claim that their safes are secure and their competitors' safes are insecure. Instead safes have a rating system. So a safe with a TL15 rating can withstand 15 minutes of attack by a qualified safecracker with good tools on a single wall of the safe. And a safe with a TRTL 36 rating can withstand a 30 minutes of attack by a qualified safecracker with highly sophisticated tools as well as torches simultaneously on all six walls of the safe. So the basic idea with the security provided by the safe is that you assume the safe will be cracked given enough time. So companies that sell safes will tell you that when you buy a safe you are buying time. So alongside the installation of the safe is installation of monitoring equipment so that attempts to crack the safe will alert the authorities with the expectation that the safe crackers will not have adequate time to crack the safe and get away before the authorities arrive. So applying this idea to information security you should assume that vulnerabilities in your application will be exploited given enough time unless you intervene. So you want to make it sufficiently difficult to exploit these vulnerabilities and have sufficient monitoring tools in place to inform you of exploit attempts such that after receiving notification of a possible exploit attempt you can try to figure out and fix the underlying vulnerability before the vulnerability is successfully exploited. And if that's not possible you will at least want to limit the possible damage of successfully exploited vulnerabilities. Note that increasing exploit difficulty and limiting exploit damage adds significant operational constraints. This presentation is not a secure programming to-do list. It will assess some security controls as well as the costs and benefits of each of the security controls. Whether the benefits of the security control exceed the costs is highly dependent on the application, the data being stored and how important security actually is relative to performance, maintainability and flexibility. So the first security control I'm going to discuss is using separate database users. So in most Ruby applications the entire application is served by a single database user usually the owner of the database which has full access to read and modify any part of the database. And with this approach an SQL injection vulnerability in any part of the application can result in all data in the database being at risk. So assume you have an admin application that issues by employees and a separate application that is publicly accessible. There's often a very large difference in terms of the database access needed by the public application and the database access needed by the admin application. So in cases like that using a separate database user for the public application can greatly reduce your exposure. So if an attacker can exploit an SQL injection and the public application they can only get access to the data that is explicitly granted to the public application database user. If you're using a microservice approach with a shared database, having each microservice use a separate database user can also significantly increase security. So if there's an SQL injection in any microservice it only grants access to the data that is needed by that microservice as opposed to all data in the database. Now if you're developing a majestic monolith it's a bit more complex to use separate database users but it's still possible. So the easiest way to implement separate database users in a monolith is to use a database library that supports sharding. So sharding is often used to connect to databases on different hosts but it works just as well to connect to the same database using different user credentials. So SQL has had support for sharding for many years and makes it easy to use a separate database user for all queries in a given block of code. And this allows you to get most of the database security benefits that you get with using separate database users while still retaining the simplicity of developing a monolith. Now ActiveRecord doesn't support sharding by default but there are various extensions that you can use to add sharding support. And last month at RailsConf they announced that ActiveRecord 6 will support multiple databases but I'm not sure if sharding is on their agenda. So one way to benefit from using multiple database users without having to manage separate connections per user is to use security definer database functions. So by default when you execute a database function it is configured so the function runs using the access permissions of the user who executes the function. And this is similar to the normal operating system model where if I run a program it runs using my access permissions. So UNIX offers the ability to create a program that runs using the access permissions of the user who owns the program instead of the user who runs the program. And these programs are called setUID programs. So the ping program is usually a setUID program. If I execute ping as a normal user ping runs as root at least it can open the raw socket that it needs to send packets. So security definer database functions are the database equivalent of setUID programs and that when a user executes the database function the function runs using the access permissions of the user who defined the function instead of the user who is executing the function. So this is useful if you want to give specific database users a specific type of access to a given table without giving them full access to the table. So in the RODOT authentication framework the recommended configuration is to use two separate database users. The database user that the application runs as does not have access to read the password hash table. Instead the other database user owns the password hash table and creates a security definer database function that can be used to check password hashes. So if there is an SQL injection vulnerability the attacker cannot export the password hashes to perform an offline attack. They would be limited to using the database function to check password hashes which is going to be multiple orders of magnitude slower. So now I have discussed the benefits of using multiple database users. Let's talk about the costs. So the first issue is that database migrations become more complex. So instead of just worrying about what tables or columns you want to add to the database you need to consider what access each of the tables and columns is needed for each of the database users you have and any of the applications and that requires significant upfront analysis and complex applications can be quite difficult. To make sure your application runs correctly when using multiple database users you need to make sure that your tests correctly use the appropriate database user when running. That's not usually difficult but it becomes problematic when the database user does not have the appropriate access to set up the initial database states for each of the tests. So one possible approach to this is setting up the initial state as one database user and then running the tests as a different database user and that's the easiest approach to implement but it does not allow for transactional testing since the two database users cannot see the uncommitted changes made by the other user. So I prefer to use transactional testing so I came up with a different approach which initially felt like app but it does work pretty well in practice. So you create a security definer database function in your only your test database and that allows other database users to run SQL code as the database owner. So when performing a database setup for the tests or the database user does not have the appropriate access you call this database function with a string of SQL code and the function has the appropriate access and the changes are visible to the current transaction so transactional testing still works. So as long as you never call it database function in your application and you only call it in your tests you get the performance and simplicity benefits of transactional testing and you get the reliability benefits of using the same database rights as production. So the next database or text defense in-depth security control I want to discuss is dropping privileges which is often referred to as priv drop. So the way most Ruby applications are deployed a regular operating system account runs the Ruby web server and this account must have at least read access to all parts of the application in order to load it. An alternative approach starts the processes route so after loading the application before accepting connections the application process switches from route to an operating system account with reduced privileges and as the application has already been loaded it no longer needs access to the files that are necessary to load the application and you can actually make such files unreadable to the user account that the application runs as. So many Ruby applications read template files like ERB and Hamel on demand but outside of the templates most of the application code is loaded at startup and does not need to be accessed after the application has been loaded. So I'm assuming attacker has exploited a vulnerability in your application that allows them to read arbitrary files on the file system and display the output. They can use that vulnerability to read all of your applications code looking for potentially worse vulnerabilities such as SQL injection or remote code execution. So removing the ability to read the application's files can increase the time required to find additional vulnerabilities. Now choosing to start the application as route and then drop privileges has a security trade-off. It makes you more secure when the application is running but it makes you less secure when the application is loading. So if developer accidentally commits code that would fail for a regular user but would succeed for the super user that code now succeeds. Now consider this command and assume that the temp dear environment variable is not defined. As a regular user this fails and does no damage. As the super user you now get a chance to test your backups. So using privdrop requires a high level of trust in the application developers and all code that your application loads during startup such as all gems in use. And while you generally have to trust all the gems you're using anyways in a privdrop scenario the penalty for a mistake can be much worse. So in terms of support in Ruby web servers both the unicorn and passenger support privdrop but it's not currently supported by Puma. Now privdrop by itself does not improve security greatly but if you're starting your process as route you have an additional security option available to you called chroot. So chroot allows you to change the root directory of the process and it's something only the super user can run. So if you're going to use chroot you should definitely privdrop after doing the chroot because you don't want your application running as root and additionally there are ways to escape the chroot if the privileges are not dropped. So when you run chroot you pass it a directory that is under the current root directory and that directory now becomes the root directory from the perspective of the process. So before chrooting listing entries in the root directory shows the real root directory and after chrooting to the application directory listing entries in the root directory shows the contents of the application directory. So after you chroot you can no longer access any files that are outside of the chroot. So again an assuming attacker has found a vulnerability that allows them to read arbitrary files. Without a chroot an attacker can read any file on the entire file system as long as the user's access permissions allow it. Within a chroot the attacker is limited and can only read files if they're under the application's directory and that significantly limits the severity of the vulnerability. Now assume an attacker finds a vulnerability that allows them to execute an arbitrary program on the server. So without a chroot this could potentially execute any program at all on the server such as a shell which would make it easy for them to attempt to compromise the system further. So within a chroot they would generally not be able to execute any programs at all because you usually do not have any executable programs under the application's directory. So chroot can prevent the exploitation of some vulnerabilities such as arbitrary file execution and it significantly limits the effect of exploiting some other vulnerabilities such as arbitrary file reading and file writing. chroot makes the exploitation of most other vulnerabilities more difficult. So after locating a vulnerability one of the first things the attacker is going to want to achieve is a remote shell which lets them easily execute arbitrary commands on the server. So within a chroot a chaining remote shell becomes much more difficult even if it does not eliminate the attacker's access completely it will slow down the exploitation of the vulnerability which gives you more time to fix problem. While chroot offers significant security benefits the restrictions it imposes make it challenging to implement. So most Ruby applications were not designed to be run when chrooted and many Ruby applications will run programs that are outside of the application's directory and the only way for that to work after chrooting is to move the files into the chroot and if the file or the program is dynamically linked instead of statically linked you also need to move all shared libraries into the chroot. Now anytime you are moving programs into the chroot you are potentially reducing your security because you're offering an attacker additional to attack surface. So you should be very restrictive about any programs you do add to the chroot and try to avoid adding programs if possible. Now if your application references any absolute paths at one time you should probably change those to relative paths and this is because the absolute path when not chrooted such as when loading the application will not work after the application has been chrooted. Now one way to work around that is to create a directory tree that is under the application directory but contains a sim link back to the root directory and that allows the same absolute path to work in both regular and chrooted modes. Now the biggest issue with using chroot is that any code that requires files at one time it will only work if the required files have already been loaded or the required files are under the applications directory. Now there are quite a few gems that will require files at one time usually because the required file is only needed in certain methods so instead of always loading file you only the methods that use it will require it. So runtime requires can be worked around by just requiring the file before chrooting and since the file is already required future attempts to require it will do nothing. Unfortunately there is an even more insidious problem that affects chroot and that is the use of autoload. So autoload is basically a hidden runtime require but instead of calling a method to require a file you just need to reference a constant. So outside of a chroot autoload can appear to be a nice to have. The constant is never referenced the related file is never loaded and that can save memory. Inside of chroot autoload is a time bomb. So if you require a file or require a library that uses autoload for any of its constants it can appear to work fine even when you are chrooted. However when a code path is taken at runtime that references the constant Ruby tries to require the related file and since the file does not exist inside the chroot it blows up. So the most prominent gem that uses autoload is rack itself. Rack uses autoload for all of its internal classes and modules. In many cases these classes and modules will be loaded at application startup which would be before chroot. However there are a lot of constants that are only referenced at runtime when handling requests. So if you chroot and do not reference the appropriate constants before chrooting most requests will work fine. Then some user tries to upload a file and that references rack multipart which causes Ruby to require the related file which blows up because the related file is not under the chroot. So another common gem that uses autoload is the mail gem and while it does not use autoload for all of its internal classes and modules it does use autoload quite a bit. Now in the mail gem's defense they do offer an eager autoload method that will require all autoloaded paths so that referencing the constants at runtime will not break things. So I mentioned that runtime requires become problematic when using chroot and that makes development environments that reload code a bit of a challenge to implement. So if you want to chroot in production you're going to want to chroot in development to make it easier to find possible issues that are caused by chrooting. So development mode code reloading usually works by looking for modifications in certain files that have already been required. So if they detect a change in the required file they remove the related entry from the loaded features away and then they remove the related constants from whatever classes or modules they were defined in and then they require the file again. So I mentioned earlier that absolute problems and entries and loaded features are stored as absolute paths. So when chrooting all existing entries in loaded features that are inside the application's directory need to be modified to strip the application directory from the start of the path and that's because after chrooting the absolute path to the file in the application directory no longer has the application directory at the start of the path because the application directory is now the root directory. So for entries and loaded features that are outside of the application's directory you would not be able to reload those even if they change so there's not much you can do. Now most reloaders will only reload application code they don't look for changes in all required files so you usually don't care about reloading files that are outside of the chroot. So unless the development reloader has specifically been designed to support chroot it will probably not work correctly when chrooted and the only reloader I know that supports chrooting is rack un-reloader which is a gem I maintain and added chroot support to. So in addition to running your development environment chrooted in order to make sure things run correctly when chrooted in production your automated test suite should also be able to run while chrooted. So in the test environment you want to chroot after loading all the entire application but before running any specs. Now with our spec I think you can probably chroot in the before suite hook but I don't really have personal experience doing that. With minitest you would chroot directly before calling minitest.run and if you're using minitest auto run you would generally chroot in an exit block. So in some cases it can be helpful to run the tests without using chroot and still catch runtime require issues that would be caught when chrooting and this is useful if you want to have the ability to run tests without being root. So in terms of catching runtime requires a good way to do that is to freeze loaded features and then any attempt to require a file at runtime either via the require method or via an auto loaded constant will raise an exception because it would not be able to modify loaded features. Now the only Ruby Webster where that currently supports chroot is Unicorn. So the next security control I'd like to discuss is the use of a firewall. So a firewall is a network device that filters traffic or restricts traffic based on a policy. So firewall policies should generally use a whitelist approach where all traffic is denied by default and only traffic explicitly allowed is allowed to pass through the firewall. Now most operating systems have a firewall that is built in these days and in some cases those firewalls aren't able to by default. Now there are a couple of types of filtering you can do in a firewall. The first type is called ingress filtering which filters traffic coming into the server and the second type is called egress filtering which filters traffic leaving the server. So for a web application server you want the firewall to do ingress filtering usually allowing only HTTP and HTTPS traffic and from all IP addresses if the application is publicly accessible. It's best to only allow SSH traffic from specific IP address ranges and you don't want to allow other ports if you specifically wanted them to be accessible. So by doing ingress filtering and restricting traffic to only specifically allowed ports you protect yourself against accidentally making other services available that may be running on the same server and this is especially important if you're running any services on the same server that do not use authentication by default such as Redis or MongoDB. It's also a good idea to use egress filtering on the firewall so that only specific traffic is allowed outbound. So we'd probably want to allow access from the web server to the database server and if your application uses any third-party APIs you probably want to allow access to those through the egress filter. Now ideally you would set the egress filter to only allow those connections to specific IP address ranges but in some cases that's not possible. So by having an egress filter you limit the ability for your server to be you to be compromised and use it to attack other servers and you also make it more difficult to exfiltrate information out of your server. Now most server level firewalls will support egress and ingress filtering on a per user basis so if you are using privdrop you can combine that with user specific firewall rules. This can make it possible to allow root to make new connections to the database but not allow the application user that ability. So with that approach even if the application gets compromised it cannot create new database connections it can only use the existing database connections and if you're using separate database users this makes sure that a compromised application cannot make a new connection to the database using different credentials that are used at application startup. Know that this approach requires you to preallocate all your connections at startup and if the database connection drops for any reason you need to kill the application worker process so that a new worker process can be created which will generate a new database connection at startup. So next to the security control I'd like to discuss is referred to in the open bsd community as fork plus exec and it's a way to offer protection against address space discovery attacks. So when using fork the child process inherits the memory layout of the parent process so if you're using a forking ruby web server such as unicorn or puma in cluster mode the web server uses fork to create the worker processes which will all start with the same memory layout as the parent process. Additionally most users enable the feature to preload the application before forking and this speeds up the creation of the worker processes since they don't have to load the application again. Preloading can also reduce memory usage significantly since the memory pages of the worker process and the parent process can be shared until one of the processes writes to the memory page after forking. Unfortunately because the worker process as all of them and the parent process share the same memory layout the application becomes more vulnerable and this is due to the fact that in many cases to actually exploit a vulnerability in the application requires knowledge of the applications and memory layout. So an attacker can attempt to determine the memory layout by submitting requests and if they guess the memory layout correctly their exploit succeeds and if they guess the memory layout incorrectly the application work process will usually crash. So unfortunately with a pure forking web server after the worker process crashes the parent process will generate a new worker process with a very similar memory layout and in that case the attacker just needs to keep trying their exploit by submitting slightly different requests each time because all the worker processes have roughly the same memory layout every time they attempt to exploit the vulnerability and they fail they get more information about the possible memory layout of the process. Eventually they can determine enough of the memory layout to get a successful exploit to work and this is commonly needed in order to mount AEO it's called a blind return oriented programming attack. So with a fork plus exec approach the parent process does not preload the application before forking after the parent process forks a worker process the worker process calls exec using the same program. So if the parent process is unicorn after forking the worker process also execs unicorn but within an environment variable set to tell unicorn that it is operating as a worker process. So when you use exec an entirely new memory layout is generated for the program but the process still inherits the file descriptors of the parent process including the web servers listening socket. So after the worker process calls exec it then loads the application and after that it is ready to start handling requests using the listening socket it inherits from the parent program. So since the worker process calls exec it has an entirely different memory layout than the parent process and all the other worker processes. So if the worker process crashes and the parent process spawns a new worker process to replace that worker process will also have a completely different memory layout making addressed space discovery attacks in practical. Currently fork plus exec is only supported on unicorn using the worker exec configuration option. Now if you're not currently preloading your application there is a slight memory cost to enabling fork plus exec probably about 10 megabytes for worker process but beyond that there's no major issues. If you are currently preloading your application you would need to stop doing that to use fork plus exec and that can significantly increase the memory usage of your application since the worker processes cannot share any memory with the parent process. So the decision to enable fork plus exec is really a trade-off between performance and security so enabling fork plus exec can improve security but it will definitely use more memory and memory is the limiting factor in some execution environments. So the next defense in depth security control I'd like to discuss is the use of system call filtering. So by default on most operating systems any process can issue any system call and the kernel will handle access control for the system call based on the user who issued the system call and that's nice and convenient especially if you are an attacker. So once an attacker finds a vulnerability in a program and is able to successfully exploit it in many cases they will try to increase their access privileges from the user running the process to root and this is referred to as privilege escalation. So the typical way that privilege escalation is attempted is to find what is called a local root vulnerability. So a local root vulnerability assumes the attacker already has the ability to execute arbitrary code on the system as a regular user and if the vulnerability is exploited it allows running arbitrary code as root. So the two most common ways to get local root are to either find a vulnerability in a set UID root program and exploit that or by exploiting a vulnerability in one of the kernel's system calls. So if you're using a ch root to limit file system access in general there should be no set UID root programs that are accessible to the process which leaves the system call approach as the only way for the process for the attacker to escalate their privileges. So most common operating systems support over 200 system calls and each one of these system calls could potentially have a vulnerability that could be used to escalate privileges. So by restricting the system calls available to the process and restricting the arguments to those system calls you can eliminate potential vulnerabilities the attacker could exploit and this is referred to as reducing the attack surface. So in addition to reducing the attack surface one other advantage of system call filtering is that few attackers expect it. So many attackers will use system calls that would work if the system calls were not filtered and if the process crashes as soon as one of those system calls is used that can provide an early warning that an attacker has found a vulnerability in your application and that gives you more time to fix the vulnerability. System call filtering in general also makes it more difficult to exploit many different types of vulnerabilities. Now one example of system call filtering is filtering the open system call which is used for opening files. So if your application only needs to open files for reading at runtime and should not be opening files for writing at runtime you can filter arguments to the open system call such that attempts to open the files for reading will succeed but attempts to open files for writing will fail. Ideally you would limit the system calls and the arguments allowed for the application to the minimum that the application needs to function that can be quite difficult in practice unless you have a good idea of every system call that your application is expected to use. Even simple approaches not like not allowing the opening of files for writing can be problematic at multiple levels of the stack. So by default Unicorn will open new files for writing for all large requests. You can work around this by using the client body buffer size configuration option and setting it a value higher than the client body size limit of the reverse proxy and this makes Unicorn buffer all uploaded files in memory instead of creating temporary files. By default Unicorn will open new files for writing for each file uploaded even if the files are very small. Now you can set the rack multipart tempfile factory setting to a custom proc to try to work around this but most application code expects that the object returned by the factory have a path that is visible on the operating system. Now system call filtering can also cause issues when testing since some testing libraries you should use additional system calls that are not used by the application itself. For example if you don't expect your application to execute other programs you can filter the exec VE system call and if your application does not execute programs and none of the libraries that the application uses execute programs you may be okay but maybe you use mini test to test this application and if your tests run fine you have no issues. However if one of the tests fails because a string value does not match the expected string value mini test will try to execute a diff program in order to get a more informative test results displayed and this fails if the exec VE system call is filtered. So you can actually set mini test assertions diff equals false so that mini test still works when you're filtering the exec VE system call. Now system call filtering is operating system specific so you have to read your operating system's documentation for how to enable it. Most of my experience comes from using OpenBSD which has a system call filtering implementation called Pledge that's very easy to use but the system filtering call filtering is a little bit coarse. I wrote an easy to use Ruby wrapper for Pledge. Most people are probably running their applications on Linux which offers system call filtering using Secacomp. Now Secacomp is very flexible since you can decide the behavior for every system call and arguments to the system calls. Secacomp is also a lot more complex. It may require detailed knowledge of the Linux kernel, glibc and all the system calls that your application uses. I know that the system calls the application uses can depend on kernel or glibc upgrades. They can change during the upgrade process which can cause additional maintenance issues. So proper system call filtering can significantly reduce the risk of exploitation as well as reduce the risk of privilege escalation after exploitation. Now on OpenBSD using Pledge it's fairly easy to do and I would recommend it for most applications. For other operating systems implementing system call filtering in a manner that the application still works and is maintainable probably has high upfront and ongoing costs. So whether to use it definitely depends on how important security is relative to maintainability. Now I originally planned to discuss memory protections such as detecting stack overflows, heap overflows, use after freeze and double freeze and unfortunately I don't have enough time to discuss all of those memory protections but I do encourage you to look into implementing them if they're not already the default behavior in your operating system. Now in most cases to implement these memory protections you just need to use additional flags when compiling or link against a malloc implementation that is designed for security instead of for performance. So that ends the defense in depth security controls I wanted to discuss. As I mentioned all of these security controls have trade-offs and the decision whether to implement them will depend highly on the application and your organization's tolerance for risk. However I think I'd be remiss if I didn't at least offer some basic guidance. First consider what the data you have is really worth protecting. How sensitive or confidential is the information that you deal with if you're dealing with anonymized data or the manipulation of public data sets. Maybe the data does not warrant the use of these security controls. Consider who can access your application if you're designing an application for internal employees that will not be accessible from the internet and the risk of attack is lower and maybe in that case your effort is better spent on improving the user experience. Consider how much control you have over your application's environment. If you are running on your own hardware or virtual machines you may be able to use all the security controls I've discussed. If you're using a platform as a service provider you're going to be limited to what the provider supports. Now if your application is accessible from the internet and contains sensitive or confidential data my recommendation would be to first look at using multiple database users and reduce the database permissions in order to limit the possible risk of exploited SQL injection vulnerabilities. If you have the ability to configure firewall rules I would recommend doing so. The initial implementation is fairly easy and the ongoing maintenance costs are pretty low. If you have memory despair and the increased memory usage is not a problem then you can consider implementing 4++ exec. Now if your application or the server it is running on has any special access to any other servers or applications that are not accessible from the internet or security is a high priority compared to the ease of maintenance and you have your own hardware or you're running on your own virtual machines then you can consider using privedrop chroot and or system call filtering. Now it is possible to use all of these security controls at the same time. So for the last year all the web applications that I maintain at work have used firewalls 4++ exec privedrop chroot and system call filtering and all applications that are accessible from the internet also use separate database users. So it took significant work to set this up especially since I had to add support for 4++ exec and chroot to unicorn and add support for chroot to rack unloader. Now thankfully I can say that the ongoing maintenance costs have been pretty low. In the first four months after implementing these security controls we had three minor production issues that were caused by one of those security controls and in all three cases we found that the issues were caused because the production environment did not completely match the test and development environments. Now thankfully in the last eight months we haven't had any production issues related to those security controls. So my hope for this presentation is that it encourages you to try implementing some of these security controls and I also hope that if you choose to implement these security controls some of the techniques I've described here will help you avoid the production issues that we experienced and that concludes my presentation. I want to thank all of you for listening to me. If you have any questions I'll try to answer them now. Any early warnings on the system call filtering? Oh early warnings. Yeah probably not. Most of the times that we do run into things failing it's usually because we didn't account for something that should be allowed not for something actually attacking us but every time we do get a crash so what we do is if anything violates the system call filtering for example and the process crashes we get notified about it and then we look at it and we can see okay this is looking at vulnerability or something that should be allowed and so far everything is something we should be allowing so we haven't actually caught anything yet but we don't actually get that much traffic in our publicly facing applications so it hasn't been a big issue for us. Will these slides be available at the conference? Yes yes I'll try to put them up probably you know whenever I get back to my desk. Sorry I very much apologize but my voice has been getting worse every day and I've been like fearing it so thankfully I'm representing today because tomorrow I might not be able to speak at all. Any other questions? Are there any special considerations that you can think of for running an environment like AWS where you also have security groups and ATCs? Yeah so the thing about using like Amazon Virtual Private Cloud like normal things you can do I think egress filtering is not allowed in general on Amazon but if you're using virtual private cloud I believe you have the ability to use both ingress and egress firewalling rules.  All right thank you thank you very much


The use of fossil fuels is releasing greenhouse gases into the atmosphere, raising their concentrations, in particular carbon dioxide. Now that carbon dioxide in turn can dissolve in the oceans, making them more acidic. That's a process called ocean acidification. Sea life, anything from plankton to mollus, indeed the whole food chain can be affected by ocean acidification. In this lesson we're going to explore how carbon dioxide increases acidity, and how that increase in acidity can affect marine life, in particular living things with calcium carbonate exoskeletons or shells. How are we going to demonstrate the concept of ocean acidification? OK, so we're going to do it through three experiments. All the experiments are linked. So we first find out what carbon dioxide does to the water. We then look at what a seashell in that type of environment is going to produce, the carbon dioxide bubbling. And then if they're exposed for any length of time to it, how that is going to affect those organisms. For the first experiment, you need salt water. Each group needs two beakers or cups, one lid, two straws, a pH meter or universal indicator, and a stopwatch. For the second part, we need salt water plus household vinegar. Two cups or beakers, one shell that has been soaked in vinegar for two days and three shells that haven't been soaked. Each group will need a stopwatch and some one kilogram masses. The first experiment we're going to be looking at the effects of carbon dioxide in sea water. The first thing they'll be doing is putting their straw into the sea water through the lid, and they're blowing continuously. After 30 seconds, they take the actual pH of the solution. So they're investigating it with a lid or without a lid. So we're looking for a change of pH from slightly alkaline to slightly acidic. As more carbon dioxide is produced, more carbon dioxide is dissolved into the ocean and therefore it tends to move more towards the acidic range on the pH scale. If you've got pH meters, by all means try them, maybe do a comparison between those and the universal indicator, or just do the universal indicator. How does the lesson then progress? Now what we need to do is we need to get a couple of beakers again. Same size beaker, small preferably. We're going to make a couple of solutions up. One which is about 30 centimetres cubed of sea water and then 30 centimetres cubed vinegar. It doesn't have to be that quantity, so long as it's a half and half mix. And then in the other beaker, we have the same volume but just vinegar. What this is to do is this is to see what the effect of an acidic environment would have on a sea shell. When we place the shells in them, we would see a difference in the number of bubbles produced in the full acid compared to the half and half solution. The students will write down their observations of what they see. And then can you substitute anything for shells? Yeah, you can. You don't have to use shells from the beach and when we're lucky we live by the seaside but you can use eggshells as well or anything with some form of calcium carbonate in it. We can now look at the effect of acidification on the strength of shells. We then take a shell that has already been exposed to an acidic environment. What we do with these shells is we soak them in vinegar for about 48 hours. Then we move on and we take a cardboard guide tube, we place that in the centre of that and then it's a case of every 15 seconds or so. You could do it less than that or more than that if you wish. You place a weight, a mass on top of the shell and just make sure that that is in that guide tube. And then you wait a certain amount of time just in case you hear any crack in or any split on it. Any health and safety configuration. There's plenty of health and safety considerations. Not only are we worried about the masses falling off the table but we're also worried about trap fingers underneath them as well. And it's important that students don't drop them onto the shell. They place them gently and as I say if you have it facing inwards on the table like you have then we've got less chance of them falling off. So today we're going to be doing an experiment to, we're going to take salt water, so sea water and we're going to add carbon dioxide to it and you're going to do that by breathing into it and we're going to see how that changes the acidity of the sea water and then afterwards we're going to see how that change in acidity affects marine life. Now all the stuff we're using today has some form of irritation in it and we don't want it on our bodies or in our eyes so we will all be wearing goggles. Okay so we've got two beakers with 60 centimetres cubed in of sea water. You're then going to place a lid on one of them which is a tin foil.  Okay so I take a deep breath, I hold it for a few seconds and then I start blowing.  You then do the same thing again for another 30 seconds. You continue this for two minutes. After two minutes you stop. You need to be very careful when you are blowing through this straw because it will bubble and come up over the side okay. Do we have to measure zero seconds before we start? Absolutely yes, we do measure at zero because we need a base point for what our solution is at in terms of pH.  You will not want to get this water in your mouth okay. So just be aware of that okay and don't blow too hard. One, stop. How long is that? What does it say? 6.57. What did we see with no lid and then with lid? No lid started quite high and then it made its way down but then it went back up again and with a lid it started high and then made its way down. What do we think the lid has done then? It might have trapped some of the gas. It has trapped some of the gas in there hasn't it? Okay so what we are looking at now is the effect of that slightly more acidic seawater on living things like seashells which have calcium carbonate in their exoskeleton. On your desk you should have two beakers. You are going to take seawater and in the first beaker you are going to put that up to 30 and then you are going to add 30 vinegar. Okay it is white vinegar. And in the second beaker you are going to do 60 vinegar. It is a very easy experiment in this one.  We are now going to take the two of the three shells. What you are going to do is you are going to place them both at the same time in the beaker and you are going to write down some observations. So does anybody have any predictions what is going to happen? So one shell is in the full vinegar and the other shell is in the half seawater, half vinegar. The shell in the vinegar will dissolve quicker or break down quicker because the vinegar is more acidic. So it is one more obvious than the other one? The full vinegar one is more bubbly compared to the more down one. The water is going more like grain. We are now looking at the long term effect of those same organisms that have been subjected to an acidified ocean. We are going to look at the effect that could have on their shells. So this is kind of a strength test. The way we are going to do that is you have got a shell on its own in your little dish here. It will look really white because these have already been subjected to acid conditions. You are comparing that against the other shell you had left which you will notice the difference in them if you look at it. Observation wise you will notice there is a difference in between them. One of them has still got colours on the outside of it and the other one is like a white kind of chalky effect on there. Now the way we are going to do this is set back on your table because health and safety we need to think about that still. We are going to place our shell within the guide tube and what you are going to do is you are going to be placing the masses on top of it carefully. You are going to wait. Now you can set a timer for this. What we are looking at is any weakness in the structure of those shells caused by an acidified environment. A little bit more worn away. We will see if that changes anything. I think I had a crack there. Yeah, that is cool. Right, take them off. Can you hear anything? Yeah, roofs caved in. Yeah, caved in after about four. OK, next one. I was surprised it would break completely because it felt really weak. Yeah. Thank you. I am just going to hold it because... Hey! It is interesting. We talked about it, didn't we? What effect it will have. Of course it is not going to produce organisms that just shatter. That is not what happens. But it will result, we think, in organisms that are smaller and more brittle. And so it will change the balance of life in the ocean. We have got to remember that we are not saying that the oceans are acidic. They are not acidic. What we are getting is a slight increase in acidity. If we look at it on a pH scale, we still cannot call it an acidic ocean. All we can say is the acidity is increasing slightly. I suppose there are lots of connections between these simple experimental results that you can demonstrate in the classroom and much wider global issues. So most people know about the rising levels of CO2, but they don't necessarily link that into things like coal bleaching and the habitats that that destroys. It is this type of activity is more accessible to the students and by doing a practical it kind of puts an idea into the head of, oh, hang on, this is happening because they are actually hands on and seeing it happen. Reading it in their newspaper or hearing it on the news because they are not physically doing it. They tend to not make those links. I thought this lesson was wonderful. I think the students really enjoyed it because it was very visual. They could see this change in acidity, ocean acidification and with the shells they could see the link between that process and climate change.


Give the people what they want. Give the people what they want. Give the people what they want. Your weekly movement news round up. Hello, it's the 27th of May and you're watching your favorite show. Give the people what they want brought to you by People's Dispatch. That's Zoe and I and Globe Trotter. Vijay is not here today. He's traveling right now after a series of conferences. He sends his good wishes and a lot of ideas as well. But this has been a very interesting week, quite interesting. And every week we come with a lot of interesting stories. Of course, some of them painful, some of them giving a lot of hope as well. This week's stories are incidentally, a lot of them have to do with summits. A lot of them have to do with major political developments that are taking place in countries across the world. So we'll be covering the whole globe as usual. And our first one really is about very interesting and in some ways even scary development that's taking place in East Asia, where President Joe Biden was on a visit not only to South Korea and Japan, but also was part of a series of meetings, including the Quad and to set up the Indo-Pacific economic framework. Now, it's important to look at both these issues separately. Of course, we reconnected with both of them also unique in their own ways, because we talked about this before on numerous episodes, the Quad, a kind of strange alliance comprising India, Australia and India, Australia, Japan and South Korea. And of course, also bringing together a series of forces that don't really, which seem to have only one major intention, which is combating China, because the United States is in one corner of the world. What interest it really has in this region in terms of strategic, in terms of bringing its military, in terms of bringing its power here is a big question that we need to keep asking regularly. But yet another Quad meeting takes place and what we see of course is that there is this whole, say this is an escalation of this whole strategy to contain China and the statements. This happens also at a time when India has been kind of slightly deviating from the PAC so to speak, because its chances on Russia have been different from some of the other allies in the United States. And this Quad meeting was also attempting some ways to sort of reconcile that, to sort of give the indication, to give the commitment to each other maybe, that the Quad would continue as an effective forum. But what was more important here was also Biden's statement made around the same time, that the United States would respond militarily if there was a Chinese operation towards Taiwan and this is a very dangerous kind of a statement because it almost came out of nowhere, it reversed a lot of the policies that the United States had earlier followed as well. And it was definitely in some senses, I think, an incitement. It is a very incitatory statement made at a time when we really do not need a conflict in another part of the world. The Ukraine war has already caused so much damage and it is actually the result, as we've talked about, of decades of policies and especially policies in the West since 2014. So in this context the US president going to East Asia and making these comments is really sort of stirring in troubled waters and if you look for instance at the other arm of what we're talking about, that is the IPEF, it's yet again a very transparent attempt to almost combat China's increasing economic growth, the fact that there is already a deal in the form of RCEP, which involves all the countries in the region. And now the fact is that the United States was part of a similar project, the TPP, it withdrew. And now this is a very transparent attempt to sort of bring together a similar economic alliance, although the fact remains that this partnership itself will take a long time to even be implemented. The potential benefits are not clear for many countries when there will be many benefits at all. So it looks like it's more of rhetoric, it looks like it's more of playing the role of say some kind of a strategic, some kind of a narrative based thing rather than any concrete economic benefits because according to most analysts, I already at least, it's going to be a long time before we even see any of these in action. So what we're seeing right now is basically the U.S. continuing with its other front in East Asia, the strategy of not only encircling China, but I think also sort of trying to disrupt the relations that are already being built, to disrupt the ties that are already being built in the region. Despite the, you know, in this region for if you look for instance, all these countries have say a lot of differences. Let's be very clear about that. It's not that say China and Philippines and Vietnam and Indonesia, all of these countries are all speaking in one voice. They do have a lot of differences. But I think they're also committed to the fact that they are going to, you know, live with these differences, negotiate these differences and still build relationships. And that's a very important thing to note. Whereas the United States intervention in this region seems to consistently point to the idea of actually causing more and more disruption. So slightly quite alarming signs in this region need to really, you know, really focus on these. And so, you know, we need to see what's going to happen with the quality of the coming months and years as well. So that's the quality that's happening in one corner of the world. In another corner of the world, we have the Summit of Americas, which we have been talking about for quite a few weeks and for good reason because almost every week seems to bring a fresh new development as far as the summit is concerned, as far as the U.S. plans are concerned. So what's happening there? Well, yesterday the United States, the U.S. Coordinator of the Summit of the Americas said in a press conference definitively that Venezuela and Nicaragua would not be invited. Absolutely not. He said about the Venezuelan government saying that they don't recognize the government of Nicaragua as a sovereign nation. And this is quite interesting because as we've covered on this show, weeks after the war broke out in Ukraine, a very high level delegation of U.S. authorities actually traveled to Venezuela. And now we know it was clearly to negotiate about getting oil from Venezuela to the United States. And who did they meet with to get crucial resources? They met with the government of Nicolás Maduro. The New York Times said President Nicolás Maduro, and this has been an outlet that was constantly saying that Guaidó was the president. And so it's interesting that now when it comes to the summit, they say they don't recognize this government as sovereign. Interesting given that they just had to beg essentially for Venezuela to give it oil and to allow their oil companies to operate in Venezuela. That aside, they also won't be inviting Nicaragua because of the a lot of pressure they've faced about Cuba's invitation. He did not make a formal comment about whether Cuba would be invited or not. I think there's been a lot of backlash specifically about Cuba, unclear how that will develop. This is Kevin O'Reilly, the U.S. State Department coordinator of the Summit of the Americas. He said the decision is up to the White House. We'll see what happens. The summit is now a week and a bit away. And as we've said on the show and as we have covered on People's Dispatch, it really is shaping up to be a failure. There's been no transparency about what is going to be spoken about in this summit. What is the real reason? It's interesting looking at Kevin O'Reilly's comments yesterday about the summit. One of the key focuses of this space is to discuss the pressing issue of immigration. Of course, across the Americas and really across the globe, this is such a crucial issue. Tens of thousands, hundreds of thousands of undocumented migrants in the past couple of years at the borders of the U.S., massive migrant camera events happening, huge human rights violations against these migrants by U.S. border control. This has been a very hot issue. What to do? How to respond? What is going to be the regional response to this? And interesting enough, Kevin O'Reilly says that the major contributors to immigration and to migration in the region are the, quote, dictatorial regimes of Venezuela and Nicaragua. Interesting the way they rewrite history. I think if you only look at the statistics, in the past couple of years, the largest contributors to the wave of migration to the United States is Honduras under the government of Juan Orlando Hernandez, backed by the U.S. government. His coup backed by the U.S., his electoral fraud with some called the coup backed by the U.S. government. So this is interesting. They're really playing with this discourse. I think a similar attempt that we see, you know, with the Quad Alliance, an attempt to really impose their narrative, impose their dominance, unclear what are the actual concrete economic partnerships that they seek to come and take out of this summit. Alternatively, at the same time, you know, the community of Latin American Caribbean states, created by Hugo Chavez, created by and promoted by Fidel Castro in the region. This has been really a space that's been growing actual concrete partnerships on COVID-19 cooperation, vaccine sending, sending medical brigades, actually having integrational processes. This has been going on. What will the Summit of the Americas do? Unclear. We know that there will be people's movements gathering in Los Angeles from the 8th to 10th of June as part of the People's Summit, carrying forward the legacy of the People's Summit. So we'll definitely be there on the ground covering what's happening. All of those developments look no further than people's dispatch. But now we're going to turn. So, you know, another one of the key debates in the Summit of the Americas is inequality. We know that in the past couple of years, especially during the pandemic, huge growth in inequality. AXEM has released another report on the sidelines of the Davos World Economic Forum. Bring us up to speed, Prashant. Right. And just like that, we're going to another Summit, of course. And this is particularly notorious one, the Davos World Economic Forum, where the richest people gather to celebrate the fact that they're rich, talk about how to get more rich and, you know, everything else is forgotten or assumed that they're getting more rich will take care of everything. But what we do know, of course, is that's not the case because of Oxfam is, you know, very timely way released. It's another report. I would really urge everyone watching it, watching the show to take a look at that report as well. It's quite crisp. Like all Oxfam reports, it actually does a good job of comparing and contrasting. I think the two realities of the world, the reality of the rich, where, you know, billions are made sometimes just like that without people even thinking about it in a day and then millions of lives are destroyed at the same time. And I think Oxfam reports really bring together what this kind of this harsh contrast and the numbers as usual are grotesque. There's really no way of describing it. The fact that, you know, during the pandemic, and I think this is something that does not really even require, need so much elaboration because we've all seen the kind of impact that the pandemic had on every aspect of life and food security, on education, on health, on home, you know, home ownership, on issues such as rent, in all these aspects we've seen around us the kind of regeneration of life that took place. But at this very same time, 573 people became new billionaires during the pandemic and this is, you know, this really I think is a one single line that explains that basically says everything that needs to be said. The fact that billionaires wealth has risen more in the 24 months of COVID-19 than in the past 23 years combined. So, you know, that's another shocking statistic in some senses. But if you look at how the world has been changing and how the society has been progressing over the past few years, definitely nothing that surprising as well. And, you know, a new billionaire being minted as they say on an average of every 30 years during the pandemic.  The Cargill family for instance, which is the food industry, the food business and how they are minting money at a time when people are really struggling to eat. We talked about some of the crisis of hunger at, what do you call it in the early episodes as well. And if you look at the solutions, the report again offers solutions which we actually talked about before as well, which is the most common, the most key solution seems to be that you offer, you put a one-time windfall tax on the riches, the wealthy have made during this pandemic. And let's be clear, it's not all their wealth, it's just on the riches they have made, they have made just during this pandemic.  If you look at it in terms of, say, reducing hunger in terms of producing vaccines across the world, all of this can be taken care of just using that one-time windfall tax. And for instance, you increase, say, wealth taxes or put a permanent wealth tax on the riches, all of this together could generate trillions of dollars. It could solve hunger, it could solve climate change, it could solve, you know, it could provide enough technological innovation to improve education for everybody. All of this together, you know, all this, the resources are available, which I think is what people's movements have been saying throughout the world that it is not that there is no money to combat climate change, it is not that there's no money to combat global hunger. The resources are very much there, but clearly being hoarded. And I think the Oxfam reports what they do, I think, is once again, you know, bring into the harsh spotlight. The fact that we are all sitting on this reality, this reality of the few billionaires, a few millionaires sort of holding the wealth that is needed to not only transform the planet or, say, improve people's life, but to save this planet in every sense of the word. That we are hurtling towards disaster is explicitly due to the fact that these people are sitting on these kinds of wealth. So, you know, a very important report, I think it's a short 19-page report, and these reports definitely deserve to be more widely circulated, more read, more, you know, internalized as far as even media coverage is concerned, for instance. This is, give the people what they want. We try at People's Dispatch and blow torture to bring the kind of stories which focus on these vast inequalities, on these, you know, these kind of gulls, these kind of artificial scarcities that are caused by the rich. So, moving on to our next story, we're talking about another country where, you know, many of these issues often come into play. We've talked about this country often all the time, that is Columbia. You know, issues of violence, issues of inequality, issues of, you know, the health sector, so many sectors facing a crisis and all of them attributable to a very corrupt political system which is supported by the United States. Now, this week we're going to see an election in Columbia, a lot of hope for an entirely, a new era, a lot of hope for change. Zoe, what's happening with the Columbia elections? Well, this Sunday is the day, May 29th, people will go to the polls across Columbia to vote for the next president and vice president of the country. Columbia is one of the countries that has a first round and second round. So, if a single candidate does not cross the 50% threshold, there will be a second round between the first two contenders and it's looking, it's unclear if the current polls are unclear if there will definitely be a second round or not. The latest poll from CELAG, the Center for Geostatistic Affairs in Latin America put Gustavo Petro and Francia Marquez of the historic Pact Progressive Alliance at 48%. So this, again, would not be enough to push them over the 50% threshold. This would indicate there would be a second round, but really at this point, everything's up in the air, everything could happen. As you said, it's an historic election. It's a historic moment in Columbia. It's a country, it's one of the most unequal countries in Latin America as you were talking about inequality. Columbia is just behind Haiti in terms of social inequality. It's a country that's been marred by policies of exclusion of the masses, of exclusion from education, exclusion from healthcare, exclusion from essential services that better the lives of the majorities in the country. And you see the progressive pact of the historic Pact Alliance led by Gustavo Petro, led by Francia Marquez, really trying to take a hold of these decades of misery, these decades of wanting something better but not being able to do because of the conservative hold that it has over politics, that it has over the policies in the country, a country that's hugely influenced by the United States, their interest in foreign policy. Columbia not only has, you know, held its people under captive by not allowing them to have access to these fundamental rights and by restricting their labor rights, restricting all sorts of fundamental human rights, but also is a key regional player in carrying out U.S.'s dirty business in the region. It's been a key ally to the U.S. in its attacks against Venezuela. Its Colombian territory has been used by paramilitary groups attempting to, who attempted to kill Nicolás Maduro, the sovereign president of Venezuela. So really, there's so much at stake this Sunday.  The far right has really been using every single trick in the book. Campaigns on social media defaming the candidates. Francia Marquez as a black woman, as an Afro-Columbian woman, has been facing a huge amount of hate online in every sort of space. There was a campaign that was a false campaign. Someone was posing as her daughter, saying that she is corrupt, that she does not represent the interests of the people, saying that people shouldn't vote for her. Francia Marquez comes out saying that she does not have a daughter. So all types of things are happening, these really horrible things, but at the same time, Francia has really remained strong and said, this is what they're afraid of. This is why they're going to such extremes. They're afraid of the power of the people. They're afraid of the hope of the people. So it's really an inspiring moment. They're persevering in the face of the most violent right-wing in the region. One of the most violent right-wings in the region during Uribe's president, the false positives campaign happened where over 6400 civilians were killed and said that they were killed in combat as guerilla fighters. This is a campaign that was oversaw by Plan Colombia with involvement of U.S. officials that were training the Colombian armed forces. This was a period where over 20,000 people were disappeared. There's so many horrific occurrences in Colombian history under the right-wing. This is a moment of change. This is a moment where the people are trying to bring their platform, their demands to the fore. We don't know what's going to happen. Federico Gutierrez is pulling far behind Gustavo Petro, but if there is a second round, it is likely that the right will unite against this progressive ticket. We all eyes on Colombia this Sunday. We encourage people to follow people's dispatch. Artege Medios align news to really get the latest on what's happening there. This is crucial for the region. It's crucial for the world. And yeah. Go for it. No, and I think it's interesting to talk about the violence in Latin America. Talk about the violence around elections and political crisis. On the other side, we've been following what's been happening in Pakistan, following the parliamentary ousting of Imran Khan. What's been happening since then, Prashant? Right. It's all happening. It's really kind of confusing to read the media reports as well, because what we see is a country kind of spiraling into a whole new kind of crisis, because we've seen this in Sri Lanka, of course, neighboring Sri Lanka, which is going into one kind of crisis, and a deep amount of unhappiness with the government. In Pakistan, what we're seeing right now is a government which came to power through what is clearly quite underhand means, because we saw that the military establishment probably was the United States involved a very important question. Many sources say that they were. All of them working together to basically kick out Imran Khan for a variety of reasons. Some say that it was because the fact that he was trying to intervene and interfere in the military's command structure with its hold on this thing, and others will say that it's because Imran Khan was far more moving, far more closer to Russia and China. But what has happened is that a new government that has come to power has, you know, does not really have that air of legitimacy that say a normal government should have. And what Imran Khan, on the other hand, how he sort of responded is to sort of assume this kind of say, almost strongman kind of politics in some sense is because he sort of mobilizes people. He's got a very active social media army.  So Imran Khan has been demanding that elections be here. The elections be announced within six days and that was his ultimate on May 25th or so. But what happened at that time was his protesters as his supporters came into Islamabad, there were clashes with the police. His party claims that five of his supporters were killed. The government says that a policeman was killed by the protesters. So there's a lot of violence taking place there. The Imran Khan did not extend that protest, probably sensing that this was not the moment to do so, but he's left that door open and this is, of course, taking place in the capital. But similar protests taking place in other parts of the country as well. So we have a very, you know, very delicate correlation of forces right now because we have what on the one hand, like I said, a fairly unstable government as government has been put together by all the forces who were earlier rivals, who have differences, a lot of personal and political differences coming together in one hand. And on the other hand, Imran Khan who was until now known pretty much as a product of the establishment as somebody propped up by the military establishment suddenly sort of creating that space for himself where he's emerged as some kind of an outsider to the system. That was always the kind of tag he sort of tried to use. So this either way does not really it's a difficult time for the Pakistani people. So there's no real, like in Sri Lanka again there's no real solution to the economic crisis. And I think what we often do not see when we look at these kind of political machinations taking place in various countries is the underlying crisis is so dire and there is a complete bankruptcy in terms of policy options as a complete bankruptcy in terms of political prescriptions, whoever we can be talking about, whether we talk about the government or whether we talk about the opposition. So the government also continuing the same discussions with the IMF that the former government is doing that, you know, there is no, you know, real solution for the people as far as they're concerned. So whether these elections are going to bring forth the change difficult to say very unlikely actually because the space for these kind of governments to maneuver seems to have completely reduced as many of them are completely dependent in various ways. So difficult times for the people of Pakistan remains to be seen what happens and you know the one hopes that the violence does not continue. So the coming weeks, the coming next days are going to be very, very important there because will the government give in to the demands and announce these elections which are due to be held or will they sort of hold off so that they did not guard Dimran Khan his victory is really the question. So we'll be covering that closely as well and that's Pakistan. Of course, it finally, you know, we go to a story which a lot of us have been talking and thinking about talk about and thinking about the past few days which is a very horrific shooting in the United States in the United States schools in the state of Texas something that only seems to happen in that country. I mean we hear about violence, we hear about shootings taking place across the country but there is something very different that that students can be killed in a country like the United States especially that to, you know, Zoe just take us through what kind of responses have come to this in what's been happening. Well as you said it's a really tragic story in a really US story where else does this happen where regularly schools are the sites of mass shootings are the sites of such violence in other countries maybe schools would be revered as a safe place but really these have become the sites of extreme violence and Uwale is the city in Texas where this latest shooting took place 19 children and two teachers were killed and it's been, you know, it's a really there's horrific details and lately some of the reports have been indicating that essentially police did not do much to try to stop the shooter there's been a lot of criticism about the response of the police to this incident the shooter allegedly was shooting outside for 12 minutes before going into the school and where he proceeded to kill 19 children and two teachers really raises a lot of questions and I think it's important to raise these questions because really what are the police there for if, you know, with millions being invested into their budgets if they're not even able to protect young children from a shooter but I think, you know, the larger the larger question is why does this keep happening what is this culture of violence that exists in the United States that makes it so that these incidents massacres happening in schools is not a normal occurrence and I think we really have to look at the the culture of violence that exists in the United States this cultural violence at home, cultural violence abroad it's one of the countries that has the highest levels of police killings of unarmed people of largely black and Latino people it's one of the countries that has the largest prison population in the entire world 2 million people in prison it accounts for a majority of the world's prison population it's a country that has the largest number of foreign military bases that exports militarization to the world that sees violence as a correct response to anything for example in the US a lot of police killings happen when there's a distress call the victims of police violence of police killings have been mentally ill people whose family is called the police because they didn't know who else to call and they either ended up killed the mentally ill person has been killed in some of these cases and it's truly horrific violence in the United States is the answer to all sorts of social problems this is what the state constantly says with its actions with how it operates with the violence of state violence against minorities against anyone who's questioning the way that things are functioning and so these instances of massacres of mass shootings are so frequent for that reason of course we have to look at the questions of gun control Texas is one of the states that has extremely loose regulation around guns very easy to access I think just the mere fact that we can access these military grade weapons so easily is extremely concerning and must not be discarded this is not a normal thing people don't need access to these guns this is a crucial element but in addition to this it exists in a extremely brutal society a society that discards the lives of poor people of minorities that says that they're not worthy it's tangible and it's a really tragic thing that's happened and of course our sympathies with all of the victims of this horrific violence and it's so necessary for there to be a cultural shift a societal shift in the United States so that these things no longer happen there needs to be serious action no more thoughts and prayers by government officials who have the power to act who have the power to change legislation and so that's we won't have to report any more of these school shootings because it's horrific no one should have to lose a child in that way and so unfortunately we're ending on this on this sad news but there is hope in people's movements and people's struggles who are fighting for the structural change across the world that is needed to transform our societies we have people's dispatch will always be covering these movements we know that this is the only way to address these problems that are structural problems that have root causes and so keep tuning in to give the people what they want every week on Friday we're here we'll be giving you all of the stories that you need to know that you must know to continue on with the weekend and I think that's it from us thanks so much for watching


Hello, and welcome to the session in which we would look at variances. However, we're going to be using journal entries. In the prior session, we looked at the standard cost system, and we learn about variances, which is the difference between the actual cost and standard cost. And we could have favorable variances when the actual cost is less than the standard cost, or we might have what's called unfavorable variances when the actual costs are greater than the standard cost. And to account for these variances, companies may use separate ledgers such as material price variance, labor efficiency variance. So we have many variances and we learn about those in the prior session. In this session, we're going to be learning about how companies journalize those variances. So companies, they use credit for favorable variance to indicate a reduction in cost or an increase in profit. So think of it as a contra expense when you have a favorable variance. Remember, favorable variance, it means it's you did not spend as much as you expected. It's favorable, or you earn more revenue. That's that's fine too. We could have also unfavorable variances from a journal entry perspective. Unfavorable variances, think of them as expenses. They take a debit. Now, the best way to illustrate this is to actually look at an example. Before we proceed any further, I have a public announcement about my company, farhatlectures.com. Farhat accounting lectures is a supplemental educational tool that's going to help you with your CPA exam preparation, as well as your accounting courses. My CPA material is aligned with your CPA review course such as Becker, Roger, Wiley, Gleam, Miles. My accounting courses are aligned with your accounting courses, broken down by chapter and topics. My resources consist of lectures, multiple choice questions, true false questions, as well as exercises. Go ahead, start your free trial today, no obligation, no credit card required. So starting with the price variance, let's assume Aram company purchased 3,000 pounds of iron ore at $27 per pound. Now the standard cost list, the cost per pound at $25. Now we are going to go ahead and journalize this entry and we have a variance here. So the first thing is we are computing a price variance. Can you tell me whether this price variance favorable or unfavorable? I hope you know this price variance is unfavorable. Why? Because we paid $27 for something we think we should pay for at $25. At least from our standard cost sheet, we budgeted from standard cost system perspective $25. Well how do we process this journal entry? Well let's start with the easy part. What's the easy part? I purchased 3,000 pounds and I paid $27 per pound. Let's start there. Whether I paid cash or I purchased this on credit, I'm responsible for $81,000 which is 3,000 pounds times $27. And I would like you to always start with this journal entry which is involved cash or accounts payable. Now I purchased inventory or raw material inventory or direct material inventory. You need to purchase the direct material inventory at the standard cost. What is my standard cost? My standard cost is I should have purchased the 3,000 pound at $25 and that would have gave me 75,000 therefore I debit direct material inventory 75,000 at the standard cost but I actually paid 81,000. Well the difference between the two is my variance and we already know it's unfavorable variance because I paid extra $2 per pound and I purchased how many pounds? 3,000 pounds therefore I have an unfavorable variance of $6,000. So I have a direct price or direct material price variance which is a debit because it's unfavorable variance of $6,000. Now obviously if it was favorable variance it would have been rather than a debit it would have been a credit. So this is an example of a price variance. Now also we could have a usage variance during the month that's a sum item company used the 3,000 pound of material to produce 400 units of XYZ. So XYZ is whatever we are producing. Now the quantity the standard quantity to produce one unit is seven pounds. So based on our standard if we needed to produce those 400 units 400 units we should have used times seven we should have used 2,800 pounds. Now how many pounds did we use? We used 3,000 pounds. So we already know from this from this angle that we also have an unfavorable but here usage it means we used more than when we should have well and how much more it's specifically 200 pounds more and also we paid more if you notice also we paid $2 more. So how do we process this journal entry? Well now since we are using and we are producing we're going to debit work and process. How much do we debit work and process? We're going to debit work and process the standard input. What's the standard input? The standard input should have been 400 units times seven pound times $25. So that should have been the standard input which is $70,000. So we're going to debit work and process $70,000 based on the standard input. Now what did we take out of direct material? Well we took out 3,000 pounds because we used actually we actually used 3,000 pounds and we're going to take it out at standard cost of $25. Therefore we credit direct material inventory to get the material out 3,000 pound at standard cost of 75. Notice here there's a difference between 70 and 75,000. Again the difference is unfavorable. Why is it unfavorable? Because I used an additional 200 pounds at a standard cost of $25. That's going to give me an unfavorable variance of 5,000. Again we have an unfavorable variance. An unfavorable variance will be reflected as a debit. Think of it as an extra cost. Think of it as an expense. Cost expenses are recorded with a debit. So this is an example of a usage for a for the material. Let's take a look at labor variances. Also labor variances we could have price or cost for the labor and the efficiency of the labor. Whether the labor people did a good job finishing the job on time or they spent more time. Let's assume Adam company spent 3,400 hours and 149,600 to complete the production of the 700 unit of XYZ company. Now right from this information I would if I take 149,600 divided by 3,400 hours I see that I paid $44 per hour for the employees. Why? Because this is how much I paid. This is how many hours they worked and they produce 700 units. So my actual hourly rate my actual is 44. Now the standard calls for five direct labor hours for each unit error rate of $40. Well the first thing I can tell you is this. If I was planning to spend $40 per hour I already see that I spent $44. So from a price perspective you know I paid more for the labor. I paid $4 more. We'll get to that but at least hopefully you can see this up front. Also if I produced 700 unit and the standard call for five direct labor hour I should have spent 3,500 hours. Guess what? I spent 3,400 hours. So what I have here for the efficiency I have a favorable efficiency of 100 hours. So I just want you to see this before we dive into the journal entry. Now the first thing I would start with is how much I paid or how much am I going to be accruing. It's 149,600. I credit a cruel payroll 149,600. Then I'm going to debit work and process because this is going to go work in process at the standard. What is the standard? The standard should have been 700 hours sorry 700 unit times five hours per unit. We should have spent 3,500 hours times the standard rate $40. It should have been 140,000. Therefore I'm going to debit work and process inventory for the labor cost the standard one 140. Notice it should have cost 140. It cost 149,600. What do we have? We have variances. Now what variances do we have? We already know that we paid $4 extra per direct labor hour and how many hours did we incur? 3,400. So from a direct labor rate variance it was unfavorable. The difference is $4 times 3,400. This was unfavorable variance of 13,600. Now we also know from not from a usage from an efficiency perspective we saved labor saved 100 hours. Well at a standard cost of $440 we come up we saved $4,000 on efficiency. So we have a direct labor efficiency variance. We did a good job. We saved 100 hours at $40 that's $4,000. Always make sure your journal entry will balance this. For example here it's going to be 153,153,600 and this is going to be 153,600 as well. It's always good to make sure your journal entries are balancing. What should you do now? Go to far hat lectures to look at additional resources that's going to help you understand this concept better. I know we learn about variances but these are the journal entries for variances. You need to know how to record those journal entries. It's important whether you are studying for your CPA exam, CMA exam, taken a managerial accounting, a cost accounting or some other accounting certification. Invest in yourself. Invest in your career. Good luck, study hard and of course stay safe.