Hello So I got a call at 2 o'clock yesterday afternoon to come and talk to you guys So this is kind of where I was Luckily, I talk about security and I work in the security field Not that's not me is it? I have a consultancy here in Wisconsin of course like many of you and we have an online service with it Where we manage and update and keep track of all your websites Originally was a jumel project and as of Christmas Day became also a WordPress project So we see a lot of security vulnerabilities We think a lot about why your website might be vulnerable and we try and think about it in a holistic way We are not a company that's going to solve your hacked websites. That's not our business What we try and do is teach you and help you With best practices so that your website doesn't get hacked or is so uninteresting that hackers go past you That's actually one of I think the best it most easiest ways To keep your site safe So what we're going to do is look at kind of a holistic approach But I wanted to back out a little and talk a little bit about the Panama papers And this was a really big news item about ten months ago And for those of you don't know I was all centered around this South American legal firm called Masak and Fonseco and their job was to basically set up Tax havens overseas for the world's rich and famous and elite and powerful So how many of you here invest your money in a tax haven overseas? How would you do it right most people don't have any way to do that?  My business partners are in Switzerland. Actually, I have quite a quite good access to something that has been traditionally considered a tax haven But what would I do? I have no idea why it's it's secret right? It's hidden It's just underworld where they don't want they're like your website in a way They don't want attention from anybody. They want to do the little thing hide their money not pay taxes and hopefully nobody notices Well, the internet doesn't like that. Of course the internet hates secrets And the story broke last year that all of these people around the world were involved in this giant basically tax evasion by alleged tax evasion I should say if I forget to say alleged just like inserted in your mind for me. So the prime president I believe or prime minister of Iceland stepped down the Current president of Argentina has been under an investigation for 10 months Tony Blair the former prime minister of the UK was implicated now He didn't stick around long enough probably to get in that much trouble in total over 150 investigations across 79 countries I think to date a hundred and fifty million dollars of un Collected taxes have been recovered. This has been a massive massive security breach the largest ever 146 million files to 2.6 terabytes of data was stolen and Then a team of 400 journalists around the world got together and started putting this information out And it took so many people because there was so much as you can see information to go through and that's what led to this huge massive giant Data breach and a lot of egg on a lot of people's faces Probably a win for governments around the world But why did this happen? Okay? We can look to something that you guys are all familiar with Everyone here uses wordpress which I think is most of you and we can just look right at how frequently people around the world Who use wordpress update wordpress? So this is I say a website security report from a company called security which some of you may know may use and They produce a quarterly report of hacked websites that they as their business Fix on other people's behalf and in Q3 2016. That's this green bar here 74% of the hacked websites that came through their door were wordpress related 17% Jumla and then below that you know drops to the single-digit percentages So that's there just analysis of how many hacked websites there are you know essentially three in every four Right, it's quite high Here we go. Oh, sorry And then if you break that down and you look at out of date core software You see 61% of their hacked sites had outdated wordpress core files Jumla 84% look at Magento 94% of Magento installs in their hacked analysis were out of date right it's pretty 61% Q3 2016 This is available online by the way you can find it at succuri.com I think and Yesterday did anyone notice this came out yesterday morning, right? You all got your update notification who who here got an update notification last night for right? So if you have anything if you have wordpress greater than version 3.7 should be basically auto updating the core And you're getting your email so it was very timely Very timely update for this talk. So I guess I'll thank wordpress for that Right, so they made that change you more press to protect us right and to protect these You know not just the people who are running Legit businesses, but also protecting the people who are you know running these scams around the world botnets You know really terrible advertising sites that you run across all the time if you look deeper. It's not just the core Software that has trouble, but if you look at all the vulnerabilities in wordpress The top but 18% were caused by just three plugins out of date Okay, I've actually never heard of Tim Thumb. Is anyone here use it? Is that popular Tim Thumb? Okay good Gravity forms, you know probably the most popular forms, right? At least it's been the premium level and then rev slider. Who's using rev slider here? one two, okay, so I presumably you're not using Anything below version three point what oh nine five. I think is that where we are right? So anything less than that has a vulnerability and this is a Captured screenshot from this is the Monseco Monseco website, and they were running this really old version of rev slider. No one knows if that was a source of The hack that caused all that international Crafuffle, but clearly this is a major a major problem Okay, and it can affect anybody and I would say that in my experience the core You can see in the news all this site on this CMS was out You know was a security problem often the core takes the you know bad credit for that Coast kinds of things, but most often it's the plugins especially when you might have 10 2050 plugins on your site think of all the little things you might install especially on large sites But it's not just the embarrassment of having your data exposed The big trend these days is ransomware if you haven't heard of that. That's where your PC or your network of PCs Have all their data encrypted meaning that you can't access it anymore And you see something like this when you turn on your computer And it's a screen that says we've encrypted everything and if you want access Please buy these bitcoins which are anonymous and untraceable and send them to us and then we'll unlock your system Okay, so 500 bucks, you know, would you do that for your business? Probably 10,000 20,000 100,000, you know as the companies get bigger these ransomwares these ransoms get higher And what's interesting is a large botnet has recently been Basically, it's kind of like a modified phishing attack. The website gets infected with something that redirects people to a site where they install it actually takes advantage of a browser insecurity and installs for better or worse For lack of a better term a root kit on your computer and that leads to this gonna ransom situation So and by the way just if you haven't been following I'm kind of linking down here as appropriate if you want to follow up on some of these things so Website security may not just affect how your private your data is or your reputation with your clients or within your area But it can you know really have serious effects on very you know a large large number of people You can imagine how many people might be infected their personal PCs by visiting your website. That's hacked Okay, it's a serious serious problem. So kind of is everyone like this right now. That's kind of Okay, well the news isn't all bad right We've got to set set up a really good straw man. So the finish is good What I want to talk to you about today are the way we look at security and Trying to prevent all those nasty crazy things that happen or even the little things that are you know just Painful have you ever had a low-level hack? Maybe a little slight defacement somewhere and it keeps coming back and coming back and you can't figure it out And oh now that's another two hours of my day Okay, sometimes it can be as small as that but it can really have a big effect on your productivity Okay, and your confidence frankly you want to be able to take care of those things But mostly prevent them if possible So we're going to talk about the ways that we look at that and we look at it in this pyramidal structure You see here where your agency is at the base of the pyramid The infrastructure you have the server and services that you use are in the mid-tier and then the very kind of last user-facing air Your application layer is kind of the top of the pyramid. So we're just going to process through those There's quite a bit there. I know I've got well, I don't have a clock in front of me So if I'm running late someone, please tell me But we're going to start at the bottom and talk about your agency and this is I think an area where especially if you have a smaller business maybe you have a sole proprietorship or a young business that You're so busy working and getting everything working and getting your clients and sales and everything else that it can Be easy to overlook some of these policies But in our experience what we're going to tell you it's easier to implement them at the early stage Because then you can scale them as you go instead of trying to retroactively fit those Changes to a kind of a set Process you might you might build So password security of course you need a strong password. That's actually not The main topic here. We talked about password security at the agency level. We're talking about how do you manage your passwords? How do you keep track of them on behalf of your clients and third parties that have hired you to work for them? How do you share them safely and securely among the members of your team and? That includes your the closest team the two people in your office or down the hall, but also maybe some remote Characters you have on your team. Maybe some outsourcing people people who live in other places Or people who work from home Hey, those are super important things to have in your agency that everyone understands how to use them they use them properly and consistently For everyone's benefit and so there are lots of password managers I mean five years ago. This would have been a different conversation, but you could you have your choice these days a lot of people use last pass personally they have a team version as does One password. It's another one that I really like for the enterprise level only out of price Really, it's an excellent piece of software and this is called a team password manager. I think you can just read at the top there Really also super good and the advantage a team password manager has to some of the more traditional ones that really super good control over ACL or Access for different groups to different pieces of infrastructure and secure not just passwords secure notes confidential agreements little sort of things so figure out what makes sense for your password policy and You know adopt the workflow that's going to give your client security But let you do your work also in an efficient way and work generally as a team Strong passwords. I mentioned it. We all know we need strong passwords unique password for every site every service on every site don't duplicate them ever and I always like to not know what my passwords are ever So the only thing that lets me I only know one password the master password For those of you who have not used them that you have a master password to get access to everything that's the only one you truly need to remember put that in your safe deposit box on a piece of paper and You know remember it. Well everything else when I log into any services It's just copy paste in your copy pasting a bunch of asterisks and then you paste it in I have no idea what it was. It was randomly generated. I pasted it blindly and we go from there, okay? There are lots of places where you can generate passwords. I recommend you just so many things on Google obviously I'm not going to replicate them here Find the one you like on Google Set up what that policy is. How long is it? How many how much complexity? How often does it change? Right, so in our at our firm we do annual password Replacements so we have a password day and that day is just everyone takes, you know One of our properties and their response for changing all the passwords Okay, because that's done in one place. It's easy then when people go back to use it Okay, having the same password for ten years not so great changing it every three months like my bank I hate that it's so bad But it's important to obviously change them regularly. So make sure you keep track of that and This password policy you're making a story of the security policy at your agency It applies to everyone right not just the boss and not just the IT guys It's really something I feel we feel at our agency that needs to be a holistic approach Everyone needs to buy in and everyone needs to be part of it Okay, if you have one week link for instance, you might have a remote worker who never ever comes to the office Never really came in never got an email account You never really put them through the right onboarding perhaps and now they're accessing your clients information with their personal Gmail account Probably you think does anyone ever I've done that does anyone else done that use a personal account for work To okay, I'm gonna I'm gonna assume there's more than two But it's a bad thing But do you have a policy for that when you hire somebody or when you're working with somebody do you say if you Want to work with us? You need to follow these the set list of things most small companies don't so I definitely recommend you do that A corporate email address is just one example of that If you use Google Drive to share data, it's really easy and drive to limit access to digital assets By corporate email so you can say everyone in my organization with the same domain name if they're on Their browser with that logged in with that account then they can access or they can't access But there are other of course off softwares depending on how you manage assets and stuff So You keep that in mind when you're developing your own one. We all share our Netflix account probably with somebody Don't do that at work. That's just for home, right? Obviously The other thing a lot of people overlook is disaster planning and Disasters come in all shapes and sizes big and small Could be something as a data center going out or recently there was a very large Denial of service attack on a din, right? Facebook was down Twitter was down. This was about two months ago. I think What is your disaster plan if you have issues at your agency all your sites go out Who does what when do they do it? Who calls who? right What is the emergency contact info? It might not be a server emergency because that's kind of one of the or like say a bunch of hack websites could be a physical disaster Could be a bad storm could be a flood, okay? You need to know where your people are and how to get a hold of them, you know, especially if this happens during work hours For it related specifically. What is your server provider info if your computer where you have your group password manager goes down?  Could be all kinds of things depending on the infrastructure you have at your at your agency and Two-factor authentication I'm sure most of you're using that already That's where you have two different ways two different pieces of information to log in So pretty common these days are to have your email address and password as one factor and then either a Dongle with a code or a code that gets sent to you by text message For example that as a second piece to log in all those services have one-time use backup passwords and those are things that You need stored digitally generally in your password manager to keep it secure But also somewhere physically and I mentioned earlier in your safe deposit box We physically have a safe deposit box for that purpose and we keep our codes in there once a year We update them in case there's some disaster, okay? Here's another part that we often skip over and that's some ongoing education for people in our agency When we come out with something new or we change a workflow or new technologies come up or new threats Do the people in our agency are they cognizant of such things if there's a new phishing scam coming out on email is that is do We have a way to tell our Team members that to watch out for that when they get mail in their account So again emails are just a really easy example to talk about here if you go to a website called phishing box What you do is you hire them to test your agency for their susceptibility to phishing attacks So they will generate a mock attack Send it to the people that you Indicate you know by email you give them a list of email addresses and then they measure how many people click through and Fall for the phishing attack They give you that information and then you get to bring it up at your next meeting, right? And that's a it sounds a little deceptive But frankly keeping everyone's mind on the fact that digital threats are escalating and escalating and more and more common We feel that's good. Okay. You can be transparent, of course and let people know that those things are coming It's kind of like a fire drill at school Knowing that you're going to have a couple of year, you know, let you know it be prepared Okay, and so that's kind of how we look at that So I recommend that if you don't have one To prepare one and if you do have one review it regularly and by that I mean a security policy talk about things like email usage access to resources Password strength password duration What's the duration that you keep passwords? What's the client rolls off your billing cycle? How long do you? Keep their credentials for when they're no longer going to be a customer, right? You should have a retention policy for that information. Okay, because you don't want to be someone pointing the finger at you five years down The road. Hey, didn't you have that password back then? Did you do you still have it could someone have stolen it from your computer? You don't want to be answering those questions You want to point them to your policy and the documentation that says oh, sorry sir We deleted all your data four years ago on this date and here's the you know Here's our audit of that information. Okay Team composition disaster planning and ongoing education. So those are all things that I Recommend you think about when you're getting considering or building your own security policy so now we're going to get a little more technical and If things start to get I know we have some beginners in the room or at least attending today So if things are starting to sound a little wonky I've got a couple slides for you at the end of this little part So don't don't get this don't get discouraged So we talk about our server and services we talk about these are our infrastructure pieces upon which we build say our WordPress site or wherever kind of project. We're building for our clients and We break them down into local resources and remote resources So local resources are the things that you maintain either on site or at your data center or with your hosting provider for example And remote are services that someone else is maintaining and perhaps you're buying and using them in the cloud Okay, so we think about the local resources most of the websites probably that you guys work on are built on some kind of amp stack Some Apache MySQL and PHP stack with Linux or Unix or some version of that Okay, all these things are software running on on your server and if we take PHP as an example This is the current PHP usage for WordPress installs WordPress.org installs Okay, self-hosted WordPress. So who knows what the current supportive versions of PHP are somebody here does Five six and seven now there are two versions of seven, but they're both supported I combined them because almost no one's on seven point oh one or point one wherever it is So it's really just these two here. So about 37 percent of WordPress sites host cell phones of WordPress sites are using a currently supported version of PHP all the rest below are end of life security updates are not being put out for that and hosts some hosts the good hosts will be kind of patching them for you But really the best thing of course is for you to be at five six which I believe goes end of life end of 2018 But with the speed increases in PHP 7 start testing your applications for compatibility upwards compatibility now so that When PHP 5 6 goes end of life you can migrate there more smoothly You don't want to be at an end of life situation and realize that half of the plugins on your WordPress site Don't support it. I think we're getting closer to that now than we were six months ago But These softwares on our infrastructure also need to be updated and maintained, okay? Well-known errors occur in these softwares like your most people are running Apache or nginx web servers and Has anyone heard of the Heartbleed bug I mean must be quite a few people heard of that, right? So this is a bug in the protocol on your server that provides the SSL Communication between your website and the end user so that it encrypts your communications and there was a pretty important bug there Last year and actually came up with a Heartbleed checker and you can just check your own website right now at that address And that'll tell you if it's that server is compatible to this SSL problem Even if your website itself isn't running HTTPS You can still check if your server is going to be vulnerable to this because if that server gets Affected depending on how your host is set up their environment your site could be vulnerable also, okay? So even if you're not running HTTPS you definitely want to check if You're you're following on if your server might be settable to to this kind of Heartbleed bug Other local issues that you should worry about or you might worry about Whether or not you're running SSH on the non-default port normally there's a default port for running SSH Communication it's a good best practice not to use that default and to customize something for you specifically disabling non-secure FTP Using strong database passwords and that goes back to our password strength conversation should be unique and strong But also you want to custom? Table prefix so when you install a new Jumla, pardon me Let's all a new WordPress site, of course your database has a prefix in there and there's a default You don't want to use that default and most of the security tools you might be using already probably told you that already Enable logging this is at the server level again most shared hosts Will not enable logging by default because it's more resources for them and more storage for them You have to manually go in and if they've let you enable logging back in the cPanel or plus back in or whatever you're using To manage your hosting account logging is only important When you need it the most okay most of the time you don't care But when your site gets hacked and you're wondering what the source was if you've not enabled logging you've missed the chance to track down and Find the problem if you turn on logging after the hack you've missed the missed the chance now I should just say that it's not a golden Solution because the really really good hackers will delete the logs on the way out after they've hacked your site So it's not always great, but for sure if it's off you have no chance So turn on the logging and magic quotes is another thing that is kind of that's more of a older legacy type tip I guess you'd say Okay, so that's local issues Okay, but there's also remote issues in today's modern on any modern website really you'd have lots of integrated services in general or at least one I mean Google Analytics most people have something that something like that on the website, right? So that's an example of a remote service that you need to make sure is safe At our consultancy, we don't actually run email on our servers on our web servers. So we have all the email Segregated to transactional email service providers some of you especially large organizations would have a separate mail server Which would also serve a similar purpose, but if you're a smaller agency and you're going to send, you know 100,000 or less emails from nothing. I'm not talking about your work email But your website is going to send a hundred thousand or fewer emails This might be for all your clients that'd be more than enough for most small agencies Then I recommend you just outsource that to something. We love spark post by the way. So you might have heard of mandrel in the past Mail gun there's all kinds of transactional email service providers I have tried them all and you should also but I highly recommend spark post We pay twenty that twenty dollars a month for a dedicated IP address That really reduces any spam issues we have we got a hundred thousand emails with that a month And we have no one interested in our web servers as a potential source of sending email spam, right? Because that's a big what's one of the big interest Areas for for spammers and hackers So it doesn't have to be spark post, but I must say I've been very impressed with them the other thing that we Use as a remote service a critical remote service is a remote DNS provider Of course DNS is what converts, you know your domain to your IP address so that you can deliver the content that is associated with that domain The right content when the user requests it now many of you who is using cPanel. There's a quick show of hands cPanel Lots right pretty common the most common back in Oftentimes when you create a new account it says oh what name servers would you like and you generally have a name server running on your shared host That's really great until your host goes down your server goes down Because it's really convenient, but the problem is when your servers down you can't change it So if you have some catastrophic event you can't reroute that traffic somewhere Maybe load your site on a backup server from a backup that you have stored off-site You can't do any of that if your domain server is on the same server as your web server or your mail server Your mail server gets hacked then you can't do that So we I recommend that you look for ways to outsource that or at least put it on a separate server With a different kind of a different access and not the same node as your web server So we use a cloudflare which has a lot of other benefits. I'll mention them a little later One really great feature even if you're not as even if you think all the security stuff is my site's too small Nobody cares The really great thing is if you do make a change in the IP address It it's about 10 second propagation time Through cloudflare and so you don't have to wait for that next day. Oh, let's see if it's done and all that stuff if you can change it literally Moment-to-moment and look at the effects on your you know on your work depending on what you're doing So in terms of development when you're in a development stage, we find it's super super helpful Or you know when you're switching another good example when you're switching from Development to we're going live then you don't have to wait the day either you switch it It's on your client's happy and you can see if you have any errors and get moving So we really like cloudflare and it's free by the way The DNS part is free most of the many many free features. So I recommend that or another kind of DNS provider I said earlier if all those technical things sounded a little bit maybe above your interest level You can consider I don't really like to recommend hosts.  These are more expensive They're gonna run you maybe tenfold more than what you could get at a low-end shared hosting WP engine and page. They are the big ones Scott are the some other ones because I know you guys are experts in this Flywheel, right? That's another big one So those those are more expensive services, but you get a lot with them you get really advanced caching a Lot of patching of security issues as they come in which we'll talk about in a moment But they're you know if you're passing on the price and your client doesn't mind Then I guess you don't mind either, but yeah, so I'm just gonna I have no affiliation with those organizations by the way So the last thing I'm going to talk to you about is Sites and software, so this is the very kind of top of our pyramid if we have a strong Group policy editor agency, and then we have really good secure hardware now We can focus on the things we're using daily, and that's usually the application in this case WordPress its themes and its plug-ins and The very very easiest first thing you should do every day if you're in your back end is update everything You work press makes it super easy if you have many sites that are services that also make it easy to do this in bulk The core is generally for a modern WordPress site updated for you, but the plug-ins are not now I don't really recommend that you auto update the plug-ins. You can automate that with plug-ins ironically So I don't really recommend that because they can break your site, especially if you have customizations But you want to be keeping your eye on the Plug-in and theme updates very very closely. Okay So we set a schedule that we update You know every Friday we only have different tiers of clients but for our tops here every Friday is update day And we start out Friday. I'm sorry Thursday, and we do all our updates post update We do all the tests because we want to make sure the sites still work And then hopefully if anything's hopefully nothing went wrong, but if it did You have about 24 hours before the weekend so you can fix it before you take off So that's also important to have a good balance Yes, so definitely update update update update. I showed you the data earlier Out of date software is probably the largest factor for WordPress plug-ins. So just I mean it's so easy these days Really got a hand at the WordPress for working hard at making sure those updates work well There are other number of known best practices that we could talk about I don't want to go into them a lot. I should say that if you've not done this Listen up and do this like in the next hour or two go search for the top or WordPress security best practices on Google you probably find 10,000 blog posts on that pick the top five and you're gonna get some really good advice Okay, I don't need to reiterate those for you because there's so much out there But just just briefly a couple of things unique administrator account Some of these again are legacy type things. You wanted to save a file editing and PHP execution Limit the number of login attempts so you can't just have a brute force attack This is a big one if you remove your unused themes and plug-ins for one you have less to update and two there's just fewer Fewer vectors for people to use to try and gain access to your site or try and attack your site and Block editing of the config file You don't want people getting in there looking at your hashes and the other things you might have in there You're database password and stuff like that so those are kind of some of the basics I think most people have many people have probably heard of some of those There's not really a good way to enforce strong passwords in WordPress they do have a password strength indicator Right when you make a user, but they don't enforce a Certain strength level so there's a there's not really a really great Comprehensive plug-in where you can set a password strength level that is acceptable for a new user for example But you can set some things in there so you can have a look at this plug-in and see if that helps if you have a lot of new Users, this is helpful or people I run a non-profit sports group Website and their users just cannot remember the passwords ever And so they are hitting that reset password a lot so this comes in handy for us for keeping things safe and secure In the general settings you can control access if you don't have a membership site This should be unselected in your WordPress settings. There's no reason This is an option for membership in the in the WordPress settings. There's no reason to give a Potential attacker or pardon me a hacker a reason to create a new user on your site because if they make that user And they can escalate the privileges to be an administrator then they can really start messing around in your site You do not want that obviously so unless you truly need new members signing up on the front end of your site Just leave that disabled There's also the new user default role so You might say oh Vic. I'm not letting membership. So it doesn't matter what this setting is well Again if someone can get access to even a low-level You know a hack that may not take your site down But gives them a little bit of access and they can manage to create a user If the default of this is administrator now, they've got a lot of access So it's just good policy that even if you've disabled membership to keep the New user default roles and low lowest privilege as possible, which is obviously subscriber Wordpress and Joomla say that word intentionally for the first time They give you a lot of information when you try and log in and you've made an error They say something like that username doesn't exist Or they say I'm sorry that password user combination is not valid something along those lines and The issue is that that tells a potential hacker or attacker that they've got one or the other wrong if they can figure out They've got a proper username. It's much easier for them to perform a brute force Entry attack on your site so you can easily. Oh, I'm sorry You can easily by modifying functions dot PHP just add a little Bit of code in there that means if they give the wrong name username or they give the wrong password They just see the same message wrong username or password. It doesn't give them the extra information that they have got one thing wrong So again, you're just de-incentivizing People of coming in and attacking your site. Okay, I have all these slides online I'll provide a link at the end. So don't worry about writing down this really ugly long URL. I'm sorry. It's so long You can get all these online all these slides Okay, so I should have had the slide a little earlier. Don't update your site until you've got a backup and Make sure you back up your site every x Frequency depending on your usage if you have a static site probably once a week or once a month is enough You have an active site with lots of new content and things like that Then you want to be doing nightly or even by you know two backups a day for example. So there are lots of backup solutions and so You know, although I've used WordPress for years. I've not used it heavily except for maybe the last two years And I can't tell you which of these is best Someone told me the backup buddy was super popular. Is that a who's using backup buddies or backup solution? So I wouldn't say super popular who's using updraft plus Not different. So there's a lot of backup solutions This appears to be the most popular on the plugin directory backup buddy is not on there Does anyone know why that is because I've been asking every word person WordPress person I know why that's not on the directory. So if you know tell me later, please I would love to know But you need to pick one of these if you're not already doing it And if you're if your host is doing backups for you, you also need to do this Okay, essentially we go by this policy Unless you have the backup in your hands and you've verified it you may as well not have a backup That's our policy. Okay And having redundant backups It certainly doesn't hurt right and if you can automate it all of these have automated backups That's great. And then they've automated off-site storage So you can be storing your backup files on Amazon s3 dropbox Microsoft one drive that was called Or remote FTP server. There are lots of options for you to send these backup files we use For legacy reasons something called a keep a backup and that's also not on the plugin directory, which is frustrating But they have a really interesting option. So you can see here. We're backing up to Amazon s3 and There's this thing called an archive integrity check So people who make a backup software will tell you every time you make a backup You need to test the backup because if it's corrupted or it's not complete.  That's not something I can do and Kind of have a healthy happy life So we really like this option in a keep a backup because it if it fail if this arc if it can't verify its own integrity It sends you a message. So, you know, there's something wrong with the backup, okay? You also in our recommendation should use a series of redundant firewalls Okay, there's no one that does it all. There's not one that's best Jetpack obviously has lots of features the free version includes Basic malicious attack prevention Okay, it doesn't doesn't provide file scanning or things like that, but essentially that's Sanitizing the requests on the website through, you know, wordpresses, you know, very large obviously database of known attack vectors So that's obviously the free version is easy to install and you can whitelist Certain IP addresses for instance of your office so that you never get locked out that sort of thing Oh, yeah, and there's the of course that's on by default blocking the malicious login attempts. Okay, so definitely recommend jetpack The other one that we recommend is the all-in-one WP security and firewall You might have your own favorite firewall. Feel free to insert that here. Okay, we certainly like this one One thing about this prep firewall and the other ones there are a few others that are in this kind of class of You know high feature, you know block everything kind of firewall One thing is you have to find a balance for your agency and this might be part of your security policy talked about that earlier What balance do you need to give security? But people can still log in and do what they need to do. Okay? I'm getting the signal from Scott and I'm almost done. Thank you for your attention This is actually a live screen or a screenshot from one of our sites and we're at about Almost not quite half of what we could get this top score in this extension for locking your site down as 470 We're at about 200 for us that balance makes sense your balance might be a hundred It might be 350, but you're gonna have to figure out what exactly that is for you. Okay? And I mentioned cloud flare earlier cloud fair has a host of Features and you can see them all listed here. There's the DNS one I mentioned earlier They also have a firewall area and it's much like we mentioned earlier with jetpack Sanitizing any requests before it lets kind of attack her in so That's another really great reason to be using cloud flare and that's basically we for every site We run we have those three firewalls jetpack all in one security W security and cloud flare That's the end of my talk as I said my slides are currently here You can get all the links that you want feel free to contact me if you have any security questions Or anything else you'd like to ask me. I'd love to hear from you. Thank you very much It's a bitly link. So it's bit.ly forward slash WCW 2017 hyphen security Right, so this ransomware is not specific for wordpress But word there was a word a botnet involving a bunch of wordpress sites that were already infected with something else that was Spreading this problem. What happened was when you went to the site to redirected you instead of going to the wordpress site You wanted it redirected you to somewhere else and that would actually take a hold of either a flash defect or a Microsoft Silverlight defect from an updated. Sorry an outdated browser And it would use that exploit to download some other nasty stuff rootkits and really take over your PC So it was a multi-layered very complex attack to figure out also very hard to solve Because you could fix it and then still go back to the same website and get it again So in that case it required an outdated infected botnet of wordpress sites and outdated plug-ins in your browser Okay, oh one more. Sorry. Oh two more Go ahead That your site is attacked or or that there's some for instance vulnerable software So that's a basic. It sounds like a basic defacing attack So you would report it first to your host or IT provider And then if you identified the cause say it was a certain plug-in then you could identify the plug-in Contact the plug-in author That's what I'd recommend Exactly right. Yeah, I only someone had told me about backup buddy. That was really popular. I couldn't verify it Actually, that's why I was asking You have to pay for up-draft premium. So of course, that's not on the directory But I wouldn't know why it would get so popular. So maybe it's just not that popular They don't ever write Exactly right. So I'm not I'm not surprised that I'm more small if they did have a free version to get popular Why did they take it off? Yeah? Yes Exactly right manage WP My time is up. Thank you very much


Welcome everyone. Thanks for coming on your Sunday afternoon to our program today. While I'm waiting for another couple of folks to join us, first I'll introduce myself. I'm John Smalley, Librarian in the General Collections in Humanities Department on the third floor of this library, where we have lots of poetry, about 60,000, 70,000 volumes in English, tens of thousands more in the 41 other languages that we have on the third floor. So while we're waiting for a couple other people to join us, I want to take a moment to acknowledge our community and also to mention a program coming up next weekend. So on behalf of the San Francisco Public Library, we wish to welcome you to the unceded ancestral homeland of the Ramatush Ohlone, who are the original inhabitants of the San Francisco Peninsula. As the indigenous stewards of this place, they've never ceded loss nor forgotten their responsibilities as the caretakers of this land. As guests, we who reside in their traditional territory recognize that we benefit from living and working on their homeland. We wish to pay our respects by acknowledging the ancestors, elders, and relatives of the Ramatush Ohlone, and by affirming their sovereign rights as First Peoples. So we have quite a few programs this month on the topic of food, and next Sunday in the Coret auditorium, which is just across the way here on the lower level, there will be a panel discussion on food cooperatives. So if you come to that, you'll learn how food cooperatives, at least since the 1960s, have been involved with food and justice movements as well as workplace democracy in the San Francisco Bay Area. There are library newsletters and flyers on the table over there as well as coffee and cookies, so feel free to help yourself at any moment. And so that ends my announcements of upcoming events. Now I'd like to turn the microphone over to Nazila Jamison of Nomadic Press, and Nazila will introduce today's readers. Please give a warm welcome to Nazila. Hello, everyone. Welcome to this lovely reading of a lot of my favorite poets. How y'all doing? You good? All right on. It's a lovely day for poetry. It's also a lovely day, so hopefully after this you'll get out into it because it's quite lovely. Our first reader. I love it when all my favorite poets come and read at the same time. It's a bonus. So our first reader received an MSW from UC Berkeley and MFA from Rutgers University. His work has appeared in Apogee, Anomaly, Ninth Letter, and the Ascentos Review. He was awarded the Alfred C. Cary Prize and has received fellowships from the Vermont Studio Center, Kanto Mundo, Community of Writers, Sarah Lawrence College, and the Lambda Literary Foundation. His debut collection, Angel Park, which came out in 2015, appeared on the LA Times list of 23 essential new books by Latino poets and was a finalist for a Lambda Literary Award. He lives in San Francisco where he works as a social worker and editor-in-chief of San Cocho Press, a queer and trans Afro Latinx imprint with Corima Press. His debut album, Busy Cat, is now streaming on all major platforms. Please welcome the very lovely Robert F. Santiago. So is the theme food for this? Okay, well I don't write that much about food, but I have a few secret food poems that I will read for you. So I'll read something from the original collection, the original recipe, which was called Angel Park. And it's titled Collecting Spanishes. Hi. Abuelita's English was just like her bread pudding. Punctuated with raisins no one ever asked for. Condensed milk contradictions, fattening tenses, cinnamon questions, and eggshell. Bapi's Spanish was more like a group of poets workshopping, not overly concerned with agreement, and never without purpose. I don't ever remember him speaking in en-yes to me, but I loved him most when he spent all his accents on Mama. Mama's Spanish was slow-moving silkworms. She sometimes threaded stars into Greek myth and lullaby. Other times she tangled words into ivy, wrapping up a building brick by brick. Abuelo Spanish folds itself into English tea sandwiches. Cucumber and watercress covered in adobo y habichuela negra. I never tasted that recipe. He wasn't around often enough for them to be prepared, and something like that just doesn't keep well. So that was one food poem, and the rest don't really have that much food in them. It was weird to read that because it's been so long since I've read anything from Angel Park, but also one of my grandparents passed away recently, and I picked that poem, not realizing it was going to hit me in that moment. So this is a poem that is not like that in any way. This is from, like, Sugar, which came out recently, pneumatic prose, hey, hey, hey. And this one is titled Self-Portrait as a Boy in Nail Polish. That boy's sweet! Sweet like sugar should be, like mango gets. Sweet so sweet it gets caught between your teeth. Orange honey blossomed. Syrupy as agave is sweet, sweet enough to sugar the red out of some Kool-Aid. That boy got more than a little sugar in his tank. Sweet as flower bloom in morning dew, and the beauty seemed to say, it's a pleasure when you treasure all that's new. And true, and that boy Gania stabbed through a mojito, begging to lay in teeth. That boy folded hands and crossed legs, don't start none, won't be none. Sugar pie honey bunch! Sweeter than rainbow sprinkled buttercream. Sweeter than water ice or piraguas in July. That boy sweeter than a mug of hot cocoa and cinnamon, of marshmallow fluff or chata, of matcha sweet tea on ice, red velvet amaretto gelato. Sweet as lavender caramel mad lens.  Maraschino cherries soaked in Pepsi, and candied raspberries after hot boxing up the coast. Burn your throat, he's so sweet. There's some edible things in that one. This one is titled, The Cavalier Nature of Electricity, or me salivating on the floor. Very, very subtle title. Whenever I'm in love, a warm animal scent lingers. Sweat and sandalwood, a top note of copper pans. The scent is so running water electric I think I might hurt myself. Or I'm sure of it.  When he's near, I fixate upon the sweetest nothings, a daydream swelling above him as he lectures. I devour everything in the way his right hand rests on my left shoulder, a static jolting whenever he laughs and reaches over to rest his hand on my moment of skin. Each moment, a moment longer than the last, but never too long. Just long enough to prove that he's there and I hear. Ampers and atoms, fleshy opposable thumbs and a current that flows between us accountable animals. Us in his office, tearing me apart and jingling his jewelry, playing gold ring, smokeful and exuberant. The sluice, a current loose from me, burning his neck through the collar. Flesh feels better when it's taken, when people can see but pretend that they can't. That was a little bit sensual. When I wrote that poem, I took it to workshop and the workshop leader thought it was about them and it was not about them. They do wish. That being said, this next one is titled You Up. So, You Up. In the jet pitch of night, I refuse sleep and its lulling touch. With that devilry to swallow me whole, I'd grip it by the throat, from the inside. Each finger and arachnid of bent cigarettes tearing through flesh to get to a place where I might gather the means and materials to march across another. Oh, baby, not tonight. I don't wanna fuss and fight. I just want to make it right, but I'm a fool as I march towards the dawn letting loose bits of myself so that I can retrace my steps and recollect them inside myself for you. My neck and lips, tender thick with shine, a twitch, a flicker, a blink.  Like Nebulae imploring, give me all your love and don't stop my love's waiting when you read the top. All night long, spreading gold-black through purple smoke, I will admit to being much less than advertised with my filthy hands and red face, but you only call me when you're lonely and need someone, not me, one. And I'm gonna, I'm gonna beg you to be human again when we're so close to the sh-t-t-t-t-t-t-do. Sh-t-t-t-t-t-t-do. And all you wanna do is get lit up and raised to the dirt. Have no fear. I don't practice what I preach. I have a fistful of stones and a pretty glass house. Inside is a love seat, swayed as starlight, upholstered moonful as licorice, black wet with nighttime talk like spit in the movies.  So come into my bedroom, honey, what I got will make you spend money all night long. And I need it while I'm young and neon enough to under-appreciate it.  So these little flags are not cooperating. So I have one and a half more. We'll see how I feel after this one. This one is titled, A Portrait of Petroclus. The shadow cast from a single lantern is not biblical, though it is indistinguishable in proportion. He is a symphony exploding slowly at first, in shifts and silently. A meticulously peddled crescendo brimming with vibration. His breath, a plie stolen from the blackness of Caravaggio. A merlot-lipped recitation of Kovafi under black lace. The black of scriptures that bleed when you touch them.  His eyes, glister gold as river light. An expression old as the earliest form of wonderment. A pleasure, a seance. Gossamer white flame licked and split up the center. His vanilla abounds. A furrow roiling beneath the morning psalm of Achilles' horses. On his brow, a covenant with any creator willing to listen. The last one I'll do is a longer poem, but I'm just going to do the first part. It's a portrait of my mother as Nina Simone. I'll take a sip of water for this one. How's everybody doing? Portrait of my mother as Nina Simone. One. Love me, love me, love me. Say you do. Mona Lisa set adrift an obsidian rill. Vantablack and crystalline. The king sits bewitched at the dazzlement of her piano. Moon is in her breath trying to find the ocean looking everywhere. Singing to the sidewalk of stars, they come and go. Static is blackness. Blackness is bright, is smiling in the dark. Don't let them take me. Don't let them handle me. Drive me mad. Sedidily she trilled in an antique necklace of jaguar tooth and bone. A little girl jostling fro and to in a pastel clawfoot bathtub. Set in the center of a house, in the center of a parish, in the center of New Orleans. Wishing aloud for the rise of a sun.  Their eyes hide too. Alabama, Tennessee, Mississippi, god damn. She ate for us to let candles burn slow, slow but hot. Wool-strong hips and mouth between worlds. Thank you so much. And apparently that's how you set it off. Thank you, Roberto. Roberto Santiago, y'all. So, uh-oh. Our next reader lives in Oakland, California. She has published multiple chat books and full-length books of poetry, two of which on Sunday a Finch and Collapse, both on Nomadic Press were nominated for California Book Awards. She has been nominated for six Pushcart prizes and was recently in the running for Oakland's first poet laureate. She has graced many stages, hosts the weekly writing workshop. On to six is co-host of the quarterly-themed reading series Moondrop Productions, host of the Badass Bookworm Podcast, and the Badass Bookworms Litloft. Her most recent book of poetry, A Pretty Little Wilderness, comes out on Be About It Press, June, and came out on Be About It Press in June of 2020. Please welcome our next lovely reader, Cassandra Dollett. So good to see all of you. That traffic was horrible, sorry. Is James okay? See, we don't know. Oh, okay, yeah. I wish I would have carpooled because we live close by each other. Um, anyways, I'm stoked to see y'all. I tried to think of food things, so let's see. See, I'm trying to give up bread to unknot my gluey gut, increase fiber, reduce gluten. So I wake every day with thoughts of the morning bun. It's round, soft layers rolled in sugar crystals. Not too sweet, but enough to stick to your lips. I'm also trying to give up the boy, but when the alarm rings, my first thoughts of lean limbs leading to hands that touch just where I want to be touched inside and out, kiss me, mouth watering, body starving. See, this is why I don't diet. On the plane, hot, hungover, deafened by nuts and bolts, shivering before mid-air collapse, he tells me that I sound like a mouse on a glue trap, caught in the act, but still squeaking.  A tear rolls from under my sunglasses. I'm sure the people in the seat behind can see me crying. I drop my head, exhausted, feel the salt burn through sweat and 24 hours of travel dirt. He reaches for me, feels sorry for his wounded, cheating mouse. Last night, the warmth brought us to the backyard where we jumped on the trampoline, howling, flying above high fences, peeking into neighbors' yards, holding each other, laughing, laughing. I think I peed myself before falling. We hugged and we kissed. Real happy kisses. It was, is the only cure for what ails us. The police copter came, the ghetto bird shined its spotlight on us, circled tighter and tighter. The sounds of Vietnam, Iraq, the streets of Oakland, but they can't arrest us for joy. That was a literal self-published mud pond. And this is from Collapse on Nomadic Press.  Damn, she got fat. Says this guy who knows your ex-boyfriend.  Or when another ex tried to convince you it wasn't his fault this ex was so bad. It was just, it wasn't used to being with someone so big. This is piled in your hurt locker of mom comments. Her reports on who lost weight, how great they look. She believes all problems solved thinner. When you are naked under adoring eyes, when you get naked milk to thirst, it mutes those voices, rubs them, salve on old scar, your thickness revealed and squeezed in a way that says, I have waited all my life to deserve as much woman as this. The moon lives inside me. The eggs still come, sad fallopian hands wave no more. So many obstacles, 15 years between us would be nothing if babies held easily to aging uteri, if we both hadn't suffered so much loss. Baby, the one pure thing I could give you, the one damned thing I cannot. I wonder if you truly understand how I saved myself over and over again, filling myself with blame, grabbed spit on rocks, thrown at me on the street by men, hands under my skirt, fists to my teeth just for saying, please don't touch me.  What I wanted was simple. I didn't know it existed, had never seen man as friend, never been treated as a friend.  There were a lot of casualties. I swept up and carried with me a heart of scar tissue like the surface of the moon. Not very foody, but then again, food and sex. It's all the same. And from the most recent book, Pretty Little Wilderness, I chose some that I don't usually read. Bless up, this rain on the window behind our heads, hissing under tires in the distance, the day we never left the bed, the taste of chapstick from your lips, the kiss, the way we move towards each other, magnetized pieces of life in a bar, in a bed, in a crazed world, we keep returning to lock limbs. It was a rainy night when we met, a summer spent in each other's arms behind us, how we compared the emptiness of the summer before to the fullness of the one together, how we don't think about any of it too much anymore, let the cold tip of dog nose wake us, rough tumble of arms, legs and paws, smelling coffee in our memory foam nest, butter melting in morning skillet, filling the house with home, slow and familiar like molasses.  There are no deal breakers on our island. Sometimes philodendrons suffocate the redwoods, they adorn, but baby, they look good doing it. Extraordinary. I need cream of chicken soup for my cornbread dressing, but it lives next to cream of mushroom in the soup aisle.  I consolidate the drawers I gave you, clothes you haven't seen since they took you into custody, when everyone knows you should be in mine. Yes, that is the secret to a good cornbread dressing. In this wilderness, I wake up to house blinding. I can't see the sun. It's cold in this robe of fleece, no replacement. This, the longest heartbreak, I do all my usual tricks to get over it, late night tinder and then delete. Even with new useless man beside me, I am weak flesh all want, no patience. Baby, you know I never did. I met you like that.  I was binging when I met you, excuse me if I go astray. All the terrible things they say about dating, it's worse, people are terrible, all selfie sociopaths. I'm either ignoring your call or running out of the room to take it. I'm drinking my coffee, coffee for one. When I was 10 and we first had television, there were these commercials for the church of Latter-day Saints. It was a single woman in the city. She walked alone. She went to the movie ticket box. She said in a solemn voice, one please. Her singular, sorrowful finger raised. She walked through a storm of pigeons, fell onto an empty bed. Life in the big city, solo, in a crowd. I was 10. I wonder how many converts came from that one commercial. I search for it on YouTube sometimes. It vanished into spinster hood, I suppose. I never go to the movies alone. Abide. California Department of Rehabilitation and Corrections has made ants of us. Small cogs in huge wheels. They tell us what to wear, if we can touch, how we can interact and for how long. They have separated us, yet brought us closer. They are the test, the opposition, the ops, the cops. They cannot shatter us. We love hard. Two diamonds shining in the dark, shining on phone calls over recorded lines, over 300 miles, over lockdown and count time, over not enough money for packages, a writing block that is most persistent around letters.  Just not fast enough, my love. Thank you. Cassandra Dahlet, y'all.  In case you didn't know. Just, you know. I like to be a giver of information. Our next reader is a poet, educator, hip hop scholar from Little Rock, Arkansas, currently living in the San Francisco Bay Area. Her previous work has appeared in storytelling, Self and Society, which came out on Wayne State University Press in 2018. Patrice Lumumba, an anthology of Writers on Black Liberation, which came out on Nomadic Press last year, and Essential Truths, the Bay Area in Color, which came out on Pease Press last year. She is the author of two chat books, The Body Has Memories and Collective Madness. Some of her favorite authors include Maya Angelou and Toni Morrison. When she is not writing, she is reading or watching documentaries. She also leads Healing Writing Circles for Black Writers. Please welcome Adrienne Danielle Oliver. Thank you, Nazala, and beautiful work, everyone, so far. I thought about doing a singing poem today, but it's like you guys both sung. I think that's enough. And I was looking for poems that had, like, a food reference in here, and they're not directly about food, but it's kind of like Where Is Wild? You can look for the food reference in these poems. So these first two poems are part of a four-part series, and everything's from The Body Has Memories. It's available on Nomadic Press. And the title of the poem is hashtag for a reason, a four-part, fill-in-the-blank poem for the overworked and underloved. And this is part two, hashtag for a reason unsettled. She is a limitless being, finding it safe under covers, indoors, listening to the homedrom of the news from the TV one floor down. The sound travels up through the thin wood between apartments, like a popcorn kernel, wedging its way between two tight molars rarely floss. The sound gets trapped between her ears. The building reminds her of TV portrayals of prison, the yard, the motel-like square that the apartments rest around create an echo chamber to compliment the inside sounds that seep through walls, floors.  Looks down from her fourth floor apartment at concrete. She thinks it would have been a nice place for a garden. She lived in a house once, a field, a village, an open forest by a sea, a sky, a limitless grove of trees, green land. She never thought there'd be so much concrete in so little land, no cool green grass to snuggle between the creases of her bare toes, the stars twinkling the night. Now, all of her sweet things come in plastic of variant thicknesses and her fingers barely remember the prickly tremble of a fresh-picked strawberry from the earth. Thank you. Part three. Hashtag for a reason distressed. She is a limitless being. She has 25.43 generations to make up for because they ain't gonna give us no reparations, she says. And wonders what it'd be like to finally, after all these years, get her 40 acres in a mule minus the mule unless the mule is a high-power energy-efficient Tesla. In which case she'd sail to save up towards the acres. In San Francisco, she'll need $85,000, give or take, for a down payment on a plot of land. She has $85. And a hard-earned pension with the homework of delivering up retirement by age 59. She dreams of paying off her student loan debt and settling down with a nice credit score. 2.5 kids and that white picket-fenced budget. In this budget, she follows all the recommended ratios for living. The monthly rent-to-income ratio, the organic food-shopping-to-income ratio, the ratio to the ratio for this and that ratio, and of course the ratio to the ratio divided by the ratio and multiplied by the ratio.  Her bank account has a bad case of bulimia, so she works overtime to convince it to keep its food down. Apple laptop, open atop the kitchen table, where dinner with friends could be. She eats takeout next to separate buckets for trash, recycling, and compost, and she hopes that making no waste is good karma. Wasting no time, she works until she falls asleep sitting straight up. In true Protestant fashion, she feels guilty forever clocking out. Food stamp line. Heart breaks in this place. I wait in line where the footprints tell me exactly six feet behind the person in front of me.  I know good suits, not because I can afford them, but because I used to work for folks who could. Cheap suit gives me paper, pen, a clipboard to press on to make sure the social goes through the white, pink, and yellow. Waiting for my number to be called, I read a book. Ideas between shiny covers holding pages bound by thread and industrial glue.  I sit here because words cannot feed me as much as chewing. Good intentions and ideas cannot comfort me as much as fullness in my belly. When my number is called, a strange smile greets me. I wonder what it feels like to be graced with a living smile, a parting of lips and a dancing of teeth rather than this ghost of one. The strange smile leads me to a cubicle, does not ask about my day, makes small talk about the weather. I walk behind her in silence, comforted by the assumption that she is doing fine like I am really not. Both our bodies occupying the space of 99%. That good government salary barely enough to pay her rent. We both walked into this building, carrying a weighted breath. Thank you. The life of a struggling artist. I know. I thought I would end on an up note sharing this poem, which also has a food reference. You can find it. For Mama Mari, and it's written in honor of Mari Evans, who published I Am a Black Woman in 1970. For Mama Mari, I am a black woman. I am from a long lineage of can do, of keep on keeping on of, you got this girlfriend. Where are my girlfriends? You got this girlfriend.  I am from the former Confederate states of the U.S. African enslaving A. I can't be your forgetting. I am black tears, not cast before that swine.  I am a capital B, L, A, C, K, woman. Minus the L, A, C, K, K. I am a returning two. I am the original woman. I am free. I am not your magical Negro. Not your light skinned, easy to accept bay. I am not masses homecoming.  And I am not leading that soul train line at your eggnog party. And no, you can not. I repeat, cannot. Shant not.  I have crossed that Mason-Dixon line and made my hair my own field.  Please pronounce my name right and put some respect on it. I am from Aretha Franklin. Patty LaBelle on a high note. Tina Turner on her way out the door.   Thank you. Adrienne Oliver, y'all.  That's everybody. When in doubt, just don't. I am so, wow, such good poetry on a Sunday afternoon, y'all. Such good poetry. And my friends. So, you know, na na na na na. Our next reader was born in the Chihuahuan desert. Raised on a stingray in Ventura and moved to San Francisco in 1980 when he was 22. Served in the Peace Corps where he began writing during a civil war in Guatemala and returned to the Bay Area and received an MA in creative writing from San Francisco State where his teaching career began. His work has appeared over 300 times in journals such as Carve, Bull, Flashback Fiction, McQueen's Quinterly, Riddled with Arrows and the Disappointed Housewife, and has received Editor's Choice Awards, a Publishers' Choice Award, and Best of the Net nominations. He is the author of five books, including Nova Nights from Nomadic Press, and Nomadic will be publishing his sixth collection translated from the original One-Inch Punch Fiction which is One-Inch Punch Fiction this December. He writes a float in Richardson Bay and walks the planks daily. And when he says a float, he means a houseboat. All y'all are jealous. Please welcome our next reader, Mr. Guy Bederman. Hi, everybody. Cassandra's read on the houseboat. It's... Yeah, it's... We used to do floats in salons there in the pandemic hit, so we'll be getting back to it hopefully. But I want to thank San Francisco Public Library and Nomadic Press, Nazila, for the event, and everybody for being here.  So, thank you. I'd like to share a couple of pieces that'll be coming out in translated from the original in December. This first one's called Tomato. In Search of the Perfect Tomato, Lou hits the farmer's market on Sunday. The heirlooms are extravagant. One purplish green monstrosity is on the grotesque side. He examines it closely, pulls back, feels the farmer's staring, and realizes the old guy resembles his tomato the way sometimes people resemble their dogs. How much for one? Lou hopes for expensive? It'll be easy to say no. He remembers the cherry tomatoes his mother grew and ate from the vine, tossing one to the big German shepherd, Francis, who politely swallowed it and waited for another. One dollar, says the farmer, not wanting to offend or appear miserly. Lou forks over a buck and takes the tomato home, thinking grilled cheese and tomato sandwich. But when he slices the heirloom, he forgets all about the sandwich and the farmer and how the tomato looked. In one exquisite bite, Lou savors the taste of summer, this summer, which is all the summers of his past. Yeah. Thank you. This is called Edible Grace. How do we know a fact is not also a fiction, a poem not also a prayer? I'm pushing a cart down the and or aisle of Stoner's Mind Store and discover just what I need. Miscellaneous warnings and advice in bulk. I scoop them into a brown paper bag and instantly they become a quandary. My twin who has come along questions this, which is her right and which she always does. So we proceed to the front, which could also be the back and ask the fact checker who moonlight said Salvador Dali's deli, famous for the world's tiniest sandwich so small it could fit in a matchbox, but so dense no one can lift it. So this leaves us with our quandary, a collective noun undefined. An octopus, by the way, has three hearts and eight tentacles with minds of their own. Imagine the poetry an octopus could write, multiplied by eight. Imagine the pencils alone. Our fact checker rings us up and asks if we want a receipt. We assure them we've had nothing to drink and we're pretty sure it's a fact. At the care facility we find a diminishing friend and a mistaken for a patient. In a heartbeat I sign out the front door and go for a bike ride in the breezy afternoon under a sky so blue just to prove I'm not. The jury's still out. So I write this poem and I pray my twin fits her shadow exactly into mine and for a moment we are one with eight tentacles but only two hearts and the need to dissect back in prayer means less than a tiny sandwich we can't eat. When in doubt we make cookie dough and lick the beaters is any art more beautiful than chocolate chip cookies baking in an oven. Any truth greater than the sweet aroma filling the house. Edible grace our ticket to the sun. Yeah. There are a couple of fun dating stories. So I'll share this one. This will also be in the next one. It's called Jane. It started with a fake name at Starbucks. Harry, I told the barista. Destiny. Gary, she asked. No, Harry. I watched her write H-A-I-R-Y. On the paper cub with a sharpie. Harry was an old man's name. A name that belonged to a different generation like Walter or George or Dick. Wait. Was I old now? And Harry? I paid for my double decaf answering my own question as usual without any help. All that day I used fake names. At the dry cleaners I was Johann. At the dog park with my sister's Corgi, I was Rolf. On a blind date that night I became Cam with a K, I said making that part up on the fly to the woman, Jane. Or was it Frida? Most people stretch the truth about income, health benefits, age. For me it was all about the name. And after the second scotch I fessed up. Jane looked at me kind of funny and I could see in her eyes there was no going back. Not to the truth. Not to the first hug. Not to her place. Or mine. Pity I was into her. A poet who liked black label war high boots named Jane. She asked for our check before dessert from the waiter, Paolo pulled out cash for a little over half the amount I could see she liked to tip after tax.  What's your last name, Jane?  Dough. This is from Novenites. It's called soup. How do you get any work done around here S.D.D.? Easy, I say. I call what I do work. That peanut butter sandwich? That poem at 3 a.m. The vase with the $5 bouquet freshened up each day that keeps on giving. I'm swimming in a bowl of soup.  No lines between pleasure and work and art and chicken noodle. Morning light comes through the stained glass vase on the sill. Standing at the stove this is as close as I'll ever get the church. This is my religion. This envelope I'm writing on my hymnal. Words become song and salvation and I lose all track of time mere handwritten movements on a watch I don't own. Work is what we do every second of each eternal day. Soup is a poem. Also dinner. A friend of mine Linda Saldana had a friend who bought this book and read that poem and I don't know the person but they were so moved by that poem they wrote a poem to my poem and it was an extraordinary experience I have to say I'll never meet her and I read the poem but it was kind of like the two poems were having a dialogue with each other separate from the writers and I just thought that was very, very cool. I'd like to close with actually one that is straight from the mole skin. Yeah. SES It's dedicated to Penelope Chloe Fernandez Biedermann my three and a half year old teacher. The epiphany arrived over toasted English muffin as Penny and I made smiling faces on a buttered surface with sliced strawberries. This is what I wanted to do. This is how I could spend the rest of my days making strawberry faces having three year old fun savoring the wonder reveling in the joy of such moments aware that what's out there the poems to be written the stories to publish the books to promote and sign the bills to be paid the readings to attend the bed to make the games to watch the philosophy to ponder the to-do list to check off the gym work to get done the speed bag to punch the oatmeal to stir the tickets to pay replacing ripe farmers market berries on top of an English muffin laughing at our discoveries smiling to each other smiling at the face we had made the muffin smiling back as we floated in our kitchen table joy. Thanks everybody. Guy Biedermann everyone we had one more reader who has not joined us quite yet so I want to give him at least a few more minutes to join us so I was going to do a couple poems if that's all right I'm trying to stick to theme this is called cannibal in church we ate God every first Sunday or rather we ate the body of his son our lord and savior Jesus Christ washed him down with great flavor blood went home in the afternoon and chewed upon the actual flesh of the dead nonholy I grew up country poor we only shopped in grocery stores for canned tornado food and milk our farmer relatives fed us I spent late summer snapping beans and shelling peas for freezing the first days of after school was cleaning freshly rung chickens by spring we were usually down to hogs had cheese and fat back sandwiches by summer dinner was grits and fried canned tomatoes God bless slaughter season when I was seven I once had a pet chicken it was then that I learned the meaning of life when I came home from school and she was silently on my plate her cage and my belly were both empty hunger eclipsed my righteous indignation God is great, God is good let us thank him for this food vegetarianism is a religion personalized by city-dwelling atheists and rich folk it is an elite western ideology attractive to those with no immediate fear of starvation consumers of billboards and articles and philosophies drinkers of smug self-righteousness to wash down the multivitamins when the rice cakes were not enough humans at their basis to eat what is edible country Christians eat by the bible Jesus gave the people fish invited us to eat his flesh basically said fill your belly with what I have available to you I am no longer Christian but I eat what is available to me my hunger eclipses your politics perhaps I am wrong maybe my country grandmothers and aunties lived to their late 90s in spite of hog moths and pig knuckle sandwiches and mother earth would prefer if we set domesticated food animals free to overpopulate and die from mass starvation though what I do know though is pita protesters are made of meat when the last animals have gone to when this earth inevitably transitions when crops dry up and blow away when the last animals have gone to slaughter due to famine and waste when there are no more chickens there will be vegetarians I will fill my belly with what is available to me hunger eclipses everything and transform saints into saviors and so I'll do this one more this isn't about food this is I guess an after dinner thing the thing you do after dinner right this is called pick me up coffee is unsurprisingly beautiful it's rich taste and aroma filling my head with exquisite wakefulness quickening and warming my heart in hand oh generous lover nudging me out of bed each morning for longing to get to you dancing melodically on my tongue tingling my nervous system your grind motivates me to get up and greet the sun clear-eyed and ready loving caffeinated cup promise you will always be there waiting for me at the cafe up the street sweet and strong you lift me make me believe I can make it through my day and my tomorrows will always begin with you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you And my name is Nazila and thank you all for being here. Have a good evening, night, afternoon, life, do other things.


COVID-19 is the narcissist's karma. It is their misfortune or bad luck resulting from their actions. It's cause and effect. What you put out is what you get back. Our actions influence our future. And if you look at the narcissist's actions, you can see why they are now having to deal with this. Of course, I know that it's not just narcissists who are going through this. Everyone has been affected by it in some way. But I believe that narcissists are getting the worst of it. There are certain jobs that narcissists tend to gravitate towards which are being affected more than most. We are in a time where everything the narcissist needs to survive is now very difficult for them to obtain. Attention, admiration, money, power, sex. In many places they can't even go outside anymore. And this is why we are seeing a surge in domestic violence since the start of the lockdown. In the UK, domestic abuse killings have more than doubled since the lockdown restrictions were imposed. These narcissists can't get supply and it's making them really mad, even for a normal person. It's no fun being stuck at home all day. But for a narcissist, it's far worse. They cannot survive without constant attention and admiration. They will become very irritable and they will attack whoever is around them. If there's no one around them, they will become depressed and even suicidal. But before that happens, they're going to be all over social media, showing some skin, taking pictures in their masks, doing whatever it takes to get the attention and admiration that they crave and need because they can't live without it. They can't use this time to go within and learn more about themselves. They can't use this time to practice mindfulness or meditation.  And when they're alone, they're forced to reflect on their shame. All of the things they've done and it's too painful for them to deal with. It makes them feel like a bad person and that is why they constantly need to be around people. They constantly need to post pictures on social media because it makes them feel as though they are worth something. When deep down, they feel completely worthless but they don't want to acknowledge it. So they do whatever it takes to distract themselves from the truth and reality of the situation. But I can guarantee they are struggling. They are having difficulty getting supply. They are having difficulty getting attention and admiration and many of them have lost their jobs. They're struggling to pay off their car or their mortgage. They can't afford to have food delivered so they stock it up on pasta, rice or noodles. Narcissists have a need to feel powerful. They have to feel as though they are in control of their environment. And during this time, they have probably never felt more out of control in their entire lives. They are fearful and insecure and that is why they need to be in control at all times. A person who is not fearful or insecure has no desire or motivation to control anyone or anything. But narcissists are very afraid. They are always on edge. They have little confidence and they are uncertain about their own abilities. And that is why they have such a desperate need for control. But during this time, they have almost no control over their lives. No control over their futures. They are in a crisis. They are going through a time of intense difficulty or danger. And that is why you may see them popping up again. You may see them making that quarantine hoover attempt. Because the only time they will want to come back is when things aren't going well for them. So this is when you are likely to see those late night messages on your phones. Asking you if you are okay. Asking you if you need some company. But it's all fake. They don't really care about you. Everything they do. It's all about them. It's all about getting their needs met. Using you for their own advantage. They have no interest in supporting you through this difficult time. So don't give in to those hoover attempts. This COVID-19 is their karma. Leave them to deal with it on their own. This isn't our karma. It's not something that we have to deal with. And that is why while all of this is going on. You will find that your life continues to improve. You find yourself going within more. Practicing mindfulness and meditation. Eating better foods. Getting more exercise. Maybe you have been looking into starting your own online business. These are all things that the narcissist will not be doing during this time. They are not going to self reflect. It's too painful for them. And they think there is nothing wrong with them anyway. They are not going to be eating healthily. They are going to be emotional eating. Using junk food. In an attempt to regulate their emotions. They are not going to be eating healthily. They are not going to be exercising. Because they only did that to gain admiration from other people. They never did that for themselves. And if no one can see it while they are sitting at home. They are not going to waste their time. They are not going to have the time, energy or focus. To start their own online business from their homes. Because during this time. All they can think about is getting supply. They need constant attention and aberration. They need power and control. They need money and sex. And these are all of the things. That they are struggling to obtain during this time. Before this COVID-19. Many of them had no problems obtaining any of that. But it wasn't through being fair or honest. They had to trick and deceive to get what they wanted. They had to lie and cheat. And it's wrong to do that. You can't just go around exploiting people. And expect to get away with it. Because it will always come back to you in some shape or form. And this is what these narcissists are dealing with now. That's why they are struggling. This is their karma. And I am not going to say that they deserve it. I am not going to say that anyone deserves to lose their job.  But it is what it is. We all know what is right and wrong. We all know how to behave. It's just that some of us choose to cut corners. And when they cut corners. We all know how to behave. It's just that some of us choose to cut corners. And when they cut corners. They end up just going around in circles. In the moment. They think that they are getting something out of it. They think that by taking advantage of someone. It's going to get them somewhere. It's going to improve their lives in some way. But it always comes back to haunt them. Their past situations or decisions. Always come back to cause problems for them. In their present or future. And that is their karma. That is the law of cause and effect. Their misfortune or bad luck. Is the result of their own actions. They are the cause of their own problems. They brought it on themselves. Just don't let them back in.  That's all these problems are. Misery and destruction. Remember. Misery loves company. These people are comforted by the knowledge. That other people are also unhappy. So they will try to get back into your life. To make you miserable. Just like they are. And that is why you could not let them back in. They might not have COVID-19. They might not have COVID-19. They might not have COVID-19. But they do have another sickness. Which is far worse. Another sickness that will harm you. And that is their narcissism. Just know that this is their karma. They are going through it. They are struggling to obtain the things that they need. And following this pandemic. Their lives may never be the same. They are not going to use this isolation to improve their lives. Narcissists are outwardly focused. And right now there is nothing to focus on. But fear, pain and misery. So you can be sure. That's what they are going to be attracting into their lives. Thank you for watching. I hope this video resonated with you. Please like, comment, share and subscribe. Click the bell icon to receive notifications for my future videos. If you would like to donate, my PayPal link is in the video description. Coaching inquiries can email me at narcissistcoaching.com Thank you for watching and I'll talk to you soon.


confess that it's extremely it's quite a quite an honor and it's extremely you know it's a humble experience and an honor to get this award because I mean at the start of my career I've always you know been so proud of when women they are making a mark in the industry because we are no wonder we are quite a you know you know women are not really in terms of the number of women in the marketing in the agency as well in the media and I always feel that women are way more compassionate and they are very passionate about their work and all that but the recognitions are way far lesser than it should be so as a onset of my career I've attended this event quite a few times and I always used to emulate and you know admire and respect the winners of this event but I felt they have always been extremely you know they have been an influence a very positive influence on or at as regards to the industry at large inspiring and that's what it is and that's as a worker or as a professional women are way more I think I for details if you say they are particular they are more finicky and I guess that is intrinsically a part of our DNA and this saw I mean I'm today extremely humbled as I said an honor to get this award because what I have always wanted and it's like you work for it as a conviction and you got it and it's very nice that the brand I work for and I work for brand for Raymond which is the complete man I personally feel that you know in end of the day women should be encouraged in terms of and should get that respectability in the circuit I mean there's nothing called equality or there's nothing like that it is they are part of that they're like everyone I mean it you should not discriminate between a woman being on you know in a senior position versus a man can be I mean those are like why discriminate because end of the day it's the it's the talent it's the conviction it is a way of working and what value add to the job that you're doing