We are here for the talk Wheel of Fortune, analyzing embedded OS number generators with Joswetsuz and Alia Basi. Short introduction, they're both researchers. They work with distributed and embedded systems groups at the University of Twente. Joswetsuz is hardening systems and hands-on teacher for offensive security. Alia Basi comes as a researcher from Ruhr Uni in Bochum. He has a chair at System Security. Before that, he was head of vulnerability analysis and penetration testing group at the Sharif University of Technology in Tehran, Iran. Starting with that, I'll just give over to both of them. And we'll have a great talk and questions and answers later. Yes, thank you. OK, thanks. All right, welcome everybody to our talk, Wheel of Fortune, analyzing embedded OS random number generators. So start with Jos, you want to introduce yourself? So I'm Joswetsuz, as I already was introduced. And I'm a researcher at the Distributed and Embedded Systems Security Group in Twente. And this is Alia Basi. Yeah, I'm Alia Basi, a PhD student at Distributed and Embedded Systems Security Group of University of Twente and visiting researcher at Chair of Systems Security of Ruhr University, Bochum, in Germany. So we start with the introduction to embedded OS random number generators today. And then we overview some embedded challenges for generally and specifically for OS random number generators. We will have some cases studies with showing these challenges, how it's affecting already existing embedded OSs or real-time operating systems. And this work is actually ongoing research. It's part of your thesis, which I am supervising. And yeah, so first of all, embedded systems are actually now everywhere from consumer electronics, medical devices, critical infrastructures, military equipment, or aviation. So actually, you see them everywhere. And beside that, there is a drive for connecting these embedded systems as an intern of things. While these original devices were not designed to be connected to the internets, but now there is a gap which vendors have to fix. And this can cause problems. As you can see, for example, for the random number generators, which we specifically work, you can see there are the problems. For example, millions of embedded devices use the same hard-core SSH and TLS keys, which make some noises in the media. So the OS random number generators. Well, what is randomness? I don't want to talk about the philosophical talk of randomness here, but it's generally in a stream of bit if you cannot predict the next bit with the probability of more than 50%. Then let's call it random. And another side of it is entropy, which is very interesting. It's a measurement of information, unpredictability, and how unpredictable are the information. And usually, high entropy means very random or higher randomness. And of course, why these things are important? Because actually, random numbers are actually a fundamental part of other security ecosystems we have. So for example, we use it for cryptography stuff. So for keys, nonces, or exploit mitigations, which maybe you never heard about it. But actually, we are using them for exploit mitigations, such as ASLR or stack-smashing protections. So randomness is actually critical for other underlying system which builds up on them. So that's why they're critical. So how we can generate random number? So physically, true random number generators are like radioactive decays or shut noises. You can implement it in two ways, as external devices such as TPM, or HSM, or as an integrated device within, for example, Intel, Ivy Bridge, CPUs, or certain smart cards. But there are some downsides for it. For example, they are expensive. Or there is some portability issues when the Covendor tried to move to the next architecture. So that's why, because you can't use those expensive hardware, is you are using software with random number generators. Well, there are deterministic algorithms which you stretch seats into sequence of random-looking bits. But the problem is that not all of these random number generators are designed to be used for security purposes. For example, RAND, which we are going to show, it will be used later by some people. It's not designed for security purpose, but some people use it anyway. So because of that, we have secure random number generators. And usually they have three features or properties. First of all, the output must be indistinguishable from the uniform. And there must have forward security, which means that in case the internal state of the system is compromised, the past outputs must still appear random. And again, for backward security as a feature, which is that if internal state is compromised, again, the future output must appear random, provided that the receding is with a sufficient or good quality entropy. So because of that, designing random number generators are not easy. So because of that, you have, for example, some certain standards for it, like NIST SP890A, which assumes some access to possibly by a source of seed entropy. But the problem is that this standard leaves some hard problems. For example, initial seed entropy, or receding control, or how is the quality of the source of the entropy. So because of that, well, some other people think about it and design something else, such as ERO or Fortuna, which already implemented in some advanced OSes, such as OS6, or FreeBSD, or iOS. So the problem here is actually a chicken and a hen problem, because well, to generate random numbers, you need some kind of entropy or randomness. But these randomnesses, again, needs another source of randomness. So ideally, you want to use the physical phenomena, such as if we consider quantum randomness, it's like radioactive decay, shot noises, or non-quantum randomness, such as thermal noises, atmospheric noises, and sensor values. Well, this is so, let's say, not always available. So practically now, for example, general purpose computers, you can see that you can use unpredictable system events. One good source is the user itself. So kiosk timing, mouse movement, or disk access can be used in general purpose computers as a source of entropy. And therefore, actually, we believe that randomness, or secure randomness, should be provided as a system service, because it's hard to implement it. And well, of course, people make mistakes later if you don't. So actually, many OSes actually already provide such secure randomness as a system service. For example, do you have DevUrandom in a Unix-like system, or Criptgen random API on Windows? And another important thing is that, again, lots of other security products are built upon them. So for example, OpenSSL, for example, assuming that there is a secure service from operating system as random number generators. And again, based on OpenSSL, you have OpenSSL and OpenVPN, so it's very, very important. So now I think you'll start with that. All right, so we've taken a look at the general background of random number generators. And now we'll take a look at why it's so difficult to get these right in the embedded world. So the common advice when you need random numbers in the general purpose world is just use DevUrandom and draw from there. But it's not as easy in the embedded world because of various design issues, which mean that operating system random number generators in the embedded world are often absent or broken, as we'll explore in this talk. So the three main areas of constraints are polyculture, resource constraints, and low entropy environments, which we'll all discuss into detail and how these relate to particular implementation difficulties. So the first of all is that in the embedded world, you have a polyculture of operating systems. Whereas in the general purpose world, you've got Linux, you've got Windows, you've got your Mac OS X in the embedded world, you have various kinds of different operating systems ranging from high capability micro kernels to very small monolithic systems, all with different constraints and different kind of capabilities and catering to different systems. So if you design a general operating system, a random number generator design, it's very hard to have this standardized all across the board because of this variety. And the same, of course, applies to the hardware spectrum because you have a wider range of microcontrollers and microprocessors, all with different capabilities. And it's not uncommon to see older or functionally stripped down versions in newly-fielded devices. So if you design a random number generator based on the assumption that you have some source of hardware, random number generator or physical source of entropy, then this means that your operating system cannot be deployed across a wide range of chips. So that's definitely a major design issue there. And of course, embedded devices are designed to have a small footprint and to be resource efficient. And this translates to various limitations when designing random number generators. So for example, limitations with regards to CPU speed translate to lightweight cryptography requirements, power consumption limitations, especially for battery operated devices mean you need to have a simple design to have limited entropy polling activity and memory limitations mean you need a small entropy and internal state in your random number generator in order to implement it in these constrained devices. And of course, there's the issue of the embedded world just generally being very boring. There is little activity going on and what activity is going on is usually very predictable. And there's a limitation with regards to common entropy sources like Ali discussed in the general purpose world, you often use disk activity timings, keyboard events, mouse events. But in the embedded world, you often have to deal with diskless nodes. You don't have peripherals. You don't have a user and you don't have hardware random number generators. And even commonly available sources like interrupt request timings are often not that good because they're too periodic. And these conditions are usually worse during boot time because you have predictable boot sequences. There's little activity going on at boot. And some entropy sources you might want to rely on are simply not available yet because they have to be initialized by the system after the boot sequence. Yet non-blocking interfaces to random number generators such as the DeFi random interface allow from drawing from the random number generator even when insufficient entropy is actually available in the system. And this results in something called the boot time entropy hole. So this is particularly bad because a lot of embedded devices often generate cryptographic keys on the first system boot. So this means that if you have a system with general low entropy conditions and an initial state predetermined in the factory combined with these low boot time conditions and then generating a key this results in very serious cryptographic issues. Common solution you encounter to deal with with boot time entropy in the general purpose world is using so-called seed files which is basically a file with collected randomness which is drawn from by the random number generator put into the system and when the system shuts down it writes to the file again. But in the embedded world it's kind of hard to generally deploy the solution because how are you gonna deal with diskless nodes? How are you gonna draw your entropy before a file system is mounted which is often required and still this doesn't solve the first boot problem. So some common embedded work around you encounter is including an initial seed file in the firmware and this initial seed file obviously better be unique and unpredictable per firmware image otherwise it doesn't do you much good. Or using personalization data such as the MAC address or serial number of a router and using it as seed entropy which is also a very bad idea as shown in the resource mentioned on the bottom or using other dubious sources of entropy such as clock timings, process IDs, foreign MAC addresses, et cetera, et cetera or simply including hard coded pre-generated keys which is also a bad idea as shown in the little black box project. So now that we have an idea of why it's hard to get embedded operating system random number generators right we're gonna look at a couple of case studies of operating systems fielded in various embedded... The cold part. Yeah, the cold part. Various embedded systems and how they get this wrong. So the first system we'll look at is QNX which is a UNIX like POSIX compliant real-time operating system initially released in 1982 and later acquired by BlackBerry. It's basically the underlying operating system for BlackBerry OS. It's used a lot in automotive systems as well particularly the entertainment systems. You also encounter it in carrier grade routers, military radios and some nuclear power plants. And it provides a custom debut random implementation which is always non-blocking so you don't have this blocking, non-blocking distinction you have in most UNIX like systems and it's implemented as a user space process addressed by a kernel resource manager because QNX is a micro kernel. An interesting thing to note is that the random number generator has always started after boot by a startup script so that's a thing to keep in mind when designing something for QNX. And we reverse engineered the implementation of the random number generator and it turned out to be based on Yarrow by Bruce Schneier, John Kelsey and Niels Ferguson but it turned out to be based on an older draft implementation of Yarrow and not the reference Yarrow 160 document which accompanied the paper release. So it only has a single entropy pool and no fast and slow pools and no blocks if or is applied to PRNG output at all. It's directly drawn from the internal state. So and QNX Yarrow in turn diverges from this older implementation as well by mixing PRNG output back into the entropy pool and having some re-seed control divergences which we'll discuss later on. So this is the design of QNX Yarrow which is relatively simple. You have your boot time entropy, you have your runtime entropy and it's drawn into an entropy pool and then you have the output function which draws from the entropy pool and also seeds back into the PRNG state. We first tested the randomness quality of the device output using the die-harder and the NIST statistical test suite tools and it passed both of these test suites but this only tells us something about the quality of the PRNG output. The source entropy can still be heavily biased as we'll see later on. After reverse engineering the boot time gathering routines we found that it draws from four sources only and these are static and non-configurable. That's the system time, the clock cycle count, the currently active process IDs and the currently active device names and they concatenate this and they pull it through the SHA-1 hash function and the resulting digest is used to initialize the QNX YARO initial state. So we decided to, because they sounded kind of dodgy, we decided to evaluate the boot time entropy because if this is very biased it might be feasible for an attacker to replicate the PRNG internal state after a reasonable number of gases. So our quality measure is the min entropy which basically means how likely you are to guess a particular value on the first try and to earn the 56 bits of uniformly random data have to earn the 56 bits of min entropy. We use the NIST entropy source testing tool to evaluate this data. We collected 50 boot runs by instrumenting the random number generator and logging the raw data that was collected during boot time. The average min entropy is 0.0276 which isn't good at all because that means it has far less than one bit of min entropy per eight bits of raw data. As you can see in the visualization on the right where the dark spots are low entropy spots with a particularly low entropy spot at the bottom left, at the top left, I mean. So we also evaluated the cross-boot entropy because even if a system has relatively good entropy quality during a single boot run if it's consistent among various boot runs this is also behavior you don't want and it turned out that apart from having less than stellar single boot entropy gathering it also had a very consistent and predictable pattern across 50 boot visualizations as you can see on the right. And you need to consider that this operating systems like these are deployed in firmware images so processes always spawn in the same order and there's the same number of processes spawning. So all these process IDs that are fed into the boot time entropy are usually static and the same goes for the device names and really the only randomness here comes from the clock time and the clock cycles and even there there is less variation than you would want because of the real-time nature of the system. So this is what the after reverse engineering the runtime entropy collection engine looks like. On the left you got your high performance clock measurements. On the top you have system information which is basically process IDs, thread IDs, flags all these kind of process variables which are fed into the, through a SHA-1 into the Yaro input function. And in the bottom left you have your interrupt timing source. In the bottom right there is an undocumented function which is a callback option to a library possibly for true random number generator support but there's nothing in the documentation there and it's not clear from the code either so. So some thoughts on this runtime entropy. The system information polling has some problems because there's lots of static information things like user ID, flags and priority are not likely to vary at all between different runs and stack and program base will only vary if you enable address space layout randomization which is disabled by default and time or program state based randomness is really the only randomness you're gonna get from this source. When it comes to the interrupt timings one of the big problems is that it really puts the burden on the developer because the developer has to select which interrupts to draw the entropy from. So that means that they have to decide are these quality sources are they not triggered too periodically, et cetera, et cetera. But this doesn't really matter because in almost all Q and X versions there is no receipt control. They actually after reversing the binary they implemented the functions but they never actually call them which means that runtime entropy is accumulated but never actually mixed back into the state and boot time entropy is the only entropy you'll find in the entropy pool of a Q and X Yaro implementation and this is very dangerous especially if we consider the quality of boot time entropy we earlier saw. In the latest version Q and X 6.6 this is there was an attempt to fix this by integrating some form of reseeding into functions called during initialization and output. So whenever the PRNG output it reseeds from part of the pool but an issue is that no entropy estimation is actually done. And this is what Yaro was initially designed to do to do entropy estimation on your entropy pools so you only reseed when you have proper entropy quality in these pools but this isn't what it does it just reseeds all the time. Luckily we disclosed some of these issues to BlackBerry and based on our suggestions they drafted a new Fortuna based PRNG Fortuna is the successor of Yaro for those who don't know and it's available in patches for Q and X 6.6 and it will be the default random number generator for the upcoming Q and X 7 which should be released I think in January or something like that. So this brings us to the next operating system which we can't mention because it was studied under NDA. It's a POSIX compliant real-time operating system used in highly sensitive systems such as the Joint Strike Fighter, the JTRS military radio system and the International Space Station. And it has a random number generator available via DEVU random interface and it has two associated functions called U-RandomRead which fills a buffer with N bytes from its random function and U-RandomWrite which reseeds the PRNG using only the first D word from the buffer you provided so that gives you an idea of the quality of this thing. So we reverse engineered this as well and took a look at what the underlying PRNG actually was and it turned out to be the G-Lib CBSD random function with custom constants and as the documentation clearly states this is not a secure random number generator so I don't know why they implemented it there but it's there. That's not the worst thing because we also discovered a local reseed attack because the DEVU random devices were writeable which means that anyone on the system can force a PRNG reseed regardless of their privileges so a very low privileged user can simply write a seed to the random number generator and then all across the board control the PRNG output. So, yeah, that's nice. Even if that wasn't enough we also discovered a known seed attack because if you reverse engineer the initialization routines you see that there's no seeding at all there's just a static 32-bit seed which is the same across all these operating system deployments it doesn't vary from firmware it's just the same sequence over and over again and there's no actual entropy in the system at all. Don't put my brand eyes on it. So, an attacker who knows the PRNG seed also knows because PRNGs are deterministic functions they also know all corresponding PRNG output consumed by crypto applications so she can see on the slide here the SSH key generator simply draws from the same output we saw earlier produced by this known seed. So, consider a remote attacker no local attacker who has a public key generated on this target operating system and they know the initial PRNG seed they simply clone the random number generator seek the appropriate state offset read from the random number generator generate a corresponding public and private key pair and if it matches the target publicly well obviously also the private key matches and if it doesn't it iterates to the next state offset and because these state offsets are determined by how many bytes have been read from the DevU random device this is bounded by a very reasonable brute force upper bound because I don't think more than four gigabytes will have been read from the random number generator before generating your keys. So, we can even pre-compute a lot of this and we can do a live demo but this is a screenshot of an attack on the SSH day of the device itself where we will recover the private key corresponding to the SSH host key within a couple of tries and yeah, that's basically it for this operating system, you're welcome. Yeah, and the funny thing is that I don't think even they are going to patch it but so the last case of study is VxWorks 6.9 it's a real-time operating system initially released in 1987 it's actually using for example, Mars Curiosity rover Apache helicopters or like X-47 B drones or lots of telecommunication equipment. Well, about VxWorks actually it doesn't provide any secure random number generator and actually you can see in libraries such as OpenSSL, WolfSSL or creep, there is no reference for it either. And well, it will have predictable consequences too so as you can, if you search in the internet for the developers who are asking questions about this stuff, about VxWorks you can see that, well, somebody comes and say, hey, I implemented, I use the RAND function as a seeding source for, I don't know, the OpenSSL which as you remember, we initially say that it's not secure, it shouldn't be used for security purposes and well, yeah. Well, and if you are thinking that this tree operating system or at least the first two which had problem and you were laughing a lot about it is the divorce actually is not. Actually in the meta-dorses and real-time operating systems actually majority of them do not support any secure random number generator and VxWorks is far from the only one with these problems but well, VxWorks is one of the biggest one and you expect that they provide something which they don't and you want to take away, yeah. Yeah, so what are the takeaways from this talk? Well, the first one is that the embedded world is harsh because there are constraints everywhere and low entropy issues are very serious and it's hard to deal with these in an operating system that seeks deployment across various kinds of chips with different capabilities. CSP or NG design is not a joke, secure randomness should be provided as an operating system service whenever possible. Please don't put the burden on developers because they will screw up as these issues from the mailing lists have shown and more scrutiny is required because the advice just use DevU random should not lend the developer into trouble as it would with these previous operating systems and too much of the embedded security world is still unexplored terrain so we need more offensive research into these embedded operating systems to get them almost up to speed with the general purpose world. So if you're looking for more technical details on embedded security, I recommend our talk at USENIX Enigma in 2017 and if you've got any questions, you can ask them now. Okay, thanks a lot first. For questions and answers, please use the microphones. Just line up behind the microphones and I'll pick you for your questions. I'll start with you. So this is not a question, this is a nice story that might be replicated. Please, only questions at the moment would be really impressive. No, this is about randomness. This is about randomness. I talked to an HP lab engineer from Bristol and he told me the following story because they had so much bandwidth on the internet they then decided, well, let's see what happens if we send a random bit stream to Dev Zero in a foreign country. It just took two weeks for the GCHQ to knock on that door and ask them what the heck they are doing there and the random number generator they used was a noise diode. Okay, thank you. Question from the internet, is a radio noise from a software-defined radio a good source of entropy for a random number generator? I'm sorry, can you repeat the question now? Is radio noise that you get from a software-defined radio chip, would that be a good source of entropy? Yeah, I mean, I guess it depends on your threat model because is it possible that the attacker controls radio signals around the device that draws solemnly from the RF chip? I mean, a specific frequency range, yes. If we can control a specific frequency, then, well, it's not. It's really dependent on the case. It could be good, but it really depends on your threat model. Is it a remote attacker you're dealing with, an attacker with physical access, et cetera, et cetera? One of the slides you mentioned... A little bit closer to the microphone, please. In one of the slides you mentioned, early boot, low entropy attacks, do you have any best practice recommendations for application developers? Because on Linux, there are random blocks. For example, on the BSDs, the random does not block unless it hasn't been seated yet and open BSD seats it in the boot loader stage before even the kernel main function one. So is there no application developers opposed to know every operating system? Well, the problem with the blocking thing is, and this came up in communications with BlackBerry as well, is that if you say, I only provide randomness when I have sufficient entropy in the pool and I'm sure this is high quality, this is not as easy to do in the embedded world because that means that, for example, if you need some source of secure randomness during boot and you don't have enough entropy, then boot times get really slow and especially if you have devices under real-time constraints, this is an engineering hurdle right there. So I'd say a paper was published, I think, at Security and Privacy 2013, I think it was called something like Welcome to the Anthropics or something like that. And there were some good best practices recommendations for the embedded world there, mainly in the form of seed files, but as we mentioned already, if you have diskless nodes there, it's kind of an open problem to design a real good embedded open source random number generator all across the board. Second microphone back there, please. Thank you. You mentioned the NDA you have with the vendor. What is the nature of your relationship with this vendor? How did you end up with an NDA with them? And how are you so sure that I'm not gonna fix it? I have an arm in front of me. I can just tell you that it took one year for us to get to us because they're providing, well, they claim security via app security, so that's how it is, to be honest, in lots of real-time operating systems. They are living in 1998. So it's an academic effort, not a consulting assignment. Okay, thank you. Okay, then you please. Thanks for cool talk. First question. ARM V8 relies on UAFI random for initializing kernel address randomization, layout randomization. Do you think that relying on bootloader is better for operating system than trying to solve random problem with ugly means? I mean, don't take random number generating into their responsibility of the operating system, but put it to bootloader. Yeah, I mean, I guess that depends on your design model. For example, that would require you to have a bootloader that's standardized all across the board where you want to deploy it. For example, if there's no bootloader that's suitable for the kind of embedded systems you want, but you do want an operating system and it doesn't have a random number generator, then you're left without a random number generator. So it's one of the biggest problems, and this is where this polyculture argument comes in, is that in the general-purpose world, you can make some assumptions about hardware roughly looks like this, roughly has these capabilities, software, the same. But in the embedded world, there is so much diversity that it's probably better to optionally include functionality all across the software stack in this case than to simply say, oh, we simply assume it's there in the bootloader, and then it turns out that it's not there in the bootloader. Okay, thanks. Another idea, can we rely on the manufacturer which makes a small device without random number sources to feed the device by random input during the manufacturing, I mean attach the device before selling it to some random, expensive random number generator, get the random input and then go. Yeah, it's one of the things I mentioned, that's essentially a seed file, and it's one of the things I mentioned in the slides. If you include a seed file with your firmware image and you make sure it's random per firmware image, then that might be a workaround, but that depends on how well the vendor understands what they're doing, because a case in point would be the Western Digital self-encrypting drives thing, where they actually generated keys based on the Lipsy RAND function. So. Or VxWorks. Yeah, that kind of stuff. So it could be a solution, but yeah, that depends on the vendor whether they do it well. Thanks, Jo. Thank you. Okay, we have time for one short last question. Okay, you have three pretty bad examples here. Do you have a broader view of the field? Are there, is it a general problem that they are all this bad, or did you just pick the three worst ones that you stumbled upon? Are there some operating systems that do it right, and whatever right might be? She does. No, actually these are the best. You got the best. Okay, thank you very much. A warm round of applause for them again, please.


Hi, everyone. So glad you could join us for another episode of Most Powerful Woman in Sports, where the world's greatest marketers, media pros, athletes, and coaches share the remarkable career journeys to achieving peak performance. We'd also like to hear from you to join the conversation in the chat and questions in the Q&A box. I'm thrilled today to introduce global brand and PR strategist, Marvet Brito, president, CEO of the Brito Agency, whose diversified portfolio is at the nexus of sports, entertainment, fashion, politics, and business. We'll talk about Marvet's career, how she became an uber connector of sports stars, and what it takes to succeed today in the cutthroat world of PR and brand strategy. But first, some background on Marvet. Called on by those in the know, Marvet is the ultimate brand architect. Marvet founded the Brito Agency in 1993, and from there has built a thriving global business-shaping brands. And having worked alongside the likes of everyone from Magic Johnson, Yankee's great Gary Shuffle, NBA All-Star, and entertainment producer Tyson Chandler to critically acclaimed director Lee Daniels and music legend Mariah Carey. Marvet is hardly behind the scenes though. She is a force in her own right with over 100,000 Twitter followers, I'm jealous, and is often tapped as a brand strategy and crisis communications expert on NMSNBC, The Today Show, CNN, New York Times, and yes, she has appeared several times on Ad Weeks events. Marvet, welcome back to the show. Hello. Hey, Marvet. Great to have you here. So good to see you. Thank you for having me, Lisa. Always good to chat with you. Same, same. Thank you for joining us. So we're going to start from the beginning. I want to start with how you, because I've never asked you this before. So it'll be interesting to me who I've known you for a few years now. How did you actually get your start in PR and brand strategy and then specifically in sports? You know, Lisa, I wish we had enough time to really talk about my journey because it was a long one. And really a non-traditional one, because back when I started in 1991, Black women, particularly in women in PR and branding, was an anomaly. And so I was a former waitress, actually a former flight attendant that ended up moving to New York City. I was a waitress before I started my business, and I went to what I love to call Barnes & Noble University. I literally believed that I had the innate ability to build equity and to build brands. And I essentially went to Barnes & Nobles and sat on the floor and read books I could not afford to buy and really just educated myself on all things, branding, bios, stories, because I knew I had the ability to serve and the ability to serve other people to fullness. For me, it's about taking people from fracturedness to fullness through brand equity and building their brand profiles. So that's my short version, and maybe one day I'll be able to share the longer version with you and the ad-week community because it is quite an inspiring college dropout to CEO journey. Wow, I would love to hear it, but I am curious. We could spend just a moment if you could tell me how you actually got to PR and brand strategy. What was it sitting in Barnes & Noble that got you there or was it somebody who inspired you? Why PR? You know, I think that if you have, I think we all are born with gifts. We all have an innate purpose within us, and we just have to really find the environments that will nurture our gifts. And for me, I was always seeing people fully realized. I would walk into businesses and give recommendations to what I felt a business owner should do. I would talk to my friends about the things that I felt they needed to do. I went to school and studied political science. I went to Tuskegee, and after two years, I felt like I wanted to just fly towards my greater purpose. And I wasn't really sure what that was called until I moved to New York City. Again, I was a flight attendant. Eastern went out of business literally in the air. I was stuck in New York. And as I lived in the city, I just began to understand that PR was a practice that was able to help me shape perceptions. I was really, really big on shaping perception and helping to understand how I could change the way people felt, the way people interacted with each other. And I realized that PR was the most potent tool to do that. When you think about how people act, how they consume, how they respond to their environment, how they respond to each other, it's awesome level of PR or shaping of perception, shaping of the way that they think. And I knew that I wanted to work on the positive side of doing that. Okay. So what is a day in the like of Marfette, Fredo, like, tell me, I mean, what do you do? What do you do? I mean, I know a little bit, you help us out with a lot of our speakers and give us strategies. But how do you work with sports stars? Let's start there. How do you work with your clients? Well, what I do for every brand and every client that I work with is that I do a couple things. First of all, build equity and bring value. That's the number one thing that we should all do. No matter where we live, where we work, what we do in our day to day lives, it's always measured in how valuable we are and how much value we bring to another individual or to an enterprise, a corporation upon which we work. And so that's what I started doing in 1991. I started to work and bring value to people within my ecosystem. And that work, which we'll get to later, which I call servitude, spread very quickly amongst my ecosystem of friends. I was always willing to work, always willing to support, always willing to partner. And from that, my gifts and talents were beginning to be nurtured. And one of the things I'll talk about later, because a lot of people always ask, well, how do I find people who will help nurture my gifts? And how do I find people who will actually hire me to do what I know I'm capable of doing? It starts with servitude, Lisa. It starts with believing in yourself and just doing it. I believe that people, when you're passionate about something, you'll do it without even being compensated for it. That's how that it fuels you, right? It becomes the thing that makes you tick. And that's what I was doing. I started with a young actress, Michelle Thomas, who was my official first client. Gary Sheffield was my official first paying client, but Michelle Thomas was the first person who let me practice my talents on her, if you will. And I did such a great job for her. She was on a show called Family Matters. And I got more press for her and she was a guest star than the main actors on the show got. And so quickly, people started to ask, Michelle, how did you get on this magazine? How did you get on Regis and Kathy Lee?  And she started to just share with people that more of that Brito was the one who was helping me, that I was helping to shape the storytelling around her talents in a way that no one had done before, really because she wasn't considered the star of the show. So no one was really thinking about her. So from there, I got a call from Gary Sheffield, whose uncle, Doc Gooden, I was friends with. And from Gary Sheffield, then that's where the Brito agency's journey began. And I started with, I was, I guess, blessed enough to say that I started with someone who was a wildly celebrated baseball star at the time. And he allowed me to learn. He allowed me to learn and develop my skills. But that was how I started in sports. Gary was our first sports brand. Go Yankees. So how does it work now? I mean, how has PR evolved since, I mean, I'm not even going to ask since the 90s, obviously, it's dramatically changed. But even in the last few years, how have you seen your business shift in terms of working with, let's, we'll focus on the sports talent, working with them in terms of that seems like there's a lot of effort and focus towards brand marketing and getting them involved. Why is that? Why are they going this route? And how are you helping them? And how has it changed? Well, you know, I think, I don't, I think the only thing that changed really is the message vehicles, right? When I started in the early 90s, there was no, certainly no internet, no Google, no social media. So we really had to do the work. It was all about reading. It was all about writing. It was all about communicating, picking up the phone and really getting journalists and potential partners outside of the sports world interested in the brands and the products that you were working with. If you look at sports, sports is all about consumer engagement and fan engagement. And it's all about getting those fans to become ambassadors, both of the team that the brand and client plays for and for the client individually, the difference between what I do in the Brito agency does and what the teams do is that the team is keenly interested in the team. They're there to advance the Yankees, the Yankees or the Knicks per se. I am there to build equity in the player. We help players build legacy and to really position themselves for life off the field and off the court, right? Because one day their career will sadly come to an end.  So that is what we started doing very early on, is cross pollinating the guys and first of all, starting with helping them create a very distinct handprint. And what does that mean? Yes, there might be several hundred players on a football squad, several players on a basketball team, but it's your job to bring your authentic, distinct handprint to the job every day. And it's my job as a brander to amplify that handprint so that I can communicate your value proposition to an audience, to fans and to potential partners. Because if you are Odell and you have blonde hair, or if you are someone who has a particular way that you celebrate in the end zone, if you have a certain way like Gary Sheffield has, where he swung his bat with a particular style, all of those things are things that we amplify. And then you introduce those nuances to potential partners and you bridge brand alliances. So teams are around really to make sure that the stands are filled with people who are there for the Yankees, right? Our job is to make sure that people specifically are there for the individual player because the player can't do a whole lot with the Yankees brand when he's no longer on the Yankee field, right? And so we want to help the players build legacy, build category leadership while they're in the game so that they can have lifelong legacies and really build enterprise when their careers are over. Okay, so I'm going to continue asking you questions, but I'm also going to ask the audience, please be sure to drop your questions into the Q&A box for Morvette. I'll ask them as we go along. So my next question tied to that is tied to what we were just discussing is how do you think the Black Lives Matter movement has altered the course of Black talent or people of color in general, even representation? How have you seen that change and where do we need still to go? I think with any industry, particularly sports, women have been historically excluded. I really became a staunch advocate for making sure that we created space in sports for women because I feel like any industry should at least mirror the composition of the fan base. I see so many women in the stands, so many women who come and support sports, but there were very few women behind the scenes. We get the glares and the stares and we get pointed in the direction of the wives lounge and I would always have to say, no, no, I'm actually the one helping to negotiate the contract. I'm the one who's actually working on a sponsorship deal and there's nothing wrong with being a wife, but the assumption is always made that a woman's role is very segmented into how she is perceived in that space. And so for me it's been about activism and I've even helped to empower the wives and work with the wives. I have a very special wife, Mia Wright, who runs the NBA Players Wives Association, who has done a fantastic job of using that organization to help reshift the way people think about women, both wives and women in general in the sports world. But for me, it's really about understanding that the Black Lives Matter movement just I think shined a brighter light on the fact that there were these gaps and voids and disparities and I just don't want there to be an assignment of titles, if you will. I want there to be real collective mission-aligned allyship rather than tokenism. Have you found it easier to do your job in this regard in promoting your clients? Has it been easier? Have you seen a change? Well for me, Lisa, fortunately for me, I have been around for almost three decades and so I think that there's a good knowledge of who the Brito agency is, who I have been. I have worked with iconic players from LaTrell's Freewell to Stefan Marbury to, you know, I mean just a long list. I mean we have been incredibly blessed to work with really category-leading talent. So for me, I have not really found any difference in the way that there have been more opportunities for me or not. But what I will say is that I am seeing more women in front of the camera whether it's in locker rooms, whether it's on the field. I do think that I don't know if it's necessarily the Black Lives Matter movement because again I think that all of the spaces of sports need to do a better deliberate job outside of any movement of making sure that there is diversity, diversity that is fair, that is equitable and that is authentic to the space that women occupy in collective humanity and in business and enterprise on a day-to-day basis. So I think that they're trying to do a better job but ultimately there's still of course a lot more work to be done.  It shouldn't be a special circumstance when you see a woman and it shouldn't be a first. There's still too many firsts that we need to really eradicate in sports. Right.  I think the hardest part is balancing the business side and the activism, you know, all the work that goes into making sure that there are others who follow behind me, right, and that these spaces that I occupy that I am not the only one because I think that I take no pleasure in being the first. I take no pleasure in being the only. For me, I take pleasure in opening up the door, sticking my foot in it and making sure that I, you know, turn around and usher more women who look like me through the door. And so that balance of doing that activism while also managing and overseeing business on a day-to-day basis can be challenging but at the same time the reward for me is greater because as I see the composition and the landscape of sports changing, I get to edify others in this space and I get to know that the work is not in vain. Right. So we have some chatter on the channel and so I'm wondering if you could share some advice with, we have a few students in college who are athletes, college players, and they're interested in PR and brand marketing. What's the best advice you could give them to make that first step into your world? You know, I think the interesting thing is I'm surprised at how many students I meet who have an interest in PR, have an interest in sports, have an interest in branding, and have not really read and done the work, right? And I mean real life stories. I mean really dig deep into how did the needle on this particular brand move? If you're trying to be in sports and you don't know who some of the icons are, and I'm talking about behind the scene icons, so if you don't know who David Falk is, you know, the man who has been an architect and agent to Michael Jordan throughout his whole career and helped create brand Jordan, then that's someone you need to study. So I do believe that it's very important people want to master fields that they have yet to study, seriously study, right? And I don't mean textbook study. I mean actually go out and understand how a certain thing came to be. And I think in that study you'll understand not only people's successes, but the mistakes that people made, right? And you understand careers and the pitfalls of those careers. You know, study the Williams sisters and understand what their father had to do, you know, to chart a very specific niche for them in the world of tennis. So to me, I think the greatest thing you can do, because I think that's what I did, Lisa, that is immeasurable and invaluable. I learned so much by reading real-time stories and understanding, being very curious and asking questions. I had no entitlement. There was nothing owed to me. I knew I needed to do the work. And I knew that if the door ever opened, that I would be knowledgeable, equipped, and ready, and fully aware of the industry that I would one day hope to master. Yeah. Okay.  So I'm going to ask one question and then we may have to go to takeaways. We're running out of time. This is from Lexi Sydney. How have you seen the branding business change as athletes have more of a direct line to fans through their social channels, as opposed to additional media outlets? So it's really much more of a direct connection. It is a direct connection. But let me tell you the difference between proactive and reactive. A lot of athletes or just people in general don't believe that they need strategy, that they need to move with strategy. You have to be proactive, but proactive and working in a strategic way, not just being responsive. And I find that a lot of athletes believe that visibility, you know, they're confusing visibility with credibility, right? So just because they're visible and just because they have an audience doesn't mean they're building equity. And equity really is about what you say no to, not just what you say yes to. So opportunity and the volume of opportunity doesn't mean you will ever become a potent brand. You have to understand what are your values? What is your value proposition? What is your distinct contribution to sports?  So I don't think that just because an athlete has direct access to an audience, they still need a strategist. They still need a team of operatives who are going to help them navigate the terrain. Because sometimes you can have so much coming at you that you believe it's all driving you further towards your goal, but it's not. It's just everyone wanting access to you and everyone wanting you to do what they think is best for you to do, but you have to have guardrails that protect your brand and keep you on track towards your brand goals. Wow. Okay, I'm taking major notes when this is over. This is like a masterclass in PR and branding. We're going to go to your takeaways now and then at some point soon we're going to have to continue this conversation somehow with all with this audience and I want my own personal class. First, let's go to the takeaways. Well, the first takeaway is rejection is God's protection. I meet so many amazing strategists and visionaries who really want to tackle the world of sports and they just don't know how to keep going. They feel like if one player says no to them, if I want to be a sports agent and if 10 players say no, rejection is God's protection. Keep moving, keep focused, keep mastering your craft. Eventually, you will find that person who will understand the work that you did. They will understand the work that you did and they will seek you out. For me, I have always believed that you should never have to pursue what you can attract. If you keep your head down, do the work, work on yourself, make yourself valuable.  They will be introduced to you and your talents will help birth their deepest aspirations. The second, your deepest purpose is found on the other side of servitude. Be of service. You won't always get paid, find an opportunity, find someone that you can work with. Be of service. Today, I think that there are so many relationships that are transactional. You give to someone and you expect something in return. Just give your gifts, support other people's vision, and in doing that, people will discover you, your talents, and your capabilities. I believe that everyone's gift is found on the other side of them being of service and them being and walking in their servitude. The third is you are your greatest asset. Make yourself valuable. This whole world, whether you're in partnership, if you work a job, if you're in school, everything is about how valuable you are and how you can make yourself an asset. I believe that everyone should do all they can do to educate themselves, expand their ecosystem, their resource space, their relationship base, do whatever you can so that when you get the opportunity, you will be so filled with those who will support you and help you. You will be so valuable that the player or the organization that you choose to work for won't be able to deny how you can help them achieve their next level of greatness. This is just amazing. I get to say that we will actually hear from you again next week. If you all register for Brand Week, you could go to adweek.com to register and Marvet is going to be holding a workshop for us. Awesome. I want to thank you so much. This has been, as always, a pleasure. I know it went really, really fast, but thank you and I hope we'll have you back. We'll definitely see you next week at Brand Week. Definitely. Thank you so much. Thank you, everyone. Thank you. See you soon. Thank you all for joining us today. Our next woman up is WWE Chief Brand Officer Stephanie McMahon. I'm looking forward to speaking to Steph about her family legacy and the role of women in professional wrestling world. See you all back here on September 29th.


I'm Robert Jolly. I am a project manager. I love WordPress. I love accessibility. I'm happy to give this talk I'm going to talk about ways that you can bring accessibility into your workflow if you're a designer a developer a project manager a client a Qa person If you wear all of those hats then hopefully there's something in here for you So what exactly is accessibility? I didn't really know a few years ago. I was big into web standards, but I kind of got introduced into web accessibility through another speaker and You know, it always seems very complex It seems like it's expensive and does anybody else share that that feeling or have you had that feeling? It doesn't have to be it can be if you approach it in a way where accessibility isn't kind of baked into your process So what I'm going to attempt to do with this talk is just talk about ways that we actually make our sites work Well for everyone, but we do it throughout the process So just a little bit of background information There are a billion people on this planet who have a disability of some kind or another some people have multiple disabilities in the US One in five people have a disability. So that's 20% If you keep up with the market share on browser stats 20% is actually higher than the number of Than the percentage that internet explorer shares for all versions I think it's in like 15 to 17 percent for all versions of internet explorer for browsers So when you think about accessibility and people with disabilities, that's a very large number and So with that large number comes a lot of dollars so people with Disabilities they spend approximately 175 billion dollars annually in the US So I think I have the marketers attention my slides are a little wonky I think my format the the ratio is bad, but you get the message, right? You know, there's money to be had there There's money to be lost there too if you if you ignore accessibility and people with disabilities can't use your site you open yourself up to lawsuits and You know, it's not just for people that that that have long-term disabilities Or or for people that are born into a disability It's a group that anyone can join at any point This is a this is a quote that gets thrown out a lot, but it's true. We're a heartbeat away from needing accessibility This is a this is an MRI of my brain four years ago I had a stroke it affected my balance it It gave me just debilitating headaches for about six weeks, and I was really lucky I was pretty fit at the time and my brain the the blood vessels in my brain they they kind of remapped and worked around the issue in my cerebellum, but Tomorrow is the fourth anniversary of my stroke So, you know, I was very close to really having Significant issues, but for about six weeks. I really couldn't use the web the way that I was accustomed to and then this year in March I have this great flattering picture of me up here but that was the day I had surgery with with holding my hand up and I had crashed my bike and I dislocated my thumb My mousing hand and you know, that's very important for me, but I couldn't use it. So I had to actually Transition to just using keyboard only and so that's a picture of the therapy that I had to go through for about three months So, you know disabilities are really, you know, it can happen at any time. There are there are many many different types of disabilities I won't list them all but it goes beyond just making your site accessibility goes beyond making your site Friendly to screen readers. It's for people with low vision people with With hearing loss or deafness people with mobility issues people with chronic pain seizure disorders There are just a myriad of different types of disabilities. So that brings us to, you know, where where do we start like this? This is you know, it's a lot to take in Don't do it at the end of the project don't leave accessibility towards the end because you'll get something like this this is a doctor's office in Europe and you can see the the Accessible ramp that goes up and kind of winds around it's serpentine. I think there are nine different Landing stages to that and I'm sure that this meets spec in some way some sort of Some sort of disability law spec about how how this should be built but it clearly was an afterthought and I don't think many people would enjoy using this except maybe skaters and You know, that's that's great But not so great for the people that really need it. So What do we do with with accessibility throughout the project, you know I can I can preach to you that everyone on the project has a role that let's let's talk a little bit about what those roles are Because you can spread the you can spread the load with with the accessibility task work And it becomes less expensive to fix accessibility issues that are left at the very end So when you're planning a project if you're a client Write it into your contract make it make it a requirement for your vendors So if you if you have a new website design project or redesign project coming up Just make sure that you use you spec out the guidelines and then if you have the the ability to Afford some time and some money to test with real people with disabilities That's the best thing you can do right there because you can meet the technical guidelines But if it's not functionally accessible Then you you still have problems. So always consider usability with usability testing with people with disabilities and Then when you're on the vendor side of things on the project management team You want to map the accessibility guidelines to the tasks that your team members are going to be Undertaken so there are things that you can do as a project manager But there are things that your team if you understand what the what the accessibility Needs are for each different role then you can You can make a big difference You want to communicate Regularly with your team make sure that you know it's not just at the beginning of the project But throughout the project that you're checking in and you're saying all right How about accessibility what are we doing to make sure that we're covering that don't just assume that your team Is going to have it covered like you do You want to establish a test plan it can be formal or informal But make sure that you have a test plan a way that you can at regular intervals test for accessibility as you're going through the design and development process and Then of course represent accessibility at every stand-up every every project check-in that you have make sure that you're at least Talking about accessibility making sure that you're you're covering covering your bases So Requirements often state very dryly in one line What accessibility guideline must must be followed sometimes it's section 508 of the Americans with Disability Act but a lot lately it's the World Wide Web Consortium's web content accessibility guidelines as WCAG WCAG The version 2.0 is the is the latest that's out So when that's stated You're like what I need to find out what that means right or maybe you're not and and that that leads to problems later on but So do your best to find out what that means and If you go to print the guidelines, it's 34 pages long. This is how this is how accessibility gets kind of a bad rap It's it's very daunting, right? It's there. There's just a lot more than just one-line item The good thing is is that it can be broken down into into four principles Those principles are perceivable operable Understandable and robust the the acronym for that is poor PO you are And those four principles get broken down into 12 main guidelines and Then 61 success criterion and there are three different levels for those Those criterion so level a is kind of the baseline and you really need to cover that there are 25 25 success criteria for that at level double a which is is what frequently is cited as you know What what sites need to have if you're a government site or in the case of airlines I've been working with a couple recently The Department of Transportation requires level a and double a and then if you really want to level up you go to level triple a and and that makes a really good experience for users so Some things that you can you can think about if you're a project manager isn't don't worry about memorizing all of the guidelines I don't know all of them by heart. I know some I can recite a couple of them and And realize that it's that you know, these are just guidelines and you can you can create a checklist mentality But that's imperfect at best so remember that the end user is your goal their experience So make sure that you're testing along the way and make sure that that if you can perform usability testing or somehow get feedback From people with disabilities who are using your site. That's going to be great do understand the roles and duties of Accessibility based on the the team that you have what designers need to do what developers need to do What your QA team needs to do if you're working on a bigger team communicate frequently Add it to every phase Incorporate testing with every sprint that that you have and advocate for end users There's there's a W3C accessibility responsibility breakdown and it's a fantastic resource if you Google that or I'm not sure in my slides. There are probably There should be a link there That's that's supposed to be a link to take you to it But the W3C has a great resource for learning, you know kind of what guidelines can be mapped to which roles and What tasks can happen on a project? So with with content you want to have images having appropriate alt text Attributes you want to caption your videos. That's another form of alternate text and Provide transcripts for audio You can provide transcripts video as well And you can do also do audio description for your videos those things are really important for people with disabilities It's also great SEO juice Juice up the SEO there as I've heard mentioned here You can also watch out for your reading level so make sure that you're not using language that's too complex for people with cognitive disabilities or challenges You want to avoid any elements that are rapidly flashing Anything that flashes more than three times per second is a potential Seizure trigger so you know people that that that that have that To deal with really you know don't need to to have a seizure triggered by your website So some guidelines some general guidelines for alt text is that every image needs the alt attribute You don't always have to have it Contain anything so if you have a decorative image that really has no other meaning other than to just decorate the page Just give it empty empty quotes not a space in the quotes, but just alt equals quote quote That will actually inform screen readers to just skip over that that content and just ignore it Along those lines with images if you're using background images for anything that's important and in terms of content If it's conveying information or functionality take it out of the background Don't use background with CSS background images because you can't apply an alt attribute to a CSS background image So basically that's inaccessible to people with screen readers and also anyone with Windows high contrast mode those background images just disappear. So it's it's you know bad things happen basically with that When you're using alt text keep it brief and on point make it descriptive But you don't have to be overly verbose and Then if you have a functional image You might want to treat your alt text a little bit differently. So in the case of Header logos that point back to the home page as a link, you know, I really like the waffle house So this is actually there there a little clip from their their header And they've got their their waffle house logo and the alt text is waffle house and that's that's pretty good They have alt text. They're using WordPress. They've got they got some things going on really really well there But a better alt text for that might be alt might be alt equals waffle house home Because that tells people that it's gonna if they click on that link It's gonna take them back to the home page and that's a pretty you know having that logo there With the link is a pretty standard convention But you can you can tell where you know other areas if they're if it's a submit button That's that's an image. You might want to have that alt text not just You know not just be the word itself, but actually telling people what to expect in the alt text So there are ways you can check your your content's reading level a quick way Well, the general guideline is to aim for a reading level of around eight for general audiences so like what an eighth grader might be able to read easily and For the WordCamp US site You can actually go to readability dash score dot com And you can plug in a URL and I plugged in WordCamp's URL and it had a grade level of eight point six Which is which is great But there's an easy way to check that online. There's a there are a few different tools You can actually download some some apps that'll run. I believe even in Word you can figure out what the What the readability score is? So when you get into design your UI designers UX designers Need to be thinking about consistent interfaces for people making sure that things are predictable and and and understandable Easy one is to always check color contrast, you know when you're when you're mocking things up Always check your color contrast and there you can make a beautiful design that is high You know high enough contrast to meet accessibility guidelines, but still looks great You don't have to have everything be black and white You want to be aware of line length issues Just keep things readable You know don't make it difficult for people with with you know line lengths that stretch all the way out when you're you know when you're on a big monitor And related to that anything related to proximity so keeping related items close is going to be very important so if you have a convention where you have your form set up and then You've decided for your design standard that you're going to put your your submit buttons all the way to the right on Your on your form well on a larger screen that might become a proximity issue where all the form fields are over here And then your right aligned you know at the bottom button is is kind of not related to the actual form itself So that that could be an accessibility issue You always want to design for your focus states So just like if you're if you're doing design work and you're thinking about what happens when people hover Think about what happens when people have keyboard focus on there So some people don't have a mouse they can't use it, but they're they're a sighted keyboard user So when they're tabbing through the interface make sure that your focus states are good In terms of clearly shown with either outlines or some sort of differentiation So the people will know as they're tabbing through your page where they are and what they can do what what links they're on And then at the same time design for your error states for so when you're submitting a form don't always assume that everyone's going to have The the perfect form experience. They're going to always fill out your form correctly So try to think about how how you can gracefully handle an error situation when people you know enter the wrong thing and They they need to you know kind of go through that form again and and and fix the errors You know take that take that heavy lifting and do that for them and make it easier for people to Correct their mistakes. You'll find that you'll have more conversions. You have more sales as a result We'll talk about some tools for color contrast So color safe that co is a great tool to use while you're while you're determining your color palette so you can plug in a baseline color and then you can get other accessible color options and I believe that's a tool that was launched and provided by the sales force UX team and Leave a ruse contrast ratio. It's on github it does a similar thing where you can plug in values and see what the what the contrast ratio is and There's also an app that you can download on windows linux Mac called the color contrast analyzer So if you're working in Photoshop, there may not be a tool for color contrast checking built into Photoshop But you can easily do that here with this this color contrast analyzer And if you design in the browser, we've got that covered too. So chrome's web accessibility developer tools Allow you to easily check for things like color contrast Ten minutes. Okay, ten minutes left. There's a lot to go through Another thing that you can do as a designer is to basically you can take your your hand and and make a tiny hole like a straw and if you want to do that now you can actually look up at the screen and You can look through it and this simulates low vision. So some people use extreme zoom magnification Or they just have pinhole vision and they can only see a small bit on the screen So you can check your proximity of items and you can see whether there are problems with this Specific example with Virgin America. This is where they fly and I wanted to see where to go from Chicago Where I could go and if you look closely those Those cities there have a book button. It's all the way to the right but with the two column layout They look like they're associated with those other cities on the right So that could be a proximity issue for people of low vision. So let's talk about the ways you can Tackle accessibility with development We want to develop with web standards in mind as much as possible. So if you can Keep things semantic and and and coded in in a standards compliant way You're going to reap all of the accessibility benefits that the web that the promise of the web has so, you know Treat buttons as buttons. Don't just do a div with JavaScript and and call that You know make that a class of a button because that won't be clickable and it won't be announced to people with assistive technologies You want to set the page language. These are very basic things, but these are things that people forget Give each page a descriptive title a unique title. So, you know, I talked about using semantics Foreground images, please everyone and that you know, give them all text With WordPress, there's a built-in CSS class that you can hide informative text from from visual users But but it gets read out for screen reader users. So it's just screen reader text It's been built in for I don't know four or five years now So that's a great way that you can basically give people more information that they wouldn't get if they can't see the screen So, you know, visual users have the context of what's on the screen So, you know, like a read more link is fine for somebody that can see that it's associated with that link is associated with the headline or the body copy But but if you if you're a screen reader user and you're going through with links mode You just have a bunch of read more links that it gets gets announced to you And you don't know what they're about so you can hide that that additional copy there to help folks and then If you take a mobile first responsive design If you if you take that approach, that's going to help you reap a lot of benefits just built in for accessibility One of the biggest things that you can do as a developer is just use your keyboard Everything you make as a developer everything that you build and code every time you do a check-in or every time you save something locally Test it with your keyboard and see if you can access all of the links and all of the functionality with your keyboard That's one of the biggest things that you can do before anything else And then of course, you know, look at look at your your error handling You know give people a great experience with with good form form error handling There's a forms example at simply accessible. I think it's examples not simply accessible.com They have a ton of great great examples of how you can make forms more accessible you can unit test with tools like quail and There's a plug-in Called access monitor Joe Doulson has has written this plug-in and basically you can you can test the accessibility of your of your posts against the tenon API and and find out if If it passes certain accessibility tests and it won't let you actually publish the post You can set that up where it actually prevents you from publishing until you fix the errors So that's a fantastic thing you can do so, you know, definitely employ unit testing but above all else Use the keyboard After that you can level up to screen readers But when you when you tackle keyboard accessibility you make you lay that foundation for for your screen reader users as well So I'm going to run through very quickly accessibility plugins and themes and And then we'll get to hopefully a couple of questions So the theme directory has the accessibility ready tag. There are 79 Themes right now in the theme directory at wordpress.org that art are have been reviewed for accessibility and And have have have gotten published out there. That's not a lot compared to the the overall number so my challenge to you as as theme developers and authors is to is to increase that number use the use the techniques that you're learning here today and and and With other information that you have out there go and and make more themes Accessibility ready. That's that's really a you know what we need in the community There's a plug-in called WP accessibility also by the venerable Joe Doulson This helps to patch themes as well as adds a few a few additional features for accessibility to wordpress We this is a great. This is a great plug-in. I use it, but if our themes are Accessible and our plugins are accessible. We don't need tools. We don't need other plugins to patch these things There's a if you use Genesis, there's a Genesis accessible plug-in to help get you through If you use gravity forms contact form 7 they're plugins for those for accessibility But really we should be baking these things into our plugins and themes. So That's my challenge for the plug-in and theme authors out there is to to really level up and and and and make things accessibility ready I've said that I want to repeat it. We should not need to Fix themes and plugins with other plugins. So let's let's try to you know build it into the core of what we're doing And that's about it. I I really love this community. I love wordpress I love accessibility if you've got any questions. There may be a couple of minutes I'm happy to happy to help Thank you Hi, thank you for the for the talk. It was fabulous Javascript is a big point of contention and accessibility Since 4.2 in wordpress is actually a WP dot a 11 y dot Class in JavaScript, which is very powerful and one of them is the dot speak method Which is very very useful. You you probably want to talk about that at some point on the theme things There are only 79 teams at the moment that are accessible, but that went up from 17 last year So it's a pretty huge bomb and there are tremendous efforts being done on that front as well Definitely. Yes. Yes, and I do want to commend the entire wordpress community on Making accessibility, you know part of the core a very important part of the core And even at the conference we have captions live captions for for each session I don't know of many if any conferences that do that unless they're accessibility focused so Big kudos to to the wordpress community for this Hey, it really enjoyed your talk question about there was a wordpress wordpress default class They mentioned like screen reader text. I think it was so could I just try having trouble understanding that so that one Hides text for screen readers. Is that right? Right it so it visually hides Content and it doesn't have to be just text, but you can visually hide some content from screen readers I mean from visual users so that so that it can be read out to screen readers, so one thing that That like with read more text so you have a read more link when when screen reader users are going through a links Browsing just by the links on the page So there are many different ways you can browse by header levels or or by links or just go through the content linearly But if you're using that links browsing you get a bunch of read more links without any context about what it is So with screen reader text you can actually put the title of your post so read more and then have a span class Screen reader text with the title of your post in there So you don't have that visually for people that that have the context of that the read more is Associated with that copy that's right above it, but you have that there for the the actual Screen reader user so it gets read out to them in the context of that link. Thank you Is there a class that does like the opposite so it would hide it visually, but only read it out on screen readers Does that make sense? Oh, that's that's that's what that is. So I meant the opposite of that. I'm sorry the opposite of that So why would you want to do that only be visible, but not I'm just curious. Well, so You can Yeah, I don't know that you would necessarily want to To show certain pieces of content for people that can see but people that can't you would hide it from them This was great, I love this It seems like a lot of people are giving advice about accessibility all the time some of which I suspect is misguided or unsubstantiated Is there any Are there any things you ever see or any like advice given that you just like think is completely wrong or things about accessibility that are That have just over the years like I don't know just like false information or like bad tips that you've come across well, I Think so. Yes. I want to say that that often people's intentions are good when they want to make things accessible one one thing that I've seen happen a lot is that that designers and developers Sometimes think that the title text will make things accessible that they use title text all over the place instead of alt text and And so the title attribute really, you know, it doesn't it doesn't behave the same with all types of assistive technology So that's one of the things that the word press community kind of fixed is that title text would always go in as kind of the default thing that that would be a description of an image or a media item and And you know, that's that's starting to to kind of go away where title text is not a is not a great Alternative text. There are certain ways you you can use it, but it's it's much more limited than people think that it is but I think in general Most of the advice that's that's coming out is is probably it's coming from a good place And I can't think of anything that was, you know, I can't think of anything that I've heard at word camp with the Ford Different talks that have been happening that has been just dead wrong somebody may disagree and somebody may say man, you are so wrong Robert, but Let me know if that's the case. Thanks. Thank you Have a couple questions you mentioned Don't use CSS background elements What if they are purely decorative Use them use them for that if they're purely decorative use them for that But if it if it's for actual content Information or functionality that's important for people to grasp You know sighted users will have no no problem with it as long as they have CSS on which most people do but but folks with either high contrast mode on and windows or Screen screen reader users will just miss that completely. So it's it's really for Functional content Informational and functional content. It's important. You don't want to trap it in background images. Gotcha. The other question is about I've noticed that there are a couple of There are a small number of gulp and grunt plugins for a 11 y and then a couple other different accessibility checkers, but I'm not sure that they're actually relevant for WordPress generated pages and sites since it looks like they're basically designed to check HTML pages and Pre-rendered HTML. I'm not sure that actually helps during the production. Well So the the access monitor plug-in that hooks in with tenon And you can use tenon directly to without using access monitor But access monitor is is a plug-in that you can actually, you know, check your your post content that runs against the the rendered DOM That for the HTML so that you know, it basically is like a headless browser So it experiences it just like any other web browser would so You know, so so some of those and I think quail does the same thing So some of those actually do check it as if it's a rendered page And that's what you want because really accessibility is all about what that front-end code How it gets rendered in the browser Do you know anything that would actually help with the checking kind of during the build process during the development of a theme for instance? Before it's rendered that I'm trying I don't know if that makes sense even but I'm trying to build themes that are that are already already have accessibility built-in so that They're ready to go without Kind of doing unit testing sort of along the way for accessibility that makes sense. Yeah. Yeah, that makes sense Well, I think I think quail is a good one for it and tenon if you're working locally You can you can actually, you know kind of bake that in you can you can use the API to send the chunks Of what that is as you're developing it so it doesn't have to be live on the internet to to be able to access that services And I think I'm being told I have to cut this off But if you have questions take a step right outside this room and I can talk with anyone about anything Accessibility related or if you if you love waffle house and tell me about that Thank you


Hi and welcome to the session, I am Asha and I am going to help you with the following question which says which of the following sets are finite or infinite? First is the set of months of a year, second is 1, 2, 3 and so on, third one is 1, 2, 3 so on up to 99 and 100, fourth one is the set of positive integers greater than 100 and the last one is the set of prime numbers less than 99. So first let us learn what are finite sets? So finite sets are the sets which are either empty sets or have definite number of elements. They are called infinite sets as they are not finite sets. Those sets which are not finite are called infinite sets. So this is the key idea with the help of which we will solve the above problem. Let us now start with the solution and the first part is the set of the months of a year. Now we know that every year consists of 12 months, January to December, that is their definite number of elements that is 12 and hence the given set is a finite set which completes the first part and now proceeding on to the second part which is 1, 2, 3 and so on. Now in this part the given set is a set of natural numbers which starts from 1 and has no upper limit. So these numbers are up to infinity thus this set contains infinite number of elements and this set number of elements infinity. The set has infinite number of elements this implies the given set is an infinite set. Now to the next part which is 1, 2, 3, 99 and 100. Now in this part we have all the natural numbers which are less than or equal to 100 as the elements of this set. So this set consists of definite number of elements since the upper limit is given to us and that is 100. So consists of 100 numbers which are finite and thus the given set is a finite set which completes this part and now proceeding on to the next part which is the set of positive integers and 100. Now the given set is a set of all the integers which are greater than 100 thus the set contains the numbers 101, 102, 103 and so on. Now there is no upper limit that is there up to infinity and so this set contains infinite number of elements that is the number of elements are non-definite. So this set is an infinite set which is the set of n numbers then 99. The smallest prime number is 2 which is less than 99 after that the next prime number is 3 and the next one is 5 and the last prime number is 97. And on observing this we find that the number of elements in this set are definite the given set is a finite set which completes the last part and in this question we understood the concept of finite and infinite sets and identified the given sets for being finite or infinite based on this concept. So hope you enjoyed this session. Take care and have a good day.


British Prime Minister Boris Johnson has promised that Britain will do everything it can to avert a humanitarian crisis in Afghanistan. Addressing Parliament on Wednesday, Johnson also ruled out an inquiry into British conduct in the nation, saying most questions had already been addressed. Mrs Beaker, I know that members across the House share my concern about the situation in Afghanistan, the issues it raises for our own security, and the fears of many remaining in that country, especially women and children. The sacrifice in Afghanistan is seared into our national consciousness, with 150,000 people serving there from across the length and breadth of the United Kingdom, including a number of members on all sides of the House, whose voices will be particularly important today. And so it's absolutely right. I can assure him that I will, as I will be saying in just a few moments, we will be supporting doing everything we can to support those who have helped the UK mission in Afghanistan and investing everything that we can to support the wider area around Afghanistan, and to do everything we can to avert a humanitarian crisis.


news update. Get afternoon folks. Steve Rhodes coming to life in the shores of mostly cloudy delray Beach, Florida with your 2 p.m. Update. And currently we have all the U.S. Industries trading higher with the exception being the transports, which are off 45 points. The Dow is updated to the S&P 12, the Nasdaq 41, the Russell's up 13, some Iserp 11 golds up nine bucks, Silver's up seven pennies like to recruit off 45 cents natural gas basically flat and the 30 or Treasury 10 out of 138 01. That's sitting right at its weekly support level. That's up a buck and pointing in a 12 30 seconds out there.  Take a look at our industry charts out here. Not that they're going to show us a ton. Let's go see what they are actually showing us. We begin by taking a look at the Dow in the upper left hand corner. Basically what we have, you could really draw it in. If we're going to draw it in, it looks like this, which is just a little bit of a sideways consolidation. So let's get to a little rectangular tool out here and the consolidation kind of looks like this for the most part. And so we're just trading into sideways consolidation inside the Dow. Now, the cool thing is about a consolidation pattern is that once price breaks it either to the upside or the downside, it provides you and I with the measured move that's equal to that consolidation. So you can do the same thing on your spies or your cues, your diamond charts out there or the indices. You can see the same pattern set up here inside the S&P 500. Now, no idea how long we move sideways. Remember, yesterday we looked at the new profile that formed in the NQ and as I shared with you, its message was to expect or anticipate a sideways consolidation out here. And in essence, that's what we're seeing inside the daily timeframe chart for the Dow, the S&P, the NASDAQ 100. The Russell 2000, not so much. Russell 2000 is kind of an A to B equal CD pattern to the upside and likely will continue to move higher. Sideways pattern certainly inside the semis out there. Looks like the semis may have come close to closing the gap. Not a requirement, but it looks like that may be the actual didn't even close the gap here yet. But just sideways consolidation move. You are going to get a TD9 countertop inside the transport software. No, the trading lower. That's not why you will be careful. But today's going to form a looks like looks like we'll form bar number nine in a form bar number nine. And that would then suggest that price could move back to its oscillator and change line in the 14-1-13 level. NASDAQ composite that same sideways action. Same So folks, stay tuned for the favorite player. He's my favorite player. That's David. And after that, we got Obi-Wan Kenobi. He'll take us on home. I'll be back with you tomorrow on one of Wednesday. Have a terrific Tuesday. Thanks for joining us. Take care.


We are arresting these Nahuapi for attempted murder. These Nahuapi must be arrested for attempted murder. We now know why those people are in hiding and are not coming out. They are running away from Nahuapi because she threatened them with death. That's what is on social media. That is what we saw. And then the other day she was all over on what FM. I think it is what FM is. HHH is a criminal gang. HHH is a one who is abducting feluna and the mutas. The UP people from UPND. Please run away. Leave that party. Leave it to HHH alone. Come and join the PA. You know, we as UPND have been very reluctant to respond to Edith Nahuapi. Because for a long time now, Edith Nahuapi, we've held her as a beacon of women leadership to inspire the girl child that a lady, a girl, a woman can be whoever they want to become in this country, including becoming a president. That's what we have been seeing in Madam Nahuapi. We have been seeing a president, not necessarily herself, but a female president for Zambia one day with her leading the way to encourage young girls and women to buy to end position. And that is the reason why she attracted funding from some European countries so that she even employed people she would pay a month. But now, look, after her Dismo performance in 2015 where here in Choma I got four times the votes that Nahuapi got at nationally, so I'm more popular than Edith Nahuapi. Even me and her in stand for president, I can win it. Straight away. No debate. I got more than 45,000 votes here in Choma. She got, I don't know if it is, 2,000 votes. So she has lost the higher moral grounds to be a champion who should be listened to. She has lost it. That's why even the European countries that we are sponsoring can withdraw the funding into our political party because it has become a sham. It has become a sham. So, as things stand now, we do not want to sound disrespectful to Madam Nahuapi, but we want to ask her to tone down her poisonous mouth, her poisonous attacks on Edith. Her mouth diarrhea will land her into a space where she will begin to call her names defeating her conduct and we are equal to the task. All this time when she has been going in the mountains screaming, talking rubbish. It is because we have respected her as a woman. But she has now crossed the red line. She has crossed the red line.