What is up everybody, welcome to week 18 of the NFL season and the fan duel hurry up. I am Brandon Gadulla, I'm the managing editor at Numberfire.com and I'll be breaking down my three favorite stacks for the week 18 main slate. Stack number one is Matthew Stafford and Cooper Cup. This week we can focus on teams with motivation to play starters. That leads to big upside historically from stud players as past optimal lineups in week 17s have shown. That makes me want to allocate Salary for Cup who has 12 catches and 136 yards away from setting single season NFL records. I know he's kind of said he feels weird about breaking them because of the extra game, but I think he's still going to want those if he can get there. Cup has double digit targets in all but two games this year with at least 95 yards in all but one game. Stafford has been struggling a bit which I get the hesitance maybe to want to play him, but again this game has relevance for the Rams who are playing for seeding and even against top 12 past events Stafford has averaged 278 yards and 2.1 touchdowns. My second stack for week 18 is Tom Brady and Rob Gronkowski. Brady and the Buccaneers are losing some pass catchers who are key for this team but that hasn't really led to a significant slowdown just yet. Brady is an outside shot but is 488 yards from setting the single season passing record so we kind of have that angle but even without that there's plenty to like against this Panthers defense that's just a round league average. Brady even against top half past the offenses has averaged 334 yards and 2.1 touchdowns. Again there's an outside chance of the record but this game matters to the Bucs and head coach Bruce Arians has said that they're playing to win. As for Gronkowski, bounced back in a big way with his usage in week 17 with 11 targets giving him double digit looks in two of his past three games. His target per route rate of around 24% suggests a high ceiling of targets again as his roll continues to expand and stay strong while the team is without Chris Godwin and Antonio Brown. My third stack for week 18 is Kyler Murray and Christian Kirk. Across 10,000 slate simulations this stack emerged as the second best value stack in my model. The only one to beat it in terms of value was Kyler Murray plus Titan Zachard. So it's kind of a two for one in a way but I don't want to overlook Christian Kirk this week just because he hasn't quite produced the past few weeks. Kirk in games since Zach has had his roll increase but in games still without DeAndre Hopkins, Kirk has a 22% target share 8.2% per game with a team best 31% area share averaging one and a half downfield targets per game which are super high leverage targets. As for Murray we know that the rushing upside is always worth targeting. He's now running for at least 44 yards in four of his past five games, ran nine times in week 17 the second most rushes he's had all season. The Cardinals need a win so this stack should have its foot on the gas pedal until the final buzzer. That'll do it for my favorite NFL stacks, best of luck in week 18. Let's double dip on those touchdown passes on Sunday.


So, yesterday I talked a little bit about why we should make Kubernetes boring. And honestly, talking about boring things is boring, so today I wanted to talk a little bit about how we can make this ecosystem and this community really exciting. And it's because Kubernetes is part of something much bigger. It's bigger than container orchestration, and it's getting bigger all the time as evidenced by everybody here this week. There's a few things that I would like to highlight that are coming in the next year. You may have heard of them, you may not have heard of them. And I want to make sure that people are aware, this is kind of at the end of the conference, but over the next year if you can find and identify these technologies and these tools and these projects, you can orient yourself and maybe get an idea of what's coming, get involved, or participate. If you're already an expert, you might find something surprising in my list. If you contribute to or use one of the projects I mentioned, maybe you'll hear about others that could benefit from the work you're doing. If you're using Kubernetes, maybe one of these projects will help solve a problem for you, inspire you to contribute. And if every one of these projects is known to you, speak up, we actually need you to help. So, I'm gonna start with a call to action. We should be making everything better. This is somewhat broad, so we, the people in this room, this conference, this ecosystem, I assume a fair amount of folks here want to build things, what are we actually gonna build? Well, everything is somewhat broad, but let's be honest, software is pretty broad now. And I actually tried to scope this down, and I couldn't come up with a reasonable definition of software that didn't include most of the things that we were talking about. Everything is networked. Everything is on a different type of device. We don't just use the cloud, we depend on the cloud, we have our own clouds. And better, this is a little bit more subjective. But I think we're all here to try and make people happy or more successful or able to accomplish things that they weren't before. And so everything getting better does sound like a really good thing. So, how do we go do this? We already are. Judging by the 4,300 people here at Cloud NativeCon and KubeCon, judging by the sessions, I think it's pretty clear that we're everyone is already passionately engaged in this effort. So it's easy, everybody give yourself a pat on the back, great, we won. But if you haven't been engaged, or if you'd like to get more engaged, or you've been heads down in one particular area, I think this is the right talk for you. So I don't have time to describe everything.  And I think that's a challenge, Michelle did a great orientation that first day. And I could do this for two days and probably not even begin to touch the surface of what's going on. So think of this as a high level, and if you can come find me later, I can talk to you to death about all those other things. And everybody else here in this community also wants to talk about these things because we all care. So there's 2,200 projects on GitHub that are labeled as Kubernetes. I did not go and look at each one of them. We have a cloud native landscape chart that doesn't fit on an 8K monitor. Dan like that. But out of these 2,200 projects, some of which are on GitHub, some of which aren't, here's some highlights. So if you're building new applications, expanding last year's applications, or integrating a new technology, 2018 is going to be exciting. There's tools that help you build and solve problems faster and better. That's been true for a long time, no surprise there. Does everybody remember Ruby on Rails? Maybe some of you are too young, I don't know. And I actually had that thought. I was like, my gosh, I'm so old that people may not remember Ruby on Rails. That was terrifying. So for those of you who are too young or for those of you who may not know what Ruby on Rails is, Ruby on Rails was a framework, a bunch of people who are very passionately involved in a very particular aspect of technology, building highly dynamic websites that empowered their clients and their users to very quickly spin up ideas. Ruby's on Rails was let's take that and open source it. Some basic ideas are it's so easy to add one more thing, where that one more thing is actually valuable to your users. But I think more than any other project in recent years, Ruby on Rails set a tone for the open source ecosystem. Because it wasn't just about Ruby on Rails, it was about all of the people on top of Ruby on Rails, who built gems and extensions and plugins and engines and templating. In a sense, Ruby really saw the birth of the modern web app. What we consider the modern web app, I'm sure next year it'll be a different modern web app. But dynamic JavaScript, data models that actually represented, these weren't new ideas, but it was about enabling people to build an ecosystem around those technologies. So 2018, I'm kind of a bold prediction here. If you went to any of the 700 talks on Istio at the conference. This actually might be the year of the service mesh, but this isn't new. Tools like Envoy and Istio, or the conduit project that was launched just a few days ago, help abstract out the interconnections between your services into a smart network. So that smart network can monitor, measure, trace, and authorize connections between participants, can detect and mitigate failures. It can connect services across clusters, operating systems and clouds. And that key idea is, rather than building all of these capabilities into each application, you're in a proxy next to each one, and dynamically program that proxy based on what the application author or the infrastructure knows about what's going on. This makes integration much easier. You don't have to write one client library for a framework or for an idea across every programming language that people use, basically JavaScript and Java. But taking that out means I don't have to worry about that problem. And just like Rails, these tools are going to empower applications to focus on the core idea and to make the problem somebody else's. And that person usually can solve the problem more effectively. So it takes key ideas, part of the first generation of libraries and tools for microservices, and it democratizes them. Like service mesh, machine learning, big data tools, and big data sets aren't new, but they're becoming easier to learn and easier to get started with. Tools like TensorFlow and Spark are increasingly becoming just something that's easy to install on a Kubernetes cluster. And then almost as easy to scale those. Project by Rad Analytics by Red Hat are taking the next steps to streamline that practical side of, I want to learn these concepts, and I want to put them to use, and then I want to get value out of them. Kubernetes is adding things like GPU support as just one more thing that belongs to the cluster, which means consuming and using GPUs on cloud or on bare metal should go from possible, but a little fiddly sometimes, to be fiddly if you do something really weird, which is actually a huge win for most people. We probably aren't all going to be machine learning experts at the next KubeCon. I do hope that we continue to focus on taking people not just into technologies, but through technologies. It's about getting out of the way and helping people get an outcome that matters. This one's maybe a little bit more wishy-washy because this is still a fairly new space. Functions as a service is continuing to improve across the cloud providers. People build more tools. There's still a lot of differences, and everybody's kind of piecing together their own solutions. Each of these three projects in one way or another takes the functions as a service idea and adds them to Kubernetes. They all have different strengths and different principles. I think there's a huge opportunity for the technologies in this space to kind of blur the line between function and container. Functions sit down at one extreme, and if you think about what a container is, it's really just a function that grew up and got a whole bunch more functionality because it was just easier. And so that just easier is something that should be true at either end of that spectrum. Many of the common patterns in serverless, fast startup, simple billing, event-driven behavior, idling, integration are also features that normal containers could use. If I have a function, it needs to talk to my services regardless of where they are. And if I'm in one cloud provider, that's really easy today. But I'm still willing to bet that for a good portion of the people here, one cloud provider isn't enough. On the application side, as Brendan noted, there's still a lot of work to go do. Applications are becoming complex, even more complex. That also has been true for the last five, 10, 50, 100 years. There are a huge number of people in this community who care a lot about helping control that complexity. I expect to see a huge amount of refinement in 2018. Brendan mentioned the app definition working group. In Kubernetes, this is an effort to help bring together tools and ideas that make everybody else's application definition easier. Maybe not to solve the problem, because if this was a solvable problem, we would have solved it already. But it tries to at least move the whole ecosystem forward to take the best ideas from people who are actually doing this in the real world, and to find the tools that work for all of us. Projects like Helm are going through a big effort to, for a new 3.0 roadmap for Helm. I think there'll be a lot of exciting things out there. Ksonnet recently announced some big improvements in how they focus on people. I think this space is going to grow, not shrink. And I think we're all going to get better at reusing common tools to make this easier. So I was voted most likely to make wildly optimistic predictions at KubeCon 2017. My classmates really, really did know me. I don't know either that or they should have played the stock market instead. The second part of this is if we're going to build more complex applications, understanding and managing them becomes even more important. Identity, if you may have seen, there was a few sessions at the conference this week around, how do we give containers identity? How do we give services identity? Istio, in a sense, is working on some of these ideas. A lot of people who are deploying Kubernetes have existing identity systems that they want to fit in to their clusters. Because it's not just enough in 2017 and 2018 to expose two public services on the internet and not protect them or not give them any authorization or authentication because there's lots of bad people out there. There's actually a lot of bad bots out there that people aren't even involved. They just go and they figure out your service and they take all your data. And so that needs to be easier. The basic idea that we'll be working towards in the container identity working group is ensuring that on a Kubernetes cluster, you can plug in identity systems that help your containers interconnect to work with other projects in the ecosystem, like Istio, but also with Spiffy. Spiffy stands for Secure Production Infrastructure for Everyone, which is a group of people and projects and companies that are working together to kind of set a combined identity system across cloud providers and clusters and provide a lot of power around who's identifying people and exchanging identity for credentials. As well, there's a lot of existing tools in this space, like Kerberos and Active Directory are a really good example that have existed for a very long time. And there's people who have massive deployments today where they're running things that are almost like containers at scale. And we want to take those lessons and bring them forward because if we just reinvent everything, I'm not really learning from history. In the policy space, this is an intentionally sparse slide because we're just now starting to really add the extension points in Kubernetes that make it possible for people to plug in in an open way. I would actually hope that throughout 2018, everyone who has talked about adding policy to Kubernetes or who has forked Kubernetes and added policy is able to start building these in ways that interoperate or make it easy to plug them in because we all need a lot more knowledge of what's going on or control. The Open Policy Agent is an open source project that I do like to talk about. They've worked with Kubernetes. And we've had a lot of discussions about how you can define. They have a simple and powerful language for doing policy rule definition. And they're planning to use the hooks that are being exposed in Kubernetes to be able to intercept when someone goes and creates a deployment to do things like, OK, well, I'm going to define a policy that says you're not allowed to update deployments outside of weekday work hours. And OPA would, in a fairly generic way, say, nope, you can't do that, reject it. And if we do our jobs right across the ecosystem, these tools will be increasingly easy to plug together. LDAP is another one. A lot of people use LDAP as a central store for their policy or their organizational identity. And I would really very much like to see better integration between the LDAP side of the fence and a Kubernetes cluster so that we can do a little bit less, a little bit more automation, a little bit more manual work. The container runtime interface in Kubernetes was a very deliberate effort started over a year ago to extract out the connections between Kubernetes and the container runtime, both for practical reasons to create a nice boundary to make Kubernetes easier to develop, but also to open up the space for better extensibility and for other people to innovate. And that has happened. There's a ton of new container runtimes out there. The most recent was Microsoft announced a virtual kubelet that could do much of the same things of calling out to the underlying services. But even under that, Cata containers, I have them up here as Hyper-V was an effort announced to take Linux clear containers and combine them with the existing Hyper-V Run-V approach of running a pod inside a VM. And to move that forward so that if people do want more secure VMs over time, they'll be able to use those in a Kubernetes cluster. The Cryo project is really about a simple and fast container runtime that exists only to serve Kubernetes needs. And to open up the doors in the future in this area for even more exploration and optimization. If we want to do serverless, we're gonna need something that can start containers pretty darn fast. And I think there's a lot of fruit left on that particular optimization tree. Debug containers is a long running thing. I had to throw it up here because I feel so terrible about this because I've been a neglectful reviewer of this proposal, which is really the idea that if you're running in a production environment, you want to jump into a pod and bring your debugging tools with you. We've gone through 15 iterations of this. Lee, if you're out there, I'm really sorry, I apologize. But I'd like to see this move to completion because there are a lot of interesting things that we can do if we can get visibility into what's actually running in production. And we don't want to take tools away, but we want to be very deliberate about how we add those tools. And as I've gone through a whole bunch of technologies, these four stood out to me because they really are awesome examples of taking the ideas in Kubernetes and going way past anything that we would have thought about. I mean, the possibilities were there, but each of these projects in their own way took some unique aspect of the ecosystem, made it simpler, easier, in ways that we couldn't predict when we started. And so the KubeD project by Appstee is a cluster enabler for cluster ops on Kubernetes and has a lot of great ideas around the dynamic nature of Kubernetes. They use extensions and API resources and annotations so that an administrator can declaratively do many of the helpful things on their application and the KubeD parts will go and make magic happen. I really recommend checking it out. Arc by Heptio is another great example. It makes it really easy to take a Kubernetes namespace or a set of Kubernetes namespaces or an entire cluster. And because of the effort that we put in to have a simple and declarative model for APIs in Kubernetes, Arc was able to just go and grab everything by discovering all the APIs, the Kubernetes APIs, the extension APIs, the custom resources, bundle them all up, back them up. And then if you wanna restore them, Arc is able to go and reapply those back to your cluster in a very predictable way. So again, not something that anybody in the direct core Kubernetes team ever planned for, which people who are knowledgeable about Kubernetes and the ecosystem were able to apply the concepts and make something that makes people's lives easier. The Kube Router project simplifies both networking and the Kube Proxy to make services much more efficient. And it leverages some really cool ideas from other projects to deliver something that feels very Kube-native, but it's also something that we could not have anticipated or would not have designed ourselves. And yesterday's keynote about the Kube MetaController, again, the idea of making it really easy to add the next incremental thing to your infrastructure to empower your developers, your operators, and more of these projects exist out there. I could only find four, or I could only find four to put on the slide because if I keep talking, I could again go on for 10 or 15 days. So there's a lot of stuff, but it's not even a fraction of what's out there. How do we, you participate? We're a community, we're an ecosystem. I'm not gonna stand up here and tell people what to do. In fact, I would much prefer to work and listen about what people want. If you build something, tell others. If you're using something and it doesn't work for you, talk to them. If you can find someone to help make the next step or to bring their idea to fruition, do it. And if you can, create something new with the tools that everyone here has built and make the world a better place. Thank you.


Hey everyone, welcome back to figure fantasy. So today we're going to be discussing a new tier list for the year. So starting with January 2022, without further ado, let's proceed to that tier list. Okay, so we start off with our tier list with C. So these four really don't don't really have much traction in terms of usability if you are in kind of in and med going up. So they probably have uses if you are still beginning beginning the game. Like Rico when I started out, I started out with using Rico, the rest, Rayoma, Midori and Ophelia. I haven't used but some I see using Rayoma and PvP in the earlier stages. But definitely guys, these four will will not really see that that much usage in any content unless they are, you know, they have a certain, you know, advantage in that content. So that is why they are in tier C. So usually they are used by mostly beginners. Okay, for tier B, so little, no, little change here in tier B. So we have Sonata here as another mainstay from last month. We have Suzumi, Suzumi. At this point, there have been a lot of Vanguard that are better than her. Her function is mainly in terms of, you know, in terms of PvE and selected stages that you need to have a lot of summons. But again, she's very situational at this point. And both Yamazaki and Norris mostly have the same function. They excel in really one area and it's to take out the back line. Apart from that, Norris might have an edge over Yamazaki. But at this point, it's really hard to get copies of her. And at, you know, if she has a less, you know, less copies and if you don't have more copies of her, her basic attack isn't that much in terms of dealing damage. She's more valued for her ultimate skill. Next is going to be Irina. So Irina is definitely one of, I think, underwhelming in terms of specialist. Although Irina has Ignite, but that's just it. And she attacks in a line. So all of them get damage. But again, her damage is very, very small. So that is why she's in Tier B. Aketshi, also very niche. Single target, high damage, and also a good figure for your Ignite team. But again, his function is very, very niche as well. And we have a new one here in Tier B, which is Sani. Sani for Frost. You don't really need her in a Frost team. You have other options to bring in a Frost team. And also her damage isn't really quite impressive. Although she's a specialist, I think she needs more in her kit for her to be used in Frost teams. Okay, so let's proceed to our next, which is Tier A. So for Tier A, no change for Vasily. Vasily A is basically your average tier for all the figures here. So Vasily's here. Vasily, good, very good for AoE stun. Alfred also good, but I think his place is ready to be taken by Ren. So Alfred, good for lifesteal and for attack speed as well. Astaroth, not really, kind of average for a defender. Not really excelling, to be honest, in his, what do you call this, in his role. Yuna, for Yuna, there have been a lot of vanguard already. Yuna is actually good for burst damage, but really that is what she is only good at. Burst damage for her ultimate. She can actually, you know, one shot some of the figures, figure enemies that is in front of her.  So Zhao Yu here, I think one of the most reliable healers, nothing too special about him. He's actually crucial more in ignite teams. So most of his utility is, is actually, he's one of, if I may say the top three, but he's in the bottom three. So next is going to be Rhee. Again, Rhee has been dethroned by a lot of militarists already that are coming out or that already came out. So Rhee single target is good with single target with bosses. She is still used actually in the big three. But apart from that, I don't think she will see any action in other content. And for Camille, Camille actually is, his lock ability is very situational. Could be good in PVP, but apart from that, he's, it's really hard to get copies of him as well. And apart from the lock, I don't think he exels in anything that is why he's in tier A. And to round out our tier A is going to be Aoi. Aoi, I actually put up from tier B to tier A. I realized that her shield and the buffs that she gives to summons is very, very, very, very good. But again, her roll is really limited to the buffs and to, to the shield that she is giving. So again, she's in tier A. In some stages, she might excel, but others, I don't think she will be needed as much. So we're going to go to our tier S. So for tier S, we start off with Zhaoyun. So Zhaoyun, attack speed, lifesteal. I like his kit definitely. He's a pseudo tank for, as a vanguard. Cruces again, lifesteal as well. Very good, reliable tank. Yoko, I had her at tier S before. Now she's tier S. Apart from her ghost ability, I don't see her going up to SS anymore. The next is going to be Eryxia. Eryxia is actually on the fence in putting her up in SS tier. I'll see in a couple of months if she performs well. If I level, if I get more copies of her and put her at at least four star or five star peach, let's see if she can really shine more than I think her value will skyrocket to SS tier. Mako is one of the healers that I think is underrated, very underrated. Most usually use Zephyr, but again, she's usually used as a secondary healer, but definitely could be your primary healer for your team. Sakura won also one of the most underrated figures that we have, so silence heals in her basic attack. So again, you just have to level her up to a couple of more stars beyond three star for her to be able to be good or to excel in supporting your team. So the next we have Rin. Rin is a newcomer at Vanguard. She replaces Alfred for Tenma. She deals a lot of damage. She also has lifesteal, attack speed, but definitely when she gets a lot of damage and she cannot recover, definitely that is her big weakness. But again, if she does a lot of damage and she deals damage first, then she is definitely a force to be reckoned with. So Vasruin, Osuki, both of them are here. Osuki is a very good support specialist for frost teams and definitely Vasruin is a very good compliment to him. Without Osuki, Vasruin's damage is just above average. But when you have Osuki on your team, her damage is definitely going to skyrocket in terms of what they call this, dealing more damage because enemies are frosted. So ideally, you pair them up. Vasruin, I'm tempted to put at SS, but I think the only drawback for her is the cost of her ultimate. Really, the energy cost really is really high. And that's why I think she can't be up at SS. Okay, so last two would be Xanthakane. So Xanthakane, again, one of the best single target damage dealers that we have, DPS wise, and she will be here for a time, but definitely as new figures come in, she might drop to A probably in the future. And the last on S tier is going to be Harriet. So Harriet, again, a very good support all around. She gives blind, especially if she's going to be valued more for bosses and also valued for her summons as well. So those pesky summons, the red and the blue ones. And I think she's going to be very, very good. If you bring her more than three stars, so probably four or five stars, she, you know, will really show her value. So let's proceed to our last tier, which is SS. So again, we have here Megan, of course, Megan, one of the toughest defenders that we have. Terrific shield absorbs a lot of damage. What can I say about her? Lubu, I actually elevated Lubu to SS had some time trying out his kit. And definitely, I'm impressed with his attack speed and all of the other synergies that he has in his kit. Definitely one of the most underrated figures that we have. If you don't have Lubu, try to get him or try to use him. Definitely, you're going to be happy when you're going to be using him. Very good PVP and also in PV and also mostly all around all of the content. So try Lubu out, guys. You won't be disappointed that you got him. So next is going to be Zephyr. So Zephyr here, again, what can I say, gives energy and heals. Again, she's going to be shining more if she has more HP and also four to five star Peach will also help her improve on her performance while she's at SS tier. Zulian probably one of, I think, if there's another tier above SS, Zulian would be at SSS. This guy is really clutch shields and prevents lethal damage. What can I say, he saved me a couple of times. And definitely, if there's another tier, he's going to be above SS tier. So next again, Zarola probably again, another with going to be triple S tier DPS Queen really in terms of taking out bosses, taking out mobs.  So that is why she's at SS. So the last four that we have, okay, so before I go to the last two on your right, they're kind of conditional to this tier list. So we'll go with Ember, Iren, so very, very good support, especially if you have a tank or a Vanguard in front. So heals, again, heals that unit, heals herself as well. So very terrific support, especially if you consider PVP, she's going to shine there in that content. And last four and not the last, but one of the SS as well is Yuyna. Yuyna for her dual skill. If you get her even to two star or three star Peach, she's going to do wonders for your team. So the last two that is in this tier list is going to be Ayane or Kada and Aihinohara. So Aihinohara, definitely I'm confident that she's coming, she's been teased in the contents in the story of the game so far. And I think she's going to be released this coming Friday. So I put her here in the tier list already. So definitely because of the debuffs that she gives, she's going to be a good militarist guys. I would suggest you save up currency for her. Do not pull for Norris anymore. Save up for her because she's going to be terrific I think for most of the content as well, especially going to be good in PVP. And for Ayane or Kada, I just want to go back to her. I actually, she's not confirmed in any of the content, not even a tease. But in terms of the Taiwan timeline, she is there with the four that was released. Nori, Rin, Ai, and Ayane. So I'm putting her here because again, I just want to inform you guys, if you have the chance to get her and if you have a lot of currency, please do pull for her. She's going to be terrific, terrific tank, probably one top tank even better than Megan probably. But head to head, she gives shield. What else? Apart from shield, I think she has damage reduction if I can recall. But again, she's going to have a good kit overall. Not only does she give shield to herself, but also to all her allies. So apart from Megan, Megan only gives shield to herself. But for Ayane, I think she's going to be a terrific addition to any Galatea team. So again, both of these are very conditional. But I put them here so that you guys could be aware, just in case if their banner falls or drops, you have to pull for both of them, Ai and Ayane or Kada. So again, guys, that ends our tier list. I'm going to put a link to this tier list in the description. Sorry for the last time, guys. I messed up the link, but now I actually got it. I'm going to get it right and show a viewable link in the description of this video. Okay, guys, so for those who are still here, please do consider subscribing because this helps my channel a lot. And take care, guys. Stay safe. This is Dwarden and I'm out of here.


How's it going everyone at Caleb here with latent sports cards next tonight? We have a break here of Don Russell leave basketball six box break number 50 pick your team style Let me read off the teams that you guys have. Thank you once again for joining Ellen C mavs Anthony P bowls Brian T Celtics Chris S wizards Christian S magic Dale F nets David G Thunder Derek J Grizzlies Dylan L trailblazers Edmund T with the Cavs Jacob C 76ers John O Spurs Johnny M Pelicans Josh B with the Hornets and heat Justin K. Pistons Long J sons Nelson T Warriors Paul Z Bucks Peter H Nicks Renee M Nuggets Ryan G Lakers I got Scott T on the jazz Talon H Pacers Trevor P with the Timberwolves Hawks and the Kings Shray H Raptors Wong S Rockets and Yenty L with the Clippers. Good luck here. Thanks again so much for joining everyone Don Russell leaps basketball. We are ready to start Here we go Good luck We got impeccable after this and then we got prism. Those are both all sold out There are a few spots remaining tonight on National Treasures football and there are a few spots remaining on flawless football Flawless, it is only the Texans remaining. They are available in both. Take your team style cases tonight And that would be the last teams available Here we go Spellbound Chris Paul Get a Luca there on the uh, he's called again deck.  That's gonna be the 99 Excuse me. That is numbered to eighty eight mistake Steven Adams redemption Demption is Zion Williamson Elite signatures blue boom Wow What a redemption congrats on that pelicans very nice awesome Zion auto What a start to the break you're on fire all these breaks are hitting right now, holy Durant star status You're finding it right now Spellbound Zion Chili's Randall Tech didn't you read that's right now. That's fun. Are you really surprised Admiral? Come on now Orange Rudy go bear jazz Are you really surprised? It's gonna be an orange there really One zero abs. Yeah, nice. They are just rolling right in this finals No problem whatsoever Greg Brown rookie there to 999 It's gonna be a power formulas orange Ben Simmons Die cut it's gonna be blue that time Derek white to 99 Spurs couple packs to go guys First box here our formulas Colin Sexton pack of the box is Auto for the cabs true good and impact impressions We go cabs Auto for you there next box everyone. Good luck Congress elite basketball empty there. Let's get right to it and Gordon for the nuggets. There you go The one-to-ones looks so sick in Don Russ elites Wow very very cool card I do not remember the name of this one summoning chat mites this parallel one-of-one so so nice Beautiful congrats on that nuggets. We'll get that mags one-of-one Aaron Gordon Awesome card there Josh giddy auto for the thunder took 149 very nice Ten pals auto congrats We'll get that magged up great hits in this box There you go thunder now Such a gorgeous card ten pals with the thick marker there to 149 on the auto Good stuff Congrats again great start here Curry spellbound Yeah, Damien Lillard on the star stents Elite it's called a little yes It's called elite Clarity Kyrie Irvin appreciate that. I figured it was something kind of fancy even Shenzhou was stuck to the Kyrie there Very cool orange chair Allen Great card for your nuggets can't complain with the one-of-one Orange there is Marcus Morris senior Clippers Scotty Barnes to 999 you go Raptors Congrats on that one nice card It's gonna be a power formulas orange Brandon Ingram die cut Deck Anthony Davis Just got to keep filling up NT football tonight everyone three spots remaining it is linked in your chat scroll up a tiny bit See which teams are left nuggets to 99 Michael Porter, Jr. See what is remaining just a couple of spots to go on it? three in each break There's like the Jags the Jets Seikun and boy there to Nets 10 you Russell lead Jared Butler to 999 jazz Spellbounds LeBron. I see that I See that Admiral It took quite a while We got a deck Westbrook primary colors Kevin Durant Nets Yep, correct Admiral Yep auto here perv is short. I think you go warriors Short auto impact impressions our formula is there Bradley Beal and Bradley Bill deck Or clarity excuse me clarity Little bit different on that acetate card or excuse me clear card One more pack then right out of the next box orange PJ Washington, Jr. Next one up here. Okay empty Let's get right to it Good luck everyone.  Did we really hit that longer? Is that real? I don't know spellbound curry Might be that's gonna be tidal waves Kyra. Excuse me Kawhi Leonard tidal waves Marcus smart orange Michael Bridges I say Jason Preston in 999 Rookie there Zion Williamson on the spellbound there Sion we got clarity Jalen Brown Anthony Edwards there. That's number to 99 nice one T wolves Iverson one of ten Boom, there you go. 76ers. Let's go. That is sick We'll get that magged up very nice You have multiple magged cards already That is awesome crushing it on this half case of Don Russell Etonites Star status curry. Don't miss out guys packs are hot this evening. Let's keep working on filling up NT case Pick your team style number 99 It is the jets the Jags and the Texans remaining check it out. There is a link in the chat for you grab them up Jags jets and Texans left Here we go. Let's keep it going LinkedIn the chat like I said, let's continue spellbound Zion Jimmy Butler deck orange go bear orange is gonna be a Nicholas Claxton Cory Kisfer to 999 wizards nice. We got Zion Williamson on the power formulas to 99 You'll pelicans nice take that gonna be a LeBron James prime numbers Go And we got blue there number to 99 Patrick Williams bowls Xbox up impeccable basketball case is coming up next They're out of prism football and just link that NT with some sponsors left to go in the chat for you guys Let's get that filled up three to go Our formulas Jimmy Butler auto this time Doug McDermott to 25 Spurs there you go Doug mick buckets Spellbound curry idol waves Pascal Siakam Orange Jaitlyn Brunson. You got an orange Kyle Lowry Sharif Cooper that time that is a red number to 98 Go to 98 bones. Hi Lin number to 999 Nuggets having a break Few teams have it well here. Oh, yeah, we're formulas there Zach Levine orange die cuts Clarity Kawai It's gonna be red number to 69 Jared Allen nice You go. It's like is that real It's real Subtraction jersey number. Yep Jerry West auto there you go Lakers Wow very nice congrats on that Lakers Hot hot hot packs very hot Yolk it starts that is Spellbound Zion I Devon Booker deck. I've got mark keep Morris orange orange miles bridges Spellbound Zion s Two packs two boxes left everyone. We've got a prime numbers Bradley Beal.  Good luck Just a couple to go impeccable basketball to follow prison football to follow that and then we got in those NT and flawless that I was just mentioning Just a couple of spots left this evening's go continuing Star status Jimmy Butler Auto Scotty Lewis for the Hornets gold to 10 6 of 10 another pen pals auto Wow very nice to 10 there Grats their Hornets nice card We'll take that gold to 10 pen pals auto Not too bad You go Hornets Josh be Kyrie Irving primary colors inserts Dak Curry Orange Ben Simmons Thompson behind him Orange is bam out of bio heat Colorado is backed up 1-0 now. What a team day around sharp there to 999 Nets What a team Lebron James Spellbound there. Oh nice Lakers again Lakers had a good break prime numbers called George Devon Booker blue to 99 Don't want the booker is rookie your book auto Joshua primo Spurs there you go three power formulas Spellbound Lebron title waves Lebron It's a heat Lebron there Just like that looks a little bit different hold on make sure it wasn't a multi-team or anything crazy, too She went out Kiki orange seen stranger things Absent for so it appears. What's up Ted? So it appears Orange KPJ Kevin poor junior Jericho Sims to 999 Nick's rookie Tatum their power formulas blew it in 99 Go clarity Lamello, it's gonna be Chris Middleton It'll be numbered to 49. There you go bucks last box Get right to it the best of luck. We got impeccable coming up right after our formulas Beal Lafonzo Ellis there is a base impact impressions auto He thinks for the sub there appreciate that cool. Let's go Steph Curry spellbound title waves Chris Middleton Orange Joe Ingalls. It's jazz clarity Zion Yo It's gonna be a use of nerk ish that time. That's number to 27 green This is 2021 22 Don Russell eat basketball. It's your hunter like Scottie Barnes or keys that class Kristoff's poor zingus on the auto. There you go the unicorn a Very funky cut on the bottom middle. It's like not all the way straight See that Send an empty box with that for the nevus case they care to get it replaced Felt weird my hands Star Stas Lillard primary colors Kevin Durant's Be a little recap at the end of this break guys. No, we write on to impeccable Deck and bead prism football to follow It's an orange you don't want to be orange Kelly Ubre Junior I'd say a Jackson in 999 Pacers Power formulas orange that time is Fred van Vleet's die cut there Orange Tyler hero heat Keon Johnson rookie there to 999 Clippers Power formulas to 49 Shrey young purple or I think that's star status excuse me. Oh Glass cleaners Yanis nice tough hits on the glass cleaners You go box congrats on the Yanis Very cool glass cleaners insert there really tough hits one that's a girl We'll take that for your box congrats and then Tyrese maxi their red die cuts to 99 Okay, let's do a recap of the hits guys. Thanks again so much for joining. Yeah, it's our hits here auto Kristoff's poor zingus That is the La Fonzo Ellis Joshua primo Scottie Lewis pen pals to 10 Jerry West's dr. McDermott to 25 Jaden Springer That is purpose short Carlos boozer or excuse me drew good in same person Josh goody to 149 Zion Williamson elite signatures blue Alan Iverson gold auto to 10 and a one-of-one Aaron Gordon Thanks again so much for joining everyone really do appreciate it We'll have them protect it up and right out to you


I guess, what can I say about this next presenter that we have, but all I know is, you know, having been in the community, I've heard of BootLogic, I've heard the name for a long time, and I have to say, we are very delighted, and it's about time that we finally have BootLogic come and present here at the pack attacking village, here at DEF CON. So, BootLogic's name is synonymous, I mean, if you look up cross-site scripting, BootLogic is synonymous, the name is synonymous. And before I begin, I do want to make a personal rag, we still have no idea why in the world you use Cristiano Ronaldo in your title slide. Without much ado, BootLogic! Thank you. Thank you. So, hi everyone. Sounds good? Okay. Hi everyone. I am Rodolfo Assis from Brazil, better known as BootLogic, and we are going to see what can be done with it for the win. So, I'm working at Sucuri Security, guys there, please, which is a go-dead company for the win also. I do some cross-site scripting, filter bypass, and some batch stuff. I help it to fix some vulnerabilities out there, but you won't see me in any of our famous, except the Microsoft one, because who is not there, right? And I have online access tool and discovery service. Okay. This is going to be a fast-paced talk about the dangers of XSS with a little intro to it for those who don't know it. XSS is a way to execute JavaScript code in victimized browser. The browser uses a programmatic model of the document in order to display it. So we can use JavaScript to do almost everything in browser. Here's a classical example of PHP code. We have a variable user, which is printed back to the screen. Then we have the input gel, but if we change the input for an XSS vector, we got the this pop-up, which is a proof of concept of the cross-site script. Okay. We have two main types, server-based, which can be reflected or stored, and kind-based after the code gets processed by the JavaScript engine in the browser. Okay. So after it, we can simply keep popping out. We have to do something with it. We have virtual defacement. What is that? It's a way to change the look of the page, and this might impact some business decision, for example, like buying, selling, off-stocks, or Bitcoin. Here is a simple code which doesn't really use JavaScript. It's just an HTML code to change the page with a picture, and here is a more complex one. It was a kind of a joke, which I altered the headline of this website with this code. You have an iframe, and then because the cross-site scripting is on a search feature of the site, we have to call the page first, use the source, and then we make some stylish over it. And finally, with the unload event handler, we are able to use the JavaScript to change the headline. Here's another one. We can access everything inside the page with JavaScript, so we can grab personal information like red card, social security number, or phone number address. We are able also to log what the victim is typing, and we can also build a fake login form to grab credentials. Here is the code of the key logger. We have two files. The PHP one is for log. It opens a file and writes on it, and the GS1 is the one that takes what the victim pressed, the keys, and sent to the PHP file. Here is a gif showing this in action. I'm typing this side, and the other side, the file is being updated. Okay, account stealing. We can still cook, but now, usually, we will face HTTP one flagged ones, but we can still compromise the account using password change or email change functionality which are unprotected. Here is a code, JavaScript code to still cook the simple one, and here is an example of the unprotected password change in WordPress.com. Okay, memory corruption. Thanks to the guys at Metasploit, it's easy to load some exploits against the browser victim. Here is the Metasploit beast, it's called a browser autopound. There is the first and the second version, which will load memory exploits, memory base exploits against the browser. To do that, we all need to call an image with a source of the attack domain, attack domain, access warm. Like any warm, we can simply spread it across the database and try to compromise all the accounts of the social network, and probably that means all. Here is an experiment of an access warm in action. You guys can watch it later, CMS. We have a guy here, expert in CMS, Mark. We can use XSS to achieve code execution at the CMS install. We just need to get the anti-serve token and submit it. WordPress is by far the most-used CMS nowadays. In my blog, I have code for all three, WordPress, Joomla, and Drupal. We are going to see now the WordPress one, the code to make an XSS becomes code execution in the website. We are using HelloDolly plugin, and then we start defining some variables, the path, the file, and the payload, which will be a reverse shell. We are using Netcat to get a reverse shell. We take the XSServe token with the first request. The dollar variable is the post-body that will be used here, and finally, we find the request to make the PHP code execute and open the Netcat listing. Here is the GIF showing. Admin is open the post to preview, and then the shell is open the other side. We have less dangerous outcome, like forced download of files, denial of service, and we can also get some geolocation or audio-video capture, but with permission of the victim. It's very easy to deliver XSS, because we can share in social networks, we can disguise it with URL shortening services, and we also have spam, spam fishing, and what a whole techniques to help the attacker or the test. Here are some references of my blog and my YouTube channel, so you guys can check later. Here is a reminder, if you are not convinced yet of how much dangerous can be an XSS attack. Any questions? The slides will be online, probably today. The worst thing, we can execute code in the website, if you know how to make the request, and if the admin is XSS with the link of the page with the XSS. I usually use separate browsers for each thing, so my blog, for example, I use another browser just for it, just to make the updates, just to access the dashboard, and I use another one to navigate, so XSS has to be fine in the same browser, it can't be XSS in my blog if I don't use that browser to navigate, to open links, malicious links. A user has to rely on the browser filter, for example, Chrome, or it has to rely on simply not clicking on links that come to your inbox, and that kind of security measures everyone has to take, yeah, plugging, browser plugging. You mean the XSS vector to use, user side, no, no, not yet, I don't have one, anyone? Anyone else, anyone else, going once, going twice, ladies and gentlemen, one more time, good logic. Thank you, thank you, thank you.


دكتور سادي you inspired us yesterday for a fantastic keynote speech and brought back home the reality of life in Syria once again so for those of you who are unaware it's recorded online to look at it again tomorrow but now there's something completely different let's look at something practical you've done to help your colleagues in the field what does that have to do with it? so yesterday in the presentation I mentioned that there are areas in Syria that are under siege and they are difficult to reach so how can we try to improve healthcare في سيريا right now in a city called مارت النعمان so I'm going to put so it's encrypted as always it's encrypted right so can I be trying to talk to the doctors in مارت النعمان so we're now connecting to the camera in the ICU in مارت النعمان مارت النعمان is in the province of Idlib it's an area that is being bombed frequently hopefully we can get the connection here so this is live this is live this is with the ICU I'm going to talk now with a different phone with a doctor on the other side to tell him to start telling us about the patients so here this is like a virtual war that you are able to do with the the junior doctors and still working in سيريا so the advantage of this that you provide 7 days a week by critical care specialist and intensive care unit in the United States and they can advise the junior physicians and the nurses and the technician in سيريا on how to deal with very difficult patients and this is life saving so you provide training mentoring advice consultation all of these things so I'm going to talk with Dr. Sami on the other side using WhatsApp so I'm going to use WhatsApp so I'm going to use WhatsApp I'm going to speak in Arabic السلام عليكم كيف حالك ممكن تتبلج تحكيلنا الله سلمك فنحن هلأ هون معنا team from Doctors Without Borders MSF فهن هلأ عمي شوفو الكاميرا فإذا بتحب تحكيلنا على المرضة تبروتك وانا بترجم لون This is Dr. Sami نحن نقول مرحبا تفضل ممكن انت تحمل الكاميرا من مريض لمريد يقول مرحبا يحب المرحب فنحن لدينا مرحب ونحن لدينا فيزيشنز في معرط النعمان ونحن لدينا 6 أطفال في this ICU ونرى أنها حقا تطبيق ونحن لدينا مرحبا في المسكس ونحن لدينا 2 أطفال ونحن لدينا وما يقوم بمعرط نعمان هل يقوم بمعرط النعمان هل يقوم بمعرط نعمان ونحن can show you مجموعة مطالبين فهي يمكنهم يقوم بعمل المعلومات عن المعرط ومعرط النعمان يقوم بعمل اكج ومعرطنا سؤال ما يجب أن نفعل إذا كانت المعرط النعمان أو ماذا تفعل ما يجب أن نستخدم إذا أنت تستخدم مختلفة لتبقى في مختلفة هل يمكنك أن تتحدث بشكل درس او من أخرى شخص من الشخص لدينا 9 أطفال شخص من الشخص مجموعة فأنا يمكننا يمكننا أن نتحدث بهم في كاميرا لكنهم لا يمكنهم أن نتحدث بي في هذه المعرط النعمان دعني أحاول أن أقوم بعمل أكثر أسئلة وماذا يعملون بشكل جيد مع هذا المعرط النعمان وماذا تعتقد أنك ستتطلب أعني أكثر مهمة من هذا هذا مخيف لدينا المعرط النعمان في المعرط النعمان ولكنها مستقبل في المعرط النعمان في المعرط النعمان في الشيكاغ نقوم بمعرط النعمان ونستخدم هذه المعرط النعمان لكنها يستخدم المعرط النعمان ولكن هذه المعرط يمكنك أن تقوم بعمل من أفضل يمكنك أن تقوم بعمل بشكل جيد في سيريا لدينا لدينا ستلائد لأن هذا مجموعة لأن there is no actually internet lines في هذه المعرط النعمان نعم ونستخدم one of our sister organization which we collaborate with called Syrian Engineer Association American Association they devised this technology to amplify the signal through using microwave I'm not but that's what I know so they used the microwave receiver to amplify the signal and then transmitted through Turkey so we can get this signal very clearly so here just we use telemedicine for other consultations so non intensive care consultations in other countries have you tried that in Syria as well we're right now starting two telemedicine projects one of them is telepsych for mental health so to provide consultation because we have a shortage of psychiatrists and as you know there is a huge crisis with mental health because of the violence and PTSD and then so Dr. Sami right now is telling us about the patients so this is one of the patients he's describing and you know he tell us vital signs and what's going on with the patient and he can ask questions of course through whatsapp and I'll show you after he finishes let me ask him questions if you want to ask him questions online Dr. Sami Dr. Sami and also maybe the some of the things that he's found that have been difficult with the system and also maybe the some of the things that he's found that have been difficult with the system the advantage that before this system they use only to depend on their own expertise but right now they have the advantage of using the expertise of a critical care specialist in the United States and that's a big advantage Dr. Sami what things have you found that can be improved with the system he said that there is no one that's a wonderful that's a wonderful quote on wish everyone all the young guys here are wishing you all the best I wish that it'll be the things you've needed do you have problems or many things or hopefully the future there's no bombing today thank you we pray to the young guys I'm thanking him on behalf of I'm sending him my best wishes and congratulations for the fantastic work شباب الله يعطيكم العافي وانشاء الله نشوفكم بخير على كل ان دكتور سامي بعد ساعتين ممكن اتصل فيك كمان مرة تاني همكن طيب هلأ ما في داعي الجولي بس بعد ساعتين انشاء الله طيب شكرا كتير الله يسلمان مع السلام نشوفنا ساعتين شكرا جدا واقعا صحيح it's the most important thing that when we ask doctors in Syria, and that can be applied on other areas of conflict, what do you need from us? they wanted support. They want to make sure that someone is with them. Whether by sending them medical supplies or medications or providing them with training, or at least they know that they can contact someone to talk about difficult patients or to tell them that. اإنfolio can look at Chess extended, you can look at vital signs all kind of information, they can see a picture and send it through Viber and that way you can provide it to our companyasea,thank you very much indeed it's really fascinating congratulations on being able to provide through a large world a network also support the people on the ground, that's great thank you very much