One of the most common questions I get asked is, you know, how do I start day trading? So what me and my mentor about it for our viewers on YouTube is create a free mentorship course that reveals our 12 secrets that every single brand new day trader should know before they get started. But please take note that there is limited seating every single week. So please reserve your spot at myinvestingclub.co. Link is in the description. It's been, it's been so long since I did one of these recap guys. It feels good to be back, man. It feels good guys. For those that do not know, so I started recording ready. For those, so today is Thursday, January 14, 2021. It's been a while since we did one of these daily recaps. The intent of the daily recap is to educate. We can probably do one of these all the time, but you know, the whole point of this versus the IG lives and the moderator mentor videos as this goes into way in depth.  That's when I do one. And so today, this is pretty much my agenda. So what I did today was, man, I made a bad mistake. I got greedy. I got, I got beat up on DPW, which I'll show you all this stuff in pre-market a lost. And then I wanted to show you how I mentally recovered back and made my money back and then, and then some more. So a couple of things. So this is the agenda guys. The main thing I want to talk about also is first red day. And also low float plus SSR plus ETB, ECBRO plus SSR, which is the DTSS place. So there's a couple of great things we're going to talk about today. So with that, let's just jump into it. There's really no format guys. You guys can ask questions and then I'll stop. And then at the end, it doesn't matter what you guys want to do. So let me show you what I did first today, guys. So today, today I got a little excited because I woke up this morning and take a look at this nasty chart on DPW. So I got really excited on DPW, man. Yesterday they had some news or whatever and then it jumped at 680 and started fading down all morning guys.  Once again, FOMO FOMO. I was like, dude, I need to get in. I need to get in. So when it started coming down to 540 line, when it started to come down this morning, we see it's at 7 a.m. So 7 a.m. is around here. So I shorted it. I shorted it at the $6 line. You see that guys? So usually a good place to have a good short is a whole number. So the whole number is six bucks. So that's why I went in. I just made my normal 20-cent scalp and then it started going down more and I was like, oh my God, I have such FOMO. This is where the mistake starts, guys. The mistake starts as I got my order in and I made my money and I kept on going down and I have so much FOMO. I'm like, why did I hold, why did I hold? This happens all the time, guys. And you take a look at what time it is. This is all market time. So it's still way early, dude. It's not even eight o'clock yet. It's not even eight o'clock yet and I already got FOMO. So what I did was I started placing bigger sized classic trap formation, shot up 420, started to go down. See, it's shot up to 420 and started to go down. And so I'm like, dude, this thing is a huge opportunity because this is the process that we teach. We teach, wait for the top to be set and then you scale the short at the resistance line. Exactly what I did. I nailed this play perfectly. I nailed it. I top ticked it around the 4, 380 and 390 line right here and I covered right down to the bottom. This is exactly what I did, what I do all the time. Wait for the top to be set when it bounces, a short. That's why I get top ticks a lot, guys. I use the lines. I draw my lines and then, you know, based on experience, I know which ones are better lines and not. So that's why I top ticked this and I kind of like scaled down. You can choose to have one bullet. I just kind of scaled out the way I scaled out. I am not the perfect trader, guys. I'm a control freak. I like to take money off, to cushion myself for the later of the whole. Sure, I can wait for the bottom, but that's not how I trade. I'm more conservative. I like money in my pocket. I lost so many times that I've missed covers by one penny, trying to get the tops and the bottoms. So now I scale to just get the average. You should try it on your own. Which one works better for your personality, guys? To me, there's no right or wrong answer to trading like this. You know, there's a technical right and wrong, risk-reward technical, but we are humans, man. It's so hard to control our emotions. This is why traders fail. They cannot control their emotions. So you have to find something that you can control your emotion. Even though it's not technically right. If you take a look at golfers and sports, basketball, they're people that don't have perfect swings, that shoot the ball so awkwardly, but they get the job done. They have to be comfortable whatever they do. So for trading, for me, I'm a control freak, so what makes me comfortable is taking some off early so that I'm cushioned for the rest of the whole. So I don't have this anxiety. I'm a very anxiety-filled human by nature. And so by scaling, I get a little piece early so I don't have FOMO anymore. That's why I piece in a little, so I was like, whoo, I don't miss it because what's going to happen is if I miss this by a penny, I am going to be so mad it's going to ruin my day. Then I'll be looking to revenge trade, to do a makeup trade and all that. And that's what happened with DPW, man. Hey guys, my name is Toss Bradley. I'm one of the head mentors and moderators of my investing club. If you have any questions about getting started in trading, getting started in MIC, MIC in general, text me at 2-1-3-4-5-8-5-9-9-7. This is not a robot. It is me directly on the other end of my business line. And we'll get you in the club. We also have special promotions going on that I can get to you depending on your trading needs. Hit me up. Back to the video. Let's see, so I go back to the screen. Let's see what this number is. This is around 390 line, 392, 390. Then there's a bottom here too, so 380. So between there, if it's going to trap, it has to be here because it'd be too low. Like, remember what I keep saying? There's too much volume. Too many longs are stuck up here. And when it deviates from this, shorts now keep hammering it. So to me, this thought, if it needs to be saved, it's got to be saved soon. It's got to be saved at this line or this line. Underneath that, in my opinion, short on all pops at the resistance line. Because the chart now has been formed, I know where to take stops. So from here to here, if I was entering here as a short, if I short here, I would place a stop. Maybe 10 cents above this because the next one is too far away. If it's too far away, why am I holding for a 60 cents loss for an ad? Take the loss, wait again to reshort the 480 line.  I was too focused on plugging all this stuff. And then when the zombie rule hit, I was like, so, like I said, there's so many stocks guys, there's so many stocks to trade.  This is a bonus, so you focus on the top three you want. And then you constrain that. I didn't look at this stuff at all. I was focused on plug. I was focused on other stocks, DTSS.  I should have focused on this. Sometimes you don't know which ones, the best ones, which was not. But look at what Alex wrote. I never hit 350, but here, he's looking at 320 to scale. That's exactly what I did. I started scaling at 320, and that covered the D-WAP. And I just covered down here. And I was like, OK, I walked away. I don't know what happened, dude. This stock should have been up there. But I was scared of this stock. I'll tell you why I was scared of this stock. This is what you should spot, guys. This is what I used to do on pink sheets and OTC penny stocks. I'd try to scan for these type of place. And this, you know, this is it. Some weird formation. It drops down to SSR. But you know what, man? You can be chasing these and never hit.  But when I look back and I see this, this hindsight is easier to go in hindsight to spot these. Obviously, at the real time, it's very difficult to spot. So don't think that people can spot this easily. Don't think that you have an algo to do this. Maybe we can in the future have a scanner set up to do this. Just spot unusual activity and you kind of track it. And what happens is this, people don't realize that you can use a stop, a stop to trigger a buy when you are not even in the stock. People think that you only use stops to exit your position. You can use it to enter a position. Because all the stop says is if it hits this price, either buy or sell. You pay one stop, you buy or sell. You can do stop and buy yourself. So you can have trigger buys when it happens. There's a difference between a limit and a stop. The stop, I could do a market stop, meaning like when it breaks that price. So example would be this. I'm looking at the pre-market high of this day. This is DTSS and say, hey, if it breaks this something's unusual, I can buy it. If I have spotted this, I'm just making this up, right? This is a, not this good guys. No one's this good because you have to be able to predict this in this snow way. This is easy in hindsight, but I'm just saying, I'm just giving an example of how you use a stop to buy. Like I say, it's three bucks and break three bucks, three 10, buy it. And then that's the stop. Plug is very ranging. Be careful in the sizes. My plan is to cover $64 and around the SSR, $62.55. So how do I calculate SSR? What SSR is, once it triggers SSR, short-cell restriction is this. The previous day's closing price was 69.50. Previous closing price, 69.50. So I take 69.50, multiply by 90% because SSR triggers on 10% down, only at the general market session, not pre-market, not aftermarket, right? Times 0.9. That is a triggering price. So basically that's 10% lower. 10% lower from the previous day is this. So if it hits this, it will trigger SSR. And usually when it triggers SSR, there's a bounce. That is a tip that you guys should learn. Always cover some, don't need to cover all, cover some at least at this trigger. Because a lot of times it will hit this exactly. And you think, whoa, it's a quizzes. No, dude, the Algos planet, the Algos hit this just to trigger SSR to squeeze all of the chasers, all of the shorts that chase. Sometimes they flush the stock to SSR to get rid of the longs for the next leg up. Because if there's too many longs, they are selling too many sellers, right? Remember, longs are natural sellers. Shorts are natural bidders. To get the next leg up, they need to clean the stock. So they wash it sometimes down to SSR. That's why you see, we do these calculations all the time, man. And I see exactly the bounce below the day is right here. Could have been better if I covered here, but it was too late, guys.  I was saving it for the SSR area. I thought it was gonna blow them down here underneath. So I saw this, I did not cover, but I got greedy. I wanted the SSR, which is 62.55 to cover the rest and third and the rest there, that's good. It's fine. So we went back up, I took the same short at the 67 line. And then look at the clock. Oh my God, 10 minutes until zombie.   You do not need to wait until zombie hour to get the hell out. This thing started a zombie before 1030. When I realized that they are VWOP reclaiming, I need, and then I looked at the clock.  If this was under VWOP, at this time, I would not be scared. I would have held it for the SSR cover, but the fact that it is over VWOP heading into zombie hours, what do we say about hovering? This thing is not only hovering, it's over VWOP.  It's not worth it. Thank you so much for watching our video. If you want to see more of our videos, please subscribe to our YouTube channel by clicking the button here. We do our best to post a new video every single day. If you have any questions about MIC or any general training questions, please text Tosh using the number here. Also, stay up to date by watching some of our most recent videos right over here.


Good morning, everyone. All right, let's do this. I think we actually may be able to get through if not all of it. So let's shoot for that, and then we'll answer any questions that we have afterwards. Cool? All right, so here we get to kind of currently one of the big monsters of the web world in terms of vulnerabilities, so cross-site scripting. So this is honestly one of the most prevalent vulnerabilities in web applications today. It can stay much more prevalent than SQL injection vulnerabilities. And it's actually really helpful to kind of think about why that is, right? So when we talk about cross-site scripting vulnerabilities, I want you to be thinking, OK, but why are they still around? And they can affect basically any web application. So unlike a buffer overflow where you can say, well, move from C to Java, and now you're fine, right? You can completely eliminate that. Nothing was really analogous for web applications yet. And the whole point, so OK. So actually, the cross-site scripting name is kind of a misnomer. So we'll get into it kind of exactly why. But the fundamental problem, what cross-site scripting means, what it allows an attacker to do is it allows an attacker to bypass JavaScript's same origin policy. So let's refresh, since I talked about that was the most important part of the course. What is the JavaScript same-origin policy? What is what defines the same origin in the same-origin policy? Post-name is 4. Post-name, 4. No. That would be that every web page had a different same origin. Right? Close. Yeah? I think it would be a great job, but I want to see if it's like. Yes, but what is that origin? Like, I want to see if it's like. How do you define the origin? By the actual interest. Domain is 1, coordinate is 1. What's the third one? What was that? Protocol. Yeah, the protocol. So HTTP versus HTTPS versus FTP or even file. File is a different protocol for local files. Make sure that those are in different origins. So the whole idea is the same-origin policy is used to separate JavaScript executing in two different web pages. So that way, the same-origin policy ensures that the JavaScript you're executing at some attacker.com site cannot change an altar or facebook.com. This is the fundamental issue. The web is actually built in such a way that you should be able to go to malicious sites. You should be able to download and execute their JavaScript, but it should not affect any of the other pages in your browser. Because you could click on God knows what links. I mean, I'm sure we've all done this. We're just like, I'll send you something link. Oh, cool link on Facebook link. We could get to somewhere malicious, but the same-origin policy should prevent us. It should keep us safe. It's our nice, warm security blanket in the browser that says, ah, nobody can touch facebook.com because the script's executing from that malicious person. The same-origin policy means that it's going to be blocked. It's not going to affect facebook.com. But cross-site scripting vulnerabilities allow an attacker to bypass this. So what does that mean more mechanically? I mean, what does that allow an attacker to do? What is bypassing the same-origin policy? What does that get, the attacker? JavaScript on the end of the tabs or in the top? Yeah, execute. Fundamentally, if you're bypassing the same-origin policy, that means you're executing attacker-controlled JavaScript in the domain of an important page, or in the same-origin policy domain of that important page. So generally, if this allows you to bypass Facebook's same-origin policy, now the attacker is executing arbitrary JavaScript within that same domain. Now they can completely alter the content of that page, that facebook.com page. They can potentially try to steal your cookies and log in as you. They can even, with Ajax, what can you do? What can you make? So what do you do? Yeah, we can make requests to the server. And it's as if that JavaScript code running on facebook.com, the normal JavaScript code, is making us call them. And what can we call? We can call anything. So we can call methods. We can call functions or call pages that transfer, that add comments, that transfer money if it's on a banking site. We can fundamentally do whatever that user can do. So we kind of think about it at a high level, cross-site scripting, into kind of three different categories. The first one are, well, first, before we get on here, I want to actually show you what the cross-site scripting vulnerability looks like. So how can an attacker actually bypass the same-origin policy? So one way would be to somehow trick the browser. Like, what if I sent, let's say there was a bug on the browser, right, that if I'm accessing Facebook, where the O's are actually some other unicode character, right, if the browser thought that that was actually the same domain as facebook.com, then we could have a cross-site scripting vulnerability, even though this exists only in the, it's the result of a problem in the browser. Mainly what we talk about cross-site scripting is in terms of web applications. So bugs in the web application that allow an attacker to bypass the same-origin policy. So let's look at a simple example. Here we have PHP code, and the PHP code is setting the main variable to a get parameter. So what's the global get, what's that accessing? The query string, right? So it's gonna return whatever the value is in the URL of the query parameters. Whatever has the key name, it's gonna return the value there, right? And who controls that? The user and attacker, right? That comes from the user making the request. And so let's say we have this, this is our PHP page, right? We have this page, we say hello name, right? And so what's gonna happen at the server side? So A, first some, what does the equal sign there mean? And do what? Yes, and print. So it's gonna print out the value of name, whatever is your name. So this is, actually I think it's a setting of the enable in PHP to get to enable short tags to get this, otherwise you'd have a PHP tags and you'd have echo name, which returns the name right there. So how does this work? Well normally, let's say we're going to this page and we pass in name is equal to atom, right? So what's gonna happen, right? We have to think what's gonna happen with this code? Right, so what happens on the server? What does the server do when it gets that request? The value of that key name then sends that guy back. Yeah, so it gets that value name, right? Which was atom, it sets it into this name variable. It outputs the start of the HTML, a hello, and then what does it do here? It replaces this with whatever we sent, right? So if it's atom, it shouldn't say hello atom, right? But what does the browser see, right? So this is the web application, right? The web application generates an HTTP response, right? Which happens to contain HTML. But what does the browser then have to do whenever it sees that response? As to parse it, yes, this is absolutely the key. It all comes back to parsing just like SQL detection and vulnerability, right? The browser doesn't see this beautifully, well, beautifully, sorry, color coded tags here, right? It just sees a series of bytes that comes back from the server, right? These bytes happen to be the first byte as an angle bracket, the next byte is an H, the second, the third byte is a T, the fourth byte is an M, yeah. So you got the name atom from the client, from the person on the webpage, you're not grabbing it from the database, so I'm sorry. In this case, so we're getting it from the URL that's passed in. So from the HTTP request, basically, is the way to think about it, right? Because you wanna think about it in terms of the protocols to what happens. But yes, so the user in their browser will either type this in or I send you this link. You click on that link, it makes an HTTP request to this example.com server, pass in the URL slash, question mark, I don't know why I can't remember that. Question mark name is equal to atom and then the PHP code uses that get super global to access the atom from that URL in the HTTP request, right? So it's important to separate out what your browser does versus what it's doing under the hood is it's speaking HTTP, right? This is why you can use a command line browser to do this, like curl. Or you can even just raw connect to socket 80 and do the request yourself, right? And then the important part of that step is the browser gets shipped this and it parses it, right? And so it knows every time I see an angle bracket and then something, right, that's the start of a new HTML tag. And when I see an angle bracket slash something else, that's a closing tag of that HTML tag, right? Just like, so I think probably everybody in this room should have taken the equivalent of 340 or actually taken 340, right? That's why we learned, I mean, part of the reason why we learned about grammars and languages and compilers, right? Because parsing is everywhere, right? Your XML engine is parsing XML, the HTTP of the browser, the HTML parser of the browser is parsing HTML, right? And this is where the problem comes in. So we looked at this in our browser, and we see something like this. So let's say, hello, Adam, yay. But the question is, right, what happens if we put in HTML or what would be parsed as HTML into that parameter, right? And specifically we care about bypassing the same origin policy, right? So what if we put in some JavaScript code in here? A starting script tag and alert cross-site scripting and ending script tag. So, hey, first question is asked yourself, is can I do this? Yeah, you may need to encode some characters, right? Depending on the URI encoding, right? But you can URI encode everything in there, right? You can turn those into percent, whatever is percent encode every single thing in there, right? So you can say name is equal to this thing, right? This is one of the important things. You can pass in arbitrary information as a get parameter or a post parameter. And so then what's gonna happen here? So let's think about what happens on, so we type this in our browser, somebody sends us this link, right? It's gonna make an HTTP request to the server. The PHP code is gonna start processing. It's gonna look up in the URL, what was the value in the query parameters that had the key name, which is gonna be what, the string, start script, alert cross-site scripting and end script. And then what's it gonna do with that value? Execute it. Yeah, it's gonna just happen on the server side, right? All it's doing is sending those bytes, right? So it substitutes in that value for that angle bracket parentheses equal, not parentheses, percent sign equal, right? It's gonna substitute that in there and then it just ships it to the browser, right? We're then, what does the browser do? Executes it. Yes, it parses that response that came back from the server and it says, oh, the developer sent me a script tag. What do I do if I say a script tag? Execute it, right? It's JavaScript code, right? This is how the developer tells me to execute JavaScript code because it's inside of a script tag. And what's the domain of this script tag? The, sorry, the same origin policy domain of this script tag in this example. Three double. What is it, actually? What is it, even this example? Example.com. Example.com, 80, HTTP, right? But where did this script tag come from? From the URL, right? Which, if we got sent this link by somebody else, right? If hacker.com, whatever, sent us this link, that script tag did not come from example.com. But it's executing in the same origin as example.com, right? This is the key fundamental problem is now this code is being executed, right? The big problem is, once again, coding data makes it, right? So here I have my HTML data mixed with my JavaScript code. And when the browser gets those bytes, it has absolutely no idea to understand which of these code came from the developer that the developer intended and what was introduced by an attacker, what's extra code, right? It's just a parsing engine. It just says, okay, parse, parse, parse, parse, right? And execute.  Modern browsers have features that will detect a very simple cross-site scripting like this where it sees scripts in the URL parameter and then sees those exact same scripts in the response page. So it will actually block this by default. But there are other ways to get around that, which is why it's still a problem. Questions on this? Yes? Oh, I'm sorry. It would seem it doesn't really cause permanent damage to that sort of one-time type of attack. Is it, are they actually still very dangerous or? Yes, okay, so question is, are they dangerous? So another related question is, what can you do with the cross-site scripting attack, right? Well, let's see where we're going. Okay, yeah. Right, so what can you do, right? So the question is, what can you do here with a direct one-time attack? So you want to give me one shot at your, you want to log in and chase and leave your account open for me? Yeah. That'd be good. It's just one time, just one time's promise. So yeah, so fundamentally what this JavaScript code can do, right, it can make any request to example.com that it wants with Ajax. It can completely change the webpage of example.com. If this was chase, I could make a login page, right? Let's say it's the normal place. I can change where that login form goes to with JavaScript. With JavaScript, I can completely control everything, right? So that action part of the form, right? Where that form goes when you type in your username password. I can change that. I can hook it with JavaScript to get those values and make it an external request to me. I can change that so it actually goes to my server and then maybe goes back. And you have no way of knowing that your credentials just got sent to me. Yeah, if you, so those are kind of more just using the JavaScript itself. Another thing I could do is I could insert an iframe or something to an exploit kit that has known browser-based exploits that would try to exploit your browser and then give me remote code execution on your machine and now I'm on your machine permanently. So I can turn your webcam on. I can do all kinds of fun stuff, right? Steal all of your accounts, not just that one time. So even that one time. Cross-ed scripting, not even once, right? But it's a good question because we'll think about stored versus, you know, there are different kind of levels. Part of what we like to do is academic stories. Categorize things and name things and think about how things relate to each other, right? How do we differentiate it from a legitimate popup that it's originates not from the same domain? Yes, the browser has no idea, right? So here I'm doing a popup, right? But this is just a proof of concept. The idea is if I can do this popup, then I can do anything, any of those other things I talked about, right? I can do anything in this origin, right? I can't mess with other origins. So I can do anything I want in this origin, okay? What if in the URL you did another and name equals, so what would actually be stored in the name parameter? It depends on the back end web server. So the question is what happens if you add, if you make a request with additional key value pairs that have the same key? That's actually, so if you're really interested in it, there's a paper called HTTP parameter pollution vulnerabilities which leverage this technique that some web servers will return, some server-side languages will return the first, some will return the second, some will actually change, some will turn them into a array sometimes which makes super weird stuff when people are not expecting that. Yeah, so there's HTTP parameter pollution is a vulnerability that takes advantage of that fact. Okay, so, right? And so for reflected cross-site scripting, right? So coming back to the question, how do we do this, right? Well, are we gonna assume that the user is gonna type in this URL with the script tags? No, probably not, right? The user is not going to type this in themselves. Although I say that, but there's actually a huge problem on Facebook of people saying, creating posts about, oh, there's this cool hidden feature in Facebook. You go into your browser and you enable the development console and then you copy and paste this thing into there and look, Facebook changes color. So people are actually self-cross-site scripting themselves because the development console executes JavaScript in the context of that web page. So Facebook actually disables the development console now. So when you go to it, you have to do certain things to explicitly enable it, which is kind of crazy. They'll actually tell you, like, if you try it, go to Facebook, I think it'll pop up a warning that says, like, you should definitely not do this. Does it do it? Yeah, yeah. So, okay, so A, we probably don't have to be worried about users typing this in themselves. But what do we need to be worried about then? Links, yeah. I can very easily get you guys to click on a link, right? I just send you a link that says, here, you're great. Every single person can click on that link, right? But even somebody who's not in a position of power, right, could get you to click on something. I could, what if I send you a bitly link, right? That automatically redirects you somewhere. You have no idea where that bitly, that short URL is gonna take you. It could take you a page that looks exactly like this. And what if I URL encode the value of that name parameter? Are you gonna know that that looks suspicious, that that looks kind of like a process scripting attack? No, not at all. We're used to doing this, right? We get emails all the time from companies that's like, hey, I don't know, coupons or something, right? And they're huge URLs that nobody bothers looking at what it is because, and then we got time for that, right? Check every link that you click on. Or, you know, that's directly sending you a link. What if I just post links on Facebook or post on a forum or post on Twitter, right? So people are gonna click on those links, right? So yes, we do have to trick somebody to click on those links. But the web, the security of the web should not be built on don't trust links, right? Because that's the fundamental part of the web. We should be able to click on arbitrary links and have nothing wrong happen with our computer. Fortunately, unfortunately, that's not the case, right? So there's important things here. So we actually kind of talked about all these. So we can access, so once we can execute JavaScript in a different origin, we can access all of the information that a user stored and associated with that site, right? So we can try to talk to the web server to extract information about that user. We can potentially access the cookie, right? If we steal the cookie, what is the cookie used for? Lot of sessions, yeah, establishing a session with the server, right? Because HTTP does not have any concept of sessions, right? So if I send you JavaScript code for Facebook, well, it's not new Facebook because they have security measures, I think. But, well, Facebook.com, right? I send you a link to a cross-executive thing. You click on it, the JavaScript code executes. It extracts your cookie, sends it to me. Now when I make a request to Facebook and I include your cookie, what does Facebook think? Yeah, it's that same session, right? It's just a new request from that same session. How many times do you take your computer onto a completely different network and you're still logged in to all the same websites? All the time. You've completely changed IP, right? You're accessing, right? HTTP only sees the IP that you're coming from. So you're coming from a completely different IP, but you're including all the session information. So it says, hey, good, I know it's you. Congratulations on your new IP, right? One of the really cool things is we can have a form appear on the site and we can steal pins and passwords. So it would be like something like this. So if I found the cross-excripting vulnerability on Facebook, right? It might be something like this. So I'll say, A, this is, it's Photoshopped. So this is not a real thing. I did not actually find the cross-excripting vulnerability on Facebook, right? But all I need to do is send you this link. So this script is doing what? Loading a remote JavaScript that I probably wrote. And so what origin, but the origin here is example.com, HTTPS, right, 443. So why does this work? Yes, for Facebook. The same HTTPS for Facebook with a domain zone match. The three tuples have the match completely. External JavaScript executes in the same origin, right? That's part of how we can include code from other places, right? That's how we can include the jQuery library from Google's content distribution network, right? And have it execute in our origin. So this specifically bypasses the same origin policy. So the question is, what happens when you type in your username password here? And it's gonna be stolen. It's gonna definitely go to me. And you may not even notice, right? I can do this in a couple of ways. I can change the action, right? So you send the username password to me, and then I redirect you transparently back to Facebook, and it would say, oh, maybe you just think like, oh, I didn't type in my username password. So I type in again and it logs in correctly. Or I could hook this. I could make an HX request to my server with your username password, and then let the original request go through to Facebook after I get a response. And now you're logged into Facebook, you have no idea that your browser is coming to second request to my site. So this is an incredibly powerful technique. And of course, I would also super encode this link. Like who's gonna check that this is not actually the login page for Facebook? And this could be any page for Facebook. It could be a comment page or something, right? If you suddenly see this page, you're gonna be like, oh, I need to log in. I'm logged out. It's really cool. It's actually super fun to do. I mean, not like two people, but a fun exercise to do. So the opposite of reflected cross-site scripting is a stored cross-site scripting. And really the key idea of who executes the JavaScript, we still want the user's browser to execute the JavaScript. The question, the differentiation here is how did that JavaScript get to the user's browser? What did, what happened to get that data there? Oh, and so does everybody agree that this is a problem of, that this is a problem in the server-side code of this application, right? Exactly on this line here, hello name, right? There's a cross-site scripting vulnerability because their name comes from the user, comes from potentially hostile, untainted, untrusted user input, right? It is being used just as is without any sanitization or any transformation here. So the idea of the stored cross-site scripting is, you can kind of think of it as like a two-stage attack. So we basically are going to try to trick these, let the server-side code to accept our input, store that input in the database, and then every time somebody visits the page, they're going to include that JavaScript in the response, our JavaScript. So the idea is first the JavaScript code by the attacker is stored in the database as part of some message, right? And then later the victim is then going to go to a page. So if you think about a blog page with comments, right? Comments are stored in the database. So if I write a comment with JavaScript code, that gets stored in the database. It doesn't get returned right away. It's not a reflective thing. But once that's in there, anybody who visits that page, right, is going to have that code be executed. And this is a key difference. So any website that, so if you store user content and you don't sanitize it when you use it, it's the same fundamental problem. We're using input that came from the user unsanitized in our HTML output. It can be vulnerable to the tech. So there's a lot of other, I mean pretty much every web application allows you to, and this could be any data. This could even be your username, right? Your username on some sites, or your city, or whatever. Any place where your input goes to the system, right? And stored and shown to other people is a potential vector for cross-site scripting, stored cross-site scripting. There's actually a lot of different ways to carry out these attacks. One of the best resources is the cross-site scripting cheat sheet, which I believe is at a... Let me see if this is the correct link. I wanna make sure. This is important for everyone to have, so. Okay, I guess it like this. There's just a redirect on it. Okay, so this is pretty good. So this is, I think, where this became and how this evolved is this is the series of tests. So there's different types of ways to execute JavaScript in the browser. So the basic idea is with script tags, right? It's very clear. If you're telling the browser this chunk is JavaScript code, right? But there is, oh man, there's so many more, though. We can include an image tag, and inside the source attribute of an image tag, we can include JavaScript. And we can say, so that JavaScript can do anything we wanna do. Also, it also depends on what the browsers accept, right? So fundamentally, even if the HTML spec says, hey, you can't do this, if the browser does it, then this is a potential vector. It may not work on everybody's browser, but it works on enough. So our snake was the first person to go through and collect all these different vectors, and that's what ended up in this OOSP list. So, let's see, I don't really need, so like here, it does all kinds of weird stuff, like malformed tags on mouseover, that's a good one. On error, this is actually a really good one that I use often. If you give an invalid source, and then this on error handlers automatically triggered when that image can't be loaded, and so this JavaScript will be executed in there. This is actually a good technique. Fixing slides on the fly. All right, don't tell anyone, it was here all along. Right, so this is actually a really good resource you can go through and pour through, and it kind of makes you realize, oh my gosh, there's so many different ways that browsers can execute JavaScript, right? It's actually pretty insane. So the simple would be script tags that normal one would be talked about, right? Script tags alert something. We can, so, why don't we just always try this? And if it doesn't work, we just say, game over. There might be partial sanitizing. Yeah, right, so, how, so, okay, let's go back to our original example. So how would you fix this? What would you need to do to fix this? And what is your goal in fixing this? How? Specifically how sanitize. Escape the input. What was it? Escape the input. Escape the how? With backslashes? Yes. 99% of the framework would change the smaller-than-scient with ampersand LT. Yes, okay, so, what's that? So the ampersand, right, is the ampersand LT semi-colon, that's HTML entity encoding, right? Which says, hey, I want a visual less than symbol, not the actual parsing important less than symbol, right? So if we throw this name, if we first, before we output it, we pass it through the HTML entities function, right? That'll completely solve this specific cross-site scripting vulnerability, right? Because here in the HTML page, how do we transition the parser to JavaScript? Yeah, we need to use the script tag or we need some kind of tag, right? Either like we saw, we can use image tags, but we need some kind of tag, right? And so if we're encoding all those as HTML entities, the browser is never gonna parse any of those as tags, right? So by doing that here, we can completely solve and fix this vulnerability. But what if you supply a greater than sign? So you are closing the tag that this browser is expecting and then you provide your... So, exactly right here in the HTML page, what tag is this expecting? So, like currently it is expecting a less than... Yes, exactly, it's expecting a less than. So that's why in this specific example, that's all you need. We'll talk about the other stuff in a bit. Yes. Okay, so that's the way to make this specific instance 100% secure, right? But oftentimes we actually want to, if we're writing a blog software, we may want users to add comments. I mean add links in their comments, right? But we actually want the users to use maybe some part of the HTML. So the partial sanitization problem is that people do it in a bad way. They maybe detect and look for a starting script tag and an ending script tag, right? They say let's just strip all of those out, right? So, and sometimes depending on where this happens, right, if it happens at the web, like a web application firewall or maybe Apache is trying to do this before it gets to the backend server side code, right? We can encode using URL encoding the tags and then what happens on the wire, right? We don't see in that HTTP request, we don't see angle brackets or angle script, right? We don't see any script tags, so we think it's fine. But it gets to the backend web server as an angle bracket, right? This URL encoding is translated. We can also use event handlers, which are very handy. The onload event handler does not work with every single type of element, so you need to do some experimentation to figure out exactly what it is. We're gonna inject this body tag, this means when that HTML loaded, this JavaScript executes. We can do other tricks like this. We can use an onmouseover event. What does this do? The web developers, when does this code execute? Yeah, when your mouse, when the user puts the mouse over this link, our JavaScript code is executed, right?  Click here to redeem your prize. You're at least gonna hover over it to see where it goes, right? Maybe. We can add, this is one of my favorites, like I said. We add an image tag, we set the source to be something that does not exist. And that way, we know it always will not exist, so that onerror clause will be triggered and this will be executed. And we can do crazy things. We can do like an image tag with the source as JavaScript as we saw. We can try some browsers. So if they're looking for the keyword JavaScript, we'll use this percent hash X41 and actually translate that into an A at some point because browsers, right? I mean, if you put a website and your browser's like, whoa, whoa, this website did not properly close this tag. This is invalid HTML. No, right? It silently tries to do its best job to parse any crappy HTML page that's existed from the dawn of time of the web, right? They're parsing engines, even the newer engines like Internet Explorer will try to detect if it sees weird things, it will actually try to parse it as if it was like IE6. It has whole other cases in there, so rather the parsing engines are really complex. So sometimes they'll do this. Sometimes you can rely on weird behavior in certain browsers. We may or may not be able to use quotes depending. So here we're actually, we may not need quotes in our source and our onerror depending on here. And here, notice I haven't input any like single quotes or double quotes, right? But I'm still alerting, I can still alert this old alert Adam in here. Okay, so these are the two traditional types of ways that we think about cross-site scripting. We're gonna talk about a third way which actually has nothing to do with the server side code at all. But it's really important to talk about this because it really is the same fundamental problem. Fundamentally, you're executing JavaScript code that came from somebody else. Yes. Which I wanna get my understanding correct. Sure. So on one tab, I have Facebook open. On the second tab, I have a blog. All right, and blog has comments. Yes. So even I can add a comment. Yes. Now a malicious, sorry, an attacker has posted a URL. All right, so now. On where? The bottom of the blog. Okay. The previous one. Okay. Now I read the blog and I happened to click on that particularly. So can I take my cookie from Facebook? No, no, you can only steal your cookie from the blog itself, right? I mean, unless the link is to a cross-site scripting vulnerability in Facebook.com. No, you're saying that the link has to be present in the same domain. No, no, no, no, I'm saying that depends on where that link goes. Where does that link take you? To this side. Yeah, that's fine. I need you. The JavaScript code needs to be executed in the same domain as Facebook.com, right? So it's got to come from Facebook.com. So you have to end up on a Facebook.com page. So they either have to send you a link to Facebook.com, right, where there is either stored cross-site scripting or there's a reflected cross-site scripting in that link that they send you. Then their chosen code will execute in Facebook.com. But by default, just by visiting some other site, they can't get Facebook's cookies. Any other questions before we go on a Dom-based cross-site scripting? Okay, so Dom-based cross-site scripting this actually has a couple different names. It's also called third order, which is very confusing because it has nothing to do with, it's not related at all to second order SQL injection vulnerabilities. It's third order in the sense that the first would be reflected and the second would be stored cross-site scripting. And so the third would be, apparently they didn't realize that to give it a name. I actually haven't, so yeah, reflected would be first order stored second order. I actually really prefer the term client-side cross-site scripting because I think it's more indicative of what is actually happening here. But so you can see literally any of these terms. And the core idea is this is because there's a bug in the JavaScript code itself, right? Whereas before in reflected and stored cross-site scripting, the bug is in the server-side code, right? It's in the PHP code or the Ruby code, right? User input is being used to generate HTML response that's not properly encoded. But here as we'll see, the bug actually exists in the client-side code, which is kind of crazy. So this is what I like to think about it. I'm actually kind of trying to bucket reflected and stored into server-side cross-site scripting. And then I like to think of like DOM-based as client-side cross-site scripting. Because it also can be very confusing if you can, I think you could have DOM-based cross-site scripting. They're also kind of reflected in a way, but also not so anyways. It's very confusing. I understand. Okay, let's look at an example. So here we have a completely static HTML page. Just HTML and we have some script. So where does this script come from? The server, from the developer, right? The developer of this application wrote this HTML page and wrote this JavaScript code. And it does something super simple. It gets the name from the location.hash. What's the location.hash? What part of the URL? Backman, yeah, the hash. Remember, so URLs, URIs, right? They are, ooh, just make a test, right? Protocol authority, path query, and then after the hash mark, fragment, right? And so what was the, I remember the fragment was used for, what is supposed to be used for traditionally in URIs? Yeah, the specific sub-resource in that page, right? But actually an incredibly important detail, right? The server doesn't care about the hash, the fragment, because that only, the server only cares about accessing documents, right? And so your browser actually does not send the hash or anything after it to the server itself. When it makes an HTTP request, it only sends everything before the fragment, which is kind of crazy. And it makes sense though, from the server's perspective, the hash doesn't mean anything. It's the same page. No matter what you put there, it's gonna give you the same results so it doesn't need to know that. Okay, so what this JavaScript code is doing is it's getting the name that's in the fragment. So it's specifically using the fragment to get as the name. So it would be like hash Adam, it would just get Adam. Storing that in a local variable name and then it's using the DOM access to write out to the document hello name, right? So just like we saw in the PHP, let's think about, okay, what's gonna happen when I access this test page with hash Adam, right? So first thing, what response I'm gonna get back from the server? The page, this page, this exact page, right? Every time I request test.html, it's gonna give me this exact HTML page, right? Now my browser gets that, it does what? Parses, it parses that HTML, right? And then it starts executing this script when it sees this script tag, right? So when it looks up location.name, it gets Adam, then it passes this to this variable name, right? And then it writes out. So document.write writes out hello, Adam, right? So this is DOM's way to change the HTML of the page.  And the crazy thing is the server never saw Adam, right, that never got to the server. So question is what happens when I do document.write? What happens if I include HTML in document.write? Or would? Exactly. So the key question is does the browser parse that again as HTML? It turns out it does. So if we do example.com test.html with a hash sign and then script alert cross-site scripting, the exact same thing happens, right? The server does not see any of this. It only sees up to test.html. It sends us this page and then location.hash is used from here, it gets passed the name, it's written out to the document, where then the browser reparces it as HTML and it sees, okay, wow, this is a JavaScript code so I should execute this. And so it pops up in alert. And so the core idea here, right? So any place in JavaScript code that can turn a string into JavaScript can potentially be vulnerable here. So this includes document.write. It includes eval, it includes the function keyword, right? It includes all sorts of other stuff that I can't remember off the top of my head. But if you look up DOMXSS, there is a huge list of all types of DOM cross-site scripting vulnerabilities. All right, so let's see where we're at on time. Okay, we'll stop the cross-site scripting talk here because we're actually almost to the end. We're gonna talk about how to, when we get back on Monday, we'll talk about how to worm cross-site scripting and then we'll circle back and cover some other cooler, not cooler, but other types of vulnerabilities. So, and we have questions on Final CTF stuff. Any other questions? Is it that if no one packs my server, I get more points? Or if someone actually got my server, I get less points? Not quite. It's more in the sense that if you, well, if you fix everything or nobody hacks you, then other people get less points, right? So if you break something, right, you can attack all N minus one other teams. But if somebody else has fixed that service, then you're only gonna get N minus two possible points. But I will say, the design of the system is designed more towards attack. You'll get much more bang for your buck by spending your time attacking other people, finding vulnerabilities, creating exploits. Cool, yeah. No, no, no, no, no. I'll provide this. The services will be provided the day of, so you'll know them the day of. Yes? Yes? Yes? Would it be, would it be here in this box? Yes. Ooh, I got a look. I think it is in this room at the final time. I believe it's in this room. I think I did look. And then, oh, but, okay, yeah. So we'll get. Sigh, did you create the registration form yet? Okay, good. Can you add, sorry, can you add on there that we want like a marker or something, like a checkbox if the team needs a computer? So if you need, if people on your team don't have access to a computer that they can bring, let us know so we can host your team in one of the server, the computer labs. So that way your team can compete from there. Cool, question. Yes, you'll be able to, you'll have groups on your machine so you'll be able to do what you want on there, but you have to do it basically like they, you can't like, you know, you wanna spend your time wisely, but yes, we'll do a lot of that. Cool, all right, there we go.


What could help explain severe coronary disease? And someone considered to be at low cardiovascular disease risk with a healthy lifestyle. Young man ends up in the ER with a heart attack, ultimately found to have severe coronary artery disease, yet given his age, blood pressure, and cholesterol, his 10-year risk of a heart attack should only be like 2%. But what he did have was a high lipoprotein A-level, also known as LP-lital A. Markedly high at 80, which may help explain it. You can see the same thing with women, 27-year-old, with the heart attack, with a high LP-lital A. What is this LP-lital A, and what can we do about it? LP-lital A is an underestimated cardiovascular risk factor. It causes coronary artery disease, heart attack strokes, peripheral artery disease, calcified aortic valve disease, and heart failure. And these can occur even in people without high cholesterol. Because it is cholesterol, it's basically an LDL cholesterol molecule linked to another protein, which, like LDL, transferred cholesterol into the lining of arteries contributing to the inflammation in atherosclerotic plaques. But it has yet to gain recognition by practicing physicians, and the main reason for the limited clinical use of LP-lital A is a traditional lack of effective and specific therapies to lower it. LP-lital A concentrations are approximately 90% genetically determined. So, I mean, the conventional thinking has been that, look, you're just kind of born with higher or lower levels, and there's not much you can do about it. Even if that were the case, I mean, you still might want to know about it, since if we were high, then, I mean, that would be all the more reason to make sure all your other risk factors that you do have more control over are absolutely as good as possible. Like, you know, maybe help you quit smoking, and do everything you can to lower your LDL cholesterol as much as possible. LP-lital A levels in the blood can vary a thousandfold between individuals from less than 0.1 mg per deciliter to 100 or more. Here's the graph of odds of heart disease at different levels. Less than 20 is probably optimal, with greater than 30 to 50 considered elevated. Even when the more conservative threshold of greater than 50 is used, that describes like 10 to 30% of the global population, and that's made 1.4 billion people. So if we're like the one in five people with elevated levels, what can we do about it? The way we know that LP-lital A causes atherosclerosis is that we can put it to the ultimate test. There's something called aphoresis, which is basically like a dialysis machine where they can take out your blood, wash out some of the LP-lital A, and then give your blood back to you. And when you do that, you can reverse the progression of disease. Atherosclerosis continues to get worse in the control group, but better in the aphoresis group. I mean, this is great for proving the role of LP-lital A, but has limited clinical application given the cost, accessibility, and the time commitment required for bi-weekly sessions of two to four hours each. It causes a big drop in blood levels, but they quickly creep back up, so you have to keep going in. Costing more than $50,000 a year, there has to be a better way. And we'll explore the role diet can play next.


Arrallano ja bond approaches are classic approaches for modeling dynamic panels or estimating dynamic panels. This technique is very commonly used in predict management, where it is referred to as the GM estimator. This is a bit misleading because GMM itself does not do anything, it does not deal with endogeneity. The reason why this is referred to as GMM estimation is that Arrallano and bond applied GMM estimation instead of some other estimation techniques. Why they did that will take a look at later on the video. But the important thing here is that it is not the GMM, but it is a particular modeling approach that deals with endogeneity. So whenever I teach students quite often as a student, perhaps from a strategy background, comes and asks me to tell them about GMM estimation. So I made some of the equations, I might have them work with Excel and implement the GMM estimator and then they ask me how does GMM deal with endogeneity. And my answer is it doesn't. It's the modeling approach, not the estimation approach that deals with endogeneity. Therefore, we need to ask two questions. What is the model and why do we use GMM and could we use some other estimation techniques to estimate the same model? Let's take a look at the Arrallano and Bond approach. I used the model that I used before as a starting point, so we have a longitudinal panel, we have a message of ROA, we have a message of CO-gender, we want to estimate the causal effect of CO-gender on ROA, and we want to control for unobsturred thermal law effects. We want to estimate the within effect in this case, and that is what the Arrallano and Bond estimation technique does. So this estimation technique differs from a dynamic panel from cross-locked model in that there is only one dependent variable, whereas in cross-locked model we would have ROA to CO-gender, but otherwise these are very similar models. Well, how does an econometrician deal with this problem? Let's write the equation. So we have an equation instead of ROA and CO-gender, I'm going to be using Y and X for simplicity, and we have the unobsturred effect AI here. We have lag of Y with minus one year as a predictor of Y, we have X lags similarly with minus one year, the lag of X does not really matter for this problem. What we need to be looking at is the effect of Y and how this unobsturred effect AI makes things more complicated. So how does an econometrician deal with this problem? Let's take a first look at a model that is a bit simpler. So we'll take a look at the model without Y as a predictor. So we'll just take a look at X to Y relationship with our fixed effect AI there. How do we deal with this problem? One way of dealing with this problem is to apply first differencing. So we do first differencing, we take, subtract the past value of Y, we subtract the past value of X and this eliminates the unobsturred effect here. So that's a way with the unobsturred effect, we estimate OLS, we're going to be fine, we have consistent estimates. When we have the lag dependent variable as a predictor, things are more complicated. When we look at the equations of the first differencing estimator, then we can see here that we have Y, T minus one, minus Y, T minus two, and we have the error term of Y, T minus one here in the composite error term. And because this Y, T minus one is a part of this Y, T minus one, so this U, T minus one is a part of Y, T minus one, we have an endogeneity problem. So this error term here is correlated with this difference. How do we deal with endogeneity problems? Use GMM is not a solution to endogeneity problem, instead the solution is that we need instrument variables. So what would qualify as an instrument here? Turns out that lag values of Y would qualify as an instrument. For example, we could use Y at T minus two and earlier lags, and Y does Y, T minus two qualifies as an instrument. It qualifies because it's relevant because of the autoregressive path. So Y, T minus two affects Y, T minus one, and also it's a part of the difference by definition. It is excluded because of sequential exogeneity assumption. So the idea of sequential exogeneity is that past values are not correlated with future error terms. So these error terms Y, U, Y, T and U, Y, T minus one are assumed to be uncorrelated with Y, T minus two. So that's an assumption of the estimation approach. So relevance comes from autoregressive paths, exclusion comes from the model assumptions. And this is referred to as difference GMM in the literature that talks about Aral and the Bond Estimates. It's difference GMM because we have a model where we have first differencing. Then we use these are called levels as instruments, and we have multiple instruments we estimate with GMM. We could apply other instrument variable techniques, but for some reason GMM is applied. Let's take a look at the assumptions of this technique and how they're tested. So the assumptions are the sequential exogeneity that I mentioned before. So Y at zero must be uncorrelated with error term at time one and error term at time two and so on. So current values of Y are uncorrelated with future error terms of Y. No correlated error. So the U terms are not autocorrelated. If they are, then this approach breaks apart. There are a couple of tests that are commonly used. So this is an instrumental variable technique. So the Sargan Hansen test that we commonly used for checking for exclusion criteria in other contexts can be applied here as well. Then Aral and Bond develop the test for testing for autocorrelation of the error term. So we assume that the error term is not autocorrelated. If these assumptions fail, typically the failure would be the autocorrelation of the error term, then we can use more distant lags as instruments. So quite often in practice when this technique is applied, we apply it with the first lag as the instruments. We check for exclusion. If exclusion doesn't hold, we increase the lags. And ultimately we will find the sufficient lag that makes the errors roughly uncorrelated. There's also another version of this estimator. It's called the system GMM. And the idea of system GMM is that we can make this estimator more efficient by introducing additional assumptions and introducing additional equations. Let's take a look at what the system GMM does. It's called system because it has two equations that are estimated. It is estimating a system of equations. So we have the model here, the levels model. So this is the model that we want to estimate. And how we estimate it is that we specify two simultaneous equations. So we estimate the beta one from the difference equation. We estimate beta one from the original level equation. But this is endogenous as stated before. So we have endogeneity problem because AI correlates with Y at T minus one. So AI is correlated with every Y, so this is an endogeneity problem. How do we find instruments? Well, the past differences will serve as instruments because first difference eliminates the unobserved effect AI. So we can use earlier differences as instruments for this model and estimate it consistently. Because we have two models that we can use for estimating beta one and beta two, this is more efficient than estimating beta one and beta two from just this difference model. Relevance of this instrument is by definition. So difference and level are correlated by definition. Also because of autocorrelation, autoregression and exclusion comes from sequence of exogenous assumption. And difference removes AI from here. So this is the system GMM. And now the question that we have is why do we use GMM? So this is a general approach. We could use any instrument or variable estimator to estimate this. Why GMM and why not some other estimates? There are basically two reasons that I can think of why GMM is being applied. Both relate to time. So this was introduced in 1991, which at the time of recording is about 30 years ago. And at that point, the computational resources that we had were much less than what we have today. Nowadays, we could estimate this model with maximum likelihood, find a numerical solution to the likelihood function and in seconds. In 1991, this is not feasible. GMM is a lot easier to calculate. We just apply matrix algebra, there's no iteration, no numerical optimizations involved. This is quick to calculate. So that's one reason. Another reason is that GMM at that time happened to be the state of the art of multiple equation estimation in econometrics. So this is GMM is used more for historic reasons than for reasons that relate to the superiority of these approach over other approaches. This technique, Aralano-Bohn technique is not without its problems. These problems are explained, for example, in Alisson's article. And Alisson notes that if the number of cases n, or number of verbs, number of whatever are our observational unit that we observe multiple times over time, if that n is small, then there will be bias. This is also inefficient. So we can get more efficient estimators using maximum likelihood based techniques. We can use multiple lags and which lags we apply, which variables we use as instruments. It is not clear and there is a problem that when we have a complicated model, we have a large number of instruments and increasing the number of instruments increases the bias of instrument variable approaches. There is also another problem with this approach and it is that this is being used as a black box. So the fact that researchers say that they use GMM estimation to deal with the endogeneity problem indicates that not everyone might understand that it is not the GMM, it is the instrument of variables that deal with the endogeneity. So if you think that it is the GMM that does the trick, then you might not really understand what you are doing and it is easy to use this as a black box because of status implementation of the technique XTA bond and you just specify the equation. It gives you estimates, you don't really need to understand what you are doing. And this estimator like others makes some assumptions, if those assumptions are not fulfilled, then the estimates can be very misleading. So there is a more modern way of solving the same problem and it is simply to specify the model using a path diagram or syntax in your statistical software as a structural equation model using the wide format data and then specify the constraints that are required. This has a couple of advantages. The first advantage is that this is more efficient than the RLN on bond approach. So maximum likelihood estimates have proven to be the most efficient possible in large samples. There are other advantages in the maximum likelihood based approach using the SCM software. Another one is easier to understand what is being measured, what is being modeled and what are the assumptions. So here we assume that there are alpha, the unobserved effect is correlated with all the predictors. So we don't make the random effects assumption and we also assume there are sequential exogeneity. So X1 is uncorrelated with the error term of Y2, Y3 and Y4 because they are uncorrelated with all the future values. X3 on the other hand is allowed to be correlated with the error term of Y2 because that is in the past. So we are allowing some correlations with the error terms, we are constraining others. Specifying this as a path diagram makes it more explicit what you are actually assuming. Then we have modern missing data procedures available. So we could actually estimate this model even if we are missing data with the GMM approach it would not be at least as straightforward. We would have to set up multiple imputation and other things which is complicated with structural equation model and we can simply apply full information maximum likelihood which takes the missing data into account automatically. And then finally we have better diagnostics. So you just need to understand one tool and the same chi-square test, the same modification indices, the same covariance residuals can be applied that you apply with these models every time. So you don't need to remember that there is an RLN-boned test for autocorrelation, you can just apply the more general techniques that you already should know. There are disadvantages. Specifying this kind of model is cumbersome if there are a large number of observations. We tend to see wide format data in organized sub-psychology where the time series are rather short. If you collect data with survey then find time points that's quite a lot. If you get data from databases like economists do, studies management researchers often do, then you might get 30 years of data for each company. So specifying this kind of model for 30 years would be a bit complicated and it would be a bit hard for the computer to calculate as well. Fortunately, there are techniques, for example, dynamic structural ecosystem modeling implemented in M+, that takes care of this problem. So that's a special technique for estimating dynamic panel models using maximum likelihood without having to specify this kind of model with these multiple different dependent variables. Then tedious to specify large models. That is true, but fortunately this can be automated. For example, there is a state of package called XDDP ML written by Paul Allison if I remember correctly, and that automates the specification of this kind of dynamic panel model with unobserved effect using status SCM command.  Then there is the multivariate normality assumption of the maximum likelihood estimation, but as I explained in other videos, this is something that we can deal with. We can use alternative estimation approaches, but even better, we can just use ML because it is consistent and simply apply robust standard errors to deal with the fact that the standard errors from ML and the test statistics may not be trustworthy if the data are severely non-normal. So this is a more modern alternative and in many ways more recommended than the RLN and bond approach. For reasons of history, the RLN and bond approach is still very common while it's dated.


Why am I taking a selfie with my Monstera US? Good question. Hi, I'm Lucia and I love plants. I love how each one of them is so unique, how we can learn and connect with them. And I love sharing all of that with you. In this channel, you will find videos that are all about plant care, about watering, soil, the leaves. We will visit botanical gardens together and really explore the wonderful plant world that is all around us. My goal with this channel is that we explore a little bit more what it means to have a dialogue with our planet, even if only with the relationship that we have with a plant at home. So if you're as inspired as I am with plants, I would like to learn about them step by step with me. Join me on this journey by subscribing to this channel so we can meet every Sunday and talk about plants. You can also check out what I do in other spaces such as Instagram, Patreon and all of the courses on plant care that I have prepared, especially for all of you. Thank you so much for checking out our channel and I hope to see you in the next video. Adios.


Aloha, I'm Kawi Lucas. This is a special edition of Community Matters. Today I have a candidate for OHA's Hawaii Island position, Mililani Trask. And we're going to just start out by saying you're not running for OHA at large. You have run for OHA at large in the past. Yes. But you are now running as the Hawaii Island candidate. Yes. Yes. That's quite exciting. It is. I think it's, everyone is expecting that there will be some change. And I think it's long overdue myself, but it is exciting whenever there's an election, even though we've not had too much support from our voters this year. Well, anybody who gets 51,000 votes, that's in a primary here, that's hats off. So, you've actually been an OHA Trieste in the past. Yes. I was elected several years ago, and at the time it was the last vote that was ever taken by Hawaiian-only voters. The case went to the Supreme Court. It was the rice case, and the U.S. Supreme Court ruled that OHA is a state agency fulfilling a state trust obligation to the native Hawaiian. Therefore, all voters in the state are allowed to vote. And since that time, all voters in the state vote for OHA, irregardless of what island you live on.  It's really a statewide vote for all voters, regardless of ethnicity as well. So, what are the main things that are on your list to do as an OHA trustee this time? I'm very, very concerned with the PKF fiscal report that came out in January 2015. It indicated that the trustees' spending habits were in violation of their own policies. And with a $400 million trust, it indicated that the trustees would be bankrupting the trust in eight to nine years. That's a significant amount of funds critically needed for our people for other areas. I'd really like to stop those spending practices, stop allocating funds for nation-building, and really start looking at the priorities that the beneficiaries themselves have identified, housing, education, employment, job training, and health. When you look at those social statistics, it's just a tragedy. And that's where we should be putting our money as a state agency. I support nation-building, but it is something that the Hawaiian peoples should proceed with and not the state and federal government. So, you've more than just supported nation-building. You have a long, long history with Kala Hui. Are you still the Kia Aina? No, no. The Constitution provides that the Kia Aina can only sit for two terms of four years. And I went through that. Following that, I went up to the UN. The Kala Hui, Hawaii, was a native initiative for self-governance. It started at the grassroots level. Elections were assisted by the League of Women Voters. And what we were trying to do was really build a structure that would meet the needs of the Hawaiian peoples, incorporate cultural practice as well as modern structure, and see what we could do to become economically self-sufficient. You know, self-determination is the right of peoples, not the federal and state government, but it is the right of peoples to determine their political status and then to pursue economic, cultural, and social development. And that's what we need to do. Housing, education, health. These are all social development programs. Where do we have strife with cultural conflict? We need a native nation to attend to that so that we can resolve those kinds of conflicts and proceed with our own uplifting rather than being wards of the state. So the critical needs, and it really is hard to think about nation-building when you're hungry and homeless. I mean, Mazla's laws were not exempt. The Hawaiians are not exempt from those. No, and the Hawaiian peoples themselves as beneficiaries have said that over and over again. Recently we found out about the OHA survey. First taken is 1978, again taken in 2016. Both surveys Hawaiians overwhelmingly reject the idea of OHA trying to create a state nation and instead direct OHA to the big five priorities, health, housing, education, employment, and job training. That's where we need to go. Our job as trustees in OHA is to fulfill the state's trust obligation. And when you look, for instance, at the critical need for housing, homelessness. The Hawaiian homelands waiting list of 27,000. You see, that's OHA's obligation as much as it is the Department of Hawaiian Homelands. And if neither succeeds, it will rest on the shoulders of the state taxpayer inappropriate when you have a trust of $400 million and trustees with a fiduciary obligation to get the job done. So I noticed in the Department of the Interior Petition hearings that Kala Hui did produce an excellent letter, written testimony, and it had all the things they asked for, a constitution. There was very complete documentation there. It was a very successful initiative for many reasons, but the first, I think, is that it demonstrated to our peoples that they can do it. They don't need a federal or a state godfather structuring anything. The second thing that I think it was good was that it showed people that the democratic process can be utilized right here in Hawai'i. You know, there's 550 Native nations in the United States of America right now. 200 are Alaska villages, 350 the federally recognized tribes on the continent. If that can occur in the United States, we can certainly do one right here in Hawai'i. We have the ability, we still have our land trusts, we have significant revenue. We have economic engines such as Kaka Ako that should be developed to cover the needs of our peoples instead of laying fallow for the last three years while we're going to the legislature for a handout. There's something wrong with the picture, and I think it's how the trust is being managed. Okay, so you're not in favor of the Na'i'au Pune or the sort of a Kaka Bill type of federal recognition, but you are in favor of a nation-to-nation relationship. Yes, yes, and I think it's possible. A nation within a nation, I should say. A critical difference. It is both, it is both. The nation-to-nation relationship does not require bloody warfare and secession from the Union. We can look what we have on the continent. You know, when you look, for instance, at the Iroquois Confederacy, it was their constitution that was used as a draft for America's constitution. There is a native nation that handles areas that many others are not even attempting. For instance, the Iroquois Confederacy addresses immigration. They control their own international border with Canada, so they have quite significant powers. And to this day, they continue to negotiate one-on-one for their treaties. You know, these are the evidence of what you would see with independent nations between Britain and the U.S., but we have it right in the United States, and there hasn't been the need to see seed. The reason why it doesn't make sense is because we're not going to leave our homeland. This is Hawaii. If you propose that a nation has to see seed and leave the U.S., there's only one way. We know that in American history. There's only been one effort to break the nation and see seed. It resulted in the Civil War. That is not furthering the needs of our peoples, but that is not following the dictate of our Queen Liliu, and she ordered that there be peace, and she ordered that the peoples lay down their weapons and never, never have the Hawaiian peoples ever bridged that. On the continent, you see that kind of violence with ethnic groups and sometimes with Indian nations, but here, inappropriate, and our peoples have never walked the path of violence. I don't think we'll ever see it. Certainly hope we don't, but nevertheless, the treatment of Native Hawaiians or Hawaiian nationals by the federal government through this Department of the Interior process are really egregious. I'm shocked by it, and I think your word egregious is really the best word that we can use. This is not the federal policy for other Native peoples in the United States, but it does us a great disservice. If we go back and read the Apology Bill that the Congress passed in 1993, President Clinton signed it, it not only acknowledged America's role in the overthrow, but it acknowledged the ramification, poverty, lack of education, landlessness, homelessness, serious health problems. These are the ramifications that America is responsible for. In the Apology Bill, they called for a time of reconciliation. Reconciliation means restitution. You make right what was wrong. That is a federal obligation, not an obligation of the state and county taxpayer. Exactly. But that isn't what we're hearing from Washington these days. We're not hearing it from the Congress. We are hearing it from an agency called the Department of the Interior. I think they're way out of line. The U.S. Constitution is clear. The Congress deals with foreign nations and the Native nations. Now, the Congress has spoken many times, 150 pieces of legislation. The Congress has never said that they will re-establish a government-to-government relation under this type of a structure that Interior is proposing. I think that it will be challenged as being unconstitutional. And like Na'i Alpony and other predecessors, I think that it will be struck down. I cannot see legally how it would be sustained, but for us, I think it's a good thing because it doesn't give us justice. It's a good thing that it's struck down. Yes. Although there seems to be just baffling momentum behind it, like the recent CHNA conference. You know, the CNHA conference, when you consider that we have over 300,000 people in our state and close to 550,000 in the United States, having a gathering of 130 people isn't all that significant. What is interesting is the media drum beating, the civil beat endorsement, the policy of the Star Bulletin supporting it, OHA putting in 4 million for Kana'i Oluvalu, 2.7 for Na'i Alpony, the vast majority of it going for media blitzes. There's a sense that there's a huge uprising, but really, it's a few voices screaming into a small microphone. The Kana'i Oluvalu legislation created by the state legislature said Kana'i Oluvalu, you registered 200,000 people. OHA, you pay for it. 4 million went out. Less than 20,000 were actually registered. So it doesn't show any support on the part of the Native peoples. No. Well, let's take a break and come back in a minute and talk some more. Okay, I'm Stacy Hayashi and you can catch me on Mondays at 11 on Think Tech Hawaii. Stacy to the rescue. See you then. Aloha. My name is John Wahey, and I actually had a small part to do with what's happening today. Served actually in public office. But if you don't already know that, here's a chance to learn more about what's happening in our state by joining me for a talk story with John Wahey every other Monday. Thank you, and I look forward to your seeing us in the future. Hello, I'm Marianne Sasaki. Welcome to Think Tech Hawaii, where some of the most interesting conversations in Honolulu go on. I have a show on Wednesdays from one to two called Life in the Law, where we discuss legal issues, politics, governmental topics, and a whole host of issues. I hope you'll join me. Welcome back to this special edition of Community Matters. Here with me is Mililani Trask, OHA Hawaii Island candidate. So Hawaii Islanders, what are some of the concerns that, specific to Hawaii Island, that you are going to champion as their new OHA? You know, one of the areas that is very much impacting our island, right down to costly litigation, folks getting arrested, the Mauna Kea issue. There was a special opportunity for OHA to come in and facilitate resolution of the conflicts relating to cultural practice. Not only rights to gather, but rights to worship as well. OHA just made a mess of it. We had seven years to resolve it. And there were hundreds of millions of dollars at stake. There were hundreds of jobs at stake. And there was sacred land and a very unique and special environmental district, the conservation district there. We needed to resolve it. Instead, nothing was done. It went from disagreement to civil disobedience, arrest, then finally the state supreme court had to step in and say, hey, people have rights, so you will start all over again. That didn't have to happen. If we had had some leadership in OHA and worked out what the constitution of our state requires, accommodate these native practices. Is it impossible? Absolutely not. On the big island, the irony is, we have the Volcanoes National Park, which is used by the federal government as the prototype model to follow a best practices working to protect sacred areas with native people. This is right on our island. We've had success there for 40 years. On the next hill over Mauna Kea, arrest, seven years, millions of monies lost. It was for lack of political will and lack of initiative. There's only one state agency that's supposed to be the lead agency in Hawaii for cultural matters for Hawaiian peoples. And it was OHA. And they didn't come to the bar now. We're back at the contested case process. It will be costly. It will be lengthy. And I think that everyone will wind up being the loser in the end. It's just such a tragedy, and it was so unnecessary. But I think we can address it now. Are there interventions that you think possible at this point? Absolutely. And actually, I will be participating and have already filed testimony as an international expert in the Mauna Kea case. I'm being called by some of the plaintiffs and their attorneys. But I'm proposing that we use the international model for conflict resolution. Let's have the consultations with the native practitioners. Time to find out who's gathering, who's worshiping, when, where. Are you going by the full moon cycle?  Once these practices are identified, we can move forward with ways to accommodate them, just as we have done with the Volcanoes National Parks. But you have to do it, and you have to have the leadership to get out there and do it. And I think OAH has that capacity. We have trustee on the Big Island. We have the ability to fund this type of consultation, assessing of this type of data, and we have excellent prototype regulations to apply. What we need to do is get down to work. We've seen pitifully little of that, but thousands, millions of dollars for things that don't impact our people's needs. I mean, I couldn't believe that OAH gave the IUCN conference a gift of a half a million dollars so that they could be the master of ceremonies when the event opened. A half a million dollars could have gone a long way in resolving the problems at Mauna Kea, but instead we are left with the problems so that a few people could dance the hula on the stage at the opening. We took trust. I think the state should have paid OAH for being the master of ceremonies, especially I was very fortunate to be there, and it was magnificent. I mean, we certainly did ourselves proud in that, and I didn't realize that Hawaiians were paying for that. Yes, half a million dollar gift. But there were other things that OAH paid for as well. International trips for the staff to go to New Zealand to be part of the Hokulia Welcome Party and Bob Lindsay's trip to go to New Zealand with the executive staff to celebrate the Pacific Festival. In between those two trips was the trip that Bob Lindsay and the executive staff took to go to celebrate the 50th anniversary of Independence in the Cook Islands. You know, these things don't relate to bettering the condition of our peoples, and those funds are needed for things like job training and homeless, addressing the homeless problem. Back to Hawai'i Island. There are some unique opportunities and challenges in that island being so large and people spread out. There are a lot of jobs in Waikoloa, but there aren't a lot of places to live there and people living in their cars, so they can go to the jobs at the hotels. I mean, people in Honolulu have no idea how hard it is. There is a critical, critical need on the big island for affordable housing. And this is also very high on my list of priorities. We've got an economic engine in Kaka'ako and an ongoing problem with the IGEA administration for another hundred million dollars. Well, why don't we stop the fighting, start developing the lands that O'ahu has, and do what Suzanne Chan Oakland suggested. Let O'ahu choose a hundred million dollars of land here on O'ahu and elsewhere so that we can help them put up affordable high-rise housing for those on the waiting list. I thought it was a great idea and I think it's very doable. It would not only meet our needs, but I think it would also be welcomed by some of the power brokers in our state, like the construction unions and others who are looking for those jobs. It's a good fit, I think. But again, you have to have some creative thinking and you have to have the commitment to move forward as well as the support of the majority of the board. And I think O'ahu has always had some problems building consensus there because of the differing political agendas. Yes, that has haunted O'ahu's effectiveness in the past. Do you have any particular insight now that it's been several years since you were last trusted? You know, you take a look at the O'ahu trustees. They continue to return again and again and again because voters really don't care and are uninformed. This is why we haven't broken out of a history of complacency and political deal-making, which is where I put this nation-building effort. We need to have some term limits for O'ahu so that we can bring in other candidates and we need to bring some democracy, real democracy, to the elected process. When the people of the Big Island elect their own trustee, that trustee will be accountable to them. The same thing with Maui and Kauai. Right now, the voters of O'ahu vote in every trustee. There's no way the voters of Moloka'i could vote in anyone. They only have a few voters. But that means that many of the trustees from the neighbor islands are not accountable to the needs of their people. If they have to roll a political deal, give a few million dollars for the next nation-building effort, they'll do it because they want to be re-elected. It's not appropriate for someone to be in office for 26 years representing neighbor island community when they're never even elected by them. I think if we went back to some real democratic processes, we could impact this. Let the people of the islands elect those who will represent them and look for some benefit coming back to the islands in things like affordable housing. I think you have very eloquently encapsulated maybe the core problem at O'ahu. And thank you for throwing out those numbers. I think there will be people who are shocked to hear that there are trustees who have been in office for 26 years and not really with direct accountability. Yes. You know, when I was voted in before the rice case, it was the first time, first time in the history of O'ahu that a neighbor island trustee won a vote. You know, it just demonstrates to you how little representation there is. But I think the thing is, is that we have a legislature that I think has had it up to here with the O'ahu fighting and the problems of Kakaako settlement. I'm hoping that the legislature would be open to moving for term limits and making some changes in the process so that it can be more democratic. So the state legislature has to approve term limits for O'ahu trustees? Well, remember, O'ahu is a state agency and it was placed into the constitutional framework at the last con con. So when it comes to things relating to regulation of O'ahu, it is a legislature. For many years, there was no primary election. The legislature changed it. And that is why we now have candidates winnled out in the primary. We get to the general. We have a face off of two candidates. Prior to this, there were 50 candidates. You know, someone gets in with one 50th of the vote. They really don't represent anybody, period. Yeah, so that was an upgrade. I didn't realize that O'ahu trustees were not in a position to be determining their own fate in that rather practical way. No, no. And many of them like it that way. You know, when you get to the legislature, there's always been the complaint that everything is O'ahu centric. O'ahu has the population. O'ahu has the power. It's the same thing with O'ahu. So there's really no accountability in terms of what the Hawaiian peoples want for real critical needs, homelessness, poverty, alleviation. These things really never get on the agenda. What they're looking at is how we can cater to the vast majority of voters on O'ahu, the majority of which are public. They're not native. So we need to go to the state to remedy some of these problems. In the meantime, we have to find ways to build consensus. And I think that we could easily get rid of all the fighting over nation-building by taking it off the agenda. It has been number one on the agenda since for the last 25 years.  Stop it. Yeah, stop it. And start building some rhymes. So we only have about two minutes left. And what haven't we talked about here today that is dear to your heart for the future of Hawaii? I think that because of the social statistics, we're seeing increasing alienation of an ethnic group, the Hawaiian peoples. What we've learned from America's history is that when we cannot resolve conflict and groups become alienated, it eventually leads to civil disobedience and violence. We're entitled to better than that. We have the capacity to provide solutions. We have lands. We have resources. And we need to do that. And we need to do that for everybody in the state of Hawaii. It's not a small issue for 18% of the people who are brown-skinned Hawaiians. It is for everyone in the state of Hawaii. And I'm urging all responsible voters to help us. Accountable government is everybody's concern. It's not just the concern of those who happen to be Hawaiian. Mahalo. Thank you for a great interview. And I've really enjoyed it. Well, very good luck. I'm not sure you'll need luck. I'll need luck and prayers.