Γεια σας, είναι Vicky here but anwelcome back to another card making video Today I am going to showcase the new Spellbinders card kit We are going to take a look on watching it and then I am going to share 10 cards It is a kit that I absolutely recommend if you are after a monthly subscription It is always packed with products and you can make way more than 10 cards that I am going to share So every time you get a leaflet with some ideas on how to put a few cards together και ας ξεκινήσουμε με το σημερινό κομμάτιο, αυτό συμφωνεί πολλές σημερινές, μεγαλύτερη και μικρό, και είναι όλοι οι σημερινές σημερινές, ελπίζω να μπορείτε να δείτε ότι υπάρχει σημερινό κομμάτις, υπάρχει also an alphabet, as well as little circle stickers that you can use to embellish your cards. In every kit you will also get 10 envelopes with 10 pre-folded white standard cards that's 4.25 x 5.5. You will also get adhesive in a form of form squares as well as a double-sided tape roll. You will also get in this kit those golden sequins that you can use to embellish your cards or if you would like to create shaker cards. And let's take a look at the dice. Now the dice this month create a little fox which I will be using on one of my cards so you can see how you can put the fox together. It also gives you sentiment dice. If you put them together you can write happy for you and there are dice included that cut out tiny little leaves and flowers. Just like every month there is a clear stamp set. This month it comes with an adorable little fox. There is some foliage as well as flowers and you can mix and match the words to put together different sentiments such as you are pretty, you are the best, you are kind and so much more. There is a 6x6 paper pad included. You can see here all the designs on the outside to end different designs. Two pages for each design so you get a paper pad with 40 different pages. These pages are not double-sided and on some of these papers there is golden foil link that gives them an extra sparkly. And here is another pack of stickers. This time you get the alphabet as well as numbers and this is a foam sticker which means that it is quite thick and it has a lovely foil link, matte gold on top. So hopefully you can see how thick they are that will give a lovely dimension on your cards and that the same time they match with all the foil link on the papers and the cutouts. Let's take a look at the cardstock that you get. There are 9 pages in different colors and one of them is gold.  Now I like to spread them around on my table and create areas of things that are similar so that I can have an idea of how I can put together cards. So here they are all together and you can see in this area here I have all the sentiments and the big words. Here I have all the leaves and the flowers down there. Here are some bigger cutouts that stand out on their own as focal points. You get some circle ones here, the houses, the butterflies are all together down there. So by spreading them out I can have an idea on how I can put things together to create cards and let's start with the first one and I will work with this lady here. If you notice the pattern paper that I chose has the same flowers as the flowers on her hair so I'm going to use my rectangle dies one inside the other to cut out a little frame. I run it through my die cutting machine and just because this paper is quite thin I'm going to use a foam tape at the back all around the frame so that I can add some dimension and at the same time it's going to make that thin paper sturdier. I have a panel out of the pink cardstock that's 4.25 x 5.5. All the cards I'm making today are super easy to recreate and you can make them just by using products from the kit. So I have some foam squares at the back of the lady, I'm going to place here about at the center of my card and then on top I'm going to stick that banner which I absolutely love. I love the size of it and how it matches perfectly with the pattern paper that I used. Now I'm going to pick one of the stickers and since I had dimension on all of the other elements I decided to add a foam square at the back of that as well and I'm going to tack that in between the girl and the banner.  This is the finishing touch, you can embarrass the card a little bit more if you want, you can add those golden sequins and here are some close-up photos. For the next card I'm using the pink pattern paper and on my right you can see that I picked up some flowers and another girl. I lost the footage on how I made this card but it's pretty simple, at the bottom of this panel I added another piece of pattern paper and in between a thin gold strip. I created a flower arrangement with the same type of flowers and a couple of leaves and also added that die cut that says loved and then I tacked the girl behind the flowers. Now to finish it off I'm going to use a sticker that says cherished and I'm going to stick it on the right there and call this card done. Here are some close-up photos and I'm so sorry that I lost the footage on this card. Now let's move on to the next one and this time I'm going to use this gorgeous pattern paper with the wood grain on top. I'm going to cut it to size making sure that I don't leave the center at the center of the panel. This way I will have more interest on the background. I'm using my white glue at the back and stick that on top of my card base and then you can see I have picked a few of the flowers and some of the leaves and I'm going to create a flower arrangement.  For some of the elements just like always I'm using foam scrolls at the back to add dimension and others are going directly flat on my card base just by using my white glue. I picked a sentiment from the sticker book that says you are my heart in a gold falling on top of black that gives a lovely dimension. I also added a secondary sentiment that says just for you again with gold foiling and I'm going to finish it off by adding some of those gold sequence at the center of my flowers. For the next card I used the blue pattern paper which I'm cutting it to be a smaller than the standard card panel. I stick it on top of my white card base and at the bottom I added a row of houses and you can see the flying bear on top.  The houses that complete the scene are completely flat on top of my card but the bear as well as the banner have foam tape at the back. Now I love having different textures on my cards so I have a piece of white thread here which I'm going to thread it through that hole at the banner. You can tie a knot if you like. I'm just going to leave it as it is and just chop off the extra tails.  I cut out three clouds because odd numbers are always more interesting on a card and I like to chop them off and place them at the edges. I think it looks more interesting this way and here are some close-up photos. For the next card I'm going to use the polkadot pattern paper and I'm going to use a leftover of the pink pattern paper that I used in the previous cards and I used the gold card stock to cut out a thin strip of paper since I like to stick that in between the two pattern papers. I think it brings everything together better. Now my card base is ready I'm going to embarrass it with three of the die cards so I picked up the word beautiful the fox as well as a speech bubble and I'm just going to put them together without any foam squares this is going to be a completely flat card but I absolutely love the result I think it looks really modern and that fox is just adorable. Here are the close-up photos on this card and let's move on to the next one this time I'm using the white and green striped pattern paper which I'm going to stick on my card base again by using my white glue at the back and you can see the panel is slightly smaller than the standard card I always like to have a border from the die cards I picked up those flowers again and I'm creating another flower arrangement I can never have enough of those flower cards I think that flowers are perfect for any occasion so depending on the sentiment that you decide to stick on top you can use it for pretty much anything. So here I picked the word moments and I used foam square at one side so that I can level it up with the dimensional flower and underneath I'm going to stick one of those labels which are absolutely adorable again by using some foam tape at the back so the complete sentiment reach happy moments. For the next card I'm combining two pattern papers the lovely one with the flowers as well as the pink one I think those two go beautiful together and again I used the gold cardstock from the kit to cut out a thin strip of gold which I'm going to stick where those two pattern papers meet I absolutely love the look and I did that I repeated this design on three of my cards today I picked the word happy from the die cards and I added foam squares at the back for dimension and I also have a few of the leaves and a butterfly which are going to complete my card and I'm never afraid to use my scissors and cut out smaller parts from the cutouts so that I can make them work for my projects So I created a little cluster of leaves there and to finish off my card I'm going to bring in the sticker book and I'm going to find for the word birthday it comes as a sticker that says happy birthday but I'm going to make it my own again I'm going to use my scissors and cut out the word happy since I have the bigger one on top there Now this is green and it fits exactly on top of the letter h so I think it is the perfect match and you can see here some close-up photos Now let's make another card with those houses just because they are super adorable for the time combining this pattern paper that has houses on top so I think they are the perfect match and on top I'm going to create a little town for the first cutout I'm going directly on top with glue so this is completely flat for the second one I'm using foam square at the back so that I can add a house at the front for some dimension now I have a tiny little pink heart from the die cuts which I'm going to stick coming out from the chimney I also have this little die cut that says a lovely saying for home it says home is where your story begins I'm going to stick that there so I create a lovely cluster which I'm going to finish it off with one of the banners and I'm using foam tape strategically on one side of the banner since I'm going to place it on the dimensional house and I want to make sure that these are leveled up together and I will repeat the same design element as I did on the blue card with a bear so I'm going to thread a white string but this time I'm going to tie a bow for the next card let's create the fox with the dies included so I'm using black white as well as the red that was included in the kit and I have here all the pieces that I can put together now there are little details that you can add on top of the tail and on her chest I cut out those from white cardstock so you can see I'm going with a red fox today it's going to look absolutely adorable this is such a beautiful focal point on a card so this is the head and I cut out the base from white cardstock and the top from the red one there are bits and pieces that you can add like the tiny little nose you can also add those pieces on the pose I went with black for that I'm going to stick the head on top of the main body for everything I'm using my white glue I find it super easy to do that because you can slide the pieces until you are happy with the placement and finally all that's left to do is to stick the tiny little dots for the eyes for that I used a piece of double sided tape at the back so now it is sticky in between those holes so I stuck inside the tiny black dots for the eyes as well as the ears at the top of her head now this pattern paper is just stunning it has falling on top of it so beautiful I placed that on top of a red panel which is the same cardstock as the fox so it kind of brings everything together and for my sentiment I'm picking letters from these foam stickers and I'm going to spell the word hello these stickers are quite forgiving if you don't press too hard you can lift them and replace them so I will make sure I will use a t-ruler right around to make sure that this is completely straight and I'm going to complete it by adding a secondary sentiment underneath and finally for the last card for today I have a small white panel here that I added foam square at the back and I'm placing it on top of that green pattern paper again I use the same banner as I did for the first card and on top I'm going to stick some lovely die cuts such as the butterfly the glass tomb and a cup of tea and what I love about those die cuts that come in the kit is that you get the same design twice so you can either recreate the same card one more time or you can make completely different designs I finished my design by adding a couple of cold hearts and here are some close-up photos and now let's take a quick look on all the 10 cards that I made for today while playing with products that were included in the December card kit by spellbinders now I absolutely love pattern papers and I do love the die cuts so I had lots of fun putting all those cards together and if you notice I haven't even used the stamp set so let's see after the 10 cards what I have left so I have lots of those letter stickers I do have lots of gold sequins the double sided tape I do have the dies that I can cut out foxes again and again from the sticker pack I used only a few of the sentiments so I have many more I do have tons of those die cuts and I can recreate the same cards or make even more designs and you can see that although I used pattern paper for all my cards I still have lots and lots I haven't used the stamp at all so I can come up with more ideas on how to use the stamp set and the sentiments can be used again and again on future cards and I do have lots of cardstock that I haven't used at all since I was working on the pre-folded white card bases so I totally recommend this card kit I think it is a great value for money you will enjoy it just like I do every month so here are the photos or all the cards that I made for today I hope you had fun that you got inspired don't forget to leave me a comment to like and subscribe if you haven't done so already and I'll see you all next time


Okay it should be broadcast. We are live and recording. Hello all welcome for joining us, welcome for joining us tonight. We are going to wait a few more minutes to let other people join but we will start around 5.35. Good evening everyone my name is Jen Santos and I'm the deputy director for the city of Santa Rosa parks section and tonight we're going to talk about the playground replacement options for the 5 to 12-year-old playground area at Colkin Creek neighborhood park. Next slide please and just to get you started I want to introduce two people you don't see here tonight but they're helping in the background. Our host for the meeting Tim Bernard and Emily Ander will be helping facilitate slide movement as well as the question and answer and polling. They'll be helping in the background. It takes three of us to run these meetings right now as we're learning and I've got a few and a little bit of information to read for you on how to participate in the meeting. So panelists and presenters please silence your cell phones and keep your microphones muted if not speaking. Members of the public joining this meeting will have their webcams and microphones muted. If you're phoning in to join the meeting and you choose to speak up during the public comment portion of the agenda for privacy concerns the host will rename you to caller and only show the last four digits of your phone number. Additionally the city of Santa Rosa is committed to providing a safe and inclusive environment free from disruption and will not tolerate hateful speech or actions. Everyone is expected to participate respectfully or if necessary the meeting will end immediately and I wanted to let you know we do have a question and answer period coming up so if you have any questions at that point we'll be taking them at that time. Right now I'll turn it over to our host, host Bernard to explain how we will facilitate questions and answers and public comments. Yes at the end of the presentation the facilitator will open the floor for questions and answers and public comments. The host will lower all hands until the public comment item is open. Once the facilitator has called the public comment facilitator will ask the public to raise their hand if they wish to speak. Those joining by phone may dial star nine to raise your hand. The host will then call on those who have raised their hands. The host will unmute your microphone for your comment and then will mute you once you are finished speaking. The facilitator host or co-host will respond to questions to each question and if follow-up questions are generated you'll need to raise your hand again. Thank you. Thank you host Bernard and I would like to get us started. We'll obviously be asking you some of your opinions about the equipment and taking question and answer later but to get us started I want to show you a map of the city of Santa Rosa with the yellow lines on there being highway 101 running north to south and highway 12 east to west and the green items on this map are all the parks in the city and the park that we're going to be talking about today of course is Colvin Creek park and it's nearby where the star is located in the southeast quadrant of the city. The city has divided up its parks by quadrant and so that's why we want to show you this tonight as well as take a look at this we will be asking you a question about which quadrant you live in later so this might be helpful for you if you haven't thought about it that way so we've got northwest which is west of 101 and north of highway 12 and then northeast which is east of highway 101 and north of highway 12 southeast which is east of highway 12 and south of highway east of highway 101 excuse me and south of highway 12 and then southwest which is on the west side of 101 and just south of highway 12 so just for your reference there next slide please thank you so we want to zoom in a little bit tighter onto the park and you can see the park itself that we're talking about is highlighted in yellow Colvin Creek park the shopping areas to the left on the screen there are the target Costco best buys in that area as well just for familiar as well as Petaluma Hill Road on the right Colvin Creek is a neighborhood park which means that we do not anticipate too many people driving to the park we do anticipate more people from the neighborhood area within a half mile to visit this park which means that some folks do have to drive to get there but the point is that it's a smaller park the typical things you would see in this park are what you have here we've got a two to five-year-old playground as well as a five to 12-year-old playground picnic areas a half basketball court we also have a multi-use trail that runs along the Kiwana Springs Creek on the side of the park there this is pretty much what you would see at a lot of community parks this has a lot of standard options in it and that kind of gives you the idea of of the type of park compared to something like a community park which would be a much larger park more like 20 acres our park is about two 2.6 acres so we just want to explain that to you so you have some general idea of the size when you were looking at the type of parks out there next slide please and one of the reasons we're here tonight to ask you about our playground replacement options is this is the playground we need to replace it's the five to 12-year-old playground and several years ago it was damaged by a vehicle and the manufacturer no longer is manufacturing replacement equipment for this type of playground and playgrounds are proprietary in that the pieces from one playground don't usually fit to the pieces of another manufacturer's playground so it makes it difficult for us to try to fix that one portion of the playground unfortunately which is leading us to need to replace the entire playground we we know that there right now is there are slides climbing features there's also two double swings there that are really popular we understand so generally this is the reason why we are replacing this because we can't we can't have something that is to our safety needs to fit right into that playground so we need to replace the entire thing next slide and just a little bit of background for you about the park it was dedicated like a lot of parks are by a residential developer as part of the summer hill development to the city in 1997 the area is 2.6 acres and the play equipment is generally original from the original construction of the park and in December of 1998 the park named change from summer hill to cogan creek park from the board of community services next slide please and many of our parks have something called a master plan this is a plan that's approved by council for the type of amenities that are allowed in a park and so we wanted to just share this with you so you can see this park does have a master plan which is fantastic so we can skip that step and roll right into replacement of the playground without having to stop and produce a master plan so next next slide please so just to go through a little bit of the process from now until you get a new playground so we do have funding secured through the park development impact fees that are collected in the southwest zone so that quadrant the southwest quadrant when new developers come in for residential developments they have options to either provide a park in the area or provide funding in lieu of a park so that the city can in the future improve on local parks or acquire new land for parks what's new for us in this city a little bit new for us is using a cooperative purchase process to buy not only the equipment itself but the design of the equipment as well as permits and things like that the replacement of the playground and the removal of the old playground equipment through a cooperative purchase agreement and that agreement is a way for us to move quickly through a process to getting a new playground the all right sorry it was just pointed out to me that this says southwest and actually the funding does come from southeast I apologize for having to back up there so I wanted to let you know so the cooperative purchase agreement is a type of agreement where you have all three of those options so we're going to do the design the actual purchase of the playground equipment and the installation all in one process helping us reduce the amount of time that it takes to get a new playground it does mean that we have to focus on one manufacturer that meets the requirements to use that purchase agreement and it does guarantee us the lowest price in the state for that particular type of equipment it's a really nice way for us to move forward with replacement of a playground equipment when we do not have to expand the size of the of the area at all which is which is a really great way for us to move forward with this sometimes if we were going to take this through a whole master planning process as well as expanding the playground that can take about three years so we're hoping that this process about a six to nine month process to get to the playground replaced the cooperative purchase agreement will be with a local recreation equipment distributor that provides playground equipment that meets the standards for the state of california and is also durable enough to be used in a public setting like this so it's a really fantastic organization locally that we're going to be using a cooperative purchase to buy the equipment from and our part of the process is to do what we're doing tonight collect feedback from you we have some options and we really need your help to help us narrow down our selection process next slide please so we're going to go ahead and take a neighborhood survey now this is just a simple survey about you know where do you live how did you hear about the survey hopefully this will help those of us using our devices our electronic devices get familiar with participating in a survey online and so i'm going to turn it over to our host to describe how you can participate in the survey yes all poll questions are single or multiple choice you must answer all questions in order to submit your responses the submit button is at the very bottom of the poll you may need to scroll to the bottom of your screen to find it if you are completing a poll on your smartphone you must answer the first question before you may answer the second question etc if you're participating in the meeting via landline you will not be able to participate in the poll at this time however the poll will be will be available via the site city website until january 5th following the meeting please check srcity.org backslash 2448 backslash park hyphen projects to complete the survey once everyone has completed the poll and has been closed the results will appear immediately and the facilitator will walk you through the results thank you host bernard so let's go ahead and take the poll and i'm going to walk you through it as well so number one where in the city of santa rosa do you live we're just looking for what quadrant you live in this helps us understand where we're receiving feedback from how did you hear about this meeting you can tell us if you heard from multiple choice options there and then how often how frequently do you visit colgan creek neighborhood park and we're also curious about how you might get to colgan creek neighborhood park is it mostly walking or never going oh it looks like we're good we have everybody's feedback so there you can see the results now so we've got everybody from the southeast quadrant which is where the park is that's fantastic folks have heard about it through postcards and word of mouth and social media and we've got a lot of people visiting the park 33 daily and a lot of folks walk and drive to the park and it looks like less than five minutes is how long it takes most people to get to the park so i'll check in with our hosts uh did everybody get a chance to participate we have ten of six of ten okay thank you so much let's go ahead and end that poll and hopefully that gives you a good idea of of how to participate in the polling and let's go ahead and start the go into the rest of the presentation so the next slide please so um as i mentioned before one of the things we're doing is using a cooperative purchase which uh which requires us to choose a manufacturer and from that manufacturer we have some options from there to choose from and so two options have come forward to us as options that are really great to fit in the existing space require with all of the current codes relating to playground equipment and also provide something fun and new as well as something very similar to what was there in some of the options here so we just wanted to make sure it was really clear that we're providing you with two types of options these might not be the final options but we hope your feedback today will give us some information on which direction we should go so we have the net play structure that's the title for that type of equipment for that playground the reason it's titled that there's a lot of net climbing systems as part of it there's two traditional swings which are very similar to what's at the park right now there's also a what's called a crab trap climber it's a big climbing structure you'll see a picture of it soon and also a spinner the hedgera play structure is the second option or first or a or b or c however you want to but it's the other option we have this the thing about this system is brand new for 2020 so it's really exciting and it's a hexagonal shaped type of design and it has slides and swings and balancing very similar to what's there now just a different style it also has instead of the traditional swings it has an option for what's called an oodle swing which is like a tire swing a group swing and it also has a sphere for moving and a gyro spinner so we're going to go into our next slide and look at the net plex option first we have three slides for you pictures of that and we'll go through it and then we'll go through the hedgera and then we'll ask you some questions about it from there so next slide please so again this is just one of two options and we've got three images coming up for you next slide so this is an image of the net plex option and if you take a look at it you can see why there's a lot of net climbing features on there we also have a slide with a little curve to it um and we have another slide on the other side you can get a glimpse of the swings to the left of this photo the nice thing about this net climber too is it also has a shade structure that's built in as part of the as part of the equipment there are balancing beams that come off of this equipment and connect to other parts of it and in the back you see the crab trap climber which it's called it's it's a huge climbing structure which is really fun with lots of tunnels in it and different types of climbing and then you've got our spinner off to the right so let's go to the next slide and we'll show you the same equipment so again this is the same equipment we just switched to the other side of the playground so you can get the other view of it so again right in the front central is that big climber feature which is really fun it's got some balancing parts to it as well as some tunnels and different you can climb all the way over it and there's a traditional type of ladder slide to get up to a walkway that goes through it it's it's a really fun feature and then you can see the net plex in the back with the climber and the two slides and and behind that you can see behind the crab timer is the is the spinner so this is just another way of looking at the same feature let's go to the next slide and again this is the this is the same same equipment the net plex option and just a different way of looking at it sometimes it's hard and you really got to get in there and look and see what's going on because there is so much going on on these playgrounds what we try to focus on is keeping keeping children active when they're on this they're always moving there's not a lot of platforms to stand around on we really want to keep them moving right on to the next thing and really get their muscles working out and and and bring their core bring their core up and get very active on these playgrounds and these new playgrounds do allow for that but you'll see very similar things to the playgrounds that's there like the slides and the climber features and the balancing features and there are the two traditional swings in this playground and these playgrounds if you've ever been to a newer playground it looks like everything's very far apart from each other and the reason that we do that is there's something called a fall zone there's a imaginary line around each equipment piece that's independent of each other and those lines really cannot intersect in order to keep kids safe from falling and hitting another play feature so that's what it's designed to do to allow the extra bit of of safety because we definitely don't want to have we want to have kids having fun on these play equipment so hopefully that gives you a pretty good idea of what the netplex option looks like the features in this can be traded traded out so the slides can be changed to some other type of slide the colors can be modified slightly if we don't like the little spinny thing we can change that out so there's there's a little bit more flexibility with this netplex option next slide please and so we're going to look at the hedgerow option again and again we have three slides for this option next slide please so here you can see what i'm talking about this is brand new a brand new style of equipment just out in 2020 spring of 2020 is when it came out and it's got that hexagon type of shape to it it's a really fun type of structure and in here what you have is the structure itself the piece itself which has lots of climbing and balancing features it's got a slide and a non-traditional slide where there's two bars where kids can slide slide and climb up it there's also some monkey bars if you call it or swinging back and forth which in the industry we call brachiating but that's where you're hanging on and you're swinging your body side to side and we also have the global motion sphere so maybe the newest version of what you might call a merry-go-round in the past and it does the whole entire thing spins and it's really there really anytime you see these in the parks are very popular we also have on this one a little different option to consider that is the it's called the oodle swing but it's it's generally very similar to a tire swing where several several children can fit on it at one time or parents and kids it's it's a really fun option to consider and we also could put in traditional swings here two swings here as well if this wasn't desired next slide please so here is again the same equipment just a different view because again you always can't see everything from every option so we have the structure itself which has a lot of climbing option balancing options and sliding options and in the very back there's a little tiny spinner for one or two people to spin on those are really fun individual play by itself and then we have the the sphere global sphere motion play equipment and then also the oodle swing which you can see in this picture they're showing several several kids on this which is fun these are a fun type of equipment to include and again if this isn't something we could place two two swing sets in there are two swings in there if we needed to which is what we have at the park in this play area right now next slide please and so again this is the same equipment just a different view so you can see a little bit closer and this is the head draw option and the difference with this is that absolutely nothing on this play structure can be modified not even the color it comes as a package which is nice and the playground manufacturer can have it ready quickly whereas if we change a bunch of components and things it does take a little bit longer to put that together so you can see the global sphere you can see there is somebody pushing it it does spin and the little tiny spinner in the back the only thing that's out of this image is the group group swing the oodle swing so hopefully that gives you enough time to look at those next slide please so we're going to go into a question and answer portion after this slide because I'm sure there's probably lots of questions about this equipment and we wanted to show that one of the both of the play structures together so you've got the net flex play structure as one option and the hedra play structure as another option and both of them offer very similar activities for children to do the net flex play structure offers more climbing opportunities than the hedra and the hedra has a little bit more of the balancing options as well as the larger spinner component so I'm going to go ahead and go to the next slide and I'm going to turn it back over to the host to describe how we how we are going to facilitate the question and answer portion of the presentation yes I have lowered all hands please raise your hand if you wish to speak those joining by phone my dial star nine to raise your hand host andrew will then call on those who have raised their hands the host will unmute your microphone for you for your comments and then we'll mute you once you have finished speaking the facilitator host or co-host will respond to each question or comment as it is raised you will need to raise your hand again if a follow-up question is generated based on the response received okay are there any question and questions out there that I can answer for you there are two questions we have two speakers first will be lane and tim and second will be john lane and tim I've enabled your speaking permissions please unmute your microphone I will lower your hand and you will have well we have a courtesy timer which will give you three minutes to speak okay can you hear me I can and can you see the timer I can hopefully I won't use all that I was just wondering when you replace the place structure will you also be taking out the existing sand and putting in a more rubberized surface thanks for that question we will be removing the sand and replacing it with what's called fiber it's an engineered wood type of wood chip that's engineered to attenuate falls so that if somebody falls there's there's a bounce effect to it so it's safer than sand sands not compliant in the state of california anywhere I don't think it is compliant in the nation but we will be removing the sand the rubberized surfacing is is typically not a choice we make because of its it's not very sustainable it doesn't last very long it needs tons and tons of maintenance and so we do look towards the wood chips the wood chip option as as a surfacing and there'll be a ramp into the wood chip area to allow for folks that need it for ADA for ADA access to the to the play equipment hope that hope that helps answer the question the next public comment comes from John John I will lower your hand and you'll have three minutes to speak please unmute your microphone and can you see the timer yes okay your time begins now yes a couple of comments I just wanted to note that the park is frequently graffitied current park and so it's good or important to have less surfaces that are prone to tagging or graffiti I guess there's gang activity in the area so seemed like the second option was had a lot of surfaces that could be prone to that and second comment was the sun shades on on the first structure and how durable are those I know that my canopy lasts maybe two years in my backyard before it deteriorates and wasn't that looked like a fabric and so I was wondering how durable that would be is it going to last 20 years or need to be replaced and my preference is the first one it looks like it has better options and we do have a kid in our neighborhood who uses the swings every day and and almost all day so he's on there for hours every day I notice and and really likes the current traditional swings and so it would be for that reason I recommend keeping the traditional swing option and and so that's that's most my oh the other comment I didn't see it in any of the designs but I just wanted to make sure there was no plans to install a bathroom or part of a party or anything like that because we don't want to attract homeless people to camp in the park which is a current problem and we two or three times a week we have people trying to camp in there so we don't want to add things that would make that more accessible I suppose and more attractive and other than that I think there's a couple of great options so thanks for doing this and so our brothers for number one that's it thank you John thank you and I I hope you can stay on because we would really like you to participate in the poll and tell us that information in the poll so we can collect it as data and I appreciate the information about graffiti in the area and for the for the shade the shade sales that are on part of the equipment are extremely durable they won't need to be changed for 10 to 20 years depending especially when you pick up when we choose a lighter tan type of color it's very very durable I'm forgetting exactly what the manufacturer told me about it but we have used this sage shale in the city quite frequently and it rarely needs to be replaced unless there is some sort of vandalism or something to it but otherwise really durable and a very sustainable option for for shade and then we do not have any plans to include any restrooms in this park so hopefully that answers your questions for that is there are there any other I'll turn it back to the host to see if there's any other questions yes there's one more public comment our hand raised again from Lane and Tim I'm going to unmute your microphone and you may and I'll lower your hand and you may begin your comments now okay hi one follow-up on the rubberized I've seen the rubberized surfacing go in on other parks in the city I think Bayer Park had a rubberized surface so I was just wondering if that was up to debate or open for future discussion and then also we have a couple young children and they their preference would be a number one so we'll stay on and do the survey at the end so you can record that information and also the existing path behind the park is really in terrible shape I was wondering if there's any plans to reconstruct the repair or patch or do anything with that because a lot yeah a lot of our a lot of people walk on that route and it's really terrible it's a liability for the city I think at this point also you had mentioned six to nine months is that to completion or is that to the beginning of construction and then that starts from there and then I was just wondering if you could share a little more information about maybe the designer and the supplier that you're working with and I think that's it okay great thank you so much and with regard to the rubberized surfacing Bayer Park was one of the last parks that that type of surfacing was installed in and almost the moment it went in it was vandalized and we are constantly out there fixing that rubberized surfacing it is it is a lot of maintenance for us and so we we try to move away from that to something that is more sustainable for us and ultimately safer because when when the rubberized surfacing is vandalized it becomes really dangerous a tripping hazard so we do really try not to look at that for especially for such a large playground surface and outside they do they do just attract an enormous amount of vandalism so hopefully that answers that so we really do we are going to look at the wood chips going forward the existing path information I greatly appreciate that I know that path has had trouble in the past with especially along the edges so I'll definitely pass this information on to our park maintenance team to to alert them that it's getting worse again I know that that trail has been has been a lot of maintenance over the years and I am not aware of anything to to replace the trail surfacing at this point but I will be checking back I'll check back in with our park maintenance staff and and let them know that it's in pretty bad shape so I appreciate that and the six to nine months is to have a brand new play equipment installed so it's it's the entire park process to to get it from the moment you say what you like to actually having the ability to play on it is six to nine months that's of course barring anything anything unknown that we might not be aware of but otherwise that's the plan which is it seems it might seem like a long time but actually it's a really quick process in the scheme of things for allowing us to quickly move and replace and replace that so hopefully that answers that that question and of course we'll mention this again at the end of the presentation but as staff are always available to have longer conversations or if you'd like to have a more detailed conversation too about anything we can certainly have that all of our contact information will be at the end of this presentation so if you feel like you need to continue the conversation or have another question that comes up after this presentation certainly we are available here to help with with answering those and providing information and I will look back to our hosts now to to see if we have any additional questions or if we're ready to move on into our selections are there any additional public comments currently I do not see any more raised hands I'll give you a moment I don't see any raised hands so I think we can move on okay great thank you so much let's go ahead and move on and we do have our next survey for you and at the next survey when it comes up we will be asking you what your preferences are there you go and so we asked you the first question is what type of swing do you prefer so for either option you can have either type of swing and then this is just great information for us to know which playground features are important to you it's really great for us to hear what's important for you all and I think most of them are self-explanatory brachyating is the hand-over-hand typically called monkey bar type of action and which playground design do you prefer we give you the options there as well as if none of those worked for you we have that option as well or if you like both of them and so I really appreciate your time especially on the multiple choice these are things we like to see these these six types of features on a playground are in the industry what we talk about as far as what what children like to use when they're on a playground and so it's kind of fun for us to know as we roll into this what's important we have four of ten attendees responses okay great thank you let's see okay let's go ahead and take a look at the results then can we give just one more minute on the left on poll we had six so I'm hoping we'll get we now have five of ten I'm hoping we'll get one more one more response okay great thanks so much okay we're holding steady at five so I think that we can move on okay thank you host ander okay so there are our results for for the type of preferences so traditional swings are the preference there at 80 percent and I appreciate the questions for number two it looks like sliding is 100 preferred with a fall behind by swinging and climbing and on the question about which playground do you prefer the net climbing structure is the preference 100 so that that is very helpful for us thanks so much for taking the time to take this survey we just have a few follow-up slides to to let you know what we're doing next and how you can keep the conversation going so I'm going to turn it back over to our host to get us started with the the rest of the presentation again and just want to say thank you again for participating to and sticking with us we are all learning this new technology so I appreciate the your patience as we as we navigate how to do this new technology if you've ever been to a city council meeting they make it look really easy but there is quite a bit going on in the background to make this happen so for our next steps we will as we mentioned earlier have an online survey so if you felt like you had other comments that you wanted to make to us about the playground equipment or anything like that or any additional questions the survey online allows you to type in information so if you felt like you couldn't give us the feedback in writing that you would like that available that option is available you can also notify your neighbors if they weren't able to attend tonight that is near the holidays that they can go online that will be available until January 5th when we will collect all the feedback from the from the neighbors and the final selection of the of the playground equipment will be posted online on our website and if you go to the recreation and parks city website there's a selection for park projects and that's where the information will will be posted as well as again the surveys there if anybody wants to take it and just a reminder that that playground equipment does include the design that permits the demolition of the existing and installation of the new of the new equipment so next slide please and you heard from him tonight Tim Bernardo is one of our hosts for tonight's meeting but he's also the project manager for this in the city and so his contact information is there if you'd like to continue the conversation or have anything else that you'd like to bring to our attention certainly we're here to continue that conversation and we also have the srcity.org website listed there if you'd like to jot that down and then other than that we'll roll into the next slide and I just want to thank you all very very much I know this is close to the holidays and virtual meetings are kind of tough because we don't get to meet in person but I truly appreciate your time to be here and your dedication to your neighborhood park and improving it we are looking forward to the results and hopefully we'll get you your new playground equipment soon thank you very much


So, welcome. Thank you for joining us this morning at super not late or early, but... Somebody followed the 3-2-1 rule to the letter last night, didn't they? Sorry, my bad. Hey, but at least I got three. So, in case you don't know where you are, we're doing voles 101 in here. Hopefully everyone can learn a little bit of something. We all wanted to ask a couple of questions before we jump in further. Number one, like, how many people here is their first DEF CON? Wow. All right, nice. That's pretty impressive. So, how many... What was the other question we wanted to ask? So, how many of you here are here for this talk? You've just started out in vulnerability research and you want to learn how to improve your game. Okay, and how many of you are not familiar with research, but you're curious about it and so that's why you came here. That's about even. Okay. Good. That doesn't help us any, but thanks. Yeah, what we realized a little bit earlier this week as we were practicing was that we were trying to target two audiences, newbies and then people who were curious about vulnerability research but didn't know much about it. And so, sometimes for those who are curious about it, we might go into some terminology you might not be fully familiar with. We're just going to move on. We'll be glad to follow up with you afterwards as well. Yeah, and neither of us hide on the Internet. We're pretty approachable, so don't be afraid of us. So, introduction. I'm Josh Jduck. I go by on the Internet. That's how you find me there. I've been doing VR for 20 years and so this 20 years actually includes several years as a hobbyist. And at one point, I ran the high defense vulnerability contributor program where we would actually buy vulnerabilities from researchers and get them fixed and coordinate and all that stuff, so that's how I met Steve and we did a fair amount of work together at that point. And we met through the CVE program which I was a co-founder of and led from 1999 until the end of last year basically. There's a thing called Responsible Disclosure. I am a survivor of the Responsible Disclosure Wars. I now call them Coordinated Disclosure. I coined the Responsible Disclosure term for which I will be eternally sorry, but it served its purpose. I started getting into classification of vulnerabilities as well which is where CWE comes from and I was also a participant in the development of CVSS version 2. One quick question. How many people in here have a CVE to their name? Alright, let's fix that. That looks like a dozen, I think. That's pretty good. So why are we doing this? We want to fix that, right? We want more people out there doing research into vulnerabilities of software and hardware into all kinds of systems because as we've seen, there's lots of crazy things possible. It was very interesting to see the previous talk, the guy hacking the loyalty program. That's good stuff. It's fun. So what else? We have this little tiny picture on the slide on here. You guys see the slides better than we do. So we're flying a little bit blind. If anybody works at Google Slides, you might need to work on this. We can move on. Alright, yeah. So just to get people involved. So disclaimer up front, right? This is our opinion. We did a lot of stuff with Volums over the years. Find them, analyze them, all that stuff. We just formulated these opinions. So they may not be right for you. Take that with a grain of salt and remember that you're your own person and you've got to find your own path. We'll just try to help you see some of the stuff. So lastly, there's no new exploits here. Who came here to see new exploits? Okay, good. Thank you. Okay, so first of all, there's a question about what is a vulnerability in the first place? We'll start with what a vulnerability is not. One of the most commonly confused terms is exploit versus vulnerability. And a lot of people think that exploit and vulnerability actually mean the same thing. However, they don't. And exploit is really a sequence of steps that's used to take advantage of a vulnerability. A vulnerability is a problem within the code itself that just kind of more or less sits there waiting to be exploited. These are almost circular sounding terms, but we face a number of difficulties in actually really defining these a little bit more carefully. And I think that's a reflection partially of the relative immaturity of the vulnerability research specialty. Yeah, I wish I could expand this picture for you, but I think what is Taylor Swift say here? To be loved is to be vulnerable. To love is to be vulnerable and to be loved is the greatest exploit. So we go back and forth with this definition of what is a vulnerability. And there's so many different ways to define it. I think Steve did a great job already saying it.  If you don't have some kind of impact or you're not changing the way things are working, it's pretty much not a vulnerability. But in mind, Greg McManus at iDefense taught me through heavy abuse of him asking me this question every time I thought of him when I thought I found something. He's like, well, what do you have and what do you get? If what you are getting from this vulnerability, if you manage to exploit it, it's not better in some way than what you started with than you do not have a vulnerability. It's more like a bug or something really annoying. And this is one of the common problems we run across with new researchers who try and report CVEs or something like that. They find something that may be a bug or may actually be a feature, but it's something that is legitimately already allowed. Or with the privileges you already have, you can already go legitimately through some other route to obtain those additional capabilities. And so that's one particular point of confusion. Another important point to make about vulnerabilities is, as Steve knows well with this classification work in CWE, that there are many, many properties of vulnerabilities. Like I mentioned before, the impact is a really important one, but also the user interaction is an interesting one. These things are used by the defensive side to prioritize patching and strategies around defense. So these are just a couple of the important properties. Another interesting one these days, which is getting more and more interesting, is how hard is this thing actually to exploit? And I think as things have improved over the years, it's gotten much harder to do that. Yes, it's become a lot more difficult to do that. And that's thanks to the defensive work and the build-up of many different kinds of protection mechanisms. And so there's almost like a Heisenbergian approach to interpreting vulnerabilities these days. And where something was clearly exploitable perhaps 10 years ago, it may wind up taking a whole lot of work. And that's one of the great things about the defensive side of understanding vulnerabilities, which is to really build in these systematic defenses. I have a whole rant on this. We can do some other time, but not right now. We'll save that for later. All right. So finally, we get to what is vulnerability research. And in this case, what we're saying is the process of analyzing a product protocol or algorithm, you guys already read this. Or a specification to basically to try and find vulnerabilities or understand them, one or more vulnerabilities basically. So there are different kind of approaches, different kinds of products or specifications and so on that you may decide to look at. It's all more or less falls under the umbrella term of vulnerability research. So the term itself is treated and interpreted a little bit differently. You might sometimes hear the term vulnerability discovery. And that's really intended by, used by people who want to distinguish from let's say academic strength research versus going and doing bug hunting and so on. So some people use that term. That distinction does wind up being important, I think sometimes. But again, the terminology is still kind of emerging and we don't have a lot of agreement. Well again, we're not doing exploits here and I personally think exploits and exploit development and stuff like that falls into VR. As do I. But it's not really our focus here. So let's keep going. It's really about solving puzzles where you don't even know what the puzzle is in the first place. You don't even know if you'll find a puzzle. Then maybe you find a puzzle which leads you to other puzzles and so on. That's one of the big attractions to me for vulnerability research. Alright, so why do it? You know, in case you're very new and you're just curious, these are some reasons why you might want to get motivated to do the hard work that is vulnerability research. Hooray, Google Slides. I'm serious, it's so tiny. I hope there aren't any Google... The speaker notes are the whole screen and the slide is like a little tiny square. I hope there aren't any Google people in the room, but... I hope there are some to fix this stuff. So one of the big points to note here as you look at this nice little word cloud is... Go ahead. Ah, that's okay. Let's just go to the next slide. The main takeaway from that previous slide is that there are many different motivations that different researchers have. And your motivations may not be the same as others. And in addition, when you're dealing with vendors, vendors may have only experienced or they may only assume certain kinds of motivations from you. And so that potentially causes certain difficulties when interacting with vendors. I personally like just about all these words on here. So there's a lot of different careers. Steve, you want to talk to them? Yeah, so there's a number of different careers, but it's not like there's a career shop that you can go to. This is still a new field. And to my way of thinking, we're like kind of entering the second generation and we're sort of the first generation. We're trying not to skip one. We're trying. And it's really good to see a full room here, actually, because we need a lot more people doing vulnerability research because we've only seen the tip of the iceberg. But what's called vulnerability research, it may vary, but there's a lot of different things that one can do. Yes, you can go and you can hunt bugs and hunt vulnerabilities. Other people may really like building up exploits against those vulnerabilities. And I agree with Josh that that's an aspect of vulnerability research. Then there's other stuff that's maybe a little bit more adjacent to vulnerabilities, but that still involves a lot of analysis. So I previously mentioned things like building defensive protection mechanisms to help protect against entire classes of vulnerabilities. You know, for CVE, a lot of what we did was to catalog those vulnerabilities and in a way try and figure out how the CVE identifier could be used to help people to coordinate and so on. And another option is to really work on fixing them. You could be working at a developer somewhere and see a vulnerability that's been reported and figure out actually how to fix the code. And I guess one note that just popped in my mind here is that there are a lot of vulnerability researchers who discover vulnerabilities but have no idea actually how to fix them. It's a completely different mindset. You can have a really solid development background. You need a solid development background to build a good fix, but that's not necessarily the kind of skill you need to do vulnerability research. Yeah, that's right. One thing I will add is that if you do start doing any of this stuff or find a job doing this stuff, you basically have unlimited job security for the foreseeable future. So there's a lot of different employers that you basically could have. I mentioned you could work at a software vendor. You could work for a government organization or a cert coordinator. You could work at a commercial enterprise, whether it develops security products or whether it does consulting services. However, these days pretty much every business that's out there is more or less a software developer. Think about Target. Think about other kinds of brick-and-mortar companies. Those all develop software, either in-house to help them manage their operations or externally with respect to websites and so on. And as you all have probably heard, there is a huge demand. And so these are some of the options that you could look at and you would be most likely welcomed with open arms by someone somewhere, because we need a lot more researchers. I'm a little partial to the bounty programs. They're really fun. And if you have a good employer like I'm fortunate enough to do, then you can kind of keep that bonus money and throw parties at b-sides and stuff like that. Cheers. So, yeah, let's do the next one, huh? So these next couple slides, these are really kind of a little bit more of a disclaimer than normal in terms of our opinion. But based on our personal experiences, and I've actually done some vulnerability research myself. It was a while ago. But based on our personal experiences and interacting with other researchers, there are a number of personality traits that generally seem to be useful for longer-term success within vulnerability research. So for example, a willingness to work independently, a willingness to learn, being very critical thinking. You always have to be more or less questioning your own assumptions. That's a good point. I don't even think that's in the slides, but that's a really good point. And really, it's primarily a solitary effort. You need to be diligent. And you see some of the other features there, basically. But two of the biggest personality traits that we believe are important are patience and persistence. Patience is essential not only with yourself and with the process of discovering and investigating these vulnerabilities, but patience when dealing with others, especially when dealing with, say, vendors that might not necessarily be behaving exactly the way that you would want to when you're trying to communicate with them. So those are some of the should-have personality traits. These are some of the ones that we think are nice to have. Still a greater formula for success here. To really be able to be focused, to seek to improve software, which is a common thing. The ability to collaborate, whether that's to collaborate and work with other people is something that we believe is important. There can be many rock stars and not-so-rock stars that don't work well with other people. But that oftentimes, especially if you're just starting out, I think is probably a career limiting kind of attitude that one would take. And we also have here a notion of having kind of an addictive personality. So for example, at CVE, I stayed at CVE for 16 years through 70,000 vulnerabilities. Now, I didn't investigate and look at all of them, but you could say that that might be kind of indicative of an addictive sort of personality. And Josh, how many days, weeks, or months have you spent on, say, a single bug? I don't know. I stayed for, I spent goings for a long time. I think it's at like maybe one year, but yeah, it's not all at the same time. So, you know, none of these personality traits here that we're talking about is absolutely essential. Each of you will find your own path. But if you feel that you have some of these personality traits, then you might find vulnerability research enjoyable. So I think we're going to be totally screwed on this slide because it's a small one over there. We have a number of different... You guys could probably read it fine. We can't read it at all. We have different skills that we've sort of listed here for long-term success, but I would say probably that some of the biggest ones, one is about analysis tools and findings. Not this one, is it? Yep. We can skip it on the next one too. All right. I think the big one we wanted to say here was about communication. I think we made that pretty clear. Yeah. All right. So here's another awesome wall of text slide that we put together. And we don't want to read it to you, but these are some of the key terms that we feel in vulnerability research. Of course, the slides will be available. You know, if you hear us, you probably already heard us use some of these terms. But when it really comes into doing analysis and deeper research, like some of the stuff like root cause analysis and vulnerability chains and classes, and especially proof of concept code, become more important. I think one of the key terms here that I guess we touch on it a little bit later as well, though, is the notion of root cause analysis. This is where diligence and critical thinking comes into play. You might discover something that's like a symptom of a problem. And it's really when you become tenacious and dig deeper and deeper into it to find out what's really causing the problem in the first place, where you may find some significant success. All right. So in the industry, many of you probably if you're interested in vulnerability research already know about this thing we call the fire hose. And that's basically just a steady stream of information about vulnerabilities that's coming from all angles. Includes stuff like some of my favorite stuff like CTFs in war games, where you can learn, excuse me, at your own pace. And just lots of aggregation in other places. If you want to learn more about violence, look at these things for sure. There are a couple items that are not on that list there that I think that came up during this weekend.  And typically those additional bugs have additional details. And then another area is bug bounty programs, which can help you to learn and interact with others. Actually, by a show of hands, how many people are in or have participated in bug bounty programs and gotten some kind of reward? It's better not to be too much more than how many people have CBEs. Moving on. I guess there is that rule about CBEs and websites, right? So, um, wow. I'm going to bend over and stare really kindly at it. So selecting your target, there's a lot of choices if you want to find bugs somewhere. This is kind of on the vulnerability discovery side. You can go deep or you can go broad, and what we mean by that is you can pick one particular type of vulnerability or something and go look at every software you can find to see if it's vulnerable, or you could pick one particular software and just drill down until you find something. There is a lot of software that has more or less low-hanging fruit, and if you want to expand on that a little. I will on that. I don't know if it's on this side or the next one. So, uh, another big point I wanted to make here is if you do do some research and you find nothing, it's actually quite useful for people to know that somebody looked, even if you found nothing. So that's one point. And again, low-hanging fruit, a lot of older code is buggy, complex or overly complex stuff is very interesting to look at, although, you know, a lot of times you just get lost in it just like the developer did. Large attack surfaces like web browsers are always fun to play with. You've got a lot of possibility for things to go wrong there. Software popularity matters. So if you're going to try to become super famous and you want to go find some bone and something, it's probably better to not pick a random personal website project off of SourceForge or something like that. But on the other hand, if you want to find something and, you know, a super popular product like Microsoft Windows Server or something, it's probably going to not be anywhere near as easy. Not necessarily anywhere as easy because that software, you know, the really popular software has already been pounded on by many people, by elite researchers and so on. So the lower-hanging fruit, the kind of software that doesn't necessarily have that doesn't necessarily have any vulnerability history at all or that no one's really looked at before, that's often an area where you can find some success very quickly. One thing I like to do sometimes when I get super stuck is to go and pick on somebody lame. I think this is kind of popular in the VR industry where we just need that redemption, we feel good about ourselves again. But the problem with that is, you know, a good example is like open office or something, it's pretty easy to fuzz that and it's full of bugs and nobody really cares about them too much. And so you can go find bugs there but then you deal with the secondary problem as nobody caring too much. So brand new emerging technologies is always a great place to look. Many people in bone research like to wait until a thing becomes very popular and therefore when things are emerging, nobody's really paying attention. I think we can say that about IPv6, I think there's like maybe a handful of IPv6 researchers around even though that's sort of slowly becoming a norm. Mobile and IoT are definitely guilty of this because as they try to hurry up and get to market really fast, they didn't invest in security and we're hoping that we don't repeat that mistake with IoT but we'll see. One suggestion we do have which would be very useful for the entire community and for contributing to the body of knowledge is that you have access to software or products that are very difficult for the everyday person to get access to. Say, you know, multi-million software or expensive medical devices or other kind of physical devices you know, those aren't things that just everybody can go and grab and look at. So not only might you have some good chances of success in finding vulnerabilities in those kind of products, not a lot of people have access. Who knows how to do that like magnifying glass thing on OSX? Anyone? Nobody? You want coffee or something? Well, I'll just stare at it really small again.  It's pretty interesting. That's one way to select your target. You see people beating up on something through advisories getting published and you're like, well hey, maybe I feel like there might be more there. I should go take a look there and maybe do some follow-on work. I encourage the community with this one on stage right heavily. It's good to have more people looking. So tools and techniques there's kind of like these two main ones that are really kind of high level design review and threat modeling. These are I think really important for anyone who's developing software to have this as part of the cycle of figuring out how to stay secure or how to basically stop having alarm bells ringing all the time. Dynamic versus static analysis is very important to differentiate depending on what kind of stuff you're going to do. Like on the malware side, static analysis is a lot more popular with vulnerability research a lot of more dynamic analysis seems to be more popular but I think the real power here is when you have both together one of my personal bug hunting processes is to start writing a fuzzer and then just let it run while I read the code and as soon as I learn something more about the code that will help the fuzzer be good then I'll add it to the fuzzer and I'll just keep doing that back and forth. So code auditing in some of these other automated tools like static code and analyzers, they're great but a lot of times they have false positives or they have other issues and so it's just important to be aware of the trade-offs of kind of all of the tools and techniques when you start getting into them. I really think that a tool in this industry is the embodiment of a technique someone developed to a large degree. And I agree with that. While we have a number of tools and techniques listed here that doesn't mean that you have to know all of them and be expert in all of them in order to find any kind of success. This is part of your path but we do recommend I would say to at least investigate and look into each of these. Everyone kind of has their own sort of favorite techniques that they like to do. This one's you man. So as the field becomes a little bit more mature and ties in obviously with vulnerability management overall, there's a number of different relevant standards that you should familiarize yourself with and utilize wherever you can. One of the main ones is the common identification scheme for vulnerability is called CVE and for those of you who've had certain questions about CVE especially in the last year or so with concerns about coverage and what MITRE is doing while I did leave CVE last year, I'm still at MITRE and we do have one of my colleagues here who is carrying the torch as it were and would love to talk to you and so I want him to stand up here. That's Dan. He will be Hey, Stan. We need to talk buddy. So he will be available and he would love to talk to you. Not all of you at once but a few at a time. Another effort is the common weakness enumeration. This is when you have these different vulnerabilities and different products well it turns out that programmers make the same mistakes and many different programmers make the same mistakes and so CVE is effectively a classification scheme for how programmers wind up making these kinds of mistakes. It's useful in two different ways. One as sort of a common identifier for characterizing what the mistake is that you found but it also winds up being very useful as a dictionary or as something to educate you. So for example CVE there's 800 different kinds of mistakes that programmers can make and as much as you think you might know about everything I guarantee you there's one or two things in there that might surprise you or that you might not have expected and if you're even just starting out you get good information from things such as OWASP but CVEs as well for stuff like SQL injection and cross-site scripting are also pretty mature. Equivalent for attacks is called KPEC and then CVSS is a way of being able to consistently apply a risk-related score to a particular vulnerability that you found so it may be your favorite vulnerability you might be in love with it you might have worked really hard but you need the cold objective or reasonably objective eye of CVSS or something like that so that you can communicate its importance effectively. Thank you. Hey sorry about messing with the slides I was trying to zoom in on this little tiny thing and it zoomed everything so that doesn't work. So disclosure models disclosure, disclosure, disclosure we're not going to go into specific details but there are a number of different models that you could consider and figure out more or less what works for you I do and I think Josh agrees that we both suggest using a coordinated disclosure model which involves really working with the vendor in order to try and reach some resolution but there are other models as well such as full disclosure as soon as you find it you sort of put it out independent of whether or not the vendor has been given a chance to patch and then there's also non-disclosure some people may choose simply not to disclose the vulnerabilities or to only provide them or in some cases sell them limited markets but this is these are different things that you're going to need to consider as you move more into vulnerability research. You may have any number of different approaches and beliefs in why it's important to do public disclosure but I think the more we know the better we know all of us collectively and finally there are a couple different standards or standards like documents that have some guidance with respect to coordinated disclosure or equivalent models that you can follow and that you can provide or give advice to vendors who may not be used to handling vulnerabilities. Most importantly is International Standards Organization ISO document number 29147 which was done by Katie Masaurus and others International Standard it is something that is directed towards researchers which explains to them how to build up a process for responding to vulnerability reports and for interacting with the researchers so as a survivor of the disclosure wars I'm very very happy to see standards like that 29147 come out and yes it did take me six months before I could start rattling off that number if you start to get deeper into building your vulnerability career so to speak then you may have different kinds of considerations for building your own kind of public your own disclosure policy based on your own experiences in your own beliefs you want to start evolving certain kind of considerations for what you're going to do in certain kind of circumstances so what would you do if you try and contact a vendor and you can't find any contact information or what happens if you're working through a process and then suddenly the vulnerability is released by somebody else as a zero day or something like that there's a lot of debate about how long to actually give the vendor before they fix the vulnerability and push it out push out a patch some say 30 days some say 60 days there's 90 days or however long it takes these are some of the questions you need to ask yourself yeah what I had a point I forgot what it was let's skip this one I think I was just going to say that sometimes the disclosure process you choose will even vary based on individual vulnerabilities some people decide not to disclose things that are not super awesome alright so we got 10 minutes we lost a little time to the difficulty let's we can move on skip that one alright so let's talk a little bit about advisory structure and contents I'm so not going to read these bullets to you structured content is very useful I think Steve and I collectively well we probably read a lot of the same advisories but collectively he's probably read thousands and thousands I agree with that some of them were really horrible there's this really offensive group and when I say offensive I mean when we read it we get offended I don't mean they use bad words or anything not to name names but I'm not naming any names if anybody reads advisories they'll figure it out so these are just some fields and some guidance that we have for making advisories and of course there's some more here one of the big ones is proof concept code I think it's a really important sort of thing to prove your case you know when you when you disclose a vulnerability to a vendor a lot of times you get pushed back like there's not even a real issue here and of course on the metasploit side of things it is a little bit hard to argue with a shell but you don't necessarily have to give somebody a shell as your proof of concept it could be whatever you choose it could be a sequence of steps that they manage to follow to verify it it could be a kind of level of maturity proof of concept code crash proof of concepts but do remember like the more sort of detailed information you can learn and extract and provide to them the easier it's going to be for them to deal with that information so one of the reasons that we have these particular details here about advisory contents is that a lot of researchers especially beginning researchers don't necessarily know what information to provide or you might submit a bug report to a bug bounty and it comes back and says you're not providing enough information or you're not communicating clearly so those fields that we have listed and you know are on the slides and will be on an updated version of this slide we encourage you to really look at those and consider seriously capturing all of that information there's some pros and cons that we came up with this basically just Steve and I kind of ranting on all the stuff we didn't like about various advisories you know we want people to do simpler simple stuff plain text is real easy it's very portable it has a very low attack surface so as opposed to say pdf yeah which is like a web browser basically and some people do like to do videos and we think that's kind of cool but I have a couple suggestions here one of the main ones being is you know respect the viewer of the videos you don't want to make your videos too long but you don't want to go too quickly either and there's a couple other considerations up there as well so you want to be mindful even of the format in which your advisory goes out so what to expect from vendors I already mentioned some of this stuff you can expect total cluelessness you can expect in some cases for people to threaten you with their legal teams I don't know why they do this I think they're confused but these are just a bunch of possibilities basically every most good companies these days especially the bigger ones they're very open to work with and actually amazingly even sometimes a new vendor that's never had to deal with these problems comes out actually understanding it quite easily and being very good to work with as well but one thing to keep in mind is that it's not like one size fits all all the time and every disclosure winds up being some kind of unique snowflake so you need to be able to be patient as mentioned before and also be able to be flexible keep an open mind so I think the first bullet like one time at iDefense we were trying to report this phone and I tried phone calls I tried email well on the other order of course tried emails and then phone calls and finally I got a response from a 30 guy there when I faxed them the advisory and what year was that it was probably 2007 so they were like oh this came out of the fax machine let's call them okay so where do we disclose publicly what we like to see is people to disclose publicly in places that are archived forever so that becomes mailing lists basically and these other things on the list like exploit db's and vulnerability databases those sites are great and we'll hope they'll live forever but in some cases in the past they have not lived forever and ultimately those sites generally are pulling from more public sites that are archived forever anyway so this is just our preference if you want to put your stuff on your blog to gain readership that's great but maybe also throw a note up on one of these lists and get the traffic to your blog as well so common mistakes to avoid number one is don't test other people's stuff unless they let you I think there was one case with facebook bug bounty program where a guy like owned a hell out of them basically and then tried to do a bug bounty with them and that I don't think worked out really well for that guy we have here on this slide in the next one we aren't going to go into details especially because we're running low on time but there are a lot of common mistakes that many researchers make including ourselves actually and so why don't we move ahead if you guys want to hear some more stories just hit us up we have some real meat to the at the tail end of this presentation okay so this is one of the one of the main ones here this is just sort of our own model first crack at this as far as we know nobody else has really sort of started on this but we're trying to outline different kinds of stages of growth that you might encounter in your career or in your technical abilities when you're doing vulnerability research so when you're just starting out you're starting at more or less a newbie phase you might have you might know just like one crude technique that you apply against software and maybe you make a lot of different mistakes at some point once you become more familiar with things you may reach what we call a work horse stage where you know a number of different kinds of basic vulnerability types you can generally find multiple issues and then you start to really more or less get a hang of certain kind of processes then when you start to move more towards the subject matter expert these are the these are the times when you're really looking for the newest and latest techniques that other people develop or you might you might go and extend those techniques that have already been reported and you're more or less pretty much treated or assumed as being reliable by people like me and so on and at some point you start to really have a clear sense of like what your own disclosure policy is and you can be relied on to find a lot of things and to write a really good solid quality report and finally upon reaching the elite stage which not everyone needs to reach the elite stage and not everyone has to and not everyone wants to and that's perfectly cool because there are way more vulnerabilities out there than there are vulnerability researchers to handle them but what I think of a little bit of as an elite researcher is you discover or invent new ability classes or you develop entirely new techniques or you know you give conference talks and so on you really sort of push the industry forward and that can take a number of years you're not just going to read a book or look at a couple of blog posts and be elite tomorrow or next year so that's something to keep in mind as well yeah it takes time for sure I'll read this again that's got my name on it anyway I think we got only a minute or something like that so one thing about the notion of growth is that there is a book by Malcolm Gladwell called Outliers which basically says it takes around 10,000 hours of focused effective practice in order to reach a level of expertise and so you can do the math and it can be questionable but that's something really to keep in mind but there are a couple different ways that you could progress a little bit further if you want I think we have like three slides left do you want to do this one or do you want me to do it it's got your name on it I'll do it if you want are you getting tired no we're getting an X from the goons get out of here guys you talk too much so we just wanted to leave on this note about feelings and fails we mentioned we are not perfect I believe there's this thing this is what I call the human condition which basically means you always make mistakes and have to deal with things that your body tells you and such but feelings are definitely a part of that so remember feelings are okay there are a number of times when you're doing some deep research and you get very discouraged you might want to find something easy to do you may want to go at it in a different way and maybe just go to the beach for a while another one of these things is you feel like you really got to keep going and you want to work really hard because you're addicted to something but it's been like 17 hours that you've been working on it it might be a good time to sleep so yeah feelings are okay and failures are okay too here we go thank you everyone and we are available to talk to anybody afterwards we're going to go down to escalator somewhere there


duo  multiples of people were not supposed to know who I was and what was the reason.  several people were easily taught how to be skilled and how to call personal. ʈʈ ʈa ʈa ㅑʀㅆ quiere história ʈʈ ʈa ʈa ʈa ʈa ʈa ʈa ʈa ʈa ʈa ʈa ʈa ʈa ʈa ʈawama. ʈa ʈa ʈa ʈa, ʈa ʈa ʐia ʈa mʈ op提ʈtʈaʈaʈstabe. ʈa ʈa ʈa ʈa ʈʈaʈnaaʈʈʈʈʈʈʈ stream theından gikoʔ funding, ᵍ sponsors


share what might have been part of your address to the team right before the champagne celebration after you went to the. Just, you know, we can say we're the best team and the best division this year, and it wasn't easy. We all know that, everyone in that room knows that. We took everyone's punches, we had some low moments, but tonight is to be celebrated. It's not easy going through the American League East and survive and be the team, you know, especially when there's other teams in the division like the team we're playing right now. You know, so I think we all understand that, you know, this is step one and we want to win a championship. That's our goal. But tonight deserves to be celebrated, especially all the things you face in the course of the season and especially the adverse times. Tonight's a night now to pause and appreciate one another. Aaron, winning the division was the goal you talked about in spring training, the first goal. What was the feeling there as far as you're counting down outs and just saying we're almost there? Yeah, I mean, I'm never comfortable. You know, even in some of the leads, we got huge leads, I'm always, you know. So yeah, every out is, excuse me, big and, you know, it's a little bit of a culmination of a lot of work. New members to the staff, you know, thinking back to the, you know, winner where you have the meetings, preparing, going through the lockout, not having contact with players, you know, this is a lot of hard work and a lot gets poured into this. And we're now six, seven months into this, including spring training. And it's kind of that exhale and excitement because again, I don't think at the start, not necessarily everyone had us pegged for this. Judge saw 33 pitches tonight. Just what did you think of the discipline he had? It was great. You know, I thought he got some pitches to hit too. He's fouling off some pitches, but his ability to lay off some pitches is close and out of the zone, you know, especially at the top of the order.  I mean, set the table. I mean, it's just, it's awesome to see the discipline that he's showing and just the consistency of it bats, you know, while he's going through this with all the attention around it. So I keep saying he'll get there, he'll get it, but to see him rack up quality at bat after quality at bat is impressive. Does that also see in all those pitches? Does that help the other guys to see them too? If he's leading off, you know? I don't think there's any question. You know, I mean, we talk about that all the time.  You know, when you're having those level of the bats, I don't think there's any question that it over time is gonna be a good thing for the team and for the group.  Dutch said he wouldn't ask for a day off until you guys clinch. So does he play tomorrow? I'm gonna go in there and start to sort that out. We'll see. Yeah. Because of the different format this year and you guys could be, you know, have a lot of time off. Yeah. Is that change of thinking how you might go in for the last week? Yeah, a little bit. I mean, now we'll start to be strategic with, you know, obviously, I think we're gonna have five days off in between the last game and the start of the division series. So, you know, we'll probably take a day off, mostly as a group after that last day and then probably have some former shape of some inner squad, live BP simulated type stuff for at least a couple of those days and just kind of map it out as we can.  Eight.  Those will be all things that we kind of talk about here and try to be strategic and strike that wanting to be really competitive with also wanting to be smart and preserve guys.


Welcome to the World Summit on the Information Society 2017. My guest is Thomas Lamanoskas, Group Director for Public Policy at Vion. Hello. Thank you, Charles. Hello. And thank you very much for joining us. Now, Vion is an international communication and technology company with more than 235 million customers. Your mission is to enhance the world's connectivity. So tell us, why is connectivity important for the world's development? Thank you, Charles. And as it was recognized in 2013, in 2005, where it was the summit already, connectivity by itself is a tool. It's not a final goal. So connectivity brings us and connects us to the world, where we can find better jobs, better business opportunities, education, information, access to health here, access to our finance, and all these other things that makes our life fulfilled, both economically and socially. So that is why it's important, not by itself. And I think that's what we see in this kind of new world, where this digitalization is transforming it. We see it very clearly where we see the skills now of the automation, we reduce jobs and all that. Sometimes people say, maybe we should be cautious, not go so far in a connectivity, not go so far in digitalization. But here, and again, that's why, demonstrates why connectivity and digitalization are important. Here, it's a very important message there, where some studies show that in the countries where digitalization is advanced, only 6% of jobs are vulnerable to automation, whereas in the countries which are much less advanced in terms of connectivity and digitalization, around 70% are at that risk. So that clearly shows that connectivity and digitalization is important as a tool for us to progress in this new world and to thrive and survive in it. Now, despite all the efforts of the technology community and company like yours, nearly half the world remains unconnected, so what are the main barriers to ensure that every human being has access to the online world? We still think a lot can be done on the policy side, and I would say so, because as a public policy person, but I think if we have public policies right, we can go much, much further. So in terms of infrastructure development, I think some of the things we see that would help investments go much further is certain things like, for example, taxation policies. In some countries, we see that around 35% of taxation are sector-specific. That means 35% are taken from ICT sector, but not from other sectors, and that means it makes so much more expensive to roll out infrastructure. Monetary policies, where in some countries, current exchange regime doesn't allow investors to actually freely invest and money into their countries. As well as, I think embracing by more policy makers and regulators, more efficient methods of infrastructure investments, such as network sharing and so-called passive and active sharing, that allows that every dollar put in infrastructure go so much further, and so easier to connect people in remote communities, where naturally it's much more expensive to connect. But at the same time, it's important to look at the supply side, because I think infrastructure is fine, but we cannot just build roads if there will be no cars or no destinations to go to. So I don't think that's why it's a bit of a chicken and egg situation. But as yesterday was also mentioned, there is much more connectivity, which is many more people than they actually connected. So statistics show that around 84% of people are within the coverage of mobile broadband, but 53%, as you rightly said, they're not connected. So how we can do, how can we do more to make sure that already those people who can connect, would connect, and that would naturally generate this economic cycle that allow more and more people to connect as well. So connectivity is about collaboration, isn't it? And is that why you're here at WISIs? No, exactly. Connectivity is about bringing different sides together. So bringing infrastructure side together with a usage side. As I said, these all opportunities that connectivity can open, it is true. And that's, again, I emphasize, but at the same time, they don't come by default automatically. This they come because someone creates relevant content and services. So that they come because someone finds the sustainable business models to provide those digital services. And they come because not only someone from some global center decides and masterminds some great services, but because people on the ground who know the needs of the people, of their people and their communities develop them. I think one of the challenge here, and I think that's again about collaboration here, that we need to encourage this more collaboration, but not only on the global level, but also on the national level. And the local level. Currently, if we see on this demand side, so 95% of the app economy is captured by 10 countries in the world. So how do we make, so how do we move further? How do we enable all the other countries, some communities in other countries, not just to be passive beneficiaries, not just receivers of these benefits, but active contributors. And through that way, also opening them to these digital opportunities that connectivity can offer. Thomas Lamanarskas, thank you very much. Thank you very much.