I need more of that, a flask later. All right, folks, thank you for attending. This is Getting a Migraine. I'm Jonathan, or JBO for short. This is Mike or Michael, however you wanna call him. And Anurag was unable to come to DEF CON, but still he took an extremely important part in this research. We're all Microsoft researchers, which is kind of weird because like Microsoft usually do Windows stuff and not Apple stuff. However, we work for Microsoft Defender. And the reason why it's called Microsoft Defender not Windows Defenders because it runs on platforms that are not Windows. And we do Mac, Android, iOS, Linux, those kind of stuff. So this is kind of like a motivation that we have. This is not a Defender talk, but I mean just shows you where we're coming from. The outline for today is talking about some of the Mac OS mechanism, specifically SIP and entitlements. We're going to talk about how we found a vulnerability by mistake, kinda. How we automated our exploit by means of reverse engineering. We'll have a demo. We'll talk about the implications of what we've done. We'll talk about Apple's fix and basically fix this, I would say. And then we'll have some conclusions. So let's get to it. Some background. SIP or rootless is a mechanism in Mac OS if you're just unfamiliar with Mac OS completely. It's a mechanism that limits the capabilities of the super user of root. If you're coming from a traditional POSIX world, root can do anything and that's not true anymore. In Mac OS, even if you're running as root, you can't do a bunch of stuff, including in user land, which is kind of foreign to a lot of folks. What it does is to leverage something called the Apple Sandbox in order to protect the entire platform. By default, you can't turn it off without going into Recovery OS. I won't talk about Recovery OS too much today, but generally what it means is that you have to click, like to hit a bunch of keys and then reboot. Like you have to have physical machine, you have to solve the hellraiser puzzle and stuff like that. So you're not supposed to turn it off at all and several organizations, including Microsoft, like in our own internal network, actually monitor and make sure that SIP is always on as a defense in depth mechanism. And we'd like to think of it just mentally, that's not accurately accurate at all from a technical perspective, that it's kind of like AC Linux on Linux or protected processes on Windows in the fact that you're admin, but you don't own the machine anymore to some extent. And SIP limits certain actions of their root user and all users really to, as the name suggests, to protect the integrity of the system. So that means there are certain files you can't override, there are kernel operations you can't do and so on. And we'll be talking about that more thoroughly in the next couple of slides. SIP itself internally is controlled by NVRAM variables. There's actually more than one, but we're going to talk about CSR Active Config on Intel platform. And in the Apple silicone that runs on ARM, they have a thing called LP-SIP-0 that is read from the booted device tree. And interestingly enough, because Mac OS, like X and U specifically, the kernel is kind of like half open source or like 90% open source, you can find all the flags in the source code under csr.h and I name here just a few. It's not a complete list at all, but you can again kind of imagine what SIP does.  You can't write to certain file system locations which we'll be talking about today. You can't get task ports for a given PID. A task port is basically like open process in Windows or P-Trace in Linux. You can't really debug processes for what it's worth. You can't do kernel debugging. You can't do retrace. You can't write NVRAM variables for obvious reasons. If you could, you can just change like SIP altogether. And there are other flags here as well, but the issue that I want to talk about is the fact that it has a certain domino effect. What I mean by that is that if you have, let's say an NVRAM variable override, a way to bypass the NVRAM variable right protection by SIP, you can bypass SIP. Obviously, you can just overwrite like the bit flag in CSR active config.  And in fact, any part of SIP you can bypass actually like topples the entire domino of SIP. So that's important to note. Generally, if you're able to bypass one mitigation, you're able to bypass all of them in theory and also not in theory. A bit about SIP and file system restrictions. If you're a developer or malware author or whatever it is, that's probably the first thing that you'd notice when you come across SIP is the fact that you can't really write to certain paths in the system because SIP actually prevents you from doing that. Again, even if you're running as root. So SIP really prevents you from modifying any files that either have a specific extended attribute called com-apple-rootless or are configured in some file system library like sandbox.rootless.conf. And that's like a naughty list, I guess, for files that basically a set of files that can't be overwritten. But there are also allow lists for these restrictions that override like the rootless.conf and they're out of scope for this talk, but they're well documented. Obviously, the rootless.conf file is SIP protected by itself.  And also you can't really add or delete the com-apple-rootless extended attribute for the same reason, right? If you could add that extended attribute you can create like an undelatable malware, for instance. If you could remove that, you could bypass SIP because you could modify files that are protected by SIP. So just keep that in mind. And generally, like Apple has released a modification to the LS command. If you do ls-lo, that's a capital O, an actual O, not a zero, then all the files that say restricted are basically files or directories or simlinks or whatever they are that basically can't be modified. So that's an example of a restricted file, for instance. So that's obvious, right? I mean, we have SIP. We basically have a different kind of layer in the system, if you will. And how does the thing work and how do we enforce things in macOS? Some background about entitlements, really. In the macOS ecosystem, processes are signed, right? And they're granted something called entitlements which are basically capabilities. So because entitlements are part of the signature of the process, you can't forge them easily at least unless you have like a gazillion PS4s and you connect them and I don't know, find the collision or something. And you can think of entitlements of a way to make a process stronger, right? Again, in terms of capabilities. And the interesting part is that Apple has private entitlements that they will only grant to their own processes. And because they sign everything, they won't sign your processes with those entitlements. These are known as private entitlements. And that essentially creates like a barrier or a capability-based security layer, if you will, because if you're able to only run, to only get certain capabilities or entitlements, but not the other type of entitlements, and Apple are the only ones who can have that entitlements and the entitlements are being translated into capabilities by the OS, it basically means that Apple has the keys to the kingdom. They control your box. You don't control your box as much anymore because you can't get those capabilities. You can't get those entitlements. And that's something very interesting, especially for us, again, Microsoft Defender, because we don't have those capabilities either, right? And you can think about the implications which we will be talking about later. For instance, because we can't, we can't let's say modify the com-apple rootless extender attribute, if there is a file that is naughty and have that extender attributes, we're kind of screwed because we can't really delete that file. That's just an example. And there are two very interesting entitlements for SIP file system restrictions. There are actually more, like SIP is very rich, as you can see, but there are the two very interesting entitlements that I wanna talk about today, which are com-apple rootless install, and that basically bypasses all the SIP file system checks. So if you have a process that has that entitlement, which is a private entitlement, it can basically bypass all SIP file system checks, which is really powerful. And then you have something even greater, which is called com-apple rootless install heritable, which inherits to all child processes the com-apple rootless install, which means that all of the child processes are going to be able to bypass SIP file system enforcements on their own. Now, if you think about the motivation why do these things even exist? Like why punching a hole through that security layer? Then you have to think about the name com-apple rootless install. These things are used for installations and updates. For instance, when Apple wants to do an OS update, they basically have to write to certain files, then those files might be protected, and that's the way they do it. They have, let's say, an updater, that updater has those capabilities, and then it's able to do whatever overwrite arbitrary files and so on. So that's the motivation that Apple has to even having those entitlements, if that makes sense. So this was all just background. Now, while performing routine malware hunting, we started noticing a process named drop-SIP. And the name itself is suggestive, as you can think. And that seems to be prevalent on many devices.  We were very excited. And a closer inspection revealed it's an Apple sign binary that runs under the system migration private framework directory, and actually drops capabilities that bypass SIP file system checks with an API called CSOps. That's a private API that I will be discussing next slide. And mentally, we think that it should have been called drop-SIP, but I mean, that's what it is. And it's not malware. That's the entire file, actually, so reversing it is not even like a thing. As you can see here, basically what it does, that's the main function for all means and purposes. What it does is really call CSOps with 12. 12 is CSOps clear installer, which I took the liberty of pasting like the screenshot from the X and U source code, which basically removes, as you can see, this is a not, the tilde is a not flag binary not flag that removes the CS installer and other stuff as well. CS installer is the com Apple rootless install and CS exec inherit SIP is the rootless install heritable entitlement, by the way. So basically what it does is to remove the installation capabilities or SIP bypassing capabilities of a process. And if it's successful in doing so, it will basically run exec VE on the command line and arguments that it got. And that's basically some mean that they have to run a file without having those SIP bypassing capabilities. So that's just a motivation. And we were kind of convinced that drop SIP is legitimate. It's not malware, it's owned by Apple. And basically what it does is to drop those SIP bypassing capabilities. So this is kind of where our journey begin. We noticed that the drop SIP process is a child process of system migration D, which is a demon, that's why it has a D in the end of its name. And it has the com-apple-rootless install heritable entitlement, which if you remember from three slides ago, basically inherits SIP bypassing capabilities to all its child processes. And that explains why drop SIP assumed that it has SIP bypassing capabilities to begin with. I hope that makes sense. And after concluding that drop SIP is legitimate, we basically decided to take a closer look at what other child processes system migration D has. Because it's a very powerful process. It's able to give all its child processes SIP bypassing capabilities just for fun. It depends on your definition of fun. And then this is a screenshot just showing the entitlements of this system migration D process. You can use code sign, that's the binary that Apple gives you to basically look at the signature. And that includes the entitlements. And as you can see, the set of entitlements, there are three entitlements that start with com-apple-rootless, and the second one is com-apple-rootless install heritable. I won't talk about the other two, but they're really interesting if you're into that kind of stuff. Now, this is again, not a talk about Microsoft and EDR and everything, but any EDR that it's worth, it's sold, you can basically ask questions. Like, hey, in my organization, give me all the processes that have so and so, right? All the processes that have command line blah and so on. So what we started doing is that, okay, we're Microsoft, we have an EDR, we have tons of data, even from macOS. And then we were like, okay, let's start hunting with EDR data. And that's really good, because you have a lot of different environments, a lot of different customers and whatnot. And also internally in Microsoft, we do have folks that run macOS as well, and they also report all the command lines and whatnot internally, right? So we were like, okay, give us a dear EDR, please give us all the child processes of system migration D. And we immediately noticed two interesting child processes, which are Bash and Pearl, right? These are just command lines. Again, these are child processes of system migration D, so they're very powerful in terms of see bypassing capabilities. Why are those child processes interesting? Well, Bash and Pearl are interesting because they're interpreters. And interpreters are affected by many things, especially environment variable poisonings. Now, in macOS, I won't talk too much about the security mechanisms in macOS, but injection in macOS is a real drag. It's not like Windows or Linux when you can just run open process or Ptrace. And especially Bash and Pearl are still baked into macOS and therefore Apple signed and actually are protected by SIP. So you can't get a task port to those processes and you can't inject into them. And that's why we needed a different method of injecting to those processes. And because they're interpreters, they're more convenient than others. Now, remember, these are processes that are child processes of system migration D, so they always does not enforce SIP file system policy checks on them, which is really helpful. And then I wanna talk about environment variables. So we found two noteworthy environment variables. These are just man pages of Bash and Pearl. For Bash, you have environment variable bash underscore env. And apparently, if you have that environment variable, you can just like write arbitrary commands there and like Bash will just run them, which is good and bad. For Pearl, it's not really complicated, but you have Pearl five opt for options and you can also make Pearl five opt by modifying it. You can make it run arbitrary Pearl commands, which is really great and bad at the same time. Now, this is like I'm doing a side track here. This is a general rent about environment variables. Shell shock happened in 2014. If you guys remember how bad it was, basically it was like a vulnerability in Bash that was related to the parsing of environment variables and how they're eventually executing. But it's like we haven't learned a lot about the dangers of environment variables. And it just took like the last couple of years, even this year, like in different platforms really, they're not all Mac OS. Like if you look at it like the first one from 2023 is in Linux, right? In the pseudo binary, in the suite binary, no less, which took years to really make secure and apparently not enough. And you have other cases here as well, including Linux, including Mac OS, and other things as well. And that doesn't even start scratching the surface because you have other issues that do not normally get CVEs, like UAC bypasses on Windows and you can override like the wind there directory or cloud credentials that are in environment variables and API keys like literally everywhere. So environment variables are very dangerous and should be taken care of. And this is where I turn over to Mike to talk about our exploitation strategy.  This is a fantastic tradition. I just wanted to say that. So thank you for that. Yeah, so like J.B.O. was talking about, the environment variables were the main thing that we went after environment variable poisoning. So we went about trying to validate this as a vulnerability that can be exploited by setting Bashi and V and Perl 5 opt. And from there we put the payload in the appropriate folder and it was just simply a matter of getting system migration D to run one of these two interpreters, which is a lot easier said than done. It felt like every single combination I tried didn't result in Bash or Perl being run at the end, which was frustrating, but eventually was able to find the right combination of just creating like a single dummy user and from there was able to get Perl to run. And that was like 4 a.m. I was talking to New Rug who's in India and he came up with Perl 5 opt exploit. And yeah, when I finally got to execute and validate that we got SIP bypass, it was an amazing feeling. And I was also like quite sleep deprived. So yeah, while we did prove that this is something that can be exploited, it wasn't perfect because we required like a physical USB drive to be attached to the device. Migration as you may or may not know will log off all users. Requires manual clicking through all the windows. And then of course it reboots at the end. So that's not ideal for a remote attacker. So this was a demo that we sent to Apple. I'm gonna spare you while I'm not gonna make you watch a 15 minute migration demo of me namoring on about the migration process, but I just wanna show a snapshot here where at the end we're writing over the Apple Kex exclude file. So if you don't know, Apple kicked everyone out of the kernel, but there were certain kernel modules that Apple still allowed to be loaded and executed. And all that's kept in a sit protected file called Apple Kex exclude list. So in the demo, I overwrote that file with just the word migraine as like a proof of concept to show that we can control these sit protected areas. Okay, so like I said, the initial demo and everything was pretty ugly. So the main challenges here were to obviously get rid of all log off, get rid of reboot. We wanted to automate clicking. So there's no user interaction needed. Obviously we don't wanna have a USB of physical access for this exploit to run. So we began reversing and trying to figure out how we can make that happen. So there's a top down approach and a bottom up top down was a very disgusting approach where we tried patching the system binaries themselves to get the behavior we want. Obviously naturally I took the disgusting approach top down bottom up was the more cleaner approach where we took the private framework that the migration Damon uses. And we tried to bend it to our will and call the functionality we need within that private framework directly with our own binary. Spoiler, neither of these approaches worked and we'll get into why that is. Okay, so migration like with most things in Mac is not a simple system, it's complex and it's multiple different processes that communicate through XPC and IPC to make this happen. We were trying to find some kind of documentation on migration and how it all works and of course Apple being Apple didn't offer us any of that documentation and we couldn't find anyone who's went out doing this and reversing it. So as far as we could tell we're the first ones to do it. So let's get into the high level of migration. So these blue squares, these are the key processes involved with migration. You can kind of think of like migration as like a chain and each link in the chain calls into the next and the previous link validates that the previous caller has the appropriate private entitlement. So an example being migration assistant will call into MBCS administration but then MBCS administration before it goes any further will validate that it has com.apple.private.MBCS administration entitlement and system administration calls in the setup assistant and setup assistant calls into the Damon all of which validate the previous caller. Okay, so migration assistant, this is the first link in the proverbial chain and this is what you all are used to using if you've ever done migration. It's essentially the setup wizard for migration where you can port a PC or Mac devices you can do it over hardware you can do it over network, all different options. So with the top down approach I wanted to patch this out because the most annoying thing we had to deal with was the log out issue. So if you're interested the function that migration assistant uses is something called SACLO start log out with options. Patching that out unfortunately didn't work for multiple reasons and I'll show you why. Oh yeah, so this was a little funny thing that JBO noticed. So when you go from PC to a Mac book Apple was kind enough to represent the PC as having a blue screen of death. So well played Apple, good job. Okay, so the next link. Migration assistant will then talk with MBCS administration and like I mentioned it'll make sure the XPC caller has the appropriate entitlement the MBCS administration entitlement.  So you might be wondering how does migration work? Like how is a user able to interact with a GUI even though all the users are logged out and the answer to that is there's a hidden user called MBCS setup user. MBCS administration will essentially use this user for the entire process so you're not actually running as your user you're running as this hidden user. There's no password so we tried logging into it and thought we could get away with doing some fun trickery but those darn entitlements got us again. Okay so setup assistant. So the MBCS administration process will eventually call into setup assistant. Setup assistant is like a generic utility used by a lot of different things in the system. Some examples would be like system upgrade or accessibility wizard or of course migration and a whole lot of other things. And MBCS administration essentially will talk to setup assistant and it'll put it into the context of migration and eventually it'll transfer migration assistant into setup assistant context. So that's basically what's being called after a certain point instead of migration assistant. Of course when it does that it's validating that the entitlement is approved before it continues to do that. And then from there setup assistant will talk with the main HANCHO which is migration assistant or Damon, the migration Damon. And it does this with XBC and of course the system migration D will validate that the caller has the right entitlement. In this case it would be private.systemigration.damonclient. By the way setup assistant is like filled with entitlement so if you're looking for an interesting target I recommend going setup assistant and if not setup assistant in their folder there's other like just utility binaries that are ridiculously entitled. So just some homework to do. All right system migration D. So this was the bottom approach that bottom up approach that a new ROG took. When starting to reverse a system binary we recommend you start with the XPC handlers for like privilege escalation or MAC services. You can usually find those by opening up the associated P list shown here. And this is the migration Damon P list and there are six MAC services that we began looking at. So as we were looking at the migration Damon it was apparent that this private framework was being utilized pretty much everywhere and two key components for this were the object the migration object that uses along with the start listener for connections function which is how it handles like a callback for valid XPC requests. Okay so when it does receive a valid migration request system migration D will create a file in the location library slash system migration slash queue and in there is all the associated metadata for the migration request itself and it stores them at that location. So we thought okay well we'll just create a file there and we can bypass log out by just putting a migration valid migration file there. Of course it's SIP protected so we couldn't do that only system migration D can modify create or delete files at that location. So anyone who has done migration can tell you that there is at least one reboot not multiple reboots and the way the system can keep track of what the current migration request is is it takes the one of the specified files and it renames it to in-dash flight at the same location that's SIP protected. All right so why did our approaches fail? Well like I mentioned several times the intelligence for the big thing so anytime we tried talking directly with MB system administration or the Damon itself we couldn't get very far because they validate that the caller has the appropriate private entitlement. Also on newer Apple silicon devices while there are workarounds for this if you try to like patch a system binary the kernel will prevent it from running which is the code for that shown right here. So yeah we basically couldn't directly access system migration D and yeah. So even though we were dejected and our two approaches failed we started thinking maybe there's a way that we can cut out migration assistant and just talk with setup assistant directly and we had an in-house tool that we created that will log all events in the system even through multiple reboots and store them as like a buffer of files if you will and we noticed that when setup assistant was executed it passed a flag called dash minibuddy yes. So we thought well maybe there's other flags that we can pass setup assistant directly to create the migration behavior so we can prevent the log out to begin with. So as we looked into the reversing the setup assistant we did realize there were other parameters being used and we'll show that right here. So this is the main handler for minibuddy yes. So if you call setup assistant directly it's basically just a generic accessibility wizard that comes up and while none of these parameters gave us migration it was really encouraging though because some of them would have like completely different behaviors and different windows so we figured okay there might be something to this passing setup assistant parameter to get this to run migration. So while the main function didn't have what we wanted we looked further and we found a function called use debug parameters and in there is a parameter it handles called dash mbdbug and when we use that we were super excited to see that the old familiar migration windows were up and yeah we were excited because that means no log out needed. If you bypass migration assistant you bypass logging out. So yeah while it was great to see migration it still was a bit of a problem with automating because there were so many frivolous windows and extra things that made it difficult to use AppleScript to click through. So we found that if you use mbdbug in conjunction with ResumeBuddy yes it has a very lean migration process that we were able to pretty trivially automate with AppleScript and for people who don't know AppleScript can click through various windows as if a user's clicking it, kind of like auto it for windows and we were able to use that to automate going through the process without any user interaction. Okay so we got around the physical USB device by creating a small one gigabyte time machine backup on the set like a partition on the hard drive. You might be thinking one gigabyte doesn't sound small but anyone who's done time machine can tell you one gigabyte is really small for a time machine and from there it's the same steps we talked about where we're poising the environment variable setting the payload and we just run AppleScript and AppleScript will then run setup assistant with the appropriate parameters. All right so this is a demo we wanna show you guys so this is all real time. I just showed like the first five lines of the Apple kex exclude file and we're gonna run it and then at the end you'll see that the Apple kex exclude PLIS file which is SIP protected will be overwritten with the word migraine. All right so I'm just showing this as restricted which means it's SIP protected and we're calling OSA script which is AppleScript and from here it's calling setup assistant. This is the time machine backup we talked about the one gigabyte time machine backup and yeah it's going to find the right window and click through everything automatically. Kinda hard to tell but it basically deselected everything except for the dummy user I created and from here my exploit's gonna run it and then we kill the migration damon before it can reboot and as you can see migraine is now overwritten the Apple kex exclude and it is SIP protected. All right so you might be asking well who cares? Well SIP is like most security mitigations it's a double-edged sword and it's really great for protecting users from themselves and in deleting files they shouldn't delete to cause unrecoverable system states. It's also great for preventing kernel access or root kits but the problem is once an attacker gets past that layer they can do things that are extremely difficult to handle if you're like an AV product or an endpoint product. Some of these examples would be like you can create undelatable malware and folders that even if you have every entitlement that you need as a third party vendor you can't delete it. Obviously you can also get kernel extension execution like I talked about which is essentially is gonna be a root kit in this scenario and it can even bypass other security layers in macOS an example being like TCC so that means an attacker could listen on your microphone or watch your camera and you aren't notified and you have no idea. All right so I'm gonna hand this back over to JBO to talk about their fix and our attempts to forward it. All right thanks Mike. So we disclosed that bug to Apple back in May 2023 and you know there was a bit of like back and forth because it's not a very trivial exploit but eventually they kind of were able to reproduce it and they fixed it in their beta and we were asked to assess their fix, their beta version. So we were like okay let's like run the beta version and see what's up. And the first thing that we noticed was something that I like to call a brutal fix which I think that no other company in the world can do really which is basically saying something like oh no more global event variables and that's pretty amazing because they kill an entire like bug class just by doing that and as you can see here I basically try to use launch CTL set nv which is the proper way of setting an environment variable in launch D and basically telling me like we couldn't set the environment variable. Yeah and it's not permitted because of SIP. So now you know with all the things that SIP enforces it also now enforces the fact that we can't really touch environment variables which kind of like sucks and rocks at the same time. Note that this kind of enforcement happens at launch D it doesn't happen at launch CTL for obvious reasons otherwise anyone would be able to bypass it. So that's fix number one and then we were like okay we don't really need to affect all of the environment variables in the system we just need to affect system migration D which is like one process in the system. Yes it is a demon so it's a child process of launch D that's why setting the environment variables to launch D works to begin with but then can we do something else and launch demons in Mac OS are described as you could see earlier by a Pillis file that's the thing that Mike showed with all the different Mac services and those Pillis files kind of like have a way to define environment variables as well. Now the Pillis file for system migration D sits in the directory that is also SIP protected so you see how that won't work but we were like okay let's define a new launch demon and you know we don't have to put it in the Pillis file in a SIP protected directory and basically run the thing and it supports environment variables so that's good and I don't want to talk too much about it but basically there is a technology called launch constraints which makes sure that things that are supposed to run by Apple are only run by Apple in this case why it enforced us is that the Mac services that you guys saw those six Mac services are actually owned by a file that was launched from the SIP protected directory so launch constraints make sure that we can't hijack any system launch demons definitions ever which is another cool thing and pretty new in Mac OS that technology. In here you can see our attempts basically that's the Pillis file that we created this is a copy paste from the system the original system migration D the only difference is that I had to name it a bit different so now it's named com.jbo.apple and shouldn't really affect anything and the other part is this part where I basically try to set the environment variables specifically part of five opt now again this works but doesn't work really because the system migration D basically gets killed by the OS because of that thing so no dice and then the third attempt that we had really is that we were like okay can we do something that doesn't have environment variables because we noticed again those are Perl scripts and Perl scripts sometimes have dependencies can we find a strong dependency in the Perl scripts and as you can see in the right part whoops as you can see in the right part you have used strict and then use file base name those are basically imports just like imports in I don't know in Python or whatever and the file base name file is really translated to a directory in the file system and base name is going to be looked after basename.pm specifically which is the Perl module and Perl has dependencies and the lookup order and the lookup order you can print it with the at INC Perl variable as you can see here and this is the search order the interesting part is that the legitimate of base file base name sorry lives under system library Perl 5.30 which is C protected it's under slash system but then the first two directories at least are not C protected so we were like okay let's create slash library Perl 5.30 file base name.pm with arbitrary contents and trigger Perl without poising any environment variables and have it basically run our arbitrary commands which works and doesn't work it works but we were able to infect Perl but not for C bypassing purposes the reason for that is because Apple also had a tactical fix if you remember that drop SIP binary that we started the talk with well what Apple is now doing is basically dropping C bypassing capabilities before launching those scripts which is kind of like a tactical fix but it works because you can't do anything even if you affect Perl it doesn't have the C bypassing capabilities anymore so you can't use that for bypassing SIP it's a cool way to persist in then Perl intensive environment but not good for this exploit at least so that's the end really the vulnerabilities was assigned with CV 2023 32369 Apple has really made an amazing impression on us those are solid fixes and you know besides the tactical fix which is good like the other two fixes the launch constraints and the fact that there are no more environment variables is really interesting because these are solid fixes in terms that they kill entire bug classes they don't just kill our exploit they kill future exploit and as I hope you were able to see there are tons of exploits that rely on environment poisoning and stuff like that besides that Apple has granted a really nice bounty money which we donated to charity if you don't know that by the way and you get bounty from one of these big companies you can ask them to donate to charity and they will usually double that amount so donate to charity if you I mean if you're into that and we wish to thank Apple for everything here and it is our point of view that with Apple moving everything to user land and creating separate security layers as you could have seen with all the entitlements and stuff like that and they're basically killing kernel extensions and whatnot so you know there are like the peasants and Apple and in the OS at least and because they have the keys to the kingdom we believe that similar bypasses will basically shake the macOS ecosystem because again in this case we were lucky that we are the ones who found it but if you know there is some malware author that finds something like that they can create undilatable malware and stuff like that and no one will be able to do anything besides Apple which might be too late so I think that's pretty much it well thank you so much


My name's Alicia and I'm going to be doing a Chinese rhyme, but let's do the English version first and so this is one that my colleague and I just made up so it goes like this first we need our hands I have a pair of small tiny hands one last one one right one clap I have one small tiny mouth la la la la la loudly saying I have a pair of small tiny feet one left one right one jump jump jump so now let's do the Cantonese version so Karen can sing with me.  It's in Mandarin. Yeah, there's no Cantonese but next. So we can also do it in Mandarin so that's what's on your sheets. Yeah, so we'll have our hands again. I have a pair of small tiny hands one last one right one clap I have one small tiny mouth la la la la la loudly saying I have a pair of small tiny feet one last one right one jump so now let's do the Cantonese version.


Okay, so I think we're live now. This is the first Facebook live. I've done using Zoom here on my Facebook profile. I am so excited about today's conversation. I'm with my own career coach, Marty Namco. The first time that I encountered him was when he was being interviewed on our local Bay Area, San Francisco Bay Area NPR station. And he was talking about career work and he was bringing in some ethical views about it. And I thought, wow, this guy's different. And then I started listening to his radio show. He has a radio show on the other Bay Area NPR station, KALW. The radio show is called Work with Marty Namco and it has a podcast. It's on podcast as well. I highly recommend it. It's one of the more entertaining podcasts that I listened to. He talks mostly about career, the future of work, how people can find their life's calling or at least do work that is contributory to society and makes them happy. He even talks a bit about business and marketing because a lot of people's career, like mine, is about marketing our own brand. And so it's wide-ranging, but one of the things that he doesn't get to talk a lot about in that podcast is his political views because that show is really about work. So I think in today's hour, hopefully, we'll start touching on some of the political views that I've heard him talk about elsewhere or just a little bit on that show and I've always really enjoyed. It's outside of our typical liberal Bay Area echo chamber. So I think that's gonna be challenging for some of you, but I think it'll be thought-provoking at the very least. So let me say a little bit about Marty and then we'll go into the first topic. Marty is an extraordinary career coach. He has almost 30 years of experience doing career coaching. In that time, he's worked with about 5,000 clients. Is that right, Marty? And... 30 years of experience and there could be 30 years of bad experience in a row. So... Well, I doubt it because I've experienced you myself and you are sharp and caring and I think you're right on with how you serve people. And one of the things I love about Marty's coaching is he's so ethical. I'm in the coaching world for almost 10 years and there's a lot of unethical behavior in the coaching and consulting industry. Marty is one of the ethical ones. He doesn't try to get his clients, and might I say addicted to him and going week after week for years and years and years. And I'm not saying that's necessarily a bad thing, but he is so ethical. He's saying, you know what? I'm gonna help you the very best I can even in just a few sessions and I want you to be empowered and be able to stand up on your own and do the best you can without having to hire me. But of course, it's actually helpful. He doesn't keep his clients away, but he actually, Marty, you told me this confirm. Marty turns away more clients than he accepts at this point because of how much word of mouth business he's getting. And I, well, here we are. And I'm promoting him without any kind of financial arrangement just because I believe in his work. So Marty, thanks for being here. I really appreciate you spending your time with us.  We'll see. Let's see what the audience says about this. So thank you for those who happen to be watching live. Really grateful to have you here. Those who are watching later, please do comment below. And along the way, it's so exciting for me when I see you comment on any reaction you have to what I'm saying or what Marty's saying. Please say, hey, I'd really like that comment when you said this, even a few words or I have a question about that. So the first question I have for you, Marty, that I think everyone will find interesting is I want to ask you about the future of work. Given that you're a career coach, you have counseled thousands of people in all walks of life and you don't only work with people in the Bay Area, you work with people all over the world from corporate leaders to nonprofit leaders to solopreneurs, schmucks like me. You've worked people of all levels in their career. And given that you've been interviewed so much about work and jobs, obviously society is going through a major restructuring of what work is. People don't usually stay with one company for decades now, like in the General Motors days. So let's start with that conversation. Where do you see work going? What do you see that us, that societies has to do to make work work for all of us? What do you see us individuals needing to do as well? So anything you'd like to address on that? In the recent years, I've been obsessed about this because I really do see the roboticization of work in part because of technological advances that are ever accelerating, but partly because the cost of hiring an American has grown so enormously. We all feel good and viscerally about the idea of Obamacare and paid family leave and rights and wrongful termination and workers comp and Medicare and Medi-Cal, all of which cost the employer a fortune.  And so there's going to be an end of work except for stars and except for super menial work. So what individual can do is one of two things. If you are not entrepreneurial, I really do think the last bastion of good work is likely to be in the government because while they already are starting to part-time and temp jobs, still most government jobs, and remember it's millions of layers, city government, county government, regional government, state government, federal government, they hire lots of people, most of them full-time with benefits, lots of holidays, vacation days, et cetera. So if you're not entrepreneurial, that would seem to me a wise thing. Get yourself in. Once you're in, you get preference for other jobs. Get in.  Things like, for example, a flower cart next to a busy train or bus station in installing or removing real estate, four by fours from for sale and homes that are for sale because those can't be off-shored and I know that those are not statusy, but ultimately status is the enemy of contentment. We have a lot of people who are fancy doctors and lawyers who are miserable, sitting in their 4,000 square feet, drinking their third vodka or getting high on their ninth joint. So those two things, simple, scalable, ethical entrepreneurship, a chain of those flower carts in the light, or a government job if you're not entrepreneurial. Interesting. Okay, so I wanna touch on what you said earlier about, and maybe I'm paraphrasing this too much, but corporate America, business, large businesses, see people, their employees' labor as a cost to be minimized. Not as, you know, the people in my audience are all good-hearted people. We believe that businesses can change the world and blood lift people's lives. That's not how the vast majority of businesses think, right? Like, I think, okay, when I give a job to somebody, I am giving them the dignity of work. I'm helping them practice their skills.  We're building something bigger than any one person can do alone. But corporate America is trying to say, let's get rid of as many people as possible so that we can have more profit because people, they have sick days. They're lazy sometimes. So talk about that a little bit. It's becoming, there's always been a tension between your employer and employee, which is why the rise of the union movement. But it's accelerated because never before has the media replaced its role as a reporter of the full range of responsibly held positions to really an advocate that really says that corporations suck. And that has radicalized a large part of the population. Even people who would normally be considered moderate or conservative, they say, you know what? And essentially my employer is my enemy. I'm gonna, they would fire me as soon as they could. And so I'm gonna give them the least I can get away with. And so there is this increased tension between employer and employee. Not to mention the cost, as I said, of hiring. Though there are sort of many factors that are resulting in not only corporations, but even government and nonprofits hiring temps in part time as possible. I mean, universities are the ultimate hypocrites in this regard. In their classes, they talk endlessly about the importance of treating labor fairly. And then yet, and even the most valued people on their, who the university's employee, the faculty, they hire as many as possible, part time and temp. So they don't have to pay them a lot. So they don't have to give them all those benefits. And they have less risk of awful terminations. So there's a tremendous tension in all sectors, not just corporations, but the reason the tension is so great in corporations is that the media has absolutely inflamed the public about viewing corporations as monsters. Oh, interesting, okay. So how do you feel about the movement for socially responsible businesses? So you might be familiar with this organization called Beacore, which is trying to bring a, you know, and I have somebody who's watching Nikki Paava, hi Nikki, who is a lot more knowledgeable about the Beacore than me. So Nikki, you can share anything. But it's the idea of bringing higher values and almost institutionalizing higher values in business, not seeing employees as a cost center to be eliminated, but as, well, as important assets to be developed. What are your thoughts on that? Well, I mean, certainly every employer who wants to make more profit views good employees as people to be developed. That's why they offer so much training. I was a consultant to a number of corporations, including the Gap and Genentech, and they pay me damn good money to go and do training for their employees. And it's in the bottom line interest. But when they feel that employees are really just, you know, kind of just mailing it in and just doing the minimum. And there really is this kind of resentment of management.  You know, there's a trend is that employers are given additional reason to not want to treat employees with kid gloves even more than before. In regard to social responsibility, corporations have been because of so much media attention. Every corporation I'm aware of has a corporate responsibility or foundation. They're, you know, all kinds of efforts to try to make, you know, to be as responsible as they can. And I certainly can understand that from an emotional and human standpoint, but where there is always another side and the other side is this. I am a huge fan of voluntary charity. I went all the teachers and social workers and others invest in, say, Apple computer because they want to have money for their retirement or to send their kids to college. When the media pressures Apple into giving more to the foundation and investing more, that's less, that is forced charity. If I wanna give to charity, that's my choice and it's great. But if I invest in Apple, if the media is forcing the corporation to do more for the poor or do more for social responsibility, that's an additional forced charity. So I'm not so convinced that ultimately, if we really care about freedom, if we really care about giving people choices and really being pro-choice, I'm not convinced that the hammer that the media is imposing on companies to devote evermore to quote social responsibility ultimately is wise. Okay, this is really good. I'm glad you're getting into this because you are already sharing a view that probably a lot of the people in my audience haven't thought through and maybe disagree with on the surface, which is, in other words, we good-hearted liberal people believe that there should be more redistribution of wealth. Corporations are so rich, they could afford to make less profit for their shareholders and spend more of that money giving to their foundations, doing employee wellness programs, et cetera, et cetera. So I, first of all, I wanna say that having listened to your radio show for years now, you are not a Republican Tea Party conservative, no way. I mean, you're here in the Bay Area just by virtue of osmosis, you've gotten a lot of the liberal values in you. But I would say you are a, and you probably would say yourself, you're a moderate and you are a, you like to question what everyone seems to accept without having thought through. And so I think you equally criticize, you're equally good at critiquing the left as the right. And I think your critique makes us think of our positions more thoughtfully. So, okay, I also have been coming to see that really if we can create in society, truly what we all want, like you said, is more freedom for every soul to have the, dare I say, to muster the love within themselves to give that love to others rather than saying, no, you have to give your love to this person or corporation, you have to give your benefits to such and such. Of course, corporations are not people, even though there's some laws that say otherwise. So say more about this redistribution. So, okay, I'll give you one example where maybe you and I would agree, is there's a movement towards universal basic income these days. Those of you who don't know, it's basic income. If you go search the hashtag basic income, you'll see lots of articles about this. But the idea is instead of the welfare state with all these different benefit organizations and having to evaluate people on whether they're worth giving welfare to, why don't we just cut all that bureaucracy and give a certain amount of money to every citizen. That would actually raise everyone above, hopefully above the poverty line. And some people might say, I'm gonna work a lot less because I've got basic income and I could do more creative activities in the world. But so isn't that redistribution as well and why would that be different? So actually, I'm presupposing something. What are your thoughts on redistribution of wealth versus meritocracy? I think that's a common sort of dichotomy or debate. I think a guaranteed annual income is obviously an example of redistribution, but it's one I do support, especially in the era of fewer and fewer jobs. So the perfectly well-intentioned people who work hard or bright or whatever, there's simply not gonna be enough work to go around. And we're all, everybody, conservatives and liberals have a humanitarian side. Nobody wants people starving in the streets or living in poor houses like in the Kenzian times. So I think that it is perfectly appropriate to have a guaranteed income and I'm in favor of it. That said, redistribution in general is I am very much against. There's already tremendous redistribution that goes on. 68% of the federal income tax is paid by the top 10% of earners already. We could tax the top 10% at 100% and it wouldn't make things equal. The question is also, is the world better off when things are more equal or where we do in fact redistribute more oil either a free market or redistribute more resources to the greatest, most to the more capable who are more likely to cure our diseases, to be wise leaders, to build bridges that don't collapse. And an example of that is gifted in the last 30 or the last 50 years have been defined by redistribution. Even in Democrats or Republicans, even when Bush favored no child left behind, it was all about redistributing education dollars and resources to the least among us, to the lowest achievers. In the 50s, the dominant model was we wanna put extra resources to the extended discretionary to our best and brightest, which at that point was simply to compete with the Soviets which I am kind of a world citizen, I don't really care about that part particularly, but it certainly resulted in greater sciences, greater medical discoveries, et cetera. Well now, since the great society in 1965, Lyndon Johnson following up Kennedy's original vision for that, and even through, as I said, no child left behind which is the Bush initiative, there has been a tremendous redistribution of the poor gifted program, programs for the intellectually gifted have been eviscerated or eliminated or expanded to be called gifted and talented and includes everybody including dancers. And so the result is that, and it's unbelievable how little money goes to the gifted and bright. You watch, you go to the elementary schools especially. We now have mixed ability classes so that literally developmentally disabled children behave behaviorally violent kids and gifted kids are all the same class who come to America as well as native speakers of English which creates an untenable situation for the teachers and the teachers because they have been so brainwashed into the idea of redistribution, spend most of the time on the low achieving kids. So the achievement gap remains as wide as ever and yet what we're doing is stultifying the bright. The only reason that it hasn't gotten even wider is we've taken away resources from the bright. So the bright, if you go into any classroom today in the elementary schools and most public schools, you're going to see bright kids stultified and bore tremendous waste of potential. And yet despite all the redistributed efforts in the low achievers, the achievement gap is as wide as ever. So I am not except for the humane basic redistribution of a guaranteed basic income, I am much more in favor of rewarding merit and that includes being against reverse discrimination which is in the real world, how affirmative action often not always plays up. Wow, okay. So there's a lot to unpack here and I think what you've said is probably in disagreement with some of the people's views that are watching this. So let me ask you some devil's advocate questions. So you're not saying that the untalented, the development disabled, they should be just not in the education system. No, I'm saying that. No, you're not. The proportion and amounts of the resources and they get, why they get 15 times as much as the gifted kids, which is crazy. Yeah. The title for the country. Okay, so this is interesting. So yeah, I could see, I mean, just even in a, let's say there's a household of three kids and as a parent, obviously, the one who is developmentally or behaviorally challenged is gonna get most of the attention because they're causing all the ruckus around the house. Whereas the one who is quiet and does what he or she is supposed to do is kind of left alone a lot more of the time. That's the sort of macro scale. That's what's happening is what you're saying. The problem with that of course is that the, there is this assumption that liberals have that, oh, they'll do just fine. The gifted kids will do just fine. Right. So many bright and just even average and above average and gifted people who don't succeed. We all know brilliant failures and the gap between what their potential is. And if we gave them the personal attention, the mentorship, the after-school programs or whatever, they could achieve so much more, but we put almost all our resources into the lowest achievers. Every in the battlefield, every medic knows that there is a limited amount of resources and they're trained to devote as many resources possible not to those who are the sickest because they may well die and all those drugs and blood transfusions or whatever may not do any good, but to those with the greatest potential to profit. We don't think twice about it in that context, but in the more macro context of society, we're fine about spending 15 times as much on the lowest achievers who have demonstrated all the way from preschool through high school, very limited ability to learn. And we nor, really nor, especially at the elementary school, gifted kids in creating, we create brilliant failures. Wow. Fascinating. I, yeah, I can see your point and I think it's worth continued discussion and Laura mentioned special ed in this state is cut first. No, that's a lie. Actually, I think Laura is in New Mexico, maybe? Anyway. I'm sure where she is. Yeah. I happen to teach, I've taught special ed in the graduate schools. Public law 94-142 mandates that the one thing that cannot be cut is special ed. That's why I jumped on that. Special ed cannot be cut no matter what happens to average kids or gifted kids that my wife's the superintendent of schools in Napa County and she's our just special ed in addition. That's the one thing that cannot be cut and there's a wonderful example of that forced redistribution. Wow, interesting, interesting. So one thing I've heard you say, I want to ask you about anything similar to this idea is you are a global citizen and you say, you know, I don't care. I want to care as much about the child in Malawi as a child in urban Oakland, right? Absolutely. They are the same of equal worth, right? Absolutely. Yeah, I agree with you on a cosmic level that they are of equal worth and they're both absolutely worth raising and helping. But I'll challenge you here and share some of my less known views on this is that I think we can do the most good for the people that are just below us in terms of their experience, their resources. So for example, I think I can help a fellow, you know, solopreneur, coach, person who has just a few years less experience. I agree. I could help that person a lot more than I could help that child in Malawi or wherever because I can't even, I can barely relate to that child. And so my thought is this, what if we all helped the person that was just before us and it wouldn't that chain help everyone, you know, help everyone, period in a much more relevant way? Well, there is a here conflating to things. Absolutely, I agree with part of it, which is, of course we're best in a position to help the person who's just a notch below us. Whether we're a math tutor, if we're a math genius we're not going to do a good job of teaching somebody who can't add because we can't begin to relate to that person.  Absolutely. But that's very different than even somebody who lived next door to me, you know, the kid in the multi-generational poor who is born to parents who are, let's just say not great parents in a bad neighborhood who are not very bright, who have poor impulse control and all the rest of it. There are, despite the fact that they have the privilege of an American education while where there are differences in truth class size in Oakland is smaller than in Arunda. People don't realize it because the attendance, the daily attendance of people who show up actually in class in Oakland is much lower. People don't realize that. That's what counts as what the real body's in the classroom, not the phony statistics get reported. We're in Malawi, the poor kid has never been even exposed. You know, I think, you know, I'm a particular, when you talk about people who are not away, the people of India and China have for thousands of years had a culture that valued education. So they both selected in terms of who they're romantic who they would have children with. Intelligence was an important characteristic they chose from in terms of a husband or wife. So over a thousand years you have these people with a culture and the genetic pool of the values, intelligence and achievement. But because of the poverty, for example, in India or Pakistan or Bangladesh, they get limited exposure. So, but they have those values and they have those genetics. So if I give a dice, I go, am I flying to Bangladesh? But a dollar that I donate to those people in Bangladesh may do more good. That's right, that's true. The ones who've had all the privileges already here in America. That's right. So let us invest in what is likely to yield, as I said, with the medic, the person with the greatest potential to profit, not with the greatest deficit who has already had an amazing amount of resources. Do you know that since the Great Society, the United States has spent 22 trillion dollars to try to close the achievement gap. From Head Start, which by the way, the Obama administration study found does not work to today's $7 billion over the last eight years that President Obama allocated specifically for the quote, lowest performing schools that are Washington Post headline this month said made no difference. It's been 22 trillion dollars trying to help the least among us. Let us help those who've not had 22 trillion dollars spent, but who have a culture and a genetics and everything else, countries that have tremendous potential. Look how in such a short amount of time, China and India have absolutely become our serious competitors for the world's jobs. Interesting, okay. So actually I have two things that I wanna address. One is it makes me think about outsourcing. I mean, even in my own business, okay. So in my business, I always advocate for people to go for my clients and my audience. I always say, hey, you know what? If you need some graphic design done, if you need some website work done, you know, yes, you could hire someone else in the Bay Area or in the United States or in Canada, wherever you are and you would pay that person $30 an hour or $50 an hour and they would do that work for you or there's somebody in Bangladesh, Pakistan, India who would be grateful for $5 an hour and they would do just as good, maybe even better work for you than someone next door to you. And of course, a lot of people are up in arms saying, George, how can you, with someone with liberal and good heart of values issue, how can you be in favor of outsourcing? Now we're sending all our jobs to overseas. Okay, so my opinion, of course, is that listen, the $5 or $30, $50, $500 that I spend on that freelancer in India is gonna make tremendous benefit for their family way more benefit than that same $500 I spend with my next door neighbor here in the Bay Area. Yes, it's not as good for my San Francisco economy. I agree about that. It's not good for the local economy and there's a multiplier effect and all that stuff supposedly, but the multiplier effect in India, I'm a global citizen as well. I think all of us should, why are we so nationalistic? And no, Americans, well, this is what Donald Trump says. America first. Very much against Trump that way. Isn't it racist and isn't it jingoistic and false patriotism, say America first? Why do I not have as much solidarity with someone in England, China as I have someone in Oakland? It's racist or elitist for me or it's jingoistic of me to do that. We want to invest our money where it's gonna make the biggest difference. I wanna tell you a brief story. As part of my charity work, I wanted to create a webinar, not a webinar, kind of a video on how to help teachers in today's mixed ability classes, like I talked about where everybody's gonna say all kinds of kids in the same class, how can they meet the needs of gifted kids in that mixed ability class? So, I looked into having, you know when I was whiteboard explainer videos? Yes. I had that done. In America, they wanted 2,024, six minutes, 2,02500. I went to a website that is, like I don't remember it was 99 designs or whatever. I found a little company in the Philippines who did it for 900. Yes. I would not have done that. I would have run in a cheap video with me just talking face to camera if it was $2,000. But because I could get it for 900, I ended up doing a much higher quality video which has gotten 30,000 views, which is a lot for some of them, which I'm not a marketer, as well as you know. 30,000 views, so I helped a hell of a lot more people. So not only is it racist to focus on America first, you actually will do a bigger difference with your charity or your business if you look at the world as your potential pool for who to hire, not just America first. Yes, yes. Yeah, I totally agree with you. So, okay, so there's a lot of directions we can go with this. I wanna ask you about, actually, let me just take a moment. Does anyone, oh, there is a question here in the comments. So anyone have any questions from Marty? I mean, I have lots of questions, but please feel free to comment. One of the questions from Laura is, what about socially conscious corporations like Patagonia, REI, those kinds of folks? Do you wanna say a few words about that? Do you, are you in support of that? Do you think we should advocate more for that? Yeah. That's what I'm saying, I said it earlier. It's forced charity. Right, right, right. So the Patagonia, if they take 20% of their money and they give it to the poor, that's forcing me to donate to their charity of choice and therefore reducing my, not only in my forced charity, because I'm investing in them, but I'm forced to invest in the charities they feel are appropriate. If in fact, let's say a company like Cypress Semiconductor, that does none of that. They're one of the few that doesn't, how was the foundation? If I then have my, let's say, and I'm going because 20% of my money is not given away, which is what Patagonia does, that money will get either reinvested in the company to create better and new products, which benefits everybody, or returns me to the shareholder. And now I can either, I can afford a lot of things, I'm not poor, but if I'm like most teachers and social workers or whatever who invest in their mutual fund or whatever, I now have money to afford to send my kid to college. I have money to give to charity. I have money to afford Medicaid. Let's get real. Many people in this country, because they are struggling, have to cut their medication in half so they can make it go further. If I am forced, if I'm a Patagonia employee, and if I'm a Patagonia employee, I'm gonna get stock options. If I'm forced to you, Patagonia gives money to whatever charity is the platypus is in Patagonia. No, I may not be able to afford my medication, or I have to maybe decide between tomatoes and more toilet paper when we, or at minimum, I'm not able to save as well. So I have more respect for the company that doesn't force me into charity, as long as they're ethical.  I would never invest a penny in tobacco industry under any circumstances. But I'd rather invest in a company that is, I'm investing in a company, not forced charity. So I have more respect for a company that doesn't do a lot of charity. And I do my own.  Yeah, now this is really good. And I'm glad you're saying these things because it's again, it's outside the echo chamber of what most of the people watching this typically. People are shocked that 59% of college educated women voted for Donald Trump. They're not what retardates. Why? Because we in the echo chamber don't begin to understand that their autocracy is a viable position. Whereas for a million years, now 50 years now, from John Kennedy to Lyndon Johnson all the way through to Barack Obama and would be Hillary, all she cared about is redistribution to the poor, minorities, women, the disabled. And the 59% of college women outside of the echo chamber said, you know, I don't think that redistributing to the least among us is a formula for enabling America to succeed. Or to look the other way when illegal immigrants come here who are disproportionately the poorest and those who are not doing well in Mexico or they wouldn't come here. Yeah. All that 59% of college women, even though he was disgusting and groping women saying bad things about women, they said, you know, it's more important that we vote for meritocracy than more redistribution to the least among us.    Okay, so just to be clear, you're not a fan of Donald Trump. I'm not and I didn't vote for him. Yeah, but certain positions that he has that may be wise at this point in history, that is a replacement of this extreme redistribution. As I said, you know, 68% pay 10, the top 10% pays to spend the income and all of them school resources and job training resources, everything, you know, all the incentives go to the have nots. There may be a time that his foundational belief in meritocracy may be a better thing for America, but I hate his hubris.   I hate, I'm very pro-choice. I'm very pro-gay marriage. Very anti-materialism. So I hate a lot about Donald Trump, but there are two core foundational beliefs, both his belief in meritocracy over redistribution and we have become a paper tiger. In the last 50 years, since Lyndon Johnson, we are a kumbaya, peacenik foreign policy and the world laughs at us because we draw lines in the sand that we don't take seriously. Oh, I'm backing away from that. And it may be at this point in time that we need temporarily somebody who's going to restore a sense that America's not a paper tiger. So I have mostly again feeling about Donald Trump. I think he's got to lose a loose cannon, but I do have to, I do support two of his foundational beliefs. Okay, this is really good. And I just, to be clear about those of you who don't know Marty, you know, you are one of the more ethical, again, I can say ethical coaches that I've ever met. In your own business, you don't charge an arm and a leg. I mean, with your 30 years of experience, you could be charging $2,000 an hour or $1,000 an hour.  And Marty, can I mention how much you charge right now? It's on your website. Yeah, I mean, Marty charges $175 an hour right now.  And Marty is incredible, excellent in our career coaching sessions. And so you're not about, you're totally not about the money when you're serving people. And so that's, yeah. I'm interrupted, I'm sorry. Sure, sure, sure. Of course. Listen to the word 175 an hour. It actually sounds like a lot, but the people think about people are making $10 an hour and $15 an hour. Of course, no career counselor can work 60 hours a week. All I really care about is they make a solid middle class income. I make about a hundred thousand a year, that's all. And that's all I need to live because I live frugally. I don't believe in materials. And there's my lefty side. I buy very little, I don't, I'm not a consumerist. So the hourly rate sounds like a lot, but my total income is about a hundred thousand, which is simply kind of a solid middle class living. I don't, and that's my liberal side. I really find it offensive when people have three yachts and two mansions and a comfy home here and all that.  And I've given, I'm giving 100% of my half of the community property to charity. I'm worth a lot because I've not been materialistic and I've invested wisely.  I'm leaving all of my money to charity because I believe that is ultimately wise and that is super liberal. But I have very conservative views about social programs because my PhD is actually in evaluation of innovation. And all those attempts to close the achievement gap have not worked, including Head Start as I said earlier, even the Obama administration's meta-evaluation of Head Start shows that it does not work despite the fortunes that have been spent of our tax dollars. Thank you for that. And I, well, the reason I mentioned the people who charge $1,000 an hour and more is that, no, 170 fights, the hourly rate is completely, to be evaluated, it's completely needs to be put in context of what other people of similar, in the profession is charging and you're charging way less than someone of your experience could. But okay, so back to meritocracy, achievement gap, et cetera. What do you say to the person that is, okay, the word privilege, the word privilege is huge. I mean, I have some friends of mine whom I love who are all day long, they're saying. Male privilege, white male privilege. Yes, white privilege, male privilege, Bayard privilege, name it, you name it. So what are your thoughts on that? Privilege is usually earned. Sure, the people who talk about privilege all the time talk about people born with a silver spoon in their mouth. Yes, so it's a multi-generational privilege is what usually what they bring up. But it's not at random. Okay.  You're Asian, and I think about all the Asians that came to this country, dirt poor, they were visibly different from a white person as are the African-American. And yet in one generation, despite Japanese and German camps, due by being Vietnamese, both people, they did not predominantly go on welfare. They did not join gangs predominantly. They did not choose school and fool around and twerk on the tables like so many other kids do.  And they said, no business beneath them. They ran Korean grocery stores. They worked in factories in the bad neighborhoods. And in one or two generations, I am proud to look at an Indian American, a Chinese American, a Japanese American, a Korean American and look at what amazing stories. Now, of course, there's exceptions. That's not privilege. That's earned. Whatever privilege exists is earned. And that's true of the Jews, who despite being my parents are both Holocaust survivors, had no education, no money, nothing but the scars of Holocaust tortures. And my father ended up working in a factory all day and all night at minimum wage and saved up and didn't spend and didn't get drunk and learned English because he knew if he didn't learn good English, he was always gonna starve. And he ended up running a successful small business. My father was father to me and I went to the cheapest public college, but now I am proud of it and they can be proud of it. Privilege is generally earned and it offends me that we denigrate people's intelligence, hard work, the lay of gratification because it sounds good to talk about intersectionalism and privilege. No, most privilege is earned. Even the kid born in a silver spoon. That father, I was just watching a special on Cornelius Vanderbilt. Now he did some disgusting unethical things and I'll never support that.  Most people who I know are worth millions work 60, 70, 80 hours a week. They don't go home at five o'clock and say, I got my government job checks coming in. They don't sleep worrying about their workers, about their products, even though science of America, it's not privilege implied that it comes at random. Most of them work their asses for it and if their children benefited, just like we don't degrade a parent for taking care of their children and providing good opportunity for their kid, we should not denigrate people who are successful as quote privilege because most of them earned it. Wow. You know, I think about my wife's family. When she was growing up, her dad was a cook on a, some kind of industrial shipping boat. And for years, while my wife grew up and my wife's mom was working from home manufacturing something from a factory. I don't remember what it was, some typical consumer item. And my wife was placed in a cardboard box to play by herself for her childhood. I mean, they didn't have time to like play with her and all that stuff. And now my wife, she has a, she grew up poor with very little, besides just whatever in the public, New York city, public education. And now she has a graduate degree. She is so smart. She has her own business. She's successful.  I grew up with a dad who was a CEO. He had hundreds of employees at one point international business. Was he given that or did he earn? No, he earned it. He earned it. His father was so poor. They were so poor that when my dad grew up, he wore the socks until most of it, most of the bottom was worn out. He only had the tube part of the socks. And he would still wear that to school because he was embarrassed. He didn't have other socks to wear. So my dad grew up dirt poor and he became a CEO and was highly successful, right?  You have had, quote, advantages because your father killed himself to go from poverty. When liberals call it privilege, it dismisses all of that hard work your father did. That's true, that's true. Now, so then how do you feel society should treat the kid who grows up in the, you know, in tough neighborhoods with very little? In the end, whatever benefits accrue from reverse discrimination are outweighed by the lack of merit. That gifted child, rich or poor of any race who gets nothing because we feel sorry for the least among us. In the end, society is worse.  We have worse pride, we have worse service and there was anger. Part of the anger in the society is the sense that this hardworking, smart person gets nothing or gets his parents' taxes taken to give to those who are screw-ups in class and carry knives and are violent and don't learn well and whatever. Ultimately, that's unfair, merit. And I don't care what your race is, I wanna be really clear. If anything, I'm more excited and happy when it's an African-American who wants merit. I'm happy about that. Ultimately, nothing is a pure go to a pure bed but society is better. Net, net, net when we use merit, when we eliminate barriers, people of all races but we don't redistribute to them thereby taking from those with the greatest potential to profit to give to people who don't. Your father, I guarantee, was not the beneficiary of any of the redistribution. Neither was my father. My father really, really did. He worked 12 hours a day, seven days a week his whole life and never complained, never went to Holocaust and Memorances, never burned down cities when a judgment and when a police officer shot a Jew, he didn't burn down any cities. Not to mention that in every one of those cases in Baltimore and in Ferguson and in Oakland, in every case a significantly minority jury found the cops 100% of the time not guilty but they rushed to judgment. We say we value the Constitution innocent until proven guilty but we look the other way in the media fans of flames of people burning down cities in advance of even the court of law. That is what's behind the misguided privilege mindset and the media fanning the flames of it. Interesting. Okay, so I wanna ask you one more question about this and then I'm gonna turn to the skill of time effectiveness because I think that's part of the whole merit question but okay, so we just the new Secretary of Education, Betsy DeVos. Right. Okay. Let's see, look, people aren't even aware of their biases. Betsy DeVos. Right. You know, that predisposes everybody to, that's not what an interviewer should be doing. Okay. What is your view on it? Because you have a graduate degree in education so you've- The evaluation of education in Berkeley, I'm not saying it to brag other than that I know what I'm talking about. I actually taught in the graduate school of education in Berkeley as well as Cal State East Bay. We have had an experiment in union, teachers union driven public education with multiple layers of amazing layers of bureaucracy. I know this better than anybody because my wife's superintendent of schools. There is a city and a county and a state and something called SELPA, Special Education Regional Districts and the federal government and foundations.  She's much nicer than I am. I'm good, but I'm not nice. She is a very nice and smart person and is reasonably assertive. And she's a Marionette. There is very little that even she can do because there are so many of these, she's governed under so many often contradictory and overwhelming rules governing what one can do in education. And the unions do dominate what teachers, it's the only field where after two years you have your job for life unless you rape a child for being metaphorical. That cannot be in children's interests. So it was real and the achievement gap is as wide as ever and give the kids, you talk to any even bright kids in high schools or schools, even bright kids say they're bored. Everybody's bored. And you look at the new common core curriculum, part of some of the crowning achievement of public education, stuff that nobody cares about and needs to know, talk about elitist. Why does anybody who can't balance the checkbook need to know quadratic equations? Why does somebody who can't negotiate a conflict with somebody need to know the cause of the Peloponnesian War? And so Betsy DeVos, who really is against public education, I'm betting. Oh yeah. We're going to have more charter schools, more innovation and encourage the private sector. Is it possible that after 70 years or longer of a dominance of this extraordinary expenses, by the way, you don't realize this, do you know that the United States spends number one or number two in the world per capita on education? Yet our achievement is near the bottom of among all industrial nations and anybody who wants the statistics email me and I'll send them to you. We spend the most and get the least. So is it not? Actually, maybe you can email me, I'll put it in the comments of this video. And so is it not possible that a Betsy DeVos who you left that and who America or the media left that is exactly what we need, somebody who's going to be not going to be in the hip pocket of the unions, not be in the hip pocket of this enormous bureaucracy that has absolutely paralyzed our educational system. Interesting. And I'll have to say, you are both good and nice in our coaching sessions, but you are definitely much more objective and direct on interviews. So I appreciate that. Okay. So let's shift over to time effect and this is one of the topics that you enjoy talking about. And this is regarding, this has to do with merit, building merit as individuals. So let's start with that. Cause I also love to talk about time management as well, but let's start with any thoughts you have on that. You know, as a counselor, I have to pick my spots, where can I make the biggest difference with my clients? And while intelligence is not purely genetic, it's certainly partly genetic. And everybody, every study has shown that intelligence is extremely difficult to change. Intelligence is defined, yes by IQ, but it's reasoning skills, the ability to remember a lot, the ability to add it to an analyzed synthesizer. It's very difficult to teach. They have all these critical thinking courses and they really, it's very difficult. So I don't try to, I can't really improve somebody's intelligence, but time effectiveness, which is extremely important, is not probably genetic. Thinking, it comes down to, it's a very simple concept in its, in explanation, but it has profound implications for everything. Not, it's having a little voice on your shoulder all the time, asking yourself, is this the most effective use of my time? Am I getting the best benefit in is the world getting the most benefit for this use of my time? And that affects everything from whether how thoroughly, for example, I chose to not prepare at all for this interview, zero. Because I said, you know, the difference between my obsessively preparing and winging it is too small to justify the effort. If it was on NPR, I probably would spend more time. I make a judgment as to where it's worth putting more and less, and of course it applies to whether I'm going to be watching TV, going to a ballgame, going to my second cousins, third wedding in Topeka, or seeing another client, or working with you, or writing another article. Thinking about what is the most time effective way to do a given task and which tasks are most time effective in terms of what matters to yourself, to your family, and to society. Having that mindset is not genetic. That's something we can all get better at. We unconsciously very often piss away time. Instead, by being more conscious, is this time effective?  There are times I just want to play with my doggy. Well, and that's effective because you need to rest, you know, you need a change of pace. That's actually an effective thing to, well, some people call it self care, right? Yes, but what's interesting is you can do, I work, I'm 66, I'll be 67 years old in June. And I work 80 hours a week to this day, and you can see I have as much energy now. And I've been working my gas off all day because I'm doing a concert tonight, a show, and I've been moving furniture and doing everything. And you can see I have as much energy as a 20 year old. Because I am doing, firstly, I'm grateful for the luck of being in good health. Yes, I try to take care of myself, but some of it's beyond your control. There are plenty of people who aren't overweight and who don't smoke or get sick. So I'm grateful. That's beyond my control. You have some good genetics, yeah. I have good genetics. But I also, because I'm doing what I'm naturally good at, thinking on my feet is easy for me. It's like breathing. I'm no more stressed talking with you than playing with my dog. But if you asked me to do artwork, I'd be totally stressed because I can't draw anything. You asked me to fix anything. I'd get totally stressed. So the key is not so much work-life balance. The key is to be, when time effectiveness is doing work you're naturally good at or are very practiced at, then it's not stressful. I can play the piano all day and I'll never be stressed. But I bet you if I asked you to go play the piano, you'd probably be very stressed because it's not something that, for me it's like breathing, playing the piano. Yeah, yeah. So that's the key to talk. That's one of the keys is to get to know yourself and what activities come naturally for you that also contributes to others. And to do each task, like writing comes easily to me, but I make a secondary decision to say, how much work am I going to do in writing this article? I could be very obsessive and review the literature and it took me a minute, but I choose to do the real minimum, usually just a smart Google search and then review my own thoughts. So my typical psychology today article, and I've written now over 3,000, including a thousand days in a row, is written in three hours. I'd rather have written 3,000 articles that don't require so much research than 50 articles that require a ton. And that's what time effect this is about. So it's not just choosing the tasks you do well, but thinking about what the most, where do you get the most bang per minute? Yeah, exactly. Now, some people might argue with you in saying, spending more time writing one amazing article could actually have more impact and reach than writing 10 articles that are, you know, so-so, but. That's wrong because even if I put in a ton of effort and say I took a year to write the definitive article on one of my graphinations, it would only in my judgment be 10 or 20% better. It wouldn't make that much more different. There's a quick point of diminishing returns. After a few hours, you've reached what's called an asymptote in calculus. It's an inflection point, it's a point of diminishing returns. So the time, the actual terms of making a bigger difference, I'll make more of a difference in recognizing the asymptote, recognizing that point of diminishing returns and stopping there rather than being compulsive. It's like if you're hiring somebody to do, to frame a door for you in your house, the guy who's gonna focus on down to the hundreds of an inch, it is gonna take you three, could take him three weeks to do it and charge you three times as much and he's fixing far fewer doors. Whereas if he only went to a 16th of an inch, you could do 20 doors. So it's important to know where you, the point of diminishing returns comes. Yeah, and one more thing, and I wanna give you a chance to say anything else too, but what do you say to the person who says, well, yeah, I would love to be more effective to my time, but I procrastinate because I'm scared of this task or I'm for whatever reason that something inside me is keeping me from being effective, from doing that effective thing that I know I should do. If it comes from fear, there are two kinds of fear, there's rational fear and irrational fear. So yeah, I'd be afraid, for example, of playing for the Golden State Warriors. I'd be like, yes, kick, you're right, right? So that's a realistic fear and I'd honor that procrastination. But sometimes there is a fear that's because, let's say I was not an experienced public speaker, maybe that fear is appropriate and I need to practice more or I need to not script it so much so I can be more natural like I'm being with you or maybe the fear is irrational and I need to fight through the fear. It's different, procrastination is a symptom, it's not the disease, it's like a headache.  Or sometimes you just need to drink some water. You just water, dehydrate it, exactly. So treat the procrastination as a symptom and then decide should you forget that task, should you get trained to do the task or is it a realistic fear you shouldn't do it? Treat it as a symptom. I'm effective, but watch, you know, and one more thing about that. People who are entitled and procrastinate too much tend to feel like everything has to be pleasurable and I also think that's a liberal view. You have to get comfortable being uncomfortable. It is more comfortable and more pleasant for me to play with my dog or eat or have fun with my wife than to do my taxes.  Yeah, me too. But I don't even think about procrastinating. It's not an issue. I am not, my job is not be happy all the time. My job is to be responsible.  And if I'm doing generally work that I'm pretty good at, I'm gonna be reasonably content. And I do do things like doing this performance tonight at my one man show. That's fun for me. But if it's insisted I'd be happy or if it's comfortable all the time, I'll procrastinate too much. So you must get comfortable being uncomfortable. Yeah, so I wanna ask you one question but I also wanna see if you wanna say anything else before we close. One question is, okay, as a career coach, would you say to yourself, Marty, since you love doing this one man show, why don't you put your efforts into making that your living? Because statistically the chances of making a living is too small. There's millions of people who wanna be creatives and artists and musicians and poets and actors and jugglers and all the rest of it. And be paid and be paid for it. Exactly.  But most people end up eating ramen and cat food. We see on the Oprah show somebody comes on and she's been or he's, but see, I was successful and became a star. You can too, follow your passion. Do what you love and the money will follow. But in the reality is for everyone who appears on Oprah, there are 10,000 you don't. Oh yeah. Following your passion as a hobby, you know, I love music and I love performing, but I'm a realist. I believe in the Bill Gates model. He made money where money was to be made in software. And then he's immunized every kid in Africa with his money. That's how you do your charity. That's what you do for fun. You don't, you make money where money is being made as long as it's effort. And I have to say, it's not like Bill Gates hated software. He had some natural inclination and interest in it. But it wasn't, it wasn't something he would do if money were no issue. Exactly. Okay. This is really good. Yeah. Is there anything else you want to say before we close this session? Two things. One is any dear listener, I know I'm difficult to listen to. One of my many weaknesses are way too intense, as well as my views being so counter to the Bay Area culture. So I thank you, any of you who have managed to listen and maybe even with an open mind a bit, you know, nobody changes radically from an interview, but even if you've carefully considered I'm honored that you did that. And then the second thing is completely optional. I've mentioned a number of things about the piano. It'd be kind of an odd way to end. Would you like me to play something on the piano to end this? Oh, please. That would be fun. Thank you. I didn't even...  I brought my, I'm sorry. I just brought my keyboard downstairs for the concert in my office. Maybe next time you could do that. Grace us with that. That would be fun. That'd be a very appropriate Facebook live thing. I wanna say as we close that, yeah, you know, this interview was not what, I mean, I didn't know what to expect to be honest. I knew that we were gonna get into some controversial issues. But I bet that a lot of people listening, they probably were like, whoa, you know, I'm hearing things that I disagree with and that I don't think, you know, I don't even know this guy. I will tell you, if you're still here, I encourage you to go and listen to Marty's podcast. Go on iTunes or Android or where you search for work with Marty Namco. Check out his podcast. It's one of the more fun and interesting podcasts that I've listened to. And I've listened to over a hundred podcasts by this point, different ones, different shows. And the other thing is if you prefer to read, go and check out his blog on psychology today. I'll be sure to put that in the comments. And if you're interested in getting a great career coach, Marty turns away more people than he accepts. But if you would be open to coaching you, take it because it's been very beneficial to me already. And so I wanna thank you for that, Marty. If you don't wanna say you can email me, that's what I do is you email me, tell me a little about your situation. And then I'll either see you might offer your appointment times or I'll refer you to an appropriate colleague. My email address is mnemco, Amazon Mary, and is a Nancy, E-M is in Mary, K-O at Comcast.net. The other thing is if you're a reader, I mean, I'm almost, I feel embarrassed to make people listen to a whole radio show. I have published over 3,000 articles and I picked out the 66 best book called The Best of Marty Nemco and it's cheap. I really, again, I priced it dirt cheap. So go to Amazon, look at The Best of Marty Nemco, get the second edition. It's just out this like last month. That way you can get the best of me for like 12 bucks. That's awesome. Appreciate it. Okay, there you go. Thank you. Thank you so much, Marty. And I don't know, if I can bring you back, I will and we could talk about other things. And maybe some of the folks here have questions that you'd love Marty to address next time and please do comment and let us know. So thank you so much. They hated me too much.  Well, maybe next time we'll bring you back for some palatable topics about work or career or leadership or whatever. So we'll see. Food or something non-controversial. Food can't be controversial too. Oh, no, we would talk about something like who makes the best pizza or something. No, but then some people are gluten-free. Exactly. Well, I'm a local organic sustainable pizza that is made right, you know, vegan, of course. Yeah, that's awesome. Marty, thank you so much. And let me just stop the live stream and we'll just chat for a minute before we go. But thanks everyone.


Ladies and gentlemen, the President of the United States and Mrs. Reagan. This week you will go further south to the dynamic city of Atlanta, later north of Pittsburgh. Then you will also journey to America's heartland, the Midwest. A farm country for a first-hand look at American agriculture. And the state of California. American innovations in energy and electronics. Sir, it's comforting to know that no matter what changes technology brings to our way of living, the good will between we will accept this week aside to be with us as a friend. During your visit to Washington, Nancy and I look forward to the evening of our personal relationship with you and Madden Midrub. Ladies and gentlemen, two anniversaries for my visit. This one of the heads of Versailles and Paris in this case, in the history of the people, is only of the destiny and ours. On top of that, the history of the country, because it was not for objective, the people were not enough, which sometimes leaves the place of uncertainty. To return to our country, it would be good if you would like, the mission is also to introduce you to the citizens of the United States, with the determination of a new world, that will bring the projects to life, towards France and constantly, that will bring the original contribution. The relations between America are not only, I will say, a few years ago, to create aggressive relations with the world. The major participation in 1984, that of the European secretary of relations between the West and the West. On this day, the firmament and the firmament are the orientations of the past. Organized around this fundamental notion, which is called the balance of effort with the West. Because the effort, independent, is over the hand, in the measure of the average. It wants to open up the discussion with everyone, and above all, it wants to weigh on international financial systems. That's it. And the peace of life, Nora. Yes, they have another to say, it depends on us. Without it, Nora, I'm done. And our habit, a little chance to stay... What is called destiny. And our destiny is indeed a common destiny. And so, I think it is natural that my first thoughts should go to the... America. First of all, the United States. Also said, in the United States, the United States, the United States, the United States. The mind is not yours, and it is not yours. This is a no-shut-down pressure. This is a no-question. The United States on several... a few seconds of intense fear. Keep a secret. Do not try to keep somebody. The French press is ready to take down what they know is said. There are some of these forms, the Lafayette men wore, when they were helping us with our revolutionary wisdom. I don't understand. I don't understand these elements. When I explain it, people are so afraid to think that when they understand the case, not even on the floor, they will be able to understand the elements.  Hello, sir. Yes. Hello, sir. Hello, sir. No sir, sir. Hello, sir. Hello, sir. Hello. Sir, wait. Huh? Yeah. No. Sir. No, no.