We are here for the talk Wheel of Fortune, analyzing embedded OS number generators with Joss Wetzels and Alia Basi. Short introduction, they're both researchers. They work with distributed and embedded systems groups at the University of Twente. Joss Wetzels is hardening systems and hands-on teacher for offensive security. Alia Basi comes as a... So, welcome to the session for the lecture. Hardware. Wheel of Fortune is the head of vulnerability analysis and penetration testing group and we are happy to give feedback on Twitter with the hashtag C3T. I'll just give over to both of them and we'll have a great talk and question back. We just got introduced and it's going on right away. Welcome everybody to our talk. Wheel of Fortune, analyzing embedded OS random number generators. We're looking at embedded OS random number generators. I'm Joss Wetzels as I already was introduced. I'm a researcher for embedded system security. I'm Alia Basi, a PhD student at distributed and embedded system security group. I'm from the University of Twente and I'm visiting researcher at chair of system security of Wilcombe University Bochum in Germany. So, we start with the introduction of the OS random number generators today and then we go over some embedded challenges and we're looking at a couple of embedded generally hard-earnings for random numbers for OS random number generators. We will have some case studies showing these challenges, how it's affecting all of the existing embedded OSs or real-time operating systems. And we're looking at the impact of these things on the OS system, which I'm supervising. And, yeah, so... Yeah, and now let's start. So, first of all, embedded systems are actually now distributed from consumer electronics to medical devices, critical infrastructures, military equipment or any other material. And besides that, there is a drive to connect these embedded systems. And the original devices were not designed to be connected to danger. And now there is a gap where vendors have to speak, right? And, well, this can cause problems. And as you can see, for example, for the random number generators which we specifically work, you can see there are really problems. For example, millions of embedded devices use the same hard-earnings. The problem is, among other things, that many devices use SSH and TLS keys that are programmed firmly. And, yeah. Well, what is randomness? I don't want to talk about it. I don't want to talk about randomness here, but it's generally a stream of bit if you cannot read the next bit. Generally, it's just because that we can't say what's next. And another side of it is like entropy. And the other side of it is entropy. And it is, in the end, in effect, a quantity or a measure for a coincidence or for information. And high entropy is high. And of course, why this is very important because actually random numbers are actually a fundamental part of other security ecosystems. So, for example, a lot of random numbers are a critical part of cryptographic systems. And they are actually being used for keys, non-sense, and other things. Stack-smashing protections. So, randomness is actually critical for other underlying systems which are based upon them. So, that might be a good idea. So how we can generate random numbers from physically? Like true random number, different systems and radioactive decays or random noises. You can generate hardware randomness that can be created by radioactivity and four registers, or as in tech-based devices, we can, for example, integrate CPUs or serve smart cards. But there are some downsides to randomness. For example, they are expensive, or very soft, or they've been recommended to try to move to the next target. That's why you can use those expensive hardware as you are using some very rich hardware. And there are like deterministic numbers which trade seeds into sequence of random-looking bits. And, for example, not all of these random numbers can be used for security purposes, for example, and show it's really safe by something better. It's not designed for security purposes, but some people use it anyway. So, because of that, we have secure random number generators. And those are usually they have a particular class or properties, first of all, is that random number generators, a single random number generator, and they must have forward security, which means that in case the internal state of the system is compromised, and the past outputs must still appear random. And again, for example, if the system is compromised, it must be a random state that is compromised again, which still might not appear random, provided that the receiving will be the sufficient quality entropy. So, because of that, a designing random number generator will not be used, but because of that you have for a random number generator like NIST SB 898, possibly by a source of seed entropy. But the problem is that this standard needs some more problems. For example, initial seed entropy or receding control or how town will be of the source of the entropy. It's so because of that, some other people think about it and design something else, which already invented in some advance OSes, such as OS6, or iOS. So, the problem here is actually a chicken and egg problem, because well, chicken and egg problem, you need some kind of entropy or randomness, but these randomnesses again, so ideally you want to use this is a compound, means such as like if we consider quantum randomness is like radioactive decay, shock noises or non-quantum randomness, these are physical phenomena, radioactive decay, shock noises and other physical influences of the environment. But they are not always usable and practically you take unpredictable system events and these are user inputs and influences of the environment or like secure randomness should be provided as a system service because it's hard and of course if you don't, so as a system service for example, do you have a random in a Unix-like system or a crypto-random API on Windows and we have a new random device in Unix-like system and as a random number generator and again based on open SSL you have like open SSL it's very very important on this a lot of relevant services we've taken a look at the general background of random number generators and now we'll take a look at what kind of background these random number generators have and now we'll look at the challenges normally you just use random and use it but in the embedded world it's unfortunately not so difficult not so easy because these embedded random generators are often not too random or not safe first of all is the problem that there are many different operating systems in the normal computer there are only OSX, BSD, Linux and Windows but in this embedded world there are many different systems that all have different capabilities it's difficult to design a standardised additional generator for all these different systems a similar problem is in the hardware where in the embedded world microcontrollers are used so if you assume that there is a physical or hardware additional generator then you can't use it in chips that don't have and of course devices are designed to be as small as possible and use as little resources for example the processor is relatively slow i.e. the cryptology can't be very complex you can't use a lot of batteries and often there are limitations with the storage of a relatively small entropy pool also the environment of the embedded world is relatively boring because the embedded world often only with other technical things is very deterministic i.e. it's difficult to find new peripherals because there are no peripherals there are no hardware random number generators and these conditions are usually worst during boot time because at the beginning it's very very deterministic there is a solid boot sequence and that works i.e. yet non-blocking interfaces to random number generators allow for drawing from the random number generator even when insufficient entropy is at the end of the day it results in something more than the minimum entropy so this is a very good method because a lot of bad devices will be generated if there is a persistent boot and an initial state the problem is that you have a system with little entropy and at the beginning it already generates random numbers which are not really random a relatively new solution is to work with a seed file i.e. a random number generator which writes a file in a seed file and a really random or pseudo random sequence but this still doesn't solve this problem some possibilities is to have a seed file in the firmware but the problem is it's difficult to do it unpersonally or you could use personalized data i.e. the MAC address or the serial number but this is also difficult or you can use less good sources for entropy like urns it's also difficult now that we have an idea why it's so hard that embedded operating systems really have random generators we will now imagine a few false studies mainly we will talk about how embedded systems implement it and how they can't i.e. QNX that's a Unix-like operating system that was originally on the BlackBerry it's the system that's under BlackBerry OS that's also in cars, in routes even in nuclear systems it has a defu random implementation that's a bit adapted it's non-blocking and it's implemented in the user space that's started after the boot we have reverse engineered and found out that it's based on Yaro but it turned out to be based on an older product implementation not on the reference version of Yaro a paper release so it only has a single entropy pool and no faster output no block service no energy output at all it's directly drawn from the input so when QNX Yaro I turned the version of this over it's a QNX Yaro that means it's directly drawn from the internal status and additionally it diverges this system that they used also from this already bad old Yaro here you see a design diagram we first tested the quality of the outputs tested with the dieharder and the NIST statistical test suit it has both of these tests suits but it only tells us about the output and not about the source not about the entropy after we engineered the reverse with the boot time entropy that's the system time the clock cycle the entropy sources system time clock cycles proc PIDs and def names and that a hash function is calculated that is used to initialize Yaro because it sounds a bit strange to us we looked how the boot time entropy looks like so our quality measure is the min entropy which basically when this entropy goes in one direction that would be very easy for an attacker to go in there and use the NIST entropy source to validate this data we collected 50 boot runs by instruments to run the number generator and I'm loving the raw data I'm loving the raw data which isn't good at all because the min entropy is 0.0276 that's much less than the 1 bit of min entropy per 8 bit raw data that you want to have and here you can see a visualization of it we also evaluated the cross boot entropy how it looks between the single boot runs this is also behavior you don't want and it turned out that apart from having less than stellar single boot entropy gathering we found that it was also very similar between the single boot you can see it's very consistent and very predictable what you don't want between the 50 boot runs that we tried so it was certain things that always come back there's the same number of processes each time the same names and the only real coincidence comes from times but of course it's not coincidence here you can see the reverse engineered run time entropy you have system information which is basically process IDs thread IDs, flags, all these kind of process variables fed into the shallow one into the yarrow input function and in the bottom left you have your interrupt timing source in the bottom right there is an undocumented function which is a callback at the bottom end we have interrupt timing sources and it's not clear from the code either so some thoughts on this run time entropy and this run time entropy because there's lots of static information we have a few problems because we have a lot of static information we have the flags the priorities of the stack will probably not vary between boot cycles and that's why we have very predictable systems and the only real randomness is time or program state one of the big problems is that it really puts the burden on the developer because the developer has to select which interrupts to draw the entropy from so that means that they have to decide how these interrupt timing sources are not triggered too periodically etc but there's a real matter which is almost all Q and X-rays there is no reset control they actually interrupt the binary and they actually call them which means that run time entropy is accumulated but never actually makes back interest time entropy pool and you can find Q and X people of a Q and X and then this is very dangerous especially if you consider the quality of the boot time entropy in the latest version Q and X 6.6 this is an attempt to create some kind of Q and X 6.6 initialization output. So whenever the PRNG output is received from part of the pool. But an issue is that no entropy estimation is actually done. And this is what Seattle, what is the design to do to do entropy estimation on entropy pools. So you only receive a proper entropy quality in these pools. This isn't what we're up to. Luckily we disclosed some of these issues to BlackBerry. Luckily we were able to give a few of these problems to BlackBerry and they have a new Fortuna-based Pseudorandom Number Generator. And it will now follow Yaro. And there are patches for QNX 6.6 that will be published in January. So this brings us to the next operating system, which we can't mention because it was the next operating system that we were able to continue. And this is a POSIX-compliant RTOS operating system, which will be used in the ISS. It will be used as a random number generator available via DevUrandom interface. And as you can see it comes from Urandom read, which fills a buffer with n from its random function. Urandom read and it fills a buffer with a write. And it feeds these outputs back into the entropy pool. So it's also very predictable. And the underlying function shows that it's a BSD random number generator, but it's not custom constant. And that's not the way it's written out because we also discovered a local re-seated deck because the DevUrandom device is writeable, which means that anyone on the system can force a PRNG re-seat regardless of their privileges. So every random world writeable, so every single write-to-see, to the random number generator and all across the board control the PRNG output. So, yeah, that's it. But even if that wasn't enough, and we also discovered a known seed attack because if you reverse it, you see that there's no seeding at all. It's just a static 32-bit seed, which is the same across all these operating systems that are deploying. So it's just the same point over and over again, and that's why I'm talking to you in the system at all. So an attacker who knows the PRNG seed also knows the BSD or deterministic functions. They also know all of our corresponding PRNG output consumed by critical application. So you can see in the slide here that all of the other numbers can be simply dropped from the same output we saw earlier produced by this known seed. So it's here over and over again, the local attacker who has a public key generated on this target operating system, and they know the animation here in G-seed. They simply go under an open generator, see the appropriate state offset, read the number here, generate the corresponding key, and the state offset is also right in the batches. And even though it iterates to the next state offset, because the state offset is determined by how many bytes have been read from the DAPI random device, this is bounded by your family being a root force upper bound because I don't think more than four gigabytes will have been read from the random number generator before generating your keys. So we can now assume that we don't have four gigabytes before our generation and our key will be generated, and that's why it's still a root force. We have a screenshot here, and that's basically our attack, and we showed that it's feasible. Yeah, and the funny thing is that I don't think even they are going to patch it. The last case study is VxWorks 6.9, and the initial release is in 1987, and quite a lot of high-tech equipment is used as a root force. And VxWorks deepens no cyber secure random number generator. And well, it will help predict the consequences too, and search in the internet for the developers for asking questions about this stuff, what makes VxWorks 6.9 that somebody comes and says, hey, I implemented, I used the RAN function as the seeding source for, I don't know, the commentator on the internet said that it's not secure, it shouldn't be for the secure network. Well, and if you are thinking that these three operating systems are the first two which have problems and have a lot about it, is that the voice actually is not. Actually, in the embedded OSes and real-time running systems, the actual majority of them do not sell any secure random number generator. And VxWorks is far from the owner one with these problems, but VxWorks is one of the biggest ones, and you expect that they provide something which they don't. Yeah, so what are the takeaways from this talk? The embedded world is very harsh, and it's hard to deal with the operating systems that seek deployment, and there are many constraints that you have to deal with in this design, and that limits the source of entropy quite a bit. The developers, because they will screw up, they simply don't care about the developers, because they won't be able to do that, and more scrutiny is required, because the advice just used definitely that it should not land the developer into trouble, as it needs operating systems. And too much of the embedded secure in the world is much more trained, so we need more offensive research and training systems that have been almost up to speed with the general purpose world. So if you're looking for more technical details on embedded security, recommend or talk about general purpose world in 2017, and if you've got any questions, you can ask them now. Okay, thanks a lot first. For questions and answers, please use the microphones. Just line up behind the microphones, and I'll pick you for your questions. So this is not a question, this is a nice story that might be replicated. Please, only questions at the moment would be really relevant. No, this is about randomness. Okay, it's now about a funny question, a funny story that I heard. I talked to an engineer from Bristol, and he told me the following story, because they had so much bandwidth on the internet, and they were saying, well, let's see what happened if you send a random bit stream to Dev Zero in foreign country. It lasts for two weeks for the G-Series to knock on their door and ask them what the heck they are doing there, and the random number generator they used was a noise diode. Okay, thank you. A question from the internet is a radio noise from a software-defined radio, a good source of entropy for a random number generator. I'm sorry, can you be the question now? Is radio noise that you get from software-defined radio chip? Would that be a good source of entropy? I mean, I guess it depends on your threat model, because is it possible that the attacker controls radio signals around the device that draws so many from the R&D chip? Yeah, I mean, if you can control a specific frequency, then, well, it's not. It's really good, but it really depends on your threat model. Is it a remote attacker you're dealing with on the attacker of physical access, et cetera, et cetera? One of the slides you mentioned, both are to the microphone, please. One of the slides you mentioned on boot low-entropy attacks, and do you have any best practice accommodations for different, because on Linux, there are random blocks. On Linux, there are random block, unless it hasn't been seeded yet, and OpenBSD seats it in the boot loader stage, even before even the kind of last one. And now, application developers are opposed to know every operating system? Well, the problem with the blocking thing is, and this came up in communication with BlackBerry as well, is that if you say, I only provide randomness when I have sufficient information, and I'm sure this is high quality, this is not as easy to do in the embedded world, because that means that, for example, if you need some source of secure randomness very good, you don't have enough entity, but boot don't get really slow, and especially if you have devices on a real-time constraint, this is an engineering hurdle right there. So, I see your, the paper was published, I think, at Security and Privacy 2013. I think it was called something like, welcome to the public, or something like that. And there were some good best practices, recommendations for the embedded world, mainly in the form of seed files, but as we mentioned already, if you have this close notes, there are, it's kind of an open problem to design a real open source, so random number generator, yeah, all across the board. Second microphone back in the air, please. Thank you. You mentioned the NDA you have with the vendor, you have the non-disclosure agreement with a vendor, what kind of, what kind of relationship do you have with this software manufacturer, and how did it come to that you have a non-disclosure agreement? As an answer, I can tell you, it took one year until we got access to it. It is, to be honest, in lots of real-time operating systems, they are living in 1998. So, it's an academic approach, not a consulting assignment. Yes. Okay, thank you. Then you, please. Thanks for your talk. First question. Arm V8 relies on UFI random, for initializing kernel address randomization, layout randomization. Do you think that relying on bootloader is better for operating system than trying to solve random problem with ugly means? I mean, don't take into their, don't take random number generating into their responsibility of their operating system, but operating system means to employ them. Yeah, I mean, I guess that depends on, well, on your design model, for example, that would require you to have a bootloader that's standardized all across the board, where you want to deploy it, for example, if there's no bootloader that's suitable for the kind of embedded system, but you do more than the way it works, and doesn't have a random number generator, then you're left without a random number generator. So, it's one of the biggest problems, and that's where the only bunch of hard-to-much systems is that in the general purpose world, you can make some assumptions about hardware roughly looks like this, roughly as it's capable of this software, the computers that can be used in the embedded world are so much diversity that it's probably better to, also really include functionality all across the software standard in case, than to simply single or simply shoot the bootloader and the bootloader is out of the bootloader. Okay, thanks. Another idea. Can we rely on the manufacturer which makes a small device without random number sources to feed the device by random input during the manufacturing? I mean, attach the device before selling it to some random expensive random number generator, get the random input and then go. Yeah, it's one of the things I mentioned, that's essentially a seed file, and it seems like I mentioned in slides, if you include a seed file, which firmware image you use, random per firmware image, then that might be a workaround, but that depends on how well the vendor understands what they're doing, because in case, in point, would be the Western digital self-encryption drives, where they actually generated these based on their, let's see, RAND function. So, it could be a solution, but yeah, that depends on the vendor, whether they do it well. Thanks, you. Thank you. Okay, we have time for one short last question. Okay, you have three pretty bad examples here. You have a broader field, a broader view of the field. Are there, is it a general problem that they are probably there, or did you just pick the reworked one and stumbled upon? Are there some operating systems that do it right, and whatever the right might be for this? No, actually, these are the best. Okay, thank you very much. A warm round of applause for them again, please.


If you want to maintain a status quo, nothing new will ever happen. A leader means you're a madman who's always wanting to step into something new. Your life is an adventure. When everybody is looking up to you, in case you fall, it's very bad. So it's very, very important you upgrade the machine to really build a DNA of success. These are the three things you need. Inside, definitely integrity and inspiration. If you want to be inspired, first thing is you must find something larger than yourself to do. Something which is bigger than yourself to do. If you choose things which are safe and nice and easy, which will make you some money, you may make some money. I'm not against it. That's the goal, it's fine. But you will not be inspired. Living an inspired life and living a... for lack of vocabulary, I'm using this not as an insult to any profession, a clerical kind of life. When I say clerical, it is all set. You do this, this, this, you'll get your salary, that's it. No risk. Last generation of people in this country would always say, first thing is got a government employment. That was the aspiration, always. Why? No risk. Whether you're capable, not capable, you have a 40-45 year work span. Does it matter? Whether you deliver, you don't deliver, you can even get there, every day are not. Still you got a job. You will never be fired. No risk. If there has to be inspiration within you, there has to be an element of uncertainty. Without uncertainty, there is no inspiration or a risk or danger. Where there is no danger, there is no adventure. Where there is no adventure, nobody will be inspired by you. If people don't see that you are willing to step into something that they are not willing to step into, you cannot inspire anybody. People should see what they are afraid of stepping into, you are willing to step into. Well, when you take a risk, you may get burnt. Yes, it can happen. That's what danger means, that there is a risk. That's what risk means. Sometimes it can go dead wrong. Yes, of course we calculate the risks. We're not going to blindly walk into something, but there is a risk. Where there is no danger, there is no adventure.  Ten years of your life may go without any product. Possible, hello? When you start a venture, it is possible ten, fifteen, twenty years of your life went into nothing. That risk is there. You may not get killed like jumping off a mountain, but loss of life is there in many different ways. So inspiration, if it has to come, one basic element is integrity. Where there is no integrity, you cannot inspire. Integrity means just this. Don't think integrity is a bundle of morals, values, ethics. No. Integrity means your commitment is larger than yourself. Maybe it's your business, maybe it's your community, maybe it's your nation, maybe it's the world. We don't know what, but something larger than yourself, you're committed to that, then people see you have integrity. People experience integrity because you are committed to something beyond your own self-interest. If they don't see that, then you cannot inspire anybody.  And these dragging feet people will make your life miserable in every possible way. Hello? You've seen them?   That you can do to some extent. With that, you're not going to produce the best in people. It is not just they're not dragging their feet, it is just that they're going beyond their limits and doing something. Only then, something wonderful is happening around you. Only then, you being there in that activity, it's worth getting up tomorrow morning, pull on. Otherwise, after being successful for five, ten years, you will ask to be or not to be him. You may not articulate it, but it will show in the length of your face. Yes, that shows there is a question mark whether what is the purpose of my existence, question mark has come. Maybe it's not entered your head and become words, but the question mark is there in people's faces. A face, if we had seen you when you were five, six years of age, it was like this, not slowly. This means the question has risen somewhere. Not it articulated maybe, but question has come. Why the question has come is, there is no inspiration. Inspiration is not just all yours, the atmosphere around you should be inspired. For that, without a very extreme sense of integrity, it won't happen. If your integrity is just of morality and ethics, people will feel sick of you because it's very hard to live under a moral shadow, very hard. It is life-taking, but your integrity is because your commitment is larger than your personal well-being. That is when everything around you is inspired. Coming to insight, this is the tricky part. Insight means you are able to see something that others could not see. You are able to see things ahead of other people, that's an important thing. Everybody sees everything at some point, but the thing is you saw it before then, that makes a world of difference.  If you're in a business, it decides whether you're really successful or just about making it. If you're in a spiritual process, it's worse than battle. If you have no insight of any kind, or if there's nobody around you with any insight, then it's lifetimes of drudgery. If you're not able to grasp any insight, or if there is nobody around you with deep insight, you're just doing a spiritual process. Now you are for lifetimes of slavery. Yes, that is why they become the most serious kind everywhere in the world. So if insight has to come, one important dimension is the reason why there is no insight is, people are largely trying to function with their intellect. This is an unfortunate consequence of the type of education that's been important everywhere, where your intellect is seen as a prime value. To understand the mechanics of how your intellect functions, your intellect is in function only with the data that has been fed into it. Data means memory, somebody's memory or your memory. Memory means things that have already happened. So if you function from the data that you have, you can do permutations and combinations of this data and make it look like magic for some time. But one thing is very clear, nothing new will ever happen. Because you've gotten enmeshed in your own data. So insight means that you do not get identified with something limited. Your identities with limitations essentially comes from the data that you gather. Right now, you are identified with let us say your own personal qualifications. Now what you identified with, that's what you become. Or let us say you're identified with your community or with your nation and that's what you become. What you identify with, you become that. In that sense, you are not able to look at life just the way it is. If you're not able to look at things just the way it is, this is simply because you have given more significance to memory than to human attention and intelligence. Human attention and intelligence is of far more significance than your memory. You know, you heard of Andrew Carnegie. And Andrew Carnegie started making lots of money in United States. Those were not the days of these Bezos and Musks and whatever, all these other people. Nobody was making billions. People always made money in an incremental way. But this guy started making enormous amount of money. So naturally there was a suspicion, where is it coming from? Because these 20s, 30s, there were lots of Ponzi schemes in America.  So a group of congressmen were formed to investigate Carnegie. This investigation went on for some time and they found nothing wrong. Then they called him and in the investigation they asked him, we don't find anything wrong. There must be something wrong. Because you're making so much money in such a short time, there has to be a crime somewhere here. Where is it? They're asking him. So he said, down. See, I can pay absolute attention to anything that I see for up to five minutes. Can any of you do that? They thought rubbish, what five minutes can't we pay attention? Tell us what is it? So he set up an experiment. Five minutes, nobody could pay attention for more than few seconds, their attention all over the place. Then they realized they're not able to pay attention for five minutes. Then he said, you should not be running United States. It's not going to go anywhere if you guys run this country. Because human attention can open up doors in the existence. Human memory will just recycle the past. Unfortunately, right now data, data, data is becoming very big. But anyway, data people will sink once the more artificial intelligence becomes more prevalent. My phone has more data than all of you put together. Hello? Yes or no? It is capable of earning a PhD a day. Yes, it has enough information. So do not mistake information and data as intelligence. Intelligence is sharpened only by attention, not by thinking. Thinking means recycling data. I'm not saying data is completely relevant. It is. If you want to maintain a status code, data is important.  Something new means you want to get into unfamiliar terrain all the time. Unfamiliar terrain means you are consciously stepping into danger. So your life is an adventure. Because it's an adventure, everybody is looking up to you. When everybody is looking up to you, in case you fall, it's very bad. So it's very, very important you upgrade the machine before you upgrade the activity.


Personal finance PowerPoint presentation. Actual cash value. Prepare to get financially fit by practicing personal finance. We're breaking the financial decisions into the short-term and long-term decisions. The short-term decisions being those where we're gonna train our gut to trust our gut the long-term decisions such as with the insurance planning being those where we're gonna use the adage of measure twice, cut once, have a more formal process in place which might look something like this. We're gonna set the goals. We're gonna develop a plan to reach the goals. We're gonna put the plan in action and then we're gonna review the results and do it over and over again on a periodic basis in order to check where we stand. Some of the things we might be applying insurance to, we went over these in the past, but just to review would be things like disability, illness, death, retirement, property laws, liability. We're now gonna be focusing in on the term of the actual cash value, which is a term that you might run into when you're thinking about different formats in types of insurance. Most of this information can be found at Investopedia, actual cash value, which you can find online. Take a look at the references, resources, continue your research from there. This is by Julia Kagan, updated July 27th, 2021. What is actual cash value? Actual cash value, ACV, is the amount equal to the replacement cost minus depreciation of a damaged or sold property at the time of the loss. So when you think about this in terms of the insurance policies, the question then would be, well, if you're insuring against something happening in the future, if you're thinking about something like property, if you're insuring some kind of property for example, then if something happens to that property in the future, then how much are you gonna get for the replacement? So clearly what we're trying to do with the insurance is lower or mitigate the risk upfront and hoping that some event doesn't happen that would trigger the insurance because that would generally be a bad thing. But if it does, then how much are we gonna get at the point in time that that event happens and will it be enough to basically suit our needs? That's the general idea, the general questions. So we could see the term of actual cash value instead of say like replacement cost, which is once again, the amount equal to the replacement cost. So we start at the replacement cost, how much it would cost us to replace the piece of property at that point in time. Notice that if you were to replace something like a structure, like a building, then the replacement, even though you might use the same materials, would be worth more you would think due to the fact that when you had the structure, you built it a while ago. It was built in the past and most things deteriorate over time and therefore due to it being older, it would be have a lesser value you would think. So then the cash, the actual cash value is the amount equal to the replacement cost minus depreciation of a damaged or stolen property at the time of the loss. So the actual value for which the property could be sold, which is always less than what it would cost to replace it. So if you see a policy that's basically gonna give you the replacement cost, you would expect that that would be a better situation typically because now you're gonna be able to have enough money to replace the item. And obviously you can't simply replace it at the cost because you can't build a new thing, for example, because you're gonna have to use, it's gonna have to be new, of course. So if you want the policy to then be covering what you can replace it for, then you would think that you would want the cash value as opposed, I mean, you would want the replacement cost as opposed to the cash value. However, of course, if you have more of a payout at the point in time that an event could happen, then it's gonna cost more on the premium side of things typically. If you have the cash value, then you would think they would give you the cash amount, but that might not be enough then to cover the full replacement, but you would think the premiums would possibly be less. So your questioning when you're doing the insurance might be something like, well, if this was to happen, do I need all the money necessary in order to pick this up at that point in time? Or maybe I do some kind of mixture and try to do some self-insurance type of thing where I have some coverage for the cash value, which might be less than the replacement cost, but I'm also gonna save money. I'm gonna have a significant amount of savings, which I'm gonna think about as my self-insurance kind of thing so that I can cover the difference. You might try to do some kind of combination between the two, for example. So how actual cash value works? Sometimes insurance companies use actual cash value to determine the amount to be paid to a policyholder after loss or damage to the insured property or vehicle. So there's a property, the insurance policy was out, the damage has happened, there's been an accident of some kind and now they gotta determine how they're gonna pay it out and some policies might use the cash value. So there isn't a type of insurance called ACV insurance, for example, that's a misconception. So it's not generally gonna be called ACV insurance or actual cash value insurance, but they might use the cash value method for to think about the payout. So in the case of an automobile that is totaled in an accident, for example, the insurance company would typically pay the actual cash value of the vehicle after determining its replacement cost and subtracting factors, such as depreciation and wear and tear. So how are they going to come to this? They're gonna use some kind of estimating system where they might first say, okay, well, what if they had a new car and then we're gonna take away the depreciation, which basically would be, well, if you had the car for so many years, like five years, then we're gonna basically do our calculations of depreciating it over that point in time, which means it's worth less than it would be if you were to replace it with a new car at that point in time. So under replacement cost coverage, the insurer would pay the amount required to replace the covered item with a like kind new car. So if it was replacement costs, as opposed to the cash value, then you would be thinking, and this might be the starting point that they're thinking to get to the cash value, you would be thinking, well, they gotta, obviously if they need a new car, they're gonna have to replace it with a car of a similar nature. How much would that cost? And so actual cash value is used in valuing insurance property in the property and casualty insurance company. Actual cash value is computed by subtracting depreciation from replacement cost while depreciation is figured by establishing and expected lifetime of an item and determining what percentage of that life remains. So the standard method you would use then is you're saying, okay, I'm gonna use these depreciation methods. The straight line method is the first starting point that you might think about depreciation and then use accelerated methods. You'd say, well, what's the useful life of the car? And then how long would the car last and how old was the car so that you can get the cost of the car and then subtract out basically the depreciation. That would be the general format to think about how much the payout would be, which would mean that you would not get enough money in that case, you would think to get a similar car for replacement because they would be giving you that cash value. So this percentage multiplied by the replacement cost provides the actual cash value. Example of actual cash value as an example and then purchase a television set for $3,000 five years ago and it was destroyed in a hurricane. So his insurance company says that all televisions have a useful life of 10 years. So that's again, it's just kind of an assumption. Notice you might be saying, hey, look, if you're doing a car, why don't you use mileage, for example, as the calculation and they could, it might be more accurate in some cases, but the default method is to use the years, which means if they're just using years, they're not really taken into consideration how much care you put into it and whatnot and that kind of stuff too. They're just basically taking an average kind of calculation oftentimes or at least that's the starting point that they can vary it from there, you would think. So as an example, a man purchased a television set for $3,000 five years ago and it was destroyed in a hurricane. His insurance company says that all televisions have a useful life of 10 years. Well, how do they know that? That's just, that's the number they use. So a similar television today costs 3,500. So if he was to buy a similar television today, he bought it for 3,000. There's been inflation and just changes in the price of TVs. You could buy a similar one, but it costs you 3,500 because it's five years later now. The destroyed television had 50% of five years of its life remaining. So meaning it was living for five years and they say it only lives for 10 years. So the actual cash value equals 3,500 replacement costs times 50% or 1,750, which often might look something more like this. You might say, okay, we've got 3,500 to replace it and they said that they last 10 years divided by 10. So that's gonna be the $350 per year and this thing is five years old, so times five. So that means that we took it down by 1,750. 1,750 minus the 3,500 is the 50% or 1,750. So they give you the 1,750 and you could be like, well no way, televisions are valued differently either years are different or something like that. And you could try to argue with them, but that's a general idea. This concept is different from the book value used by accountants in financial statements or for tax purposes. Accountants use the purchase price and subtract the accumulated depreciation in order to value the item on a balance sheet. So if you were doing this from an accountant standpoint, you wouldn't be taking the replacement cost but it would be similar. You would be taking the 3,000 up top, how much you purchased it for because in accounting, what you're trying to do is allocate the cost over the useful life. So you're not gonna increase it based on the fair market value or the replacement cost. You're gonna take the, this would be generally accepted accounting principles. You'll take the 3,000 divided by the five years which means it would be 600 per year times the five years. You would be, I'm sorry, you would take the 3,000 divided by 10 years. That would be 300 times five years have passed 1,500. So we would be at the 1,500 minus the 3,000 would be 1,500. So 50% of the 3,000 instead of the 3,000 five would be the general difference if you're using a straight line kind of method. So accountants use the purchase price and subtract the accumulated depreciation in order to value the item on a balance sheet. See, ACV uses the current replacement cost. So that's current replacement cost. That's the difference. So the actual cash value versus the replacement cost property insurance policy holders will usually prefer payment based on the replacement cost of damaged or stolen property because it compensates the policy holder for the actual cost of replacing the property. So if you have a choice and you're saying, okay, we've got the actual cost or I mean, we've got the replacement cost or we've got the actual cash value. Well, I would like to get the replacement cost. I would, whatever it is that I'm ensuring that broke down I'd like to replace it with a similar one today rather than just get the cash amount which is going to be less than that. So clearly that would be generally the better way to go but obviously too it's going to cost more on the premiums you would think on the insurance side of things and the company's side of things they're going to want to be feeling more comfortable giving the actual cash value because that would be less in the event of an accident. And if they're going to give you more at the event of an accident then you might have an increase in the cost of the insurance in the premiums. So for instance, if a camera is stolen every replacement cost policy will reimburse you for the full cost of replacing it with a new camera of like kind. So clearly you would like to say I want a new camera that I can buy not just like a little bit of money that's not going to pay for my new camera that I want to have at this point in time. So the insurer will not take into consideration that the loss camera had a shutter count of 25,000 because you use the camera every day for the last two years using a considerable amount of wear and tear. So those are the kind of the pros and cons when you're thinking of the insurance policy you want to take into consideration actual cash value replacement costs measuring and balancing that out with the cost of the policy, the premiums.


What up, everybody? I'm Joe for jasphyscasewrakes.com doing a quick little pack of 2019 Prism football. If you like 2019 era football, you're gonna love 2019 NT football on jasphyscasewrakes.com. Check it out. This is gonna unlock Phoenix football. Pick your team two, giving away nine teams in there, these nine right here. But first, the break. Big thanks to this group for making it happen. We got a brup with a lot of spots. All teams are in. Let's roll it, randomize it. One and a four, five times each. One, two, three. This is just for the break, four, and fifth and final time. Then we got brup down to Aaron. One and a four, five times to the teams. One, two, three, four, and five. It's down to Vikings. No trade windows in this. There's the first half of the list and here is the second half of the list. Maybe Rex, who knows? Kyler Murray in this graph? Should go into fillers without very much expectations, but in a filler pack like this, you never know. Looks like there's some numbered cars here. Doesn't look like an autograph. We have a big Ben Silver and a red wave Cameron Brake to 149. All right, nothing too crazy there. All right, so this one's gonna go to Aaron and the Buccaneers and the Silver Big Ben. Silver Ben, Silver Ben. It's Big Ben time in the city. That'll go to Aaron and the Steelers. All right, now let's flip back over here. Let's gather everybody's names for our second and final dice roll.  So it's by price, highest to lowest. This will be for teams in Pick Your Team 2, Phoenix 2. All right, there's all the names there again. Let's roll it, randomize it. Two and a four, six times, top nine after six. Good luck, one, two, three, four, five and six. There's two and a four, six times. So from 10 on down, sad times, 10 through 32. Appreciate everybody giving it a shot. Top nine though, you're in the break. Think, I think Brupp is gonna have a lot of spots here. Lauren's gonna have, hopefully some teams. Brian, you're in. There's Brupp, Omar, BK, Lauren, Kevin, Lauren, Kevin, Lauren. There you go, top nine. We'll see you in the next video for the break. Let's match you up with those teams. So Brupp with the ATL, Kev with Baltimore, Brupp with Carolina, Kev with Green Bay, Brupp with Miami, B-Cords with SG. That must be San Francisco. I don't know why I wrote it like that. I was maybe thinking Giants. Omar with Tennessee, Brupp with Tampa Bay and Brian with the New York Football Giants. There you go again. We'll also put Prism91 next to your name so you can know where you won that. Thanks everybody. We'll see you in the next video for the break. Jaspyscasewrakes.com.


Next question is from warrior monk fitness is following your passion. Bad advice, you know I love these these broad Like recommendations or you know wisdom when they're like follow your passion how many times have you heard that statement on Instagram You know, I think you're in trouble if you always follow your feelings or if you always follow your mind I think you have to come you have to be able to do both always following your passion You'll be chasing your feelings around all the time And you may not you may not be pragmatic you may not may up end up dating the wrong person Because you're passionate about them You may end up doing a job that doesn't really support you or your family very well because you're not being pragmatic Your diet may be passion driven in which case you may not eat in the right way Your workouts might be the wrong workouts if you always I think passion and emotion are Important as part of what makes this human, but just following passion. I don't think that's a great message I really I didn't think you guys were gonna go this direction I thought I was gonna be the one that was gonna challenge that I thought you guys are gonna be all pro go for your passion But I guess I you know this that show I was talking to you by the playbook One of the coaches kind of like alluded to this and said, you know doing things like that You are you're driven by your feelings and it isn't always the most logical decision You know sometimes you feel passionate about something because it makes you you find it's fun Or you enjoy it or currently at this moment in your life You have a feeling around it and it's that feeling that that drives that passion And that may not always drive a logical decision in what you should be doing And so actually being able to and it's and it's not also necessarily a bad thing either because you know Hopefully whatever it is that you end up doing for the rest of your life You're also passionate about maybe the spark that got you there, right? But I know there's a lot of things in my life that I'm very passionate about today that I fell into because I was Open to doing a bunch of other things and so and I and I think that this message for the the generation kind of coming up now I'd like the being somebody who has had you know now what two three generations that I've led underneath me and seeing like the you know Gen Z and Millennials yeah millennials coming up and and how they're there This is like a very hot topic like finding something that they're so passionate about and they spent some of them spend so much time Trying to find this passion that they'll turn other things yeah opportunities away right that they don't I'm seeing they don't they don't do They don't do something and part of that is like just getting yourself and I mean look I actually did not believe I did not actually love personal training that much like I liked personal training I really did like there's but what I found in it was other things that I ended up really being passionate about like I was in I was passionate about building a business. I liked numbers. I liked sales I didn't even know that was part of that But I found out that it was a big part of it which made me more passionate and fell in love with it And then I got into leading trainers and thought oh my god. I don't like personal training at all I love leading trainers and so sometimes you don't know if it's gonna be something that you're gonna be really passionate about So turning away a lot of things because you're like oh, I'm not really passionate about that I don't feel very passionate about it. And so you you don't do it. I think that's a silly way to Yeah, I think it's important to Definitely don't turn away Opportunities get involved in these opportunities and find where that passion lies within that experience and you know for me It took a while to kind of figure that out like what I really wanted to do You know, I did a lot of different types of jobs and it it definitely Eliminated a lot of directions that I thought I wanted to go in but I was like well I just I don't like I don't like this this this You know industry I'm not really, you know driven towards this that other job I had you know, there was a spark there and so you know in terms of like just waiting for that passion You know to present itself for you. I think that's a that's a not the message. I would put out I think if you're seeking to put to have passion for something that's gonna serve you for the rest of your life I would say find passion in and growth.  It means that you'll view failure Which you will encounter in your life a lot You'll view failure as a learning and growth process. I think that's a very smart Way to look at things I think if you if you run by passion on specific things You're gonna screw yourself and you know to your point Adam about you know the these generations coming up and having to find their passion that's the result of a Wealthy easy good society, and I know some people are getting their feelings hurt right now because they think oh life is so tough or whatever Okay, I'm talking about in comparison to how it's always been for people Okay, go back to your parents your grandparents your great-pink grandparents, you know my great-grandfather Didn't find a job that he was passionate about you know He did it because he fight tooth and nail for an opportunity. Oh, so here's a deal passion happiness Excitement they feel great. They're wonderful, but that's not the key to Success in life the key to success in life is meaning Purpose those will always serve you you know they do these these surveys of People who have children and they compare them to people who don't have children and it's so funny when these When when articles are written about this, but you could tell there's a media bias Constantly trying to convince people to not have children because you'll read that article titles and they'll say things like People pay no couples who don't have kids are more happy People who don't have kids have more fun And so you if you just read the headline you're like wow I'm not gonna have any kids because people who don't have kids have less stress and they're more happy Yes, that's true, but continue to read the study people who have kids find more purpose and meaning in their life Which one is more valuable ask any old person who's about to die or who's reaching the end of their life And they'll tell you it's meaning and purpose passion Excitement happiness are all fleeting those are they're great enjoy them the real parts of life But that's not what life is all about so although passion is a part of who you are and You should experience it don't chase it and drive after it make that you're defining Feeling because you'll be screwed. I promise you you'll be fleeting and I've worked with lots of people like this I have worked with very talented people who were constantly chasing passion and When they're young, it's okay. Oh, I'm moving from this thing. I'm doing this thing I'm passionate I'm bored and now that they're in their 30s and 40s. They're they're not successful They're in debt not happy. Not happy. They're looking for the next thing always looking for the next thing So well, you know what ends up happening is that you're something that you you're so passionate about you end up Working in that industry and you would find out there's so much more to it And then all of a sudden that that passion starts to fade away And then now you're stuck in this career that you you waited so long to get into because you thought you had to be so Passion about and then that all changed always greener somewhere else. Here's a great example Talk to any successful couple that's been together for 40 50 60 years right talk to them about passion When you first meet someone you fall in love with them passion dominates the relationship It's just all over the place But how do you build a long-lasting? Partnership with the person those feelings change and go away and then you have this bond that is different than passion But way stronger and more powerful and that's much more important if you're always chasing passion Here's what will end up happening you'll fall in love with someone you become passionate Passion starts to wane then you don't give the bonding a chance You don't give the hard part the part that's real important chance You end up leaving them you go to the next person you feel passionate about and that's a it's a road to failure It's a road to a poor outcome in life. So passion is good, but don't don't let that one lean on it. Absolutely


Hi everyone, my name is Steph. This is Kidlet Joy and welcome or welcome back to my channel and welcome to the second episode of my weekly reading diaries where I talk about all of the kids lit that I have read in the last week. It's been a pretty busy week for reading in terms of both reading at work and also at home. And there's a couple of titles that I'm not going to mention in this video because I will have future videos on them coming very soon. And I am very excited to share those with you all. In terms of things that I was reading at work in the classroom, we were finishing off our startup learning program. So we were doing a lot of work around wellbeing, around our school values and things like that. So a lot of the titles reflect that. We're also looking at growth mindset. So a lot of the picture books feature those themes. And then we also started our first class novel which is going along swimmingly. In terms of the picture books that we read this week, we read two by Zany Louise that linked in with our school values and sort of our work around that. So there was resilience and kindness and both of these books feature five different characters who are all experiencing moments where they need to demonstrate these character strengths. So either resilience or kindness. And so we were reading those to look at the examples to talk about times where we have been in situations like that, how we respond, how we display resilience or how we show kindness. And we also use those as a jumping off point later in the week when we actually created our own classroom matrix. So we spent a lot of time using books like this to help us unpack those things and then came up with our list of, well, what does resilience look like in the classroom? What does responsibility look like in the classroom? And so on and so forth. We also read Incredible You by Rhys Brissenden which is a really great growth mindset book. It is all about celebrating the amazing things that make us us, very bright, it's very colorful. There's a lot on the page so it could be visually overwhelming for some students but it's a lot of fun and there are some really great messages in there. And they were also very keen to read a book. I'm pretty sure I've reviewed it on the channel already. Can You Teach a Fish to Climate Tree by Jane Godwin. This is very similar to Incredible You except it's really focusing on asking the question, can a fish climate tree? Can something do something? And the answer for most of those is no because that's not within its skill set. It's not what it's designed to do but that doesn't mean that you can't be amazing and incredible if you can't do something that is well outside of the scope of what you can even attempt. And so this one was really about that growth mindset about looking at your strengths, identifying those and how you can leverage those to succeed in whatever you wanna succeed in. And the other book that they were desperate to read because I'd spoken to them about it last week and we were talking about the way our brain works with like just a general conversation. And I mentioned that I had a book called Your Brain is a Lump of Goo in it.  I have reviewed this on the channel. We finally read it and they were laughing so much. They like the humor in this is really pitched at the right level for year one, year two, year three students and they thought it was hilarious the way that the brain was talking to them and telling them about all the amazing things that the brain can do but in a very humorous, very approachable style. They were a bit disappointed because we didn't have time to read the nonfiction section at the back of the book which I did promise them we will come back to at some point but they did enjoy the humor of the narrative nonfiction part, which was great. It was also a really great way for them to start thinking about all the things that their brain does and that it's okay if it doesn't get everything straight away because it's doing a lot all the time because it was the week leading up to Lunar New Year. I read Our Family Dragon at the start of the week to them as sort of a lead into it. It was really applicable and really appropriate. They really enjoyed this one. They really enjoyed the illustrations. They were pretty excited to talk about the dragon and those people who had seen line dancing and whatnot before. So there was a lot of really great connections happening and so it was really, really lovely. And I think it's really nice to be able to tie in those cultural celebrations. We're appropriate in the classroom because it gives us the opportunity to connect and get to know other people in a different way. As for our class novel, The Wild Robot by Peter Brown, I have not reread this book in a while and I actually have the third book that I haven't read at all. So I've got that to pick up and read sometime soon. There's humor in it. It's a fun story. It's about a robot. So we're only about six chapters into it. As you know, after two days, we had the book in the classroom for two days and we're about six chapters in. They're very short chapters. They're like one to three pages long most of the time and there's illustrations through the book. The Wild Robot, if you've never read it, is about a robot called Rozz who is being transported on a cargo ship and in the very first chapter, we find out like the story opens with the cargo ship sinking and there are six boxes that manage to float to the surface and not sink and five of them crash against the rocks and all of the robot bodies inside are destroyed. And the sixth one ends up on a rocky ledge and some very curious otters come along and accidentally activate the robot inside the box and that's Rozz. Throughout the story, it is Rozz adapting to the environment that she finds herself in because they're on an island. There's really nothing around. There's not any humans, it's all animals and I'm very excited to continue reading this because there's a lot of enthusiasm in the class for the book and they like that it's short chapters so you can get through a couple of them in the five or 10 minutes that we have to share the class novel. So yeah, I think it's gonna be a really good one. All right, so that is the reading diaries for this week. I will leave all of these books linked down below so if you wanna find out more information you absolutely can. I'd love to know if you've read any of them or if you're planning on picking any of them up. Otherwise, feel free to leave a robot emoji to let me know that you're here. I hope the reviewer on the world is staying safe and healthy and I will see you in my next video. Thanks so much for watching. Bye everyone.


Hello and welcome to the session. In this session, we will discuss the following question and the question says, which of the following pairs of sets are equal sets? Part A is, A is equal to set of letters of the word late. B is equal to set of letters of the word tale. Part B is, P is equal to the set containing the elements 1, 2, 3. Q is equal to the set containing natural numbers less than 4. And part C is, A is equal to the set containing the elements P, Q, R and B is equal to the set containing the elements A, Q, R. Before we start solving the question, let us first recall what are equal sets? Equal sets are two sets which contain exactly identical elements. So this is our key idea for this question and using this key idea, we will solve the question. Let's start the solution now. In part A, we have A is equal to set of letters of the word late and B is equal to set of letters of the word tale. We shall first list down the elements of the set A. So set A in rosed form is equal to the set containing the letters L, A, T, E. We shall now list down the elements of the set B. So set B in rosed form is equal to the set containing the letters T, A, L, E. We can see that both the sets A and V contain exactly identical elements irrespective of their order. Now going back to the key idea, we have equal sets are two sets which contain exactly identical elements. So we can say that the sets A and V are equal sets. Therefore, we have A equals B. Now in part B, we are given that set P is equal to the set containing the elements 1, 2, 3 and Q is equal to the set containing natural numbers less than 4. We know that natural numbers less than 4 are 1, 2, 3. So set Q in rosed form is equal to the set containing the elements 1, 2, 3. We can see that both the sets P and Q contain exactly identical elements. So set P and Q are equal sets. Therefore, we have P equals Q. In part C, we are given that set A is equal to the set containing the elements P, Q, R and set B is equal to the set containing the elements A, Q, R. We can see that the element P belongs to the set A but it does not belong to the set B. That is, P does not belong to B. Also the element A belongs to set B but it does not belong to set A. That is, A does not belong to set A. Thus we can say that the elements of sets A and B are not exactly identical. Therefore, A and B are not equal sets. With this we end our session. Hope you enjoyed the session.


Join us every day this fair path term for Backgarden Bushcraft in partnership with Fjarrraven and Ellis Brigham.


Today, we're going to talk a little bit more about the shop right of Branchburg, New Jersey and specifically their shop at home service.  Last year, we did a basic review of the Branchburg shop right. Our review was kind of middle of the road. It met our needs, but it was just okay. Everything really stood out as outstanding. In one case, if we ever needed to get something at 11 o'clock at night, they were open until midnight, which is a little bit rare out in the western half of New Jersey. You know, it's good if you have a crisis, oh my God, we need milk.  But the whole crisis that we've been in recently has kind of put the shop right supermarkets that we go to to the test because now we have a new feature to test that. We didn't use the shop at home. We always like going shopping in person because you get the touch, feel, look and analyze. You can't really do that online, which kind of stinks. But at this particular shop, our orders have come up a little empty a lot of times. You might buy a $200 order online and by the time you pick it up, it's 100 bucks or even less. I'm not sure why that is. It could be because maybe they have these bad food pickers and they just don't, are too lazy. They don't know how to find the product that you're looking for. Because we don't buy 100% easy to find or common items. Or maybe they just had bad inventory and they somehow just didn't get their shelves restocked. But as a comparison, we've had amazing success at the shop right, which is about, I don't know, 20 minutes south of there in Hillsborough. They have everything, almost everything. I think I had my first substandard order a couple of days ago. It was just missing like three or four items, but that's fine. I guess the day of the week matters too. Maybe I should find out when they get their deliveries. But overall though, the shop right in Branchburg, it meets your needs for the most part. You should always have backup plans, but they have a nice little area there. It's easy in, easy out, but we'll still never wear a mask because, especially when it's 100 degrees out, why do people, they wear their mask in the car, from the car, into the parking lot. They're like 100 feet away from the next person. I don't care. We're not going to see the interior of another supermarket or store until this thing goes away. I know a lot of people don't want it to go away, but whatever. We'll see what happens. Maybe there's some brilliant plans in the works, but if you liked this video, please hit the subscribe and the bell. I mean, we do three videos a week. You're not going to get harassed by us, and we don't bother you with marking. So I'll see you next video.


Hello, everybody, and thank you for joining us today at the Virtual Vertica BDC 2020. Today's breakout session is entitled, The Road to Autonomous Database Management, How DOMO is Delivering SLAs for Less. My name is Sue LeClaire. I'm the Director of Marketing at Vertica, and I'll be your host for this webinar. Joining me is Ben White, Senior Database Engineer at DOMO. But before we begin, I want to encourage you to submit questions or comments during the virtual session. You don't have to wait. Just type your question or comment in the question box below the slides and click submit. There will be a Q&A session at the end of the presentation. We'll answer as many questions as we're able to during that time. Any questions that we aren't able to address will do our best to answer them offline. Alternatively, you can visit Vertica forums to post your questions there after the session. Our engineering team is planning to join the forums to keep the conversation going. Also, as a reminder, you can maximize your screen by clicking the double arrow button in the lower right corner of the slides. And yes, this virtual session is being recorded and will be available to view on-demand this week. We'll send you notification as soon as it's ready. Now let's get started. Ben, over to you. Greetings, everyone, and welcome to our virtual Vertica Big Data Conference 2020. Had we been in Boston, the song you would have heard playing in the intro would have been Boogie Nights by Heatwave. If you've never heard of it, it's a great song. To fully appreciate that song the way I do, you have to believe that I am a genuine database whisperer.  Now, as cool as they may sound, 3 a.m. Boogie Nights are not sustainable. They don't scale. In fact, today's discussion is really all about how DOMO engineered the end of 3 a.m. Boogie Nights. Again, welcome. I am Ben White, Senior Database Engineer at DOMO, and as we heard the topic today, the road to autonomous database management, how DOMO is delivering SLAs for less. The title is a mouthful. In retrospect, I probably could have come up with something snazier. But it is, I think, honest. For me, the most honest word in that title is road. When I hear that word, it evokes, for me, thoughts of the journey and how important it is to just enjoy it. When you truly embrace the journey, often you look up and wonder, how did we get here? Where are we? And of course, what's next, right? Now, I don't intend to come across as too deep, so I'll submit that there's nothing particularly prescient in simply noticing the elephant in the room. When it comes to database autonomy, my opinion is then merely, and perhaps more accurately, my observation. Let me offer some context.  Now imagine, someone promised all these users that we could deliver BI leverage at cloud scale in record time. I know what many of you should be thinking, who in the world would do such a thing? That news was well received, and after the cheers from executives and business analysts everywhere, and chances keep calm and query on, finally starts to subside. Someone that turns and asks, that's possible. We can do that, right? This is no imaginary place. This is the very real challenge we face to DOMO. Through imaginative engineering, DOMO continues to redefine what's possible. The beautiful minds that DOMO truly embrace the database engineering paradigm that one size does not fit all. That little philosophical nugget is one I would pick up while reading the white papers and books of some guy named Stonebreaker. So to understand how I and by extension DOMO came to truly value analytic database administration look no further than that philosophy and what embracing it would mean. It meant really that while others were engineering skyscrapers, we would endeavor to build data neighborhoods with a diverse topology of database configurations. This is where our journey at DOMO really gets underway. Without any purposeful intent to define our destination, not necessarily thinking about database as a service or anything like that. We had planned this ecosystem of clusters capable of efficiently performing varied work loads. We achieved this with custom configurations for node count, resource pool, configuration parameters, et cetera. But it also meant concerning ourselves with the unintended consequences of our ambition. The impact of increased DDL activities on the catalog system overheads in general. What would be the management requirements of an ever-evolving infrastructure? We would be introducing multiple points of failure. What are the advantages, the disadvantages? Those types of discussions and considerations really help to define what would be the basic characteristics of our system. The database itself needed to be trivial, redundant, potentially ephemeral, customizable, and above all scalable and we'll get more into that later. With this knowledge of what we were getting into, automation would have to be an integral part of development. One might even say automation would become the first point of interest on our journey. Using popular DevOps tools like Softstack, Terraform, ServiceNow, everything would be automated. This included everything from larger, multi-step tasks like database designs, database cluster creation and reboots to smaller routine tasks like license updates, moveouts, and projection refreshments. All of this cool automation certainly made it easier for us to respond to problems within the ecosystem. But these methods alone still left our database administration reactionary and reacting to an unpredictable stream of slow query complaints is not a good way to manage a database. In fact, that's exactly how 3 a.m. boogie nights happen. And again, I understand there is a certain appeal to them. But ultimately, managing that level of instability is not sustainable. I mentioned an elephant in the room. Brings us to the second point of interest on our road to autonomy. Analytics, more specifically, analytics, database administration. Why are analytics so important? Not just in this case, but generally speaking, I mean, we have a whole conference set up to discuss it. Domo itself is self-service analytics. The answer is curiosity. Analytics is the method in which we see the insatiable human curiosity. And that really is the impetus for analytic database administration. Analytics is also the part of the road I like to think of as a bridge, if you will, from automation to autonomy. And with that in mind, I say to you, my fellow engineers, developers, administrators, that as conductors of the symphony of data, we call analytics. We have proven to be capable producers of analytic capacity. We take pride in that and rightfully so. The challenge now is to become more conscientious consumers. In some way, shape or form, many of you already employ some level of analytics to inform your decisions. Far too often, we are using data that would be categorized as nagging, perhaps your monitoring flow queries in the management console. Better still, maybe you consult the workload analyzer. How about a logging and alerting system like Sumo Logic? If you're lucky, you do have Domo. But you monitor and alert on query metrics like this. All examples of analytics that help inform our decisions. Being at Domo, the incorporation of analytics into database administration is very organic. In other words, pretty much company mandated. As a company that provides DI leverage at cloud scale, it makes sense that we would want to use our own product to be better at the business of Domo. Adoption of stretches across the entire company. And everyone uses Domo to deliver insights into the hands of the people that need it when they need it most. So it should come with no surprise that we have, from the very beginning, used our own product to make informed decisions as it relates to the application-backed engine. In engineering, we call our internal system Domo for Domo. Domo for Domo, in its current iteration, uses a rules-based engine with elements of machine learning to identify and eliminate conditions that cause slow query performance. Pulling data from a number of sources, including our own, we could identify all sorts of issues like global query performance, actual query counts, success rate, for instance, success as a function of query counts, and, of course, environment timeout errors. This was a foundation, right? This recognition that we should be using analytics to be better conductive of curiosity. These types of real-time alerts were a legitimate step in the right direction. For the engineering team, though, we saw ourselves in an interesting position as far as Domo for Domo. We started exploring the dynamics of using the platform to not only monitor and alert, of course, but to also triage and remediate. Just how much autonomy could we give the application? What were the pros and cons of that? It's a big part of that equation, trust in the decision-making process, trust that we can mitigate any negative impacts, and trust in the very data itself. Still, much of the data comes from systems that interacted directly and, in some cases, indirectly with the database. By its very nature, much of the data is past, tense, and limited. You know, things that had already happened without any reference or correlation to the conditions that led to those events. Fortunately, the Vertica platform holds a tremendous amount of information about the transactions it had performed, its configurations, the characteristics of its objects, like tables, projections, containers, resource pools, etc. This treasure trove of metadata is collected in the Vertica system tables and the appropriately named data collector tables. As of version 9.3, there are over 190 tables that define the system tables while the data collector is a collection of 215 components. A rich collection can be found in the Vertica system tables. These tables provide a robust, stable set of views that let you monitor information about your system resources, background processes, workload and performance, allowing you to more efficiently profile, diagnose, and correlate historical data such as load streams, query profiles, tuple, mover operations, and more. Here, you see a simple query to retrieve the names and descriptions of the system tables and an example of some of the tables you'll find. The system tables are divided into two schemas. The V-catalog schema contains information about persistent objects and the V-monitor schema tracks transient system states. Most of the tables you find there can be grouped into the following areas, system information, system resources, background processes, and workload and performance. The Vertica data collector extends system table functionality by gathering and retaining aggregated information about your database cluster. The data collector makes this information available in system tables. A moment ago, I show you how you get a list of the system tables and their descriptions, but here we see how to get that information for the data collector tables. With data from the data collector tables and the system tables, we now have enough data to analyze that we would describe as conditional or leading. Data that will allow us to be proactive in our system management. This is a big deal for DOMO and particularly DOMO for DOMO because from here we took the critical next step where we analyzed this data for conditions we know or suspect lead to poor performance and then we can suggest the recommended remediation. Really, for the first time we were using conditional data to be proactive in a database management. In record time, we tracked many of the same conditions that Vertica support analyzes via scrutinized, like tables with too many projections or non-partition fact tables, which can negatively affect query performance. And like the Vertica enviromental suggests, if a table has a date or a time staff column, we recommend the partitioning by the month. We also can track catalog size as a percentage of total memory and alert thresholds can trigger remediation. Requests per hour is a very important metric in determining when to trigger our scaling solution. Tracking memory usage over time allows us to adjust resource pool parameters to achieve the optimal performance for the workload. And of course, the workload analyzer is a great example of analytic database administration. I mean, from here one can easily see the logical next step where we were able to execute these recommendations manually or automatically via some configuration parameter. Now, when I started preparing for this discussion, this slide made a lot of sense as far as the logical next iteration for the workload analyzer. Now, I left it in because together with the next slide, it really illustrates how firmly Vertica has its finger on the pulse of the database engineering community. In 10.0's management console, ta-da, we have the updated workload analyzer. We've added a column to show tuning commands. The management console allows the user to select to run certain recommendations, currently tuning commands that are allowed our analyze statistics. But you can see where this is going. Using DOMO with our Vertica connector, we were able to then pool the metadata from all of our clusters. We constantly analyze that data, creating a number of known conditions. We build these recommendations into scripts that we can then execute immediately via actions or we can save it to a later time for manual execution. And as you would expect, those actions are triggered by thresholds that we can set. From the moment Neon Mode was released to beta, our team began working on a serviceable auto-scaling solution. The elastic nature of Neon Mode's separated storage and compute clearly lent itself to our ecosystem's requirement for scalability. In building our system, we worked hard to overcome many of the obstacles that came with the more rigid architecture of enterprise mode. But with the introduction of Neon Mode, we now had a practical way of giving our ecosystem at DOMO the architectural elasticity our model requires. Using analytics, we can now scale our environment to match demand. What we've built is a system that scales without adding management overhead or unnecessary costs all the while maintaining optimal performance. Well really, this is just our journey up to now. And which begs the question, what's next? For us, we expand the use of DOMO for DOMO within our own application stack. Maybe more importantly, we continue to build logic into the tools we have by bringing machine learning and artificial intelligence to our analysis and decision making. Really to further illustrate those priorities, we announced the support for Amazon SageMaker AutoPilot at our DOMO Prolucid conference just a couple of weeks ago. For Vertica, the future must include in database autonomy the enhanced capabilities in the new management console to meet our clear nod to that future. In fact, with a streamlined and lightweight database design process, all the pieces would be in place to deliver autonomous database management itself. We'll see. Well, I would like to thank you for listening. And now of course we will have a Q&A session, hopefully very robust. Thank you.