All right, let's start. Hello, everyone. My name is Tomah Rosa. I've been a Fedora contributor for more than three years. And I've been mostly working on DNS related stuff in the network space. So today I'd like to explain the DNS like from high level and the changes we're trying to make in Fedora. So let's start. During this presentation I'll cover why DNS is important, is important, and why we should care. What is the change in Fedora all about, how it works, and what is the integration in Fedora products. I've been working on one station server cloud and not everything is finished yet, but what are our plans. So why is DNS so important? Hopefully all of you know what DNS is. It's a distributed database that is able to store various types of data. Usually IP addresses are used for translating domain names to IP addresses, but that's not the only thing you can store in DNS. You can store also different types of data. For example, as I call them, trust data. Data you can use for verification of, for example, certificates or remote books, fingerprints and stuff like that. So for example, TLS resource record can use for verifying remote host TLS certificate. SSH fingerprint you can use for verifying remote host SSH fingerprint. So you don't have to be tasked to answer if that fingerprint presented by the remote host is really the one it should be. So it can be verified by the SSH client automatically. IPsec keys, for example, I know Paul is trying to do some opportunistic VPN tunnels and stuff like that. So in the ideal world, if you are trying to connect to some remote server, first you look up IPsec keys. So of that server, create a tunnel, that server will look up your IPsec keys and you can start communicating over tunnels. Then there is the third resource record you can use, for example, for storing PGP certificates and there is the certification authority authorization resource record you can use for like restricting which certification authorities can issue certificates for your domain. So this opens possibilities for new kinds of applications, like I said, like opportunistic VPNs, VPN tunnels. Then SSH clients can automatically verify the remote host fingerprint and so on. But with plain DNS, it doesn't make sense to get those data from DNS database because with plain DNS there is no data integrity mechanism and no data authenticity mechanism. So plain DNS is vulnerable and suffers from various types of attacks, main-to-middle attacks, cache poisoning attacks, spoofing attacks and so on. And also, in usual situation, DNS works over UDP so it is really easy to spoof the client's IP address or server's IP address. So this is why DNSsec was introduced. It stands for DNS security extensions. It's just an extension of DNS protocol so all the implementations that don't have DNSsec implemented should just ignore all those extra data in the responses and all those extra flags. DNSsec provides data authenticity and integrity in DNS world and it uses asymmetric cryptography. Basically, all the data that you are using DNSsec are signed using asymmetric cryptography and keys and then you can verify the server responses by building the chain of trust from the root zone and by using the well-known key used by the root servers. So you can build the chain of trust from root zone to the host name you are trying to resolve and verify that the response is really the one it should be and that no one messed with the response. Or you can find out that there is no such a domain name and you can be sure that this is the response from the alternative server. So now we know why is this important to have DNSsec so what's the change all about? We are trying to focus on the client side and by that I mean the applications client side. Everything works pretty nicely on the server side but when it comes to for example mobile machines and clients there is really not that much support built into applications. So we are trying to basically integrate multiple components on the system so they can be installed by default in Fedora and provide some extra security. These components must respond to different network configuration changes and do some other stuff. So we are trying to have a local magnetic resolver on the system installed by default and running by default. This will allow us to provide some extra security from DNS point of view to the applications that don't even care for example your web browser. It doesn't have to fetch any like trusted data from DNS but even though it can be sure that your internet banking domain name was translated to the right IP address and it was very fun. Applications that do care like SSH client or if the browser wants to do the TLS certificate verification using the TLSA record they should use preferably some validating DNS API. For example get DNS or leave unbound or something else because you could rely on the locally running validating resolver but you can never be sure or can make sure that there is such a resolver running and that it was configured properly. And all the libraries you are using for example GWPC is kind of broken from DNS point of view so if you do care about security preferably you should use some better API for DNS. So how it works in Fedora? In Fedora we are using three main components network measure since it's used by default in Fedora as a network configuration manager. We use it as for notifications about network configuration changes and for all the data about current network configuration. Then there is the unbound server which is validating DNS resolver. It's used basically for the name resolution and it does the validation. Unbound is kind of special because it was developed with DNS in mind from the beginning and its purpose is to be like not a Swiss knife as a DNS mask but rather just a resolver solving its purpose. Then there is a DNS trigger. DNS trigger is kind of integration component between unbound and network measure. It does dynamically reconfigures unbound base on the current network configuration. So you can imagine like a network measure on the top which on every network configuration change notifies DNS trigger that there is some change. DNS trigger uses a standard network measure provided in the library to fetch all the current network configuration from it and it tries to figure out if it should reconfigure unbound in any way. It gathers for example default configuration, default connections, what are the DNS servers provided by the default connection, if there are any VPNs, what are the domains provided with those VPNs, name servers and so on. DNS trigger then when it gets all the data it does some performance various tests. For example for unbound to be able to do the validation it needs to be configured properly with proper set of DNS servers. Those DNS servers have to be able to provide all the data necessary for the validation. So this is what DNS trigger tests for. Those network provided DNS servers are capable of providing all the data that are necessary. If this is not the case it can try if it's possible to reach alternative servers on the internet. If that's not possible it can try if it can contact Fedora infrastructure. Because in Fedora infrastructure we have DNS results running on TCP port 80 and also on port 4143 and they are using SSL. So it tries to tunnel all the DNS communication to the Fedora infrastructure. It does not possible it should basically inform the user that something serial broken. Then when all those tests are performed unbound is reconfigured so it reflects the current network configuration. Currently we support split DNS view VPNs so if you connect to your VPN and the VPN provides you different set of name servers and some domains and the VPN is not configured to be used for all resources. But just for the resources from the VPN network it configures special forward zones in unbound so that VPN provided name servers are used only for VPN from the domain from the VPN. Then we are configuring forward zones also for private IP network ranges so you are able to do the reverse resolution of IP addresses. Then we have a couple of fallback mechanisms like I said full recursion and then DNS or TCP or SSL. Basically you can set up your own infrastructure if you don't trust Fedora infrastructure but by default we are using Fedora infrastructure for that. There is also upstream infrastructure from the upstream of DNS sector here. Okay so what's the integration in Fedora? In Fedora we have different products for some time and those products have different audience. Therefore after some pretty long discussions on Fedora. At least we figured out that we need to provide specific configurations because known folks were not really happy about the changes and the user interface DNS sector either provided. Also we figured out that there are a couple of integration points we need to solve and then maybe solve differently in different products. For example get the portal detection, get the portal handling, login handling and then the user interaction. So what are the common things? In the beginning there was a DNS sector panel that was not really user friendly but it worked and it was installed by default. Fedora workstation product didn't like it so we split it into separate sub-package so it's not installed by default. And we made some changes so that we don't need to do any extra user interaction but we left everything up to the workshop. Then get the portal detection, it's now turned off. Currently only in Fedora workstation but it will be most probably turned off on every product and every variant. We will rely on network measure because network measure is doing basically exactly the thing, maybe something more that DNS trigger was doing when detecting the captive portal. And for that we will need some notifications on connectivity state changes from network measure. That's not yet available but network measure developers promise to provide this functionality. So like network measure dispatcher notifies you on network configuration changes. It will notifies us on connection state changes for example if the internet is reachable or if there is a captive portal and so on. So Fedora workstation we completely turned off the captive portal detection and logging functionality because not shall already implement this and basically it didn't work really well because there were some race conditions. We are doing no user interaction but we want to provide some way to easily configure some notifications if you really want to. Developers don't want to bother users with some notifications that may confuse them or the user may not even understand what does it mean. For example when all the fallback options fail and we are switching to some kind of insecure mode from the NSF point of view the user may not understand what are the implications and may get scared, something like that. So therefore we also not to get rid of the need for user interaction when all the fallback options fail. We got rid of the basically UI for that and we are doing the automatic switch to insecure mode all fallback options fail. This is basically the switch to insecure mode means that you are basically in the state that is currently in Fedora. So we are not doing any NSF validation. So does the user have any way of knowing that they've fallen back to NSF? So if I'm a user of Fedora workstation and I think I'm using the NSF and then I walk to a cafe or whatever and something fails and we go back to the insecure mode. Actually we as the change developers we think that user should be important. But all developers have different opinion about this but by introducing the possibility to automatically switch to insecure mode because the NSF trigger didn't have that before. I also added an option to run some command on switch to insecure mode. So it is easily possible and it will be commented out in the configuration to send a notification window to Inoxia so you can be notified like now I switch to insecure mode. And the insecure mode automatic switch can be disabled so it will not happen at all. And the applications will actually know because they're not getting the NSF data anymore. So they'll actually know that something's wrong. If they care they will know. So maybe we'll figure out some good notification that is digestible for the user and also for the developers. But right now we agreed not to do any notification which is not really good from our point of view but everything silently fails and you are losing the security but it doesn't seem like a priority for workstation. So for cloud we basically just started discussions. We think that the trustee resolver makes sense at least on the host where you are running containers because containers running on that host can reuse the locally running resolver and get extra security even though they don't care or are not aware of it. So for sure it doesn't make sense to have a local resolver on the images themselves because you don't want each container to run a separate resolver. The problem is that Docker currently is not able to use the locally running resolver. It works in a way that if the host result contains some IP address different from local host the Docker will copy the IP addresses to the containers result call. But if there is local host address it will put Google's DNS servers IP addresses in the containers result call. Which is basically the easiest way to solve this and it works but it's not the most clever thing to do. Does it do all local host or like if you were to change 127.001 to 127.002? I think it's like 127.8 so anything from the sublet is basically not. We proposed like some easy hack using IP table rules to forward all the DNS queries from containers to the locally running resolver. But the upstream wants to solve it in the more proper way by implementing some DNS proxy. And they are not really sure when this will be available or how this will work. The communication is kind of slow and we are not sure how to solve it in Fedora without the upstream really improving the fix for now. So the discussion is still ongoing. For the server there is the question of configuration in the server environment. You don't have that many like network configuration changes and most probably everything is statically configured. So the DNS trigger part may not make sense in server. But if you use it you get like the value of not having to manually configure anything because it will automatically configure and load. Even though it will be just once when you boot up the server. And also there is the DNS trigger control tool that substitutes the user interface in command line interface in command line. And that's usable for getting data like what's the state, what are the outcomes of the best performer by DNS trigger and basically for switching to different modes. This tool is included by default on any product but it makes more sense in environments where the command line tool is like the most usual way of interacting with the system. So for other variants for example as I said don't shall provide some user interaction and hotspot login functionality. But for other variants some spins that don't provide this it will be necessary to install the DNS trigger panel sub package for the user interaction. And as for the rest it should be all the same as for other products. So to summarize DNS trigger on client side opens new possibilities. Like I said you can store some special data in DNS and right or enhance your client applications to use those data to for example validate remote host certificate or some fingerprint or to build some VPN tunnel to the host. The changes we are doing are mostly consisting of tightly integrated set of components, network manager, unbound and DNS trigger. We are providing different configuration for workstation but we are open to like suggestions if there are other things that should be different. We can provide different configuration also for other products or variants. Basically I forgot to mention that by using DNS like some 30 hex that were commonly used with plain DNS will stop working. For example in the past if you used just network manager and you connected to VPN. Network manager put the VPN and DNS servers on the first place in the result call. So even though the VPN was configured to be used only for the resources from that VPN network those VPN provided DNS servers were used for all DNS queries. So this was privacy leaking basically but it worked. So if you didn't list all your domains when you connected to VPN it worked in that way but now it will stop working because if you don't list specifically all domains from the VPN those queries not from the listed. From domains that are not listed will not be provided to the VPN. Also some like if you connected to some pipeline on airport and they are using their own top level domain that doesn't exist it will not work because they are basically making up their own records that don't exist. So you can get like cryptographic proof of non-existence of that top level domain but they are still claiming that there is such a domain. So if you are using DNS like this is basically an attack so you will not trust their answer. I like that. That's a good thing but you know a lot of users are used to things working and by introducing new countermeasures for security you are breaking those things that were basically misconfigurations or misinterpretations of RFCs. But now for $180,000 you too could have your own top level domain. Right so why not to buy them. So I would like to ask you to test the NSEC trigger if you didn't yet in Fedora and provide us some use cases for which it doesn't work for you. Not all use cases you had may be valid. So I will tell you that you should change your configurations. So hopefully there will be some place where I can share the slides with you so we can go through some links or Fedora VK if you are interested in some design documents we put together after having to explain over and over and over and over again like what is DNS like all about and what is the change all about and why I think it's important and stuff like that. So that's basically everything from my side. So when you were talking about the cloud host so are you saying that the DNS set result wouldn't be included in the cloud image? I think it doesn't make sense to include it in the image. Yeah I agree I just want to make sure that's not included because the way it's been presented on the mailing list it seems like you guys are trying to put the DNS set trigger in the cloud image as well as in the comic host which I don't think makes sense. Actually I don't think there was any previous discussion but just this week BJP sent some email to Fedora cloud mailing list and to be honest I didn't go through the email but if he claimed that we should include it everywhere that's not true. So what I mean to say is that on all containers it would not be included because then if you run a thousand things in one host you're running a thousand times 15. Yeah that's what I thought about the cloud image especially because you're paying. Yeah that's the idea. There is of course some trigger between you have to then start to trust a host you're running on for DNS between the local host tag. Because you're outsourcing the trust of your DNS from within your container so in theory you're vulnerable to the host compromise. I mean but you're already outsourcing your computation storage network so like they can just do anything they want with you when you're over there. But having the local auditing resolver on the host I think it makes sense to have it there. Can you define cloud image because I'm thinking of cloud based image which is just like a disk image that you boot and then like you mentioned a thousand different versions of it running which makes me think you're talking about a docker image. So what are we talking about. So I'm talking about the cloud image that gets turned into the ANI. But there would be a thousand different versions running if you include it in that. But look in a normal cloud if you run anywhere between the honor and service and it doesn't necessarily make sense because a lot of cloud providers provide network isolation and you get control over it. You get control over DHT so you can run there. So with each VM instance you're talking about it would run not necessarily if containers were running on top of the VM. The cloud image if you're already setting up your image in like an AWS or a Rackspace it doesn't make sense to include the trusted resolver there because if you want a trusted resolver there's a more efficient way of doing that external to the image. By dealing with like the network can fade around it. In like your DVC or your Rackspace get it private. And so I just think that including the cloud image doesn't make a lot of sense because then you've got a bunch of DNS instances running inside of the environment you've already controlled in DNS 4. And it's just wasteful on the resource. And you don't want to run a thousand on a VM so long because it's a hardware. And so I don't think it makes sense to run it. You mentioned atomic host. You say it does make sense there or it doesn't. Because like we currently do atomic host for bare metal and atomic host for cloud and right now they're kind of the same bits almost.   Like you know you're almost using the container host is becoming like a second. It's becoming your infrastructure. Fewer really easy atomic hosts even if you're running them in cloud. And so I feel like it would be less wasteful for running them down there. Because for the number of tenants you're serving like the point of containers that you can serve way more tenants on the same hardware. And so I feel like for the cloud if you're just using cloud and not those of the containers you're going to be running a lot of them because that's probably how you're separating them. Whereas with the atomic host you're sharing for a long time. So it seems like it makes sense for atomic hosts on the Bermacol but it doesn't make sense. He's saying it depends on where you divide the services. Because if you're doing it with a traditional cloud image then you're probably going to spin up a ton of those cloud images to do their own things. But if you do it on atomic host even if atomic host is hosted in the same cloud situation you're probably breaking up a bunch of different containers on top of that atomic host. So you would only have one DNS second resolver on that atomic host for a lot of different services. Versus in the traditional cloud case where you probably have a bunch of different VM instances and each of them have their own resolver. So you might have 10 atomic hosts with 100 containers each. So you're only writing 10 instances of that whereas if you were to secure VMs you'd have 1000 VMs of 100,000. Like it has some implications on its own to have to unload there. You can save some by caching, you can save some time and bandwidth but it is still running there so it's consuming memory and CPU time. Yeah, because if you're running in a standard cloud environment you're running a one web server with maybe some of the similar processes that are there. And then you're running one on-down for every instance of the web server that doesn't have as much time as running 100 web servers and 100 containers all sharing that same memory. Yeah, that would be good. Because the process can do its own DNS caching. You're not simply here just single host. And that's not a big deal because you've got a bunch of processes in here. Sorry for being the, like, if the email was... Yeah, I will reply with this to the mail-in. So I was working on this one this morning. But I just had not done my own complete session. Okay. Yeah. I mean not having known anything really about DNS stack much before this is what we have now kind of an in-between step before larger infrastructure gets in place for DNS stack. And at what point in the future does the current implementation go away? Right, so like... You keep the DNS result very on the local host forever. Forever? Yeah, because it does caching through the whole machine. Okay. None of them have caching. There's a lot of confusion that happens now. Like, Firefox has caching. It's an network. It may work. Firefox doesn't. I know... System... I saw Leonard talk recently about something similar to this where... Yeah. You didn't want each application to do its own caching of DNS, so there was some system D service. System D is doing some tunneling of DNS over a deep bus back and forth. Uh-huh. Yeah. Yeah. It's hard to sort everything out, like, and understand, like... There is a DNS product called the Works of both 53. Yeah, I'm marching through a lot of us. Marching DNS into any other format seems to be... It's a well-known host too, format. Just running over work, if you think. And ResultD doesn't support DNS stack yet. And from Leonard's talks and from what I discussed with them or asked them, they are trying to do... Or they are planning some kind of best effort DNS stack. So we are trying to do all those fallback options, like trying to do it for a garden or tunnel DNS over TCP, but their plan is not to do any of those fallbacks. So if the network provided DNS servers don't support DNS stack, they will just turn it open. Yeah. That works. So... So without... I'm not the only one listening, are you with that? Yes. Okay. Because I have an interesting... I've been able to sit down over there for you since... Yeah. Actually, it works pretty nicely also with... With manager and... I'm, like, running three instances of DNS mask for... For VMs. Yeah. And I have, like, unbound running and... Yeah. It's just unbound. On the loop back, having been being listened on for... It's certainly... It's certainly helpful to be able to explain it with integration. Yeah. But other than that, it's a... A config file. Yeah. It should work out well. Well, I need to read it. Yeah. Can you guys do the work? It's a system that I want to use. No, I think... And then... More specific bind. Yeah. Exactly. And local policy meaning that anything that's not... That's the only way. Okay. For example, bind in depot configuration with Fedora. It's also listening on local. So it works perfectly. Well, because it's still listening... You know what you see better, huh? You'll actually listen on with...  Actually, bind... We ship, like, depot configuration with bind. Yeah. Fedora policy that you're not allowed to... So it can stop the beam and it listens. It has to be on the local. Right. Unless you manually re-configure it.  You don't have to stick in the depot config file. If somebody were just going to turn it on... Yeah. You can install two Vienna servers. Oh, yeah. And they're like... What is this going to take? One-to-one factory installed where it was optional. Yeah. And the problem is to be aware of that's only there. Yes. I'm trying to prevent users from shooting themselves in the foot-out. Right, yeah. They won't... No, they won't. No, they won't. Let's hope you don't, like, I'm afraid of it. No, not the way you understand what I'm holding in my hand. You know what I mean. Nobody's going to listen to you. We don't want to have, like, more open resolvers on the internet and, you know, to help with the denial of service attacks and stuff like this. Nobody asked Fedora in-house. And someone will be like, this is what's going on, and then they'll just be up over to the top and they'll just be stuck there forever. So back to the scope of your DNS. So you're saying that that's going to work out of the box if you have network manager configured directly for your VPN? Because in a lot of cases right now, I'm just setting up the DNS mask myself manually and setting it back to your result com. So then setting the domains for the... Right. If the VPN provides all the domains like, for example, if I connect to Redhead VPN provided on the redhead.com and some set of DNS servers, DNS mask automatically configures unbound to forward like varies from redhead.com to that set of DNS servers and for everything else, it uses different... So it depends on your upstream VPN configuration, though? Yeah. Some VPNs don't, by default, give you DNS. Okay. Do you set it in network manager? No. And also it depends on the type of VPN you are using because if the VPN implementation is not communicating with network manager, we are fetching all the information from network manager. So if network manager is not aware of your VPN, then we will not configure it. So key news... But currently some VPN solutions do it directly with... Yeah. But also I think open VPN... If you get a system VPN, you will find that it has a kernel model that blocks a resolve account and then... No. It's a horrible thing. Sorry. You mean the Cisco VPN software? Yeah. Of course you can have all the resolution to the VPNs. It does bad tricks. You mean the proprietary software? Yeah. Yeah. Yeah. People have. People have. That's not necessary. So you can use the stock IP stack software which works fine. You can use another one like Juniper or...  You don't need... Those are all RFC-confined IP stack clients. You can just... Yeah. Only if you don't use any special feature but they have all their own special features only if you have a client. I've been running a lot of VPNs. Yeah. But I've seen situations where the... If you level up a patch with the... that you have to use, that won't become a bad specific feature. Sometimes it's corporate policy too. Those tricks. Corporate policy is a lot to allow for Dora and then mandate a binary only other VPN software. Okay. So there's one limitation currently to the DNS. You can only actually get one domain currently because the... For the 20 microseconds one because I only support one. Space one. So this... We're working on a graph together with Apple to actually extend this to be a list of multiple one. Right. But that's the limitation of the VPN software. Yeah. In reverse case where, for instance, I go to the customer and they've got their domain locally that's attached to the VPN or whatever. But I actually want to do all of my resolution on the road down and only do the resolution force one domain on the VPN servers working. The non-VPN. So you want the local, virtual, virtual, and one domain and everything else goes through the VPN? Yeah. If you configure your VPN to be used for all... for everything. Like done for... No, I mean like in network measure. When I configure in VPN I can like check the box to use the VPN all before resources from the network. So if I don't check the box network measure will prefer that VPN over any other connection. So it will be the default connection from our point of view and we are not distinguishing like between if it's VPN or just via network. So if you configure... How is it the local way? Right, yeah. You need to treat the local connection as a VPN as well. So the domain is connected to the local connection. Because they don't... The local VPN is just that domain. So you have the domain thing in the... Yeah. Actually we are configuring... If you're being used over people around then you're basically isolating your laptop from your local network. You're only connecting to the VPN. That's what it means. Exactly. The local network is simply a local network. It doesn't take over the local network. So... No, not that. If you say it's your local network. That's the problem. So currently we are configuring for our own support. Any... Domains provided by the wired connection. So it would be configured. But if there's like... Hopefully in domains so the VPN provided the same domain that the wired connection is providing the VPN would be preferred. Okay. Yeah, it would only be for probably somewhat fake. To only what they create on their local resources. Actually we have some... like... own solution for the situation where you connect to a wired network but the network provided DNS servers are not able to provide all DNS and data. So in the end you would not use them. But there may be... They may have different internal view of some zone. But so for the internal domain you want to use them anyway. So we have like module for unbound that can be configured with different set of name servers. So if the response from the internet was insecure basically meaning that the domain is not signed because we don't want to downgrade the security the module would ask the different set like local DNS servers for the answer. So what could you do for an extra domain if it's a local underdone? Yeah, you try the internet and you try the signed answer if you get un-signed answer you will try to ask also those local servers because they cannot tell you or provide you any signed answer for sure. So if you would ask them for every answer you would downgrade the security basically. Question, can you in your own environment can you have a subdomain that is explicitly not signed but approved to the main sign and then in such a way that a client knows that it is not signed but willing to sell. So you can actually ask where the DNSX will not be there. In such a way that there is no proof that it doesn't exist. So I think a lot of people that might want to live in DNSSEC think about a common or a party whatever. They might want to have it signed but they might have a cork temp or a subdomain where it is kind of far west and they don't want to sign that because And you don't want to publish the specific subdomain but I don't want to have any other recommended subdomain to actually Right, but you don't want to have like delegation or anything for the subdomain Well maybe, I don't know how You can delegate that subdomain to also to the same like a set of servers but and not having the so-called TS record like the delegated signer and by not including the record for that delegated domain you are saying that the domain is not signed basically. But you say that the domain actually exists But it exists but it is not signed because You can also use NSEC3 opt out and everything opt out is actually not covered so anything could exist in a range that isn't there So you can actually have your hidden domain name that is still going on Even just not signed I want to be able to say these are not signed subdomain but okay and this is non-existing you have to take action to actually save the subdomain so if you don't take any action for definition it remains unassigned as long as it is delegated yes because it if it's part of the same zone it has to be signed or not signed because you cannot have half signed zone I think it will be common to find things like that outside zone half signed zone is not technically possible because you are including also the proof of non-existence of some names so it will be then like so you have to explicitly acknowledge that unsigned subdomain and you will get like proof of non-existence of DS records for that subdomain and by that you know that it's not signed basically because there is no such record so you are not able to build chain of trust To be honest we are the only ones based on the DNS sector you are mailing yes we are the only ones contributing to the project but there is a previous team who now for default installs hand down but they have sort of ignored all the hotspot problems I guess they don't have much of a laptop market they are mostly servers so they do install those for default so it is that people do not serve before them with validation they don't know what fund they are missing I think they installed actually what fund they are missing if you install a bind in deviant exclusively then it has gano-sempret default but it is not installed by default if everybody installs and any of them have that for default install bind or unbound and also in Fedora they all come with DNS like enabled but then you have then you have problems ideally you want to use never provided all name servers if possible so you do not use it but it is there as far as as far as for the server side by server side I mean bind when install bind unbound just to do the resolution DNS like enabled everywhere every time but if you want to use it on mobile you have problems because you can connect to network where all outgoing DNS communication to the internet is blocked and then you are screwed if you don't configure unbound correctly like to tunnel the communication or to use the local name servers alright thank you for coming


Jim let's begin with Trump's budget. Does it does this mean tax reform is over? Well, you know you submit a budget that's really a not rigorous budget and what happens is is that it sets back the process even more. When I say not rigorous I mean that it has a lot of assumptions that are just kind of unrealistic and now if you're really a Pollyanna and you come back and or you say that Trump is a deal maker and it wasn't the swamp on the other side you can say look I want this they come back with this and then we work together but that's not the way it works in Washington and I think he wants to make it so it's the way it works in New York and it's not so what happens is you just say wow that's not a non that's a non-starter so you're gonna have to do you know something again and it doesn't it's not a starting point is what I'm saying it's not a starting point and the assumptions aren't right so what happens is is that if you thought that there could be tax reform you set the calendar back so I no longer think anything good's gonna happen in 2017 and I felt that way before this which is why the stocks that are going up are the stocks that don't need the government's help


Basically, they replace the legacy incandescent and fluorescent lighting fixtures. We've dealt with this for decades now, the old legacy lights. They have ballasts, they have starters that are associated with the operation of those fixtures. With the installation of the LED lights, we actually minimize some of those associated gear that, of course, are additional costs. The LED lights increase the lifespan of the lightings. Of course, they reduce maintenance and spare part costs, as well as for storage spaces as well. Because if you have more reliable light bulbs, you tend not to store more of them.


We're being joined by Chris Cain Day and Wando for Off the Press. Chris, it's good to have you join us this morning, complement of a season. Thank you very much, thanks for having me. Good morning, I'm Eric Christmas in advance. It's alright then. Let's take a look at the punch newspaper this morning. Naira Depreciates and adds a night trillion Naira to foreign debt burden. That's a lot. We need to do something. I mean, we just wake up and there's a lot to deal with. There's a country. As local currency weakens by 53%, external debt increases by 288%. 53 is a pass mark. Nigerian needs strong productive economy, says economists. And we couldn't agree less. Tunibu takes campaign to the United Kingdom, Atikutrain Stomps Lagos. And then, you know, there was a video at the Chatham House where Kofi was actually talking about that. So I'm sure that our guest would be ready to answer all of the questions this morning and share his thoughts. Atikut appeals to Lagos voters.  And federal government not ready to fund versities. That's what asks this quarter to say. Again, you find Nigerian projects 1.8 million bios production in May 2023. I hope that we've been able to solve the issue of, you know, theft and what have you, all of that pipeline vandalism and others. Nigerians with NIN increased to 92 million, 92 million, all theft. Navy denies blaming NNPC. But really, it was very explicit. And you have Abuja Kaduna train records low pass and a turnout, but you wouldn't blame the people. That's the much we can take this morning on the punch newspaper. All right, let's go to the next paper. Some very interesting, very interesting stories there. The next one I think we'll look at is the nation. Indeed, Tunibu points the way forward on power security. Others is a big one there. Shadum House, host APC candidate. L5, Waleh Edun, Project Biarmila Ayade, Alake, Beta Edu speak. Quite interesting. Of course, you will see that too. People speak. Very interesting indeed. Wiki attacks, Doga for parking at Tikku. Of course, the man has jumped from the APC to the PDPX speaker files back. XVP can see Buhari's achievements as government. More from the paper. I'll sell off refineries, raise $10 billion for SMEs. All right, how will that work? My guess will give us his thoughts. All theft. We didn't indict NNPCL, says Navy. Message, I don't know what we read yesterday. Wyatt is every election by Governor Somolu. He was in London. I'll carry the loop, presents $272.73 billion NARA budget. $130 billion NARA to fix federal roads. Quite interesting one. But the picture on the front page, you may see in the Chris Kane one, the picture on the front page of the punch, that the story basically talked about earlier, looking at the Abuja Cardinal train recording the passenger turn. Reminds me of this line from the last song, where he said, I know who won't die, I know who won't die. You know that song, right? Why not? I'm a huge fan. What he wants to go? May I see over to you? All right, let's turn our attention to another paper this morning, is a Daily Trust newspaper. And we'll just look at a few headlines before we move to the other one. Now, on the Daily Trust newspaper, Atikoo, I beg your pardon, Tunibu Tech's campaign to the United Kingdom, Atikoo Wars, Lagos, Voters, quite similar with what you have on the punch newspaper. How I'll tackle insecurity, energy crisis, ex-governor, is quoted to say, records of my background, age and education is consistent. I'll sell refineries to raise $10 billion employment fund. That's what the PDP candidate, of course, Atikoo has always wanted to sell the refineries. While Dane to end Tunibu's dynasty in Lagos, I love the word dynasty, Jando is quoted to say. Now, we'll move away from the board caption. You have another federal government, orders redeployment of prison officers who cannot shoot to kill, really. Bandits kill three policemen, orders in Sokoto, protect our facilities, Ineq begs Nigerians. Four nabbed as APC PDP clash over billboards in Quarra, but there's also another clash, you know, in the United Kingdom. It's just like we just take our wahala, go outside the exporters. That's the much we can take on the Daily Trust news people this morning. Interesting. Let's go to the final port, seven years after Buhari, after Buhari falters on 24 million jobs. Promise. It's a paper doing an investigative one there. Maybe something that people may have forgotten about. You can see a picture of Nigerians at the Abuja Stadium. Mosheira Biola Stadium, Abuja, applying for jobs. I think this should be when Godlock Jonathan was president, if I'm not mistaken, where you had this in 2014, where you had a stampede, I think Abamoro was a minister of interior time. The riders to that headline, NBS fails to release unemployment rates since 2020. That's Nigeria Bureau of Statistics. That's very worrying. And I try to remember when Yemi Kali left that seat as the head of the Nigeria Bureau of National Bureau of Statistics. Gige's claim of seven million jobs created unlikely. NDP 2021 to 2025 to create 30 million jobs in Miraj, says Yereindey. No honeymoon for who will take over from Buhari or Joe. It will require three governments to clean up this administration's mess. It's what another rider quoting someone is saying. In insecurity, COVID-19 others undermine efforts to lift 100 million out of poverty. So it's a focus by the paper on employment and poverty in the country. Interesting one there. FG decries of positions downplaying of Buhari's achievements. I'm ready to lead Nigeria. Tinibu says at Chatham House. So I'll read that again. I'm ready to lead Nigeria. Tinibu says at Chatham House. Nigeria, Morocco Gas Pipeline, NNPC, Science MOU with Ghana, the Gambia, Guinea-Bissau or oil companies from these countries. INEC Blast, sorry, INEC. Elections can't be conducted in an atmosphere of violence. An election, not a priority now as a nation, says Emmanuel. Final one from there.  We'll fire back Ibatiku Boys Attack G5 Governors again. At this point, let's bring in Chris Candy-Wandu for his analysis. Let's start with that story on the front page of The Guardian, Chris. I'm ready to lead Nigeria. Tinibu says at Chatham House. It sounds like a paradox that he had to go to Chatham House to say he's ready to lead Nigeria. But I think he can be forgiven because he had actually already said these in the country already. But some, I'm wondering why he's gone to London to face open questions from the public and an event not organized by his campaign team or in collaboration campaign team. There's a public forum, almost like a town hall. Has he done anything wrong by not opening himself up to the press here? He says, you know, we, the media in Nigeria want to use him to make money. That's why he's not been granted interviews. Over to you, Chris Candy-Wandu. Yeah, it's quite unfortunate that our people believe in everything for building our leaders. When any of them fall sick, instead of looking for a local hospital here they'll travel to London or US for treatment. If they want to spend their holiday there, they go abroad instead of going to Obudu, Katturant or Jaws or any of these tourist centers in Nigeria. So we love for him. That is what has taken us to where we are presently. We don't have a single product to export again. Even our oil that we're supposed to be exporting, we have an issue with seeds, with a number of tests and tests of them. And our debt profile continues to rise. It's just one of the papers saying that Nigeria's debt profile has reached about 9 trillion because of the situation of the Naira. They're breaking it back home to Singapore's attendants at Chatham House. And I continue as, what is this crazy about Chatham House? We have here in Nigeria, Nigeria Institute of Internal Affairs, NII. That organization has to render it useless. Are you to remember in those days of Professor Hizio Gousson, you all do this. I can't remember his name now. Actually, it's late. When NII became the epitome of our foreign policies, where our leaders go to martial art, they are manifesto, 10 Nigerians, what they're going to do about national relations and the rest of them. That has, it used to be somewhere in Papua Bayomi, in Victoria, I don't know whether it is still there. It's the years I've had about NII. But you see our people, every day killing themselves to go to Chatham House. And I continue to ask, there is nothing like that. We ask for voting in 2023. Those that are going to vote for this presidential candidate's appearance. So if you say you are going to Chatham House, what message are you going to say to Nigerians? They organize town hall debates in Nigeria, you don't attend. They invite you to professional bodies meetings for you to be able to ventilate your ideas. You don't attend. Then every single time we jump in and run to it. But it is left for Nigerians. And I've said it before, especially when it triggers to be presidential candidate of the ABC. ABC is taking Nigerians for granted. Whether I would like it or not. I'm not just talking as a media person, but also as a Nigerian. It's a situation where you are invited to tell Nigerians what to do for Nigerians.  It's really all right. But if I have to hire you for a job, then I must be able to get you into view so that I can know whether you have the capacity to give me the job you are asked to do. But Ashwajibola meant to you and his team. It doesn't seem to understand that. Or they just say that it was not necessary for me to speak to Nigerians or Nigerian media. Let's wait and see in 2023. But if you look at what's just passed at the Chattanoaxe, I guess, yes, he was due to clarify certain issues, including his academics and the rest of them. He said now the certificates from the University of Chicago, that there's no question about his birth and his parentage. And then when questions were thrown at him, at the time of the treatment, at some of those that went with him, I had the understanding.  Is he going to be the president of Nigeria? Is he going to be the president of Nigeria? We want to hear from the man that is going to be at the schedule of affairs. Because based on that, we're taking from his words, there were so many promises in 2015 by the APC and the presidential campaign. At the end of it, all they say were, when they thought that and asked, this is what he said, he said, no, this is to bring video evidence. So if to remove some of the things that El Rufai or Ayadeh or whatever said, come to the vote. I think people can deny, he never said that he was said by one of my aides or those that put up with me. So those are the issues. But he has attended the chat and I'll don't forget also that we're pro and pro and those that were against TNPP's protest yesterday at the PEPAM House. But it's becoming more like a circuit. So we are here as the media to give Nigerians all the necessary details. But it's come 2023, Nigeria has to make up their mind. And exit has no impact on this. Chris, let's take a look at the punch now. The punch talks about Naira depreciation and the fact that it has added 9 trillion Naira to a foreign debt burden. Now, recently, the Minister of Finance was saying clearly that Nigeria is not broke and that we're paying our loans. However, there's also the fact that our external debt has increased by 288 percent. Of course, the local currency. So with all of this, are we still not broke or are we about not to be broke? What's going on? What are your thoughts? I just look at the finance minister as the ostrich that very decent on the sound. We are the rest of his body exposed. We cannot say Nigeria is not broke and we're having this level of a debt profile 9 trillion. That is just part of what we have. From what we've had, we have a debt profile of close to about 30 trillion currently, and it may even be more. We are not even paying the debt. What we are talking about is that we are paying presently at the interest on debt. How does it continue like this? Essentially, we do the next show. We are not exporting enough. Our crude oil, we are not making much from it. We are not tapping into other areas like natural minerals and that Nigeria is well, we have in abundance. We are not looking at that area. So all we just want to export crude oil, even the prices of crude oil is not helping matters. Inasmuch as it's going with Nigeria, it's having serious export diversity. We can't even meet our opaque quota that's giving us the liquefied natural gas that's supposed to be hitting us so much. It's the second time that Ukraine and Russia is at war. We are not doing much about it. Look at every part of Nigeria now. We have Nigerians here for hours to five foot. A country that is so full in abundance of crude oil where we still go around having issue of petroleum because none of our refinery is working. When promises were made in 2015 that all will be revived and many more will be viewed. Not a single refinery has been built. So with the finance minister continuing to say that we are not broke. Well, I don't know what to say. This is not the first time they are saying it. After all, this same administration told us some months back that through his ministry of humanitarian affairs which has become a content pipe as far as I'm concerned to siphon money that they were feeding our children who were at home with us during the COVID and nobody asked any question about it. So any of them can come out and say it but the reality is not pointing to that direction. So then what's the significance of the redesign of the Nair in all of that? I mean a lot of pundits have said that it would mean a lot of positive or bring a lot of positive economic benefits. Does that also include strengthening the value of the Nair? Well, you cannot say the effect of the redesign Nair now until it comes into circulation it will come into circulation until 15th of December. So it is then that we know the effect whether it will make any developing part or not. Don't forget that what the Sibian is doing is to mop up the old Naira notes that since so many wrong hands and they feel that by so doing when it introduces the new Naira that it's going to have some economic effects on the Naira itself but I really doubt that as it were. The Naira cannot appreciate because we are not doing what we need to do once you remain an important country. There is no way your current is going to appreciate it. It's not even possible. How are you going to do that? So to be able to export more and be able to make more foreign exchanges which are the dollars, pounds and euros there is not going to be any level of there is not going to be any level of even Chico B or whoever the best of a mathematician or economist cannot say anything to the contrary. The best way we can be able to appreciate this Naira is making sure that we be able to export more and end more foreign exchange. All right let's look at the apathy as you know shown on the front page of the punch Abu Jaqaduna train records low pass so passenger turnout like I said you know quoting the lyrics of Fela song where he said everybody run run run everybody skata skata you know and he says we know one die we know one quench nobody wants to to to be the one that the federal government we used to test whether it's safe to travel on that route what do you say about is it too early to have opened the services and will you be encouraging people to get on that on that train just yet? You go and talk to the tree you go and talk Are they ask you sir? No, they're not I'll go and talk to you You don't go and talk Me I don't catch the ball I don't throw it back to you You're the one You're the one me But on the most serious you know that is expected there will be a lot of apathy on the passengers Coffee message also take a look into whenever you heard there was a plane crash in Nigeria, you see that in the last two weeks or three weeks, you'll be so afraid to fly any flight in Nigeria. You would rather take it now for this level of security. You would rather go by road from here to Medjugorje rather than taking anything. In fact, the airlines that affected, you'll be sure that nobody wants to, you remember what happened with them? What's that flight? Dana Air? Dana Air. For a month, people refused to fly Dana Air. I'll give you a classical example. It was just the art of God that I missed the Soliso flight that King Sebra students of Loyola University passed away and the rest of them. I was to fly, I was booked for that flight from Abu Dhabi to Lagos where that flight was supposed to go and route to Potakot and to Lagos. Unfortunately, I got there, I was already booked. But the airline, for whatever reason, had a book purchase booking from that school. Over a few years, about 80 students from that school came and those of us that already booked for that flight decided to refund us our money and because that flight, they're having more passengers on that Soliso flight. That was how I missed that flight. And less than one hour after that flight took off, it crashed. Probably I wouldn't have been talking to you today if not for the grace of God. But the effects of that crash affected me for close to two, three months. I refused to fly Nigeria. So it's the same thing that is happening, which takes some time. Confidence will be built and the people will start going on that train. But what I still believe and I hope that enough security will be put in place so that, likely, we will not strike a second time on that route. That's a very chilling revelation by you, Chris, can they want to? Just before message comes in, I remember one day I had to fly, I think, just after that crash, I flew down the end. Someone asked me, are you okay?  But just a normal human, human reaction. It's a very, very chilling revelation by you. Very, very, very touching. All right, then. Thank you very much. Well, let's move away from that and look at the oil projection from 2023. Nigeria projects 1.8 million barrels in terms of crude. What do you make of this, especially looking at the setback for us in 2022? We haven't been able to meet the UPEC quota so far. And also, there's also been issue of oil tests. There's also issues of not being able to export, you know, the product through the export channel for whatever excuses has been going on. What are your thoughts? As long as our security agencies, as well as the staff of NNPC, those in the Ministry of Petroleum Conspiracy, they will continue with the conspiracy theory of oil theft, we can never meet that quota. Now what are we doing? We're hiring individuals like Campolo to marshal out and be able to protect them. Merci, Kofi, do you remember there was a video that went barra as some months back where we were shown what is in the UAE to buy one of these, I think, I can't remember which country is in the far east, where from just the room, from room, from their control room, they can see how the oil movement on the pipelines, until it gets to where it is pumping to the east. No single drop of one barrel of oil will be stolen or was stolen or is being stolen in those countries because everything has been digitalized and it can be seen. We have the capacity to do that from here and be able to make sure that we're able to monitor what is going on. But corruption will not allow them. A situation where we see a ship, a very, very mighty ship anchored somewhere in the Gulf of Guinea and we have feedash ships coming into our creeks to pump over 300 million or is it 3 million barrels of oil into that ship. That ship has been retrieved from the Potora Guinea. That is just one out of so many. So until we do the need, we don't know what to do. For us, we're able to meet our quarter. But a situation where we're losing over 400,000 barrels of food oil every day to oil it. That's not where we're going to meet our quarter. So you're expecting or whatever anybody is protecting. It's just a total fallacy. Secret agencies know what to do. NNPC know what to do. Nigerian dogmen know what to do in order to stem the tide. Curious game, what are the interesting, you know, announcements by you and we'll leave it at that for now. And of course, we look forward to having you again next week. Thank you very much for your time. Thank you very much for having me. Do have a nice day. All right. Thank you. Chris Kelly-Wanda is a chatted mediator and constellator. He's been a guest on After Press. We have some more discussions ahead. Mercy? Definitely. We take a break and when we return, it will be time for us to delve into it. Please stay with us.


there are plenty of narcissists out there at the same time. And I said, what happened to the man before that you dated? And she goes, Oh, he was a narcissist. In fact, if I was keeping a tally, I think she had five or six narcissists in her life. And I'm thinking, well, I'm not a narcissist. I'll be her hero. Well, sure enough, just like those men we were speaking of, we dated for about six weeks.  And I realized she wasn't much fun to be with. She was our personalities were totally different. Our communication styles were different.


This is stock number 21J47. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used Jeep and Jeep Wrangler headquarters, and today I am excited to show you our very first 2021 Jeep Wrangler Unlimited with the chief blue color on it. This is a Rubicon. It has a 3.6 liter Pentastar V6 motor. It's going to get you 24 miles per gallon on the highway, 19 city, with an average of 21 miles per gallon. Pretty good for a full-sized Wrangler. Chief clear coat is the color we shoot all of our videos in 1080p, 60 frames per second. So if you have HD capabilities on your computer, tablet, or smartphone device, turn them on right now because it is definitely your best way to check out the looks and styling and the color of the vehicle before seeing it in person. And if you'd like to check out all the photos on this Jeep in the upper right-hand part of your screen, is a link to our website. Click that and check us out there. It comes with the special painted and polished aluminum 17-inch rims, and it has BF Goodrich All-Terrain TAK02 tires. These are LT28570R17s. They definitely have an all-terrain tread pattern on them. The Rubicon, of course, has the sway bar disconnect, locking axles, which make it a Rubicon. This one has the LED lighting group. So you get the LED fog lamps, the LED running lights in the fenders, and you also get the LED headlamps and halo rings. You get the sport hood on there as well. This one also has the color match hard top and the color match fenders, which combined total are about $3,100. This one also has the rock rails, which come standard on the Rubicon. And you also get, for Easter eggs, you get the little sandals in the plastic shroud there. You also get the Jeep climbing up the side of the windshield. You also get the T-50, so you know which Torx wrench to get those doors off with. And this one does have the enter and go or keyless proximity key entry. Here's the original window sticker. Feel free to pause this at any point. You can see it is a 2021 Rubicon. Color is chief clear coat, 3.6 liter with the e-torque, eight-speed automatic transmission. Everything on the left is your standard options. Feel free to pause this. Chief clear coats 245. Leather trimmed bucket seats are $15.95. Cold weather group is $9.95. LED lighting group is $12.95. You get the $8.4 and premium audio group, which gives you the subwoofer and the factory navigation system that's $18.95. You also get serious guardian for a year. You get serious travel ink and traffic plus for five years. And then you get the 4G LTE Wi-Fi hotspot. Safety group is $8.95, which gives you the parking sensors and the blind spot monitoring. Advanced safety group gives you the automatic high beam headlamp control, full speed collision warning, adaptive cruise control and advanced brake assist. Eight-speed automatic transmission and the 3.6 liter are combined total of $3,000. The remote proximity keyless entry is $5.45. That color match hardtop is $23.95. The painted fenders are $6.95 for a total of like $3,100. And then the satin black grille by Mopar is $3.25. So that's why it's got a little bit different grille on the front. And then those special rims are $9.95. Total MSRP is $59.380. And if you want to get your summit price in the upper right hand part of screen is a link to our website with all the discounts and rebates on this vehicle. Three-year 36 bumper to bumper, five-year 60 powertrain. There are your miles per gallon, still amazed at the 24 on the highway. And then you get the front crash and roll over radians right there. This one does have the red dash on it. You can see that all the metal parts are painted that chief color as well. And we'll finish the walk around here on the outside. Four-wheel disc brakes on all the Wranglers. This does have the backup parking sensors, the LED tail lamps. Get the matching spare tire, the HD backup camera. And this one does have the LED license plate lights as well. You get the red tow hook there. These doors open up real nice and smooth now. The back ones do better than the JKs. That's your case for your front hard top pieces. You'll notice the bars here are all color matched. So when you have the top off, you still get that effect. There's the factory subwoofer. You do get a lot of storage underneath here. There's a big area to store stuff back here. Door hinges and roof bolts can go back here as well, as well as windshield bolts. And then underneath there are your jack tools. So you do get the JL badge on the back here. It gives you wheel base and overall length for the two-door four-door and then water fording as well as where it's built. These hard tops come off the same way as all the old ones did. You got three bolts on the side, two on the top for a total of eight bolts. And then you have two quick disconnects right there. The nice part is they store those disconnects right there as well. Those seats do fold down pretty nice and flat. And I'll show you how that works in just a minute.  The JKs always had kind of a pitch to them. I really like that color match hard top. Get a look from the back here. You get that black metal gas door cover. Of course the color match fenders as well. The other thing I like that they did is they have 3M guard on the front of the back fenders. They always usually get rock chipped up but it's nice that you know Jeep's thinking about your investment here. Heated mirrors, blind spot monitoring, the enter and go system. You just have to have the key in your pocket. Has the heated leather trimmed bucket seats with the red stitching. The Rubicon stitched into the backrest. Driver seat height adjuster, factory floor mats, auto headlamps, tilt telescopic steering wheel, power mirrors and power locks. This one has the 7-inch LCD display. You get the animation of the Jeep and the Rubicon when you start it up there. And that 7-inch LCD display is really good looking. You can do a lot with it. You get a compass, digital speedometer, you can do temp, mileage, all that good stuff there. You get the heated leather wrap steering wheel, adaptive cruise control and cruise controls on the right. That's your adaptive cruise control so you can set the car to a certain distance behind the car in front of you and it'll automatically speed up and slow down to keep you that distance. You got bluetooth and information center controls on the left there. This one comes with the 8.4 4C radio, AM, FM and Sirius XM radio capabilities. You also have the factory navigation on the system. You get that with the premium audio group. So that is your navigation system there. You also have your heated seats and heated steering wheel buttons. And you can also check out your backup camera at just about any time. You can see just how HD high definition that backup camera is. Those are dynamic grid lines. They turn as you turn that steering wheel and that middle line would line right up if you'd put a receiver hitch on this vehicle. And then you have all your different apps here. So there's two I really want to talk about because a lot of this is like just heated seats and stuff. But you have your projection manager where you can project your cell phone to the screen. So say you got a different navigation system you like better than the factory navigation system such as Waze or Google Maps on your phone. You can project it to your screen through Android Auto or Apple CarPlay. And then you can use that navigation system. Pretty cool stuff. We did a demo on Android Auto in the upper right hand corner if you want to check out that video. But you also have the off-road pages here which take a second to load. I always do like the animation once that does load here. May be lost but never stuck. So that's pretty cool mantra there. You have the drivetrain with your steering angle. As you turn that steering wheel you can see that that changes. You get your transfer case if your sway bars are connected or disconnected and your front axle and rear axle if they're locked or unlocked. So that's pretty cool there. You got your accessory gauges cool and temp oil temp battery voltage trans temp and oil pressure. And then you have your pitch and roll which you can see we're nice and flat in our picture studio. And then you have latitude longitude and you also have your altitude there. So pretty cool stuff that you have on those off-road pages and that comes standard with the vehicle. You never have to pay a subscription for that. Now if you don't like doing the climate controls and everything up on the screen you can do them all down here including your heated seats and heated steering wheel and volume and tune controls. You have your mute start stop capabilities. You can turn those off if you don't like them or if you don't like it. Stability control parking sensors and downhill assist control you can turn that off and on. Down here you get an Augs USB and USB-C jack. You get the front and rear axle locker or just the rear axle locker. You have the sway bar disconnect and then the off-road plus mode. This stuff is really what makes the Rubicon a Rubicon and really good off-roading stuff there. 4x4 shift on the floor, the 8-speed automatic transmission. You get the little jeep on the top there. You also get the keyless entry with the remote start. This is a switchblade style key so that flips out like so. It's definitely a bulky chunky key. You always know which key you have in your pocket. You just press that twice to remote start the vehicle. Once again you get that red metallic looking dash finish there. You get quick disconnects up here. You got two back there. One on the side and then you get four in the front. Two quick disconnects and then the hinges right there. Then those hard top pieces come off. You get the home link buttons for your garage door security systems and lane systems. You also have your assist and SOS buttons. Another little Easter egg. There's seven little slots right up there. Not sure if anybody would ever know what I said but it's up there. You have your auto dimming mirror and yeah that's really about it for the front. We'll take a quick look at the back seats and then we'll do one more final walk around of the vehicle. I got all the lights on so that'll be pretty cool to see this thing lit up with all the LED lights so check that out. We're almost done here. These back seats are in great shape.  Back here you get two USBs, two USB C's for charging and then you get a 115 volt 150 watt plug-in back here as well. Factory floor mats and then the other cool thing is these headrests on the back seats do fold down now and while the seat is still upright and then you can also put the seat down. You can see just how nice and flat that those go so you can haul a bunch of extra stuff if need be. You get the child safety locks on the back doors and we'll do one more final walk around with all the lights on it here and I would personally like to thank you for checking out the video today and hopefully from this HD video you will have gotten a really good idea of the looks and styling of the 2021 Jeep Wrangler Unlimited in chief blue clear coat. Get those LED fog lights, running lights, headlamps and halo rings there. Probably one of the best looking Jeeps I've ever seen on our lot and to see more pictures of this Jeep or one of other 450 new and used cars, trucks, SUVs, minivans, Wranglers, you name it we got at go to our website www.summitauto.com right there and if you want to check out more HD videos you can go to youtube.com slash summit auto remember to like subscribe and share on this video and all the videos that you see there in fact in a second you will see a link to subscribe to our YouTube channel on your left a link to more Jeep Wrangler videos like this one on your right if you have not been to our website on the bottom link to this vehicle on our website click those check us out and we're super excited to be offering this really good looking 2021 Jeep Wrangler Unlimited Rubicon in chief blue clear coat thanks again for checking out the video


So let's talk about how Armored Core filters players honestly, because despite being a meme at this point, I think it's actually an extremely important topic right now, especially if you're a new and aspiring game developer. Like I said before, I've been playing Armored Core all my life, it's my favorite series ever, and when Armored Core 6 was announced I was extremely curious to see how the devs were going to prepare for the influx of casual gamers that no doubt had no clue what they were signing up for. There were some fans that were worried that FromSoft would water down the game for casuals, but most of us old vets knew the game would be made for us, because the last 15 games were made for us and we happily saw no evidence that they were all of a sudden gonna make a 180 turn and forget about us in favor of casuals. But what I didn't know was how they were gonna handle the massive new casual demographic. So the main question for me as a dev looking from the outside was how are they going to adjust the difficulty of the game for the casual players? Because historically, Armored Core has officially only ever had two difficulty settings. They had normal and hard. Because f*** easy mode I guess.  Maybe you're in for glory, for fortune, either way it's not gonna be a walk in the park. So how in the world were they going to make the game at the same level of difficulty that the veterans expected, but easy enough for casuals to get into? Well, it turns out that FromSoftware's answer was they don't. They just decided it was not worth the resources to make a game that appeals to both casuals and hardcore, and filtered out all the casuals in level one. But it wasn't just a filter. It was also a mini demonstration and explanation of what you will need in order to play the entire game. Because literally everything you learn in the first level, all the techniques, skills, combat maneuvers, and strategies that are required to beat the first boss are the exact same skills you will need in order to effectively fight all the bosses in all the missions for the rest of the game. Now I've heard people complain and say the first level is poorly designed, it's unfair, it's not very well explained. And I respectfully completely disagree. And I'll talk more about why in a later video, but for now, just to put it simply, Armored Core knows exactly who their hardcore audience is, and they know exactly how their audience likes to overcome challenges. Armored Core has never been a game where the exposition and the story is shoved down your throat, holding your hand taking baby steps while turning on slow-mo bullet time with a tutorial message saying, press X to win battle. No, none of that. The game respects the player's intelligence, creativity, perseverance, and determination to figure things out without being told. What most Armored Core fans love about the series is, unlike many games out there that are made for everyone, this one is not.  Aside from a few hints before the boss, the game doesn't really tell you how to play. You decide that for yourself. The Armored Core series comes from an age where players were expected to figure it out. That's one of the few games that still does that today. And if you think there's too many hints or messages in the first mission in Armored Core 6, you should try play the first mission in some of the older Armored Cores like Armored Core 2. Or in the beginning of the game, you literally get zero tutorial instructions or messages to show you how to play the game.  Back then, we literally just had to press all the buttons to see what they did mid-fight before the boss shows up. That's what most of us old-school players are used to. And if that's not what you're used to, and if that's not what you want to play, then listen, that's cool. That's totally fine, I respect that decision. Not all games are made for everyone and you should be glad that from software straight up showed you their true colors in level 1. So you could know immediately that the game was not for you and you just get your refund and move on. I actually believe that's the most ethical way that you can use a filter as a game dev.  Also, when you try and trick people with easy difficulty at the beginning, you drive away your hardcore audience because they assume that the game is too easy and has been watered down permanently for the casuals. So in actuality, the most honest thing that you can do as a dev is just be straight with the player in the front, then let them decide for themselves whether the game is worth investing in continuing or not. The entire game revolves around mastering what you need to learn in mission 1. The skills you learn here are the exact skills you will need to beat the final level. So this is probably one of the most honest filters I've ever seen in a video game and I think they did a great job.  Even as an old school ArmourCorp player, I had to make some huge modifications to my fighting style in order to get used to the new combat system in ArmourCorp 6. But I kind of knew that was going to be the case going in, because that's always the case when you get to a new ArmourCorp game. And honestly, that's part of the fun, because I love that cathartic feeling of finally making the right adaptation and overcoming the challenge in front of me. Figuring out what part of my game plan wasn't really working, making that change and then realizing, oh, that's what the problem was, now I got this. And if it turned out that the game really wasn't for me anymore, at least from software had the courtesy to let me know in the beginning right at level one. So I think they did the right thing by putting the filter in the front. But what do you guys think? If you disagree, let me know how you would have changed things if you were in their position. Thanks for watching. And as always, hope you have a fantastic day and I'll see you around.


The Internet of Things, IoT, technology provides convenience for data acquisition in environmental monitoring and environmental protection, as well as avoiding invasive damage caused by traditional data acquisition methods. Additionally, an adaptive cooperative optimization Segal algorithm, PSOSOA, has been proposed to address the issue of coverage blind zone and coverage redundancy in the initial random deployment of heterogeneous sensor network nodes in the sensing layer of the IoT. This algorithm calculates the individual fitness value according to the total number of nodes, coverage radius, and area edge length, selects the initial population, and aims at the maximum coverage rate to determine the position of the current optimal solution. After continuous updating, when the number of iterations is maximized, the global output is output. The optimal solution is the node's mobile position. A scaling factor is introduced to dynamically adjust the relative displacement between the current Segal individual and the optimal individual, which improves the exploration and development ability of the algorithm. Finally, the optimal Segal individual position is fine-tuned by random opposite learning, leading the whole Segal to move to the correct position in the given search space, improving the ability to jump out of there. This article was authored by Li Chao, Zihui Wang, Zihai Wang, and others. We are article.tv, links in the description below. Thank you for watching.


and I haven't managed a mic test yet. So I will keep talking and someone can interrupt if there is any issue with the mic volume. Also, I'm just gonna take a moment to share my screen for this presentation. So just bear with me a second, Tokyo. This is partial, we will be getting this. Perfect. Good. Actually, this is a slightly unenviable task to give some key takeaways for this session. It certainly very much felt as if during a panel discussion and questions and answers section that we were really starting to take off into some very interesting debates and discussions and this is a fantastic platform to continue further over a number of days. But unfortunately I'm going to have to reduce things down again a bit here. So apologies if it feels like a rather false fall back to earth. Anyway, to start my summing up, I thought it would be useful to place our problem in the simplest terms once again. And these are very simple problems which have come up time and time again throughout this forum. And I'm going to do it through the lens of our favorite fictional detective, Sherlock Holmes who always claimed that he judged the case by how many times he would have to smoke his pipe before coming to a solution. So I've placed this as a three pipe problem for three components. Number one, what we're talking about here for responsible agricultural investments we're talking about an issue of investor confidence. There are many investors who wish to work with reputable practices. But they've seen multiple investments and business models fail in the region. And so a concern about their ability to achieve a suitable economic return as well as a maintenance of their corporate reputation. Then we have benefits for smallholders or rather a lack of benefits. And in many cases smallholders have lost their land or seen it degraded through intensive agricultural practices. And this ties into the third point of achieving environmental sustainability. Now, what is clear is that support is needed for governments, communities and companies. And this is where we moved into our first presentation from Yana who I thought provided an excellent overview of looking at the as in right guidelines. This was not intentional but it seems Micah Ingles and I are both thinking in terms of bridges during this forum. And I kind of visualized things in the same way. Now, these guidelines are not one singular vision but instead they could be seen as sort of housing of multiple international standards in a form that is geared towards a specific region. And Yana highlighted guidelines four and five which look at land tenure and forest areas. So there's a very good bridge between identifying these international standards and putting them in a regional framework. But the problem now is the challenge of reaching a national context. So in our further two presentations we then had two companies presenting their perspective in a way achieving responsible agricultural investment although in actuality neither of them specify their work in these terms. So I'm actually starting with the new forest presentation who looked into that they provided a case study of eucalyptus and the casey of plantations in Lao PDR. And they've got very clear CSR policy in place to look towards international standards like FSC, FPIC, IFC, excuse me for all of these acronyms. And the challenge for them is how they can manage operations at the local level in order to achieve these international standards. And even though they're not directly incorporating the RAI guidelines I think there's still a very important role that could be played in finding a way to implement these guidelines at the national level and help them support national, subnational and community actors work with companies. Now in a way I could put this diagram for Vietnam rubber group as well but I think there's something else quite interesting going on through their presentation and there's a sort of a double edged attack to their work. At one level they are very much a domestic event investor in rubber and other crops in Vietnam and in this sense they're looking with CSR policy to engage with government regulation. But this also has to happen in their cross-border ventures in Laos and Cambodia. So there are two ways here that the RAI guidelines could be of some use. I think it's very interesting from the questions that came up, obviously in their case there's a very interesting positioning here and I think there's demands for everyone to kind of know how do we relate past practices next to the sort of implementation of new company policies and what these can actually bring to the table. So perhaps now getting to some more meat or in the discussion or some final thoughts obviously there's a lot of strong points through the RAI guidelines but we are talking about potential here. The potential to address economic, social and environmental impacts of land-based investments. The potential to assist governments, communities and companies in order to achieve inclusive and equitable outcomes. I think in particular we have to make sure that small holders and the rural poor are included in a meaningful way so that this doesn't become some sort of box ticking exercise. Of course the companies we've had presenting here have been putting forward their strong interest in CSR but what about other companies? And in a way we had some examples of carrot and stick options. I mean the sort of comments from James Bampton were very clear in wanting to call out continued illegality and corruption. Then on the other hand we had a sort of false carrot from Stefano Savi in that it would be great to highlight the economic benefits but then what about the fact that responsible investment costs more from production to consumer? And so he asked the question how do we internalize some of these costs? To make them more a level playing field and bring in more and encourage more responsible investment. And then as a final point I think we have to look to the comments of Vicky Bowman which also taken up through the question from Ushuaitian about the price of political instability. And in particular we're looking at the case of Myanmar here. There may be many companies wanting to act in a responsible way but how can they do so when they're faced with a very uncertain political situation as we can see in Myanmar? And I think the question from Ushuaitian did highlight many fears that the country is failing to kind of benefit from the potential of responsible investment. So I think I'm gonna leave it there. As a final reminder, please if you have not already do go to the mentee website and fill in the code and answer the questions for the second poll today. And we have until five o'clock which I guess is coming up soon. So jump to it. I think that's all from me at the moment. Thank you very much.


Now, here's a teaching idea for the present perfect continuous tense. If you remember, we use this tense to talk about actions that had been continuing up until the present moment or very recently. In this activity, you'll be giving a student a card. That card will include the past activity as well as some results. This card says, You've been driving in the rain on your motorbike.  The results are you're all wet and your clothes are too. You'll present that information to the rest of the class and therefore it's up to the class to guess the action that was occurring up until the certain point in time. What will happen in this activity is the student at the front of the room will express the present results. Clothes being wet. I'm all wet. The students in the group then will form their questions obviously in the present perfect continuous tense, such as have you been swimming? Have you been playing golf in the rain? The student at the front of the room will form his answers in the similar tense, no I haven't been or yes I have been. If there are troubles guessing the activity, the teacher could perhaps prompt the student in the front of the room to use a mime and they will obviously mime in this case the driving of the motorbike. Eventually the idea will be to guess that activity that again had been happening up until the certain point.


Please stay on. Coming up next is the an award ceremony. It's the forum's global growth companies awards I'm handing it over to David Eichmann, Managing Director and head of new champions at the World Economic Forum. Thank you all. Thank you once again Thank you, Arsha As we've just heard India is entering a new era governmental and societal changes are contributing to a prosperous outlook for a thriving economy and Thriving economies rely on the influence and contribution of robust and dynamic medium-sized enterprises of which India has many With India's enormous middle-class and renowned ingenuity. There's plenty of opportunity for both business and society Today the World Economic Forum is recognizing some of India's most influential high-growth companies That are impacting the economy and creating opportunities These companies are innovators and market shapers and you may know them already The forum aims to support their potential and impact not only in the region, but beyond They're well positioned to be the next generation of India's globalizers 12 of the companies the Indian awardees are here today and they recommend represent the economic dynamism and highlight the Entrepreneurial and innovative spirit that India has demonstrated on its path to greater prosperity and a more equitable society ladies and gentlemen I'm thrilled to introduce the Indian global growth company honorees for 2014 Please join me in welcoming and honoring 4g identity solutions AI technologies Avastajan Bandhan financial services Sentom electronics forms Marshall make my trip Nash Industries assistant systems radical systems Radical food sorry RBL bank and trans H bio medical. Thank you ladies and gentlemen Please join me in congratulating the forums Indian global growth companies for 2014 Thank you


Welcome folks, we have the Dow Industries down 10, Nasdaq is up 30, S&P is up 7.5, Gold Contract up $3.60 trading at $13.11 an ounce, you got Silver $15.20 an ounce, Light Sweet Crude up 60 cents, $64.58 a barrel, that Light Sweet Crude market is just hanging right at that 65, notes and bonds, you got the 10-year note up 5, tick trade in $123.25, 30-year bond up 7 at $140.07, if we get open, we take a look at this 10-year first, 10-year right now, $1.2 million contracts, that's not bad contract volume, not great, but that is an expansion of yesterday, yesterday all day we did $1.25, right, now we have $1.21, that's going to get a little more juice out of it, dollar index, bottom line, still hanging at these highs, no volume in the way up, no volume in the way down, and today you got a split market, there's no two ways about that, we've got a high out here of 96.840, a low of 96.405, the number to keep your eye on is that 96.685, what that number is folks, that is the high of February which it had taken out on March 7th, got below it again, got above it again about a week and a half ago. We take a look at the S&P, what you have with the S&P is this, we go take a look at the spy, you get a sideways movement in the spy, no juice whatsoever, 33 million shares traded, you get out at 66 yesterday, the prior day you went up with 53, at 33 we're going to do about 40, probably about 45 million shares, that's saying that there's no juice on the way up whatsoever. We go take a look at the NDX100, the 3Qs, 3Qs, bottom line, 16 million shares, that is trying to peek its head over the highs of 18528 and then we get into the small caps, we take a look at the small caps, IWM out here is up $2, you're at 157, bottom line is that this also is coming into 21 million, right now you get 12.3 million coming into it, so I'd expect you to see out here, number 15747 is the number to keep your eye on, we've hit 15726 thus far, so we'll see how the next 60 minutes come in, what you actually have out here though, you got a sideways movement out here, you do have light volume, if we take a look at the indices, the indices volume out here right now in the NYSE, you're at a low, not only a low, today you're at a low right now for this time of day, going all the way back for three months, we're only at 385 million shares, recap out here, Dow is up 11, NASDAQ is up 47, S&P's are up 10.5, stay right there folks, we're going to be coming right back.