Thank you. Thank you It's a real pleasure to to be back in Montreal and to see so many people at an infosec conference when I when I moved away 15 years ago this this was nearly unimaginable Which is part of why I had to go and so I'm really I'm really psyched to be here And I'm psyched to see such an amazing community and have a chance to speak with you. So So thank you and today I want to talk about some pen testing and threat modeling lessons from Star Wars and I was talking with with Richard theme yesterday and we were joking that I had the advantage of choosing a movie that some of you might have seen and So really what I want to talk about today is three major things. I Want to start out by talking about what threat modeling is From there give you a simple approach Some of you raised your hands when asked if you know about threat modeling some of you didn't so I want to bring everyone up to speed and then I want to share top top 10 lessons that I've learned along the way and So let me start out With what threat modeling is and some of you raised your hands when asked if you know how to do this And some of you didn't but I'm gonna argue you all know how to threat model That if I were to ask you to help me threat model my house you would have no difficulty doing so You might start out by asking you about doors and windows You might start out by asking about family or pets or pre digital photographs or other valuables in the house And each of these has an analog in the digital world Doors and windows are the are the entry points The valuables are the assets and so We can take the things that we've learned how to do as we grow up as we mature into adults and we can bring them to the digital world and as we do so oftentimes it doesn't work quite right and So as People became more and more focused on How to threat model how to bring threat modeling into a software development process How to get non security people to threat model effectively or to know when they were outside of their depth we added complexity we added Layers of things like list all of your assumptions or start by listing your assets and these didn't necessarily work and so About ten years ago a little bit more now. I had the Opportunity to take a job at Microsoft and on my first day there My boss said the threat modeling thing is broken. Can you please fix it? And I said, what do you mean? And he said, I don't know step one is to figure that out for me and tell me and convince Me what I mean by that and then go do it and so I've had the opportunity Over the course of about of over a decade really To be yelled at by an enormous number of people Who told me that the threat modeling things I was trying to tell them didn't work? And so if any of the things I tell you don't work, please come yell at me Because that's how we learn and I'll share oops I will share the top ten lessons that I've learned along the way But before I do Well, I've talked about threat modeling and I want to I want to tie it to penetration testing Their bookends Ideally you're going to threat model before you do any other security work And ideally you're gonna pen test is a very last thing to see whether or not the things you planned the things you hoped Actually came to pass in the system that you're building the system that you're analyzing the system that you're working on in some way and so I think of them as natural compliments that a Good pen tester has learned to be a good intuitive threat modeler a good threat modeler a good threat model can help inform the Activities of a penetration test of a red team in really exciting ways, and I'll talk about that But to start out I want to talk about a simple approach to threat modeling I said we added a lot of complexity over the years, and I should mention that I've done this work Not only at Microsoft. I've done it with open source projects. I've done it with All sorts of different companies in and outside of the technology space. I've done it with some governments This is not a Microsoft-centered talk in any way With that a simple approach to threat modeling I start with four questions. What are you working on? What can go wrong? What are you gonna do about it? And did we do a good job? And the reason I like these questions is because it starts out with something that people should be able to answer If I walk into a room full of engineers and say, what are we working on here, and I can't get an answer That's problematic and I have to provide a whole different sort of help Right, and so it's a comfortable thing because people like to talk about the stuff that they're working on and so As a consultant as an advisor It's a great place to start and the place I like to start is the whiteboard and I'll come back to that in just a minute and From there we go to the question of what can go wrong and This this is the nub of threat modeling. This is the hard part It and I'll talk about why I'll give you one simple approach that you can start with and a bunch of others that you Can use and other in situations where it doesn't work What are you gonna do about it? I'm gonna speak briefly about right now You're gonna file bugs and you're gonna file bugs in the thing that the developers or the engineers or the ops people are Using to manage their system Because if you write a threat modeling report that report is gonna sit on the shelf It's gonna gather dust and it's not gonna lead to improvements in the security of the system Did you do an acceptable job is one of those engineering questions? Can you look back? Can you say yep? We did this we created a good model of the system We pen tested against that model of the system and we weren't surprised by anything we found So those four questions we start with what are you working on and Since we don't have a whiteboard. I've got a little animation Pretend this is on a whiteboard We might be threat modeling a web app So we draw that and then we've got a customer who talks to the web app in some way we got a back-end database and We can draw a little boundary around this we call it a trust boundary and The point is to say what's what's in our control and with just this simple diagram We can start asking questions about what can go wrong How does the the web app know which customer is showing up? How does the database know where to take data from and where to give it to? Right these are these are super simple questions that a diagram like this provokes We might have a content creation system that also talks to the web app to add a little complexity But these these sorts of things are an easy way if you're walking into a room and Talking to the engineers that are doing it But when you're doing a pen test, maybe you don't do that, right? You've got a different way of saying what are we working on and we use tools like nMap like TCP dump to start Analyzing the thing that we're building to start or start analyzing the thing we're taking apart excuse me and As you're doing this you can create a model in your head of what it is you're working on what it is you're doing a pen test against and The thing that I find is so rare and so powerful Is to take that model and put it on a whiteboard, especially if you're working on a team so that the data goes out of your head into something that you can point out and collaborate with and Even if you're not working on a team when I take apart systems I have a sheet of paper with me, which is just a picture of the thing Has very few words on it. It'll have some describing protocols and whatnot but I create that picture because I lose track of stuff as I learned things and So Sometimes sometimes you'll do this without a copy of the teams of the victims threat model Sometimes you'll do it with you have a glitch on the con here. Let me try Screwing that in so that it doesn't jiggle quite as much and I'll turn this So maybe it's a little less That's very exciting. I apologize for this. I am testing the idea that it's a physical problem versus a logical one Does it seem to be working? I'm gonna give this five or six more seconds of Um Sure, actually can I get one of the AV folks? To come up and give that a shot with me so that I can All right, so my Mac thinks it has a connection because it's doing the PowerPoint Speaker mode Why don't we switch back to VGA since that was at least partially working? So what I was going to show you My very next slide Olivier who spoke yesterday on the moose botnet had a Had a slide that oh you can see something I'm gonna stand far away from this look we have video I'm gonna stand far away and try not to step down the back of that in the hopes that I don't jiggle my computer Um So I was excited to see this and I spoke with Olivier after his talk and he showed me the whiteboard Diagrams, but I like I like the pretty version of this picture Diagramming what you're working on being able to point to it really helps keep make sure that everyone Involved in engagement is Doing is thinking about the same thing and oftentimes I find that just getting things on to a whiteboard provokes so many arguments about what's actually happening that you find not lots of nice Disagreements and you can exploit the heck out of that disagreement and misunderstanding between the owners of different modules You can get a little more formal. I'm gonna skip over the data flow diagram thing because I lost a little bit of time To to playing with the video and I want to move on to the question of what can go wrong and For what can go wrong? I want to encourage you to use strides strides and mnemonic It stands for spoofing tampering, repudiation, information disclosure, denial of service, and elevation, and privilege. You got that? Great. Let's move on No, it's a mnemonic, but to help you remember the mnemonic I want to walk through it a little bit more slowly So spoofing might be Someone pretending to be a stormtrooper It might be someone pretending to be a Nigerian prince. It might be someone pretending to be paypal comm Each of these is an example of pretending to be someone or something you're not so the essence stride stands for spoofing The tea and stride stands for tampering that might be Ben Kenobi Tampering with a power supply and might be someone modifying bits in a database. It might be you modifying web requests With the awesome backslash scanner that we saw yesterday In each case it involves Modifications of things so the tea and stride stands for tampering the are in stride stands for repudiation That might be Han Solo say we've had a reactor meltdown very dangerous Than everyone's fine then shooting the console. It might be someone saying I'm sorry I didn't see your email or that package never arrived in each case It's about having logs so that you can look back into the past and understand what's happened The iron stride stands for information disclosure now You might notice if the video yet the video is I Was just gonna say you might notice if the video is working then I don't have a Lego version of this slide and You know Part of that is I couldn't find a good Lego version of this online and part of this is people are very confused about What Star Wars is about? Does anyone here believe that Star Wars is about like Luke's journey to manhood or his relationship to his father? You know, this is a trap, right? That's why no one's saying yes Good for you If you believe the critics they'll say those things but the truth is Star Wars is all about information disclosure and its consequences from the very opening crawl or now even back to Rogue one where we see the plans being stolen and then the opening of episode four where we see Darth Vader ship pursuing Princess Leia All the way through the climactic final battle Star Wars is the story of information disclosure and its consequences I recommend that you go rewatch the movie in that light. I'm sure you'll enjoy it There's other for that. Oh, excuse me There's other forms of information disclosure We we saw a talk from the tour folks yesterday from David about Just the fact of communication can be an interesting thing that people want to protect We've seen talks on SSL TLS about protecting the contents of those communications. And so The I in stride stands for information disclosure The D in stride stands for denial of service and whether that's freezing Han Solo in carbonite or Taking over half a million Webcams and using them to knock a DNS provider off the internet Each of these involves breaking availability in some way And finally the Ian stride is elevation of privilege that might be Ben Kenobi saying these aren't the droids You're looking for it might be someone finding a hidden web admin. It might be remote code execution In a file service protocol, that's for some reason exposed to the internet who knows so When you think about what goes wrong as Security folks, I encourage you to remember stride as a mnemonic to help you think through the different sorts of attacks that you might execute or the different sorts of attacks that you might want to defend against so Brings moving to question three. What are you gonna do about it? There's a bunch of different answers If you're building a system Then there's a set of tools you can use and the thing this this table is Down the left-hand side. It's the stride Attacks the middle column is the property that those attacks violate and then there's an approach Mitigating that a standard sort of way to dealing with those problems, but you can also think about this in terms of pen testing You can say oh There might be a spoofing attack. What sort of tool do I want to pull out of my toolbox to start Executing those attacks to start seeing whether or not the system is vulnerable to these things And so the same sorts of models can be used to help you understand Attacking a system from an attacker perspective or from a defender perspective With that with that I want to switch to the top ten lessons. I mentioned I've been yelled at by a lot of people and The reason that people tend to yell at me is because they want this stuff to work They want to be able to protect their systems. They want to be able to build defenses and When we give them advice that doesn't help them they get frustrated and so I've started to see these lessons as Traps I've started to see that each of these involves something that well-meaning people do that doesn't work the way they want it to and so my first example is Search your feelings Now in Star Wars whenever someone says search your feelings Someone makes a bad decision Again, watch the movie again. You'll see and so search your feelings is an excellent plot device and a really bad engineering tool and the the engineering equivalent of saying search your feelings is to say think like an attacker and I'll tell you a quick story about this. I was in a meeting. This is about 2006 And I said to someone think like an attacker and He sort of scowled at me and went to his laptop and didn't participate through the rest of the meeting and then after the meeting He he grabbed me in the hallway and politely said Adam I'm a little concerned about the way you expressed that. No wait. That's not what he said This was Microsoft. This was 2006. He said that was the most bleeping annoying bleep bleep bleep. I've ever bleep and heard I Was a little taken aback people have been saying think like an attacker to me for 10 years before that it seemed like a natural thing to say in the circumstances and What I when I got him calm down.  Um, I was doing something. I didn't think was doing any harm and This guy shut down Because he didn't know how to respond to what I was asking him to do and so When I'm working with security folks, I will say think like an attacker When I'm working with people outside of security, I Look for structures. Um, I Look for ways to help them get through the things that I'm asking them to do So trap number two is to say you're never done threat modeling. I Feel that way. I really do and In a sense, it's true. You can always go and find one more problem All right, you you're never done pen testing either. You always can find one more good bug and the trouble that we face is that if I go to a VP of development and I say We should threat model as part of your process or we should do a pen test as part of your process They'll say great. How long will it take and I say you're never done pen testing They'll say great. Don't let the door hit you on the way out and So we need to unroll this and this by the way I should mention is is the same four questions just drawn in a little hamster wheel of pain Model, what are you working on? Um What what word is there identify threats what can go wrong? Mitigate what are you gonna do about it validate? Did you do a good job, right? It's the same questions and I drew this I drew this when I thought I was simplifying things and I added a problem inadvertently and so now I like to unroll this and think about this in terms of We're gonna we're gonna build a little time box for each of these activities and when I first tried to do that It felt really worrisome. I'm like, what if What if we go through and we're still finding great attacks? You know what the answer I found is if you go to an executive and you say we're still finding a lot of really good stuff a Lot of times they give you more time to work on it The fact that you put a time budget in front of them is an enabler In a lot of circumstances where otherwise you're not making the progress you'd like to make so Trap number three the way to threat model is Used to be people would come to me and say, how do I threat model my whatever and I would say well you use data flow diagrams You use stride and what I've learned is that people do all sorts of different projects if someone were to come to me and say hey, I'm building a Device driver you might want to use C. I'm building an insecure website. You should use PHP different languages have different strengths and so Rather than saying the way to threat model is I'm much more focused on How do we help people find interesting threats? How do we customize the things we're asking them to do in a way that maximizes their strengths and I think in a similar fashion we can say there's no one pen test methodology that's going to Address everything you need Right this morning. We heard from someone from the privacy commissioner's office Talking about dropping a new root cert into the things they're looking at so they can man in the middle them Is that really a threat if you own the device I sort of think you should be able to drop your own cert onto it and man in the middle Let it seems like a reasonable thing to want to do occasionally Um, but the way you threat model the way you pen test different systems should be focused on that system Rather than on the way you'd like to approach it So a variant of this is monolithic processes Um, you might have thought that the Legos were just there for fun They're not the Legos were there because I actually think of Legos is sort of fundamental Sort of fundamental I think of Legos is fundamental to the way in which I approach these problems, which is how can we break them down Into the smallest useful building blocks we can And so we can develop different building blocks for modeling We can use data flow diagrams. We can use nmap. We can use lsof We can use swim lanes. We can use all sorts Of different ways to break out the system that we're looking at to gain an understanding of it And we can complement those with different ways of identifying problems with different depths of identifying problems Do you need to Find a crash or do you need to actually develop a proof of concept? Do you need to weaponize it? Um, you can apply different building blocks to the process of identifying a threat um And you know attack trees kill chains k peck the mitre common attack pattern Enumeration and categorization Is an interesting one. I'll talk more about in just a minute. I'm going to skip over privacy threats Um, again just in the interest of time But if you have questions, I'm happy to talk about it a bit later so when I think about When I think about different ways to identify threats, I like to think about who's using them And so we've got a continuum here And at the far right side, you've got security mavens and then at the far left You've got experts in other areas, which is a bit of a tongue twister And the reason that there's a tongue twister there is I used to say non-expert Until I realized I was insulting the heck out of people who had expertise in databases Expertise in usability Expertise in networking expertise in scalability. There were all of these Non-experts who I was just saying They've got no expertise. So now I've got a bit of a tongue twister and if you're in security Then stride allows you to think about what's going to go wrong with a system and it can be very helpful Attack trees allow you to organize your thinking about how someone might execute towards a goal And that can be a very helpful way of attacking a system Capek is sort of in the middle For those of you who are not familiar with Capek, it's a pattern library. And so the pattern Description for SQL injection has subsections like SQL injection is code data confusion. Where does it occur? It occurs Usually around web servers that are talking to a database back end. How do you test for it? You use these insertion attacks. How do you correct it? Here are some patterns for fixing it My guess is that most people in this room Who have a few years of experience are likely to look at Capek and say I know all of this stuff It's a very heavy weight. It doesn't help me It's not intended to help you. It's intended to help people who are getting exposed to these problems for the first time Get an understanding of them um The kill chain the kill chain is another great model It's very helpful as you're thinking about organizing red team activity as you're thinking about defending against red team activity um But when you bring the kill chain to people who aren't security experts Even the names of the phases like reconnaissance and lateral movement require explanation Um And then the last one one more thing I want to talk about About the way to threat model is is about checklists I'm often working with customers talk to them about threat modeling and they say adam Do you just have a list of everything that can go wrong in my system? Do you have a list of everything you're going to pen test for? I'm like, are you doing something new and cool? They're like, oh, yeah Whatever it is they're working on and I'm like great I'm going to find new and cool attacks against that I don't have a list beforehand Of what's going to go wrong and I used to really have a a thing against checklists Because of this and then I read a lovely little book called the checklist manifesto. Has anyone here read the checklist manifesto? One Wow, okay, maybe two um So lovely little book Um, and when I read the checklist manifesto what I learned is the difference between a good checklist and a bad checklist A good checklist consists of five to seven items that can quickly be answered. Yes or no That address commonly made mistakes during a process So for example If you're landing a plane the checklist says things like did you talk to the Ground air traffic control ground control? Did you lower the landing gear and have you raised the flaps? Now that's all lovely and you can hand me that checklist But you should not want me flying your plane because I don't know how to fly a plane um A checklist Helps experts avoid problems And so one of the things I did in my book on threat modeling is I put lots of checklists throughout To help people see whether or not they were doing the right thing and some of them were very hard to do because Short five to seven items. Yes or no common problems And so that brings me to to an insight that I had um Which is that PCI which we often derived as checklist security Has absolutely none of the problem none of the properties of a good checklist It's 12 items with a bunch of sub items There is no element of PCI which you can't find yourself arguing about with an assessor um And the question of whether or not these are common problems I refer you to like 6.4.12 or whatever it is about cryptographic random number generators with proper seeds um And so maybe that's why we have one of the reasons we have problems with PCI um Not of course the only one so Track number four is to treat threat modeling as a single skill Someone might say I should learn to threat model But there's a lot of skills involved in threat modeling Um, and when I think about this, I think a lot about techniques I've talked a lot about techniques about drawing diagrams about using stride about k-pack There's also repertoire. There's also knowing the things that you should know um And the repertoire can include tools and how to use them it can include stories and you use all of this To analogize and reason about new systems to say, huh, I'm breaking into this iot device Let me look and see if it's got a listener that I can just connect to Let me See if it's got an admin admin password right you look for these common problems first because they recur um And that's part of developing the skill is starting to use this repertoire starting to use this knowledge And one of the things about repertoire is that um When you're when you're looking at a system you'll often find and I see this at both ends The early side the threat modeling the late side of penetration testing the Operational side of red teaming where someone will look at a finding and say but no one would ever do that Some of you have heard that I can tell because you're grimacing some of you have heard that I can tell because you're laughing but um, it used to be when someone said but no one would ever do that I would say Here's an example and sometimes that worked and sometimes it didn't and I was confused by this and So what I realized is that people mean two entirely disjoint things when they say no one would ever do that the first is But no one would ever do that and the second is I don't have time to fix this And and so now When someone says no one ever do that I say if I can give you an example of a time someone did this Well, we agree that it should be fixed And then I know which conversation I need to have and which arguments are going to work and which ones don't so Trap number five is thinking that threat modeling is easy that thinking that penetration testing is easy um It can feel a little bit like uh, like taking your x-wing out of a swamp or You know, it can feel a little bit like a musical instrument It's if you hand me a violin, please don't but if you were to hand me a violin It would be hard for me to make music out of it. There's lots of skills. I would need to learn About thing holding my fingers in the right position. I would go through easy songs And some people handed a violin Want to become a virtuoso Some people well no one handed but some people handed a guitar just want to play with their friends on the weekend And both of those places are okay with an instrument Both of those places are okay with threat modeling with penetration testing Where you can say I want to learn a little of this Great develop those skills to a point that makes you happy But don't think it's necessarily going to be an easy journey Um, so trap number six is thinking that all of this is for specialists Um that you've got your one guy out front who's got a totally different set of skills than everyone else Um, but what I want to do is I want to make it a little bit more like version control I want to be able to say, you know, if I went into a big tech company today And they asked me a question about git and I said, you know, I've heard about this version control thing It's not for me. I just back up my home directory once a week It works The interview would be over pretty quickly It'd be done Uh, but if I asked a question about threat modeling And they said, you know, I've heard about this. It's not for me Odds are the the interview would keep going and this is a bit of a stretch goal It's a goal for me As someone who's passionate about threat modeling is that I want to make it a more Unusual thing for people to know nothing about it. And that's why Um, that's why I dedicate so much time to doing talks like this Trap number seven is all about the wrong focus um And I'm going to use a little bit of a build in this slide because I want to talk about some of these things and Some of them might some of them upset people when I talk about them. So I'm going to talk about them one at a time um And the first wrong focus is to say is to start from your assets And this seems like a natural thing, right? Let's make a list Of our assets and go after them And if we don't have such if we have gotten no assets, why are we bothering? Why are we bothering to threat model? Why are we bothering to pen test? To borrow a line from this morning This vibrator doesn't have any personal information about you Um, why bother? And the reason that I don't like starting threat modeling from assets Is because it fails on a regular basis People are set told make a list and they start making a list of things like here's the money in the bank or here's our password And here's our reputation Those are three entirely disjoint things, right? One is something an attacker wants to steal One is something that an attacker wants is a stepping stone And one is very diffuse and can be damaged But it's hard to defend right your reputation doesn't exist in a single place And so you create this list and then what do you do with it? Well, you start thinking about how to attack it Why not start from the thinking about how you might attack it rather than starting by making a list of these disjoint things? The second the second wrong focus that I see really frequently Is to start by thinking about attackers. This is also natural, right? If no one's going to attack this thing Why would we bother? So let's start by thinking about those people who will attack it And last summer I was reading an article in the Atlantic. It was a long interview with president obama And he said something that really struck me what he said was We it was it was an eight-year retrospective by the way across his entire presidency And what he said was we underestimated the impact of tribalism in libya And that really struck me because the united states has been involved militarily in libya For long enough that it's part of the marine him which starts from the halls of montezuma to the shores of triple a Libya is an open society people go there. They write books. They write sociology. They write travel logs. They study The society of libya And number three the president of the united states has one of the largest analytical capabilities in the world available to him And they underestimate the impact of tribalism in libya if he can do that What hope do you have of guessing how the Soldiers in 63 198 in china or 8200 in israel have no one's written books about those People don't go out and write tell-alls. So how are you going to know? What their motivations are how they're going to respond to the pressures that we put on them I'm not saying it's impossible. I'm saying it's a very hard task And starting your project with a very hard task, which is easy to get wrong Well, it's about as good as search your feelings as an engineering technique um so Thinking that threat modeling should focus on finding threats Seems sort of natural And this is actually an interesting disjointedness between threat modeling and pen testing When I threat model, I want to make sure there's time to fix those threats not just to find them But when I come in on a pen test engagement when I come in on a red team engagement My goal is to capture flags. My goal is to find bones And then I hand them over And so there's an interesting The symmetry breaks down a little bit in a way that surprised me when I was thinking about this um And before I leave this wrong focus, I want to call back to trap number three the way to threat model is I know people who are really really good At threat modeling from an asset list. I know people who are amazing when they start out with a list of attackers It works for them. Who am I to say they should change? But If it works for them and it doesn't work for the organization they're trying to help It's worth considering So trap number eight is not having an alliance Is is thinking that you've got to do it all And this one this one hits all across security um If And let me explain first so along the supply chain if you're by if you're building an internet thing If you're building a toaster that connects to the internet, you're going to buy a chip From shenzhen and you're going to put it in your toaster Excuse me You're going to put it in your toaster and if that chip Can validate a signature as part of its bootloader Then there's a whole bunch of problems that go away and if it can't Because the chip that can validate the the file that it's loading costs twice as much as the one that doesn't Um, then there's a whole bunch of threats that are really hard to fix And once you're developing the operating system once you're developing the the internet connectivity for that thing That system on a chip decision has already been made And similarly if you're sending something out into the world You're releasing an open source project for example It's going to run in customer environments. You don't get to see the logs unless your customers want you to And so it's important to talk back and forth about what your expectations are and what You know, you can do what you can't do Um And so while rebellions are built on hope, I think security is built on threat modeling It's validated by pen testing And so you need to be able to talk and two of the tools I like to use for this purpose Or a security ops guide And a non-requirements document and so a security operations guide is precisely that Um Early as you're building a system write the security operations guide hand it to a security person If you're doing a pen test ask for this document Because the things that it's missing should be the first things you attack um The the non-requirements I had the pleasure of while I was at microsoft I worked on a document entitled the 10 immutable laws of security version 2 um And the 10 immutable laws of security are things like if An attacker can run code on your computer. It's not your computer anymore If an attacker has physical access to your device, it's not your device anymore And well, that's true of microsoft and it was true of windows This is an iphone And on an iphone neither of those things are true the fbi made a big deal last summer About how neither of those things were true and they really wanted access to the device But what the what those 10 immutable laws really were Is an expression of microsoft's threat model If an attacker can run code on your windows computer Back in the came out Windows 95 98 it wasn't your computer anymore. There was there wasn't even an admin account really There was but um But it communicated what problems microsoft worried about and if those problems didn't Make sense to you You might say Windows isn't a suitable thing for me. It was communication along the supply chain and it was actually reasonably effective so Trap number nine is a laser-like focus on threats I believe that there's an important interplay between requirements threats and mitigations I'm going to walk through these i'm going to walk through these uh one two at a time and so When you're thinking about threats You might say the plans for this battle station should not fall into enemy hands Great. We have a we have a confidentiality requirement. We know that information disclosure threats are important Awesome. You might also say With enough eyes all bugs are shallow We should publish the plans for this death star so that the good citizens of the galaxy can help us find out Whether or not it's safe You know who knows maybe the empire is full of open source advocates Um Whichever way you start you can have a useful conversation about the intersection of threats and requirements Um And when we flip that around it's important to think about what the requirements are While I was listening to the talk from the privacy commissioner's office He talked about certificate pinning a little bit And I said who are we protecting this device from? Is it really required if I have physical access to my light bulb and I install a new certificate on it so I can sniff it Do I need to protect it against that? Is that a requirement? Is that a threat? And is the mitigation of certificate pinning the best place that we can put our security dollars? and this is important because Threats can be threats can be mitigated to go back to the example of my house If i'm worried about someone coming in through my door, I put a lock on the door and then i'm done Right. No, obviously not. Someone can drill the lock. They can pick the lock They can kick the door down. They can go around to the back door All of these can be bypassed and there's a back and forth between these things that Is where a lot of interesting penetration testing happens you find one mitigation you go to another area um But more importantly, it's where a lot of not more importantly Also importantly, it's where a lot of security engineering effort gets laid down And so that back and forth is important and let me go to the third thing here, which is That if there's no mitigation You should change or simplify your requirements And what that means is if you don't need to continue the example If you don't need to protect against a man someone replacing the certificate on their device Then you can spend the energy that you would spend on certificate pinning and dealing with the potential problems after somebody Locks themselves out or your Your pin fails for whatever reason you can spend that on other security requirements which are more important and When when the snowden documents came out people used to say our threat model has changed Yeah, your threat model didn't change if your threat model didn't tell you people could listen to a network connection You had a bad threat model if someone didn't tell you that someone might want to drop malware or Implants or whatever they want to call it on your computer. You had a bad threat model And this may sound a little nitpicky But the reason I point it out Is that when someone says the threat model has changed It's our responsibility as security engineers to think about this whole triangle and to say If the threat if that threat now matters or if that threat doesn't matter, what does that mean for my requirements? and What does that mean for the system as a whole? and similarly If you're if you're red teaming something if you're pen testing a device And someone says oh that threat doesn't matter You should think about this triangle and find places where they're investing energy and variance of that threat And say so why did you bother with that defense? because a lot of times the That threat doesn't matter or the threat model has changed that threat doesn't matter Really means I don't want to spend time fixing that. It's an inconsistency In what they're working on It leads to wasted security effort. It leads to ineffective security effort and it helps you identify that misused effort And help people that you're helping refocus their effort Into more important places So when you hear the threat model has changed when you hear that threat doesn't matter Jump on it and think about this triangle um Because this interplay between attacks and mitigations and requirements Is one of the constant underpinnings of a lot of what we do And thinking about it in something resembling this way can really help you Get a little bit more Strategic and a little bit more effective in the penetration tests you're doing Now the last thing I want to say about this slide before moving on I drew this diagram when I was working on the threat modeling book And I was really bummed because when I drew it there were only five arrows And I'm like it should be symmetrical. What's going on here? And so I looked at it and I'm like what the heck is a what the heck is a mitigation That has to be in place Whether or not there's a threat and I said oh that sounds like an outstanding description of compliance and Part of the reason that I think our community tends to find compliance so frustrating Is that it ends up being a lot of wasted effort And that you know it's wasted effort because you walk by those systems on a pen test, right?  You don't want to be like grand moff Tarkin when this guy comes up and says sir We've analyzed their attack pattern and there is a danger. Should I prepare your ship? Um, that was a very bad day That was evidence that they neither threat modeled nor pen tested nor red teamed this thing Before putting it into production Um You want to do each of those activities at the right time you want them to build on one another In ways that help protect the systems that we're trying to protect So to summarize Anyone can threat model and everyone should and Even if you just find your job as pen testing or red teaming I want to encourage you to go out and start with those four questions. What are you working on? What can go wrong? What are you going to do about it? Just a little bit And I want to encourage you to do it soon Because the things that I hope you learn today will fade with time You'll remember less of them a month from now than you do a week from now And so give it a shot see if it helps you because I believe That the skills the techniques the the repertoire these are things that can be learned But there are lots of traps that have inhibited a lot of people from trying um And I believe I've been uh I've been doing threat modeling in various forms for 20 years now And I really believe it is the most effective way To drive security through your product through your service through your system whatever it is you're working on Or to demonstrate that those that thinking never happened um When you succeed when you break in what you're doing is you're proving that there wasn't good threat modeling so there's really of great complementariness between these two skill sets and Lastly, I think models are useful for engaging with leadership for engaging with management About what's going on and why because it takes away the details It takes away some of the hard to understand bits and a model helps you understand the world and Leads me to this quote by george box george box was a statistician who said all models are wrong And some models are useful And they're all wrong because all models eliminate detail the territory is not the the map is not the territory. Excuse me um But I want to encourage you to focus in on the useful kind So go out and remember the four questions. What are you working on? What can go wrong? What are you going to do about it? Did you do a good job? Be proactive find this stuff early Fix them before you pen test make your life a little bit more difficult, but maybe you'll have more fun on the pen test um, and go Go drive threat modeling for your organization um And so with that I'm happy to take questions. I'll be around for a little while after after There's also the book and I blog about this stuff on a regular basis. So thank you very much for your time You


Well well well welcome back yet again for another fantastic day of reactions and would you believe we are still up with the play so to speak no pun intended we're moving the chains 10 by 10 and we're actually at number 28 today 28 on the list of the NFL's top 100 players in 2022 it's Quentin Nelson and when I think about Quentin Nelson you know all I think of is this ridiculously scary looking offensive lineman with a real with a real dose a real hefty dose of under eye black paint he's a guard he plays for the Colts he's been on the list before and he'll most likely be on it again because I think he's pretty young but with all that in mind let's get into it number one his speed is physically when he gets his hands on you he's a smart player for it for there is a battle for it Batman for real for real it's pretty damn consistent right Quinn's huge I mean just a huge human being he's he's got cuts in his arms which is not a good sign putting guys in the dirt as in look at the definition the doubt the tricep the bicep and he's that size one time in practice I've ran into him he didn't flinch but I feel like I I got hit by a car that reminds me of when Chad Johnson ran into the big man Ray Lewis was a lot of big man go son look at the cornerback he's like please please no don't do it to me yeah I will say the plays that the offensive lineman are expected to to actually run at top speed downfield blocking for their back or wide receiver or even quarterback that kind of place surely isn't called time after time after time there the coaching staff surely would have to mix it up a wee bit you I never considered that you to see his key and like okay he's gone who do I need to get to and he's not searching I found my key I'm gonna go get to that person that's what you really want to see in the office alignment that gets that full effort it doesn't care bro look at the arch on it look at the arch on a backfield he just ran like he ran a 60-yard sprint he's gonna be absolutely gassed see what you don't want to see the 330 plus man come get you all right 330 pounds calling his wide receiver slow let's have a look at a stats next Monday Quinton Nelson 26 years of age March 19th 1996 six foot five no less no more 330 pounds okay look I might be reading out the pound value but every time I do I always look to the right and and look at the kg value and I must admit we haven't seen a player that's tipped 150 kilograms yet 150 kg it doesn't be a thinking about went to Notre Dame the fighting Irish from 14 to 17 got picked up in the first round of the 2018 draft with pick number six it's been at the Colts ever since he's a three-time pro bowler sorry a three-time first team all-pro selection in 2018 to 2020 last year he he dropped down a peg to the second team all-pro selection but he is a four-time pro bowler in all four seasons that he's been in the league he's put on a few pounds he weighed in pre-draft at 325 pounds with a 4.6 to 40-yard shuttle of 7.653 cone drill a 26 and a half inch vertical jump eight foot nine on the broad jump and 35 reps on the bench okay we we don't have too many stats I could probably edit it if he had any tackles I mean being that he is a guard did they just play a game and start it surely not there's got to be another stat it has to be it is a fumble recovery there should be a new stat I reckon we should should be edited no I won't do that I'm probably feeling a little bit too happy for my own good but if we are talking about stats for Quentin Nelson there should be a block a block stat anyway 16 games played 16 games started in 2018 16 and 16 and 2019 16 and 16 and 2020 but only 13 and 13 and 2021 now why was that he needed surgery on his left foot prior to the start of the season cavalry time was projected to be five to 12 weeks but the doctors deemed that the injury was not as serious in week three he suffered a high ankle sprain and was placed on injured reserve on October 2nd 2021 he was reactivated on October 23rd he became just the second player in team history to earn the Pro Bowl honours and his first four seasons joining Alan Amici receiving those honours from 1955 to 58 he also became the first offensive lineman in the NFL to do it in his first four seasons since Zach Martin receiving the honours in 2014 to 17 and he is the first Indianapolis player to be selected to four consecutive Pro Bowls since T. Y. Hilton again doing receiving the honours in 2014 to 17 the last Colts offensive linemen to be selected to four consecutive Pro Bowls were Chris Hinton and Ray Donaldson okay so he's well he's big he can run a 60-yard dash and he's an absolute blocking machine look at the ball carrier and you know they're running with the ball down the field he's running right behind him every time to help them finish the play that's so good and be the first one to help them up when they get tackled he's a mauler but he's also and then straight back into the huddle he's a team man he's a mauler but he's also he's also a team man but what's he like off the field you know he's technical his fundamentals are great you know that's what makes him the kind of player he is yeah when you get his hands on you you gonna feel it for him and he gonna beat up it's gonna be like that every every play though like he's not gonna get up you're all around good player pulling fast side line the sideline right we got one there you see how he latched on he's still going surely most offense of linemen would stop they'll be like right you got I did my job you've got past me do your thing he doesn't stop doesn't office alignment rolling down a field like that they're reaching and when you get his hands on you going for a ride looks about right going for a ride it is funny he's a physical player and that's kind of his trademark is he's athletic and he can move himself but he just physically wears guys out I get fired up when I see him when I see the pancakes oh bro can you imagine a hundred and fifty goddamn kilograms landing on top of you and you're meant to be the one dominating him yes sir you good I never let nobody do that to me after giving up just one second 2021 what a blight no wonder Quentin Nelson is the top ranked guard on the players list one second game and he shows it technique hand placement footwork and then at the end of the day you know just to finish in the drive that he plays with make someone in the best office alignment oh my god I tell you what yeah I was gonna say that the one guy who would appreciate it more than most would be Jonathan Taylor anyways guys that brings us to the end of another video I really enjoyed that one in the next one we're looking at the Super Bowl winning quarterback that I don't know if he's ever I don't know if he's actually ever made the list he certainly hasn't whilst I've been reacting to it but this should be really interesting you know what a what a success story what a you wouldn't call it a comeback story he's 30 33 is an absolute veteran but he's come into a team with the firepower needed to at least get a chance to make the big dance gets there wins the Super Bowl legend but we'll get into that in the next video thanks for watching guys and peace out


Today we're conducting LANNAV. We have 10 service members out there who are testing their skills with being able to find a point and how to return without their cell phones. Biggest challenges for LANNAV is attention to detail and self-awareness. So you have to make sure that you plot your points correctly before you start and if you somehow navigate incorrectly to get to your point you have to know how to self-correct. I learned so much from what the Army taught me and now I feel like I need to get back to the Army.


We know many communities across the country are struggling financially and some have decided this year to cancel their local firework shows. For those who experience fireworks in their backyard instead of the local fairground or schools, our message is clear.  And adults should always use caution when setting fireworks off. The message is so important today because 70% of all fireworks related injuries occur between June 20th and July 20th. I encourage everyone to put safety first and follow the laws of your state, city or county in the purchase and use of fireworks. This year the CPSC is pleased to report there has been a decline in fireworks related deaths and injuries. Our new report, which is being released today, shows that there were 11 reported fatalities in 2007 and only 7 in 2008. There were nearly 10,000 injuries in 2007 and an estimated 7,000 in 2008. This is good news, but we want the numbers to continue to go down. So we are here today to urge families to celebrate with safety. Welcome to a new day for the United States Consumer Products Safety Commission and the start of our renewed commitment to protecting the safety of families and children. Last year there were 6 deaths and 7,000 visits to emergency rooms due to injuries caused by fireworks. Most of these incidents occurred around July 4th. For families to have a fun and safe celebration, it is very important that children do not play with fireworks and that adults know about the dangers and precautions to take. The incidents we have shown today could occur in the backyard of their home.


This study examined the effects of land use on microbial diversity and function. The researchers found that microbial diversity was highest in woodland areas, followed by grasslands and then cropland areas. They also observed differences in the types of microbes present in each area, with cropland having more chemo-autotrophic bacteria, while woodland had more fungi and plant pathogenic fungi. Additionally, they noted that the presence of certain microbes was associated with specific climatic conditions, soil properties, and vegetation cover. This suggests that land use can affect microbial diversity and function, which has implications for environmental policy decisions. This article was authored by Mevala Buiri, Cristiano Bolabio, Feren Romero, and others.


Mrs. Nui, you're about to release the first ECB annual report on supervisory activities, which also covers the preparatory phase up to November 4, 2014, when you became operational. What were the main highlights in this preparatory phase? One important highlight was the recruitment of the teams to recruit about 800 supervisors and 200 people for support services was quite a task in the small period of time that we had to deliver on this issue. Also, obviously, the comprehensive assessment was a huge task that also had to be performed under a tight deadline. Also, preparing the manual, operationalizing the regulation, the framework, regulation, creating the needed infrastructures such as for IT, for example, were quite a task. So what are your key priorities this year? Among the priorities for this year, one is very obvious, to draw the lessons from the comprehensive assessment to make sure that all the quantitative and qualitative information that we got through this exercise is fully used for supervision. Another important priority is also to finalize our methodology to assess risk in the banks and to decide about the additional capital buffers they need, the pilot to capital they need to face the risk they are taking. And obviously, we have a number of other issues to address, policy notes to prepare to make sure that banks are safer and sounder. How about if you look ahead, you must also have some issues where you think, oh, we want to tackle these. So going ahead, what are the biggest challenges this year? One big challenge is to have a consistent, better definition of capital. There are too many differences in the definition that are used by the SSM banks. So we have to address the national options on discretions. Most of them are related to capital, but not all of them. So it's a big project to make sure that we have fully harmonized regulation on definition of capital in Europe. Also, obviously, a big challenge is to address the level of non-performing exposures. This level is pretty high, as was demonstrated by the comprehensive assessment. It's not a surprise after years of economic difficulties in Europe, but this is something that has to be addressed soon. Thank you very much. I wish you a lot of success. Thank you again. Thank you.


On Wednesday, March 20th, the Wheelwright City Commission held a meeting to discuss the implementation of a new trail system. While it's still in the planning stage, much consideration has been given to where it can be built and the cost for construction. Mountaintop News spoke with Wheelwright City Commissioner Michael Tackett for more details. Okay, the overall plan is we have 60 acres of reclaimed mine property, you know, and it's just sitting there. We have funds in the bank. So, we got to develop something in Wheelwright that Pikeville, Prestonsburg, Hazard doesn't have to draw those people in. With that said, my long shot dream is a trail system, whether it's four wheeler, horses, bikes, whatever, is a trail system. But if I can create a fireground type property back there, where you have campsites, a trail hub, we can have festivals, you know, that type of property. I'm just sick of everything moving out of here and us doing nothing about it. Coal is not coming back to Wheelwright. Inland Steel is not coming back to Wheelwright. We got the prison income. Let's use it for our people. I want to move forward. Wheelwright needs something other than what we used to be. Window tinting, remote starts, leather interiors, sound systems, front and rear bumpers, spray and bed liners, bed covers, wheels and tires, lift kits, step rails, even underglow like kits and so much more. If you can dream it, we can do it at J&M Custom. It's currently applied for a grant to Kickstart the project. Along with fellow Wheelwright City Commissioner Sam Little, he believes a trail system will improve the quality of life in the area. Since I've been in office, I've been pushing this and he pushed it even way back. Him and Shannon Hall, a citizen Wheelwright, has tried four years ago. But he went out and got some numbers, statistics on trail ride communities and recreational ATVs and motorcycles and it goes down. Drug use goes down. And Wheelwright sure felt the head of drug use. We lost a whole generation to it. So if we can save a generation, move forward. Why can't we? Let's move forward together, everybody. Reporting for Mountain Top News, I'm Nick Colum.


Welcome, I welcome you all to this lecture in the course Introduction to Paninian Grammar. We are studying the process of speech production as described in the Paninian grammatical tradition. Let us continue dealing with it. In the previous lectures, we have studied the source that is used to describe the process of speech production namely the Paninian shikha and we analyzed the shikha text and we said that there are these eight stages available to us from this particular source. So, this shikha text says, Atma-buddhya-sametya-arthana-mano yungte-vivakshaya-manah kaya-gani-mahanti-saprera-yati-marutam-marutastu-rasicaran-mandram-janayatisparam-sodhirno-murdhyavihato-vaktram-apadyam-arutah-varnan-janayate And the eight stages mentioned in these verses are Atma-buddhya-sametya-arthana. That is the first stage. Mano yungte-vivakshaya is the second. Manah kaya-gani-mahanti is the third. Saprera-yati-marutam is the fourth. Fifth is marutastu-rasicaran-mandram-janayatisparam. Sixth is sodhirno-murdhyavihato. Seventh is vaktram-apadyam-arutah. And eighth, and the final stage is varnan-janayate. The speech is actually produced. This is an audible speech. Amongst them, we have been studying this first stage so far. And we have been trying to understand what this stage entails. What do these words mean? And so we first of all tried to understand the role that is played by Atma and buddhi and arthas. And now we are studying what is the meaning of sametya? After having collected the meanings through the intellect, that is the meaning of this line. What is the meaning of having collected sametya? That is what we have been studying. And then we said that, let us study in some more detail what is meant by this collection of meanings namely simple, derivate, super derivates, etc. Let us also study briefly what is the concept of congruity and also the concept of mutual expectancy. And so in the previous lecture we also studied the overall cognitive process involved in the cognitive apparatus of the human being. And on that basis, using that as an example, we shall study now the first point on this slide namely the collection of meanings, simple, derivate and super derivates. All these they are stored in a hierarchical order in the intellect. And it is these meanings or parts of meanings from these that are collected by the Atma in order to respond to a particular situation which demands communication. Let us now look at the first stage little more deeply. To recap, these are the domains and these are the sense organs shrotra, ear and shabda is the domain sound, tvak is the sense organ, skin and sparsha is the domain that is touch, cakshas that is eyes is the sense organ and rupa is the domain that is form, jiva is the sense organ and taste is the domain and grana or nose is the sense organ and gandha or odor is the domain in which grana operates. So, this is the correlation between the sense organs and the domains and we have seen the rules that the sense organs operate within their own domains they never have a cross link. Now, let us look at each one of the sense organs and the domains and when we say collection of meanings what do we mean, what are the examples and for each of the sense organ and domain pair we shall study the three developments namely simple, derivate and superderivate. Let us first look at the shrotra, indriya, ear and shabda that is sound the domain. So, what is the simple arthakash, it involves let us say action of hearing and words related to it and other meanings also related to it action of hearing. Then action of hearing is more specific in general action of knowing that is what happens through ears and so there is also part of the arthakasha that can be considered as simple. Parts of the organ they are also considered to be the part of the arthakasha which is termed as simple related to the ear. Then let us say the ornaments of the organ and the functions of the organ all these fall under simple arthakasha related to the indriya ears. Similarly, related to the domain shabda we can list down following articles which can be considered to be part of the arthakasha related to shabda namely action of hearing, action of speaking this is also related to sound, sound is also used in relation with the action of expressing. Then there are other meanings which are part of the oral apparatus in the description movements of those parts that is also part of this arthakasha. These are only few sample examples and there are many more but these can be termed as simple because they are directly related with the sense organ and with the domain. Now from these there would be some more meanings that could be derived those we shall call as derivates. So, what are the derivates in the arthakasha related to the shrotra and shabda? The components of speech for example, then sentence, words, roots, suffixes, sounds etc all these can be the derivate meanings as part of the arthakasha related to the indriya ear. Similarly, actions related to the ornaments of the organ ear, shades of the action of hearing, listening, ear-dropping etc also music and different varieties of music and so on and the details those could be the derivates as far as the shrotra arthakasha is concerned. Similarly, if we study the derivate arthakasha as far as shabda is concerned or sound is concerned or sound is concerned we can talk about the process of breathing components of speech as was there with shrotra as well. Shades of expressing, uttering, muttering, speaking, singing, crying, shouting, ordering etc and also music and concepts related to music they will be all the derivate arthakasha as far as shabda the sound is concerned. Something that is derived out of these derivates can be referred to as super derivate and so the super derivate part of the arthakasha is related to that is related to the shrotra or ear is extension of hearing that is lending an ear for example all ears another example. Similarly figurative use of the organ ear hearing what cannot be heard if that is to be said then obviously you are not actually performing the action of hearing by involving the ear but then you are still using the word hearing knowledge in general that could be the super derivate and also refinement of arts, refinement of arts music and so on. Similarly if we talk about the super derivate arthakasha as far as shabda or sound is concerned we can say that the written symbols considered as a speech is an extension and that could be the super derivate of shabda or sound action of amplifying, action of compounding, sound proof etc such words and such meanings they could be considered as super derivates and of course creative acts and refinements they could be considered as the super derivate arthakasha with reference to shabda. This is how the collection of meanings with reference to shrotra and shabda can be mapped, can be noted down and once again these are just a few examples and there could be many more depending on the situations as well. Here we are only looking at the cognitive process of a human being which is core and which is universal so these are universal concepts that we are dealing with. Let us proceed further and study each one of the pairs of sense organ and the domain and see what collection of meanings does mean in their case, what arthakasha can be represented by in those cases. Let us now go to the next pair of sense organ and domain namely tvak and sparsha skin and touch. So the action of touching and the action of knowing that is part of the simple arthakasha and collection, sense of temperature, sense of gradation, action of removal of skin, action of cutting the skin and so on they would be part of the simple arthakasha as far as the tvak is concerned. If we look at sparsha touch we can say that the action of touching as well as the objects with space which can have touch, temperature in general, opposite pairs of temperature, sheet, usna and so on and various shades of them all of them can be part of the simple arthakasha that is related to the domain sparsha. If we proceed further to the derivate arthakasha then we will see that they are derived out of some of these or most of these. So for example skin protection apparatus that would be part of the arthakasha related to tvak, skin related medical issues, skins of trees and fruits etc. That can also be the derivate arthakasha related to tvak as an indriya. Then if we look at sparsha and the derivate arthakasha related to it we can note down some examples say namely shades of touches, gentle touch, rough touch or whatever, body parts related to touch and finally emotions that are related to touch they all can come under the derivate aspect of touch as an arthakasha. Then if we go to super derivate as far as the tvak is concerned we can say that figurative use of skin in sentences and so on that gives us a clue that this must be an arthakasha where skin as a meaning is used in the figurative sense and then equipment of means for skin protection and so on things related to them they can also come under super derivate part of the arthakasha. Similarly for sparsha also we can say that figurative use of touch for example touch of imagination and so on that can come under super derivate. Similarly measurements of touch something like that can also come under the super derivate part of the arthakasha related to tvak. Now let us look at the arthakasha which is simple related to the pair of chakshas and rupa and most probably this pair predominates every other pair. So chakshas eyes can be related to the action of seeing and action of knowing of course then there are parts of eyes biological limbs then there are movement of eye that is opening closing etc etc they all will come under the simple arthakasha related to chakshas. If we look at the rupa as the domain of chakshas we can note that size or shape length color direction written symbol all of this would constitute the rupa and would come under the simple arthakasha related to rupa. Then if we go to the derivate part of the arthakasha related to the pair chakshas and rupa we can note the following the medical aspect of eyes can be the derivate part of the arthakasha related to the chakshas or the eyes shades of action of seeing what blocks the eyes what blocks the perception through eyes that can also come under eyes the blocker and technological aspects of seeing for example using a microscope and so on new equipment that helps improve the action of seeing that can also come as the arthakasha related to chakshas and this arthakasha will be called the derivate arthakasha. Now the arthakasha related to rupa would be of this kind say for example in pairs gross versus subtle. So these and related concepts can be part of the arthakasha related to rupa or form. Similarly when form as form becomes an important feature of a personality then also we can say that that form has become the derivate part of the arthakasha related to rupa. Form of language is another example and the material that expresses the form that can also be called as the derivate of the arthakasha related to rupa. Then we go to super derivate related to chakshas and rupa. So figurative use of eyes is part of this super derivate arthakasha seeing equated with philosophizing as is the case in the Indian philosophy where the philosophical systems are called darshan primarily an action of seeing, seeing something. So then that would be a super derivate arthakasha related to the action of seeing. Extension of action of seeing to inanimate such as machines, computer vision for example could be a concept that can be related to the chakshas as part of the super derivate arthakasha and also extension of action of seeing to virtual entities like state. So there is a famous statement by Kautilya Chanakya in his work where he says the kings have the spies as their eyes. Here we are imposing the organ chakshas on an entity which is virtual entity namely the state and saying that spies are the eyes for the king. So this is a super derivate part of the arthakasha related to chakshas. Now the super derivate part related to rupa or form as a domain would be mixed form with all features put together for example color, size etc. There are some colors which are distinct from one another but there are some colors which are mixed which are the result of the mixture of two or more colors all of them that can come under the super derivate aspect of the rupa. Form becoming a template in intellect as in logic this is an extension of the form. This can also be considered as the super derivate part of the arthakasha related to the rupa. Next we go to the simple arthakasha related to jiva or tongue and rasa namely the taste. So here the action of tasting the action of knowing they are part of the simple arthakasha that is related to the sense organ tongue. Parts of tongue and movements of tongue they will also be primarily primarily part of the simple arthakasha related to the organ tongue and then the domain taste will have following as part of its domain namely its arthakasha namely action of taste, types of taste. Then the contrasts that exist between the tastes all of that can come under the simple arthakasha related to rasa or taste. Then objects generating different taste they will also come under the simple arthakasha. If we look at the derivate part of this arthakasha related to jiva and rasa we shall say that the medical aspects related to tongue they can be considered to be the derivate part of tongue of arthakasha related to tongue tongue used as an instrument for speech can also come under that classification and then types of tongue that can also come under the derivate part. Similarly rasa or taste if this is to be studied and the derivate aspect of arthakasha related to it needs to be studied then we can say that mixed taste of different objects that can come under the derivate aspect of arthakasha related to rasa. Basic crops generating objects of different tastes they can also come under the derivate part of the arthakasha related to rasa. Types of food for instance ingredients recipe and related material that can come under derivate part of the arthakasha that is related to rasa. Correlation of tastes with emotions and culture they can also come under the derivate part of the arthakasha related to rasa. Then if we look at the super derivate aspect of jiva and rasa we will note the following the figurative use of tongue in the language this will come as the super derivate part of the arthakasha related to jiva figurative use of action of tongue that can also come under the arthakasha which is super derivate related to the tongue and now if you look at rasa or the taste and the super derivate arthakasha related to it we will note that generalization to refer to aesthetic experience in general as rasa that would come under the super derivate aspect of arthakasha related to rasa. And then of course figurative use of taste that will be also a part of this arthakasha. Now finally the fifth pair of sense organs and domain is grana that is nose and gandha that is odor. So the simple arthakasha related to these two is something like this as far as grana is concerned the action of smelling and the action of knowing also the action of breathing that is part of this arthakasha. Parts of nose the biology that will also be part of the simple arthakasha related to grana the nose and then the simple arthakasha related to the domain gandha or odor is the following action of smelling of course different kinds of odor objects which generate different kinds of odor they will also be a part of this arthakasha and then there would be somebody someone who would be the carrier of this odor even that can come under the simple arthakasha related to gandha. Similarly as far as the derivate arthakasha is concerned we will note the following as far as grana or nose is concerned shades of action of smelling association of mental acts to the action of smelling medical aspects related to nose ornaments related to nose all these would be considered as the derivate aspect of the arthakasha related to grana or nose. Similarly the derivate aspect of the arthakasha related to gandha would be shades of odors contrast in the types of odors association of mental acts to the odor animals working on odor all of that can come under the arthakasha related to gandha and this would be the derivate arthakasha and if we go to the super derivate arthakasha related to this pair we can say the following the figurative use of nose for example poking your nose and so on that could be that could come under the super derivate arthakasha related to grana or nose similarly the objects that cover the nose that are not actually related to it but are temporarily related to it they can also come under this super derivate aspect of arthakasha related to nose. Similarly the objects that decorate the nose ornaments they can also come under this category under the super derivate aspect of arthakasha related to nose. Similarly figurative use of odor can also come as a super derivate aspect of arthakasha related to gandha also odor as a parameter in scientific tests can also come as super derivate aspect of the arthakasha related to gandha. So to summarize what we have said we can say that the material that we have studied so far shows the mapping of arthakasha in a limited manner namely related to the human cognitive apparatus and it is possible to construct a hierarchical structure of different other types of arthakasha based on this limited structure. It is from this arthakasha that the atman collects meanings that are to be expressed as a response of a particular situation. These meanings for most part are interrelated to affect and effective communication. These meanings also have the feature of congruity and mutual expectancy which we shall study in the coming lecture. Now as is our practice before closing this lecture let us recite the Mangala Charana. This Mangala Charana is taken from another text written by Shri Bhattuji Dixit called Proudham Anorama and the Mangala Charana of this text reads as following and I read it, Dhyayam Dhyayam Parambramha Smaram Smaram Gurur Giraha Siddhanta Kaumudi Vyakhyaam Kurve Proudham Anoramaam and I repeat Dhyayam Dhyayam Parambramha Smaram Smaram Gurur Giraha Siddhanta Kaumudi Vyakhyaam Kurve Proudham Anoramaam This is from Proudham Anorama and now let us also read the five sutras of today. They are taken from 3.4. Here are they Dhatusambandhe Pratyayaha Kriya Samavihare Lot Lotohisvau Vachatadvamoho Samuchya ye Nyatarasyam Yatha Vidhyanuprayoga Purvasmin Samuchya ye Samaanya Vachanasya I repeat Dhatusambandhe Pratyayaha Kriya Samavihare Lot Lotohisvau Vachatadvamoho Samuchya ye Nyatarasyam Yatha Vidhyanuprayoga Purvasmin Samuchya ye Samaanya Vachanasya Thank you for your attention.


Hey everyone Shaber1000 here today, we've got more free stuff There are some things inside that Dale Earnhardt bag that a friend of mine dropped off to me He told me a few weeks ago that he had some stuff for me. He's always given me something in fact. He gave me one of the pressure washers that I worked on and The pump went bad on it, so he gave that to me. I'm gonna that'll be In an upcoming video when I get the stuff for it But anyway, there's a couple items in this in this Dale Earnhardt bag. We're gonna check them out and see what he gave us Okay guys, so like I said got this Dale Earnhardt duffel bag here. It's it's used. I mean you can see He gives this stuff to me in case I want to sell it Or if I want to keep it a lot of the stuff he gives me I do keep I Have sold a couple things, but most of the stuff he gives me I do keep But he gets some people give things to him and he goes to state sales And he buys a bunch of stuff and a lot of times in the state sales You know if you want to buy one thing you got to buy You got to take like everything in this lot they call it like there could be 30 items in there But you got to take it all just to get your one one item even though you say you know look I'll just I'll give you that amount, but I just want that one item you have to take it all And also he works for a guy that has rental rental properties all over the place I think some of this stuff can't comes out of rentals, you know that people leave behind so See what we got here. We got a bag within a bag Okay, so this bag's pretty cool It's like a I don't know if that's real leather if it's pleather But it's velcro and you open it up and that drops down Just like that. So that's pretty cool I Let me see what this is here. We'll We'll see the brand name Looks like Oscar OSC AR Oscar I can't read the bottom there, but maybe we can on the video and the The top zipper has Looks like their logo and it also has that logo Right there. Let's see what's in the bottom of this not I already know guys, but I wanted to share with you We were having a yard sale the other day and he stopped by So I've got some Teflon tape That you can never find when you need it. Oh, you can find black electrical tape Whatever duct tape, but you can never find this now if you're looking for black tape electrical duct tape duct tape All you find is this That's okay Can you get that and two fishies they look familiar? I don't know what they do But I don't know if they're part of a game Or what there's two fishies in there a roll of felcro Still got the sticky stuff on it. So this this part of this rolls never been used and We got a magnifying glass, which will come in handy. This will go in my toolbox It does have light on it, but the battery is probably dead. They just take like a little button cell battery right there There's the number that it takes so that's you know That can help me out on carburetors and stuff like that. So In this bag, I think we're going to use for camping To put spices and things like that in it. So we got that It's gonna put this in here for now that way when I go to find it. I'll forget where I put it and I'll say no I saw it the other day So that'll be a good camping bag we can put stuff in like monkey said maybe spices or something and Here's something really cool He come by one day When we was having a yard sale when I was putting the The the fuel when I was doing the fuel injectors when I had that clogged injector and I had Arthur himself sitting up on a windshield and he says, you know, I got some stuff for that thing I see you do because you know this gets expensive. He said yeah, I'll bring it by to you. I Said cool. So this was in there, but he also told me he says You ever seen one that's in like a holster. I So well, you know on videos, I haven't seen one in person, but he says I got one check this out and this works Now in the side pockets here You can put your extra stuff. This was in it, but That was turned on so someone had left it on and ran out This one on this side is full. Yeah, you can see the stuff in it and I just put a full one in it And that is a new pad And You can take it out if you want just like that. I like the color of it All of drab the two things there Here's your clip for to clip it on your backpack belt pocket whatever and it turns So that's cool. So This will either go on my pack or in my pack Now we have two so mink can have one beside her and I can have one beside me and that way I don't have to Remember it every time we go somewhere Like if I take it with me on my solo, you know, I Might for forget my bag or something next time we go out together or I know one time I needed it on a solo and I had forgotten it in our stuff So this way this one can stay in my pack and our other one can stay with our camping gear And this is pretty cool We have a charger here Something goes with this charger this we're going to check out later tonight. It's like someone's sitting in a garage This is a Motorola. It's the LR 097379 Now it does come with the radios now the antenna The antennas are broke, but that's from people sticking them in their pockets and it gets broke off When I worked in Troy, Ohio at Dell Tech Polymer. We was always breaking these off These are pretty cool This one has the clip on it unfortunately This one does not Again, you know just got to glue them antennas back in but this one does not have a clip But that's okay Also has a weather weather band on them So you can we can hear the weather when we're when we're out somewhere has emergency Button on it. I think they're 22 channels. They're supposed to go up to 35 miles I don't believe that but later on when we try it We'll put a camera in the car with monkey and we'll have her head down towards the river Which is about six miles away and we'll see how far she can go before They start giving out But that's okay. I mean it's worth it just to have the weather channel weather station on there and you can change different stations to get to where Your station is, you know closer to you also has A light on it. This one's not staying on. I don't know if they do. I can't remember now No, but you just hold it You got a nice little LED light. We'll check this out later. So that's pretty cool and two other little things Nice little Swiss army knife there. I have several of these but mine aren't I Didn't notice this earlier Miller plastering and stucco incorporated and it has their phone number on it. That is cool I did not notice that the other day. So I'm gonna hang on to that. I Don't know if this is made in China the ones I've got are made in China, but they're still cool I mean, I've got one in my pack. I've got one in my My box. Yeah, this is China me too, but I just think it's cool I've got one in my tackle box and in my backpack and then this little guy as you can see there's my finger There's my pinky Barely covers my pinky That's a cute little knife. You can put it on a keychain or whatever I'll hold on to this Okay, so this is Ducks unlimited. Is this something there? Imperial Ireland stainless. Is that what that says? Yeah Imperial Ireland stainless Right down there at the bottom And then we've got the ducks unlimited Right there that's pretty cool Now so I don't know where this is made I'll look it up Imperial. I'll put it on the screen right now And the ducks unlimited and we'll see See if that's made here or if it's made somewhere else It's kind of sharp for these little things are usually not that sharp because they're not made for Woodland wood or anything. It's just made to carry in your pocket a pocket knife or on your key chain Just get you got to open them piece of mail or something. So yeah, so that's pretty cool So that's our free stuff for today. That's So that's pretty cool, it's gonna be fun checking them I've already charged the radios up. So that'll be pretty cool and like I said, we'll put a Camera in the car with monkey and we'll let her go down the road and we'll talk until we start Till it starts breaking up. Who knows it might get that far I doubt it because we're kind of like three-fourths maybe two-thirds Up the top of this is a hill. It's like a 10% grade here. It doesn't look like it on camera I know but if I went down there to the end of the street and filmed up you could actually see it. It's pretty steep hill But there's trees all Over here all the way back There's nothing but trees and woods all the way to Hike with light All the way to To the river so that'll be fun and just wanted to share that with you guys Thanks for watching. I appreciate it. Shea Bear the myth man a legend gone for now I hope you guys had a great weekend and hope you have a Better week to come stay safe everyone. Bye. Bye and take care


The International Institute for Democracy and Electroassistance, or International IDEA, is an intergovernmental organization that has the mandate to promote and advance democracy worldwide. Our mission is to support the building, strengthening and safeguarding of democratic political institutions and processes at all levels, as an enabler to achieve the UN's sustainable development goals. To achieve our mission, we focus our work into three areas central to democracy, electoral processes, constitution-building processes and political participation and representation. Gender, inclusion, conflict sensitivity and sustainable development are mainstreamed throughout everything we do. We support those engaged in democratic processes by providing analysis of democratic trends through our flagship research on the global state of democracy, by producing comparative research on international democratic practices, by offering technical assistance and capacity building on democratic reform and by convening dialogue on issues related to the public debate of democracy. Headquartered in Stockholm, our work has a worldwide reach through our offices spread over Africa and West Asia, Asia and the Pacific, Europe and Latin America and the Caribbean. We also sit at the UN as a permanent observer. Learn more at www.idea.int