Aloha, welcome back to the Cyber Underground. I'm your host, Dave Stevens. Last week we had an attempt at a live broadcast from the floor of Def Con at Caesars Palace Las Vegas. And today we're back in Hawaii. We didn't quite get the sound right, but the episode's already been viewed quite a few times and we had interviews with the students that actually went out there. And the reason I kind of casually titled that episode, How to Be Hacker Part One, is because it's important to know that if you're going to go in to become what they call now a security researcher, you need to go see what things are being done, hear these presentations, actually put your hands on the tools and meet other people in the industry and make some contacts. That's important. Next week we're going to be taking this to the next level. How to Be Hacker Part Two will be going over the first phase of an attack, which is reconnaissance. We'll be doing some open source intelligence and giving you a view of Wireshark and some NMAP tools. Today we're going to wrap up what happened at the Def Con conference and of course the previous conference of that black hat. And we'll be talking about the presentations and some of the fears we have now. And I think our co-host Andrew had a great term for this. Andrew, the security guy, said, Brother the world's broken. Brother the world's broken, but at least I'm not wearing makeup. Like Dave, Dave's wearing makeup over there. He got some number five pancake on today, I found out. It's anti-glare, anti-glare. No worries. Amazing stuff. We got Professor Hal, we got Professor Dave, we got Andrew's dumbass over here. Anyway, we saw a lot of really cool stuff. I spend a lot of time in the arsenal and so if we can touch on some of those, I'm happy to share some of those. It's a demonstration mode. You go there and you see people demonstrate different tools and techniques that they use in the industry and you saw some that were pretty interesting. Some, some, one of the very first one I happened to walk in on was a cumulus. This guy was, actually it's a toolset that he built that works on, you know, your cloud services, but it works on account escalation and then account takeover and then actually a way to launch unauthorized payloads, right? And ultimately he showed us absolutely launching an instance of an account, setting the privileges on an account that enabled it to lock everyone else out of the original account. It was amazing. So you get command and control through this tool? Yeah, yeah, through this tool. And I was like, this is not good. This is our cloud, like we have all of our stuff and he's gonna lock me out of my stuff. I mean, but he was really, the research he was doing was trying to show you how a lot of these privilege sets are, you know, they're start-out-start, right? So that you really need to be careful when you set these instances up to go in and apply all the right controls. And that's kind of what he was able to take advantage of. So let's talk about that. The start-out-start is a notation that programmers use to say everything. Yeah, and then the directory structure and whatever I am and below me, just take it all. And the start-out-start notation has been used default. When someone's programming, it's an easy little notation to put in there and you always think, oh, come back and fix that later. But then if you don't, then you have this problem, right? Everybody at your level or below gets everything. And if you're administrator, well, the world is yours. Yeah, and this role creation tool, he had gave it that, gave that role that privilege set, right? So it was pretty powerful. Snowden did one of these, the privilege escalation, he created another account that wasn't him. And then he escalated that accounts privileges and then did his... Maybe that's where this guy learned his tool. It was really amazing stuff. So that was one. What did you see, Hal? Well, I saw so many things that made my head spin. The arsenal was the demos, right? At Black Hat. Yeah. And then we had presentations at Black Hat. They called the briefings. You go into a big room for about 40 minutes. I couldn't afford that. Thankfully, we got a teacher's discount on that. Yeah, right. Everything from social engineering and fishing to industrial systems being hacked. One of the more interesting ones that we saw, that was the car wash, where they actually had a car wash that was on the internet so that the owner could log in and configure the car wash and get statistics of, you know, how much water did we use today? How many cars did we do? But they used that internet connection to log in and hack into it. And they programmed it to attack the car. What? They drove the car? Well, like the wash, they just started beating it. The door would crash. They would spray with water. They would crash down and smash the hood. No. Where is it in the US? Or was it outside? Yeah, just in the US. What they found was that the website that they put up was in the URL, you could see that they were calling DLLs, these dynamic link libraries that were sitting on a server somewhere. And he masterfully just went through one at a time, finding out which functions were available on this and which functions actually didn't just bring back statistics and present reports, but actually had command and control of the servo motors that control the mechanics of the robotics and the car wash. And he said, Oh, look, I can control the door through the website. So this is all in the URL of the browser. The way that he was able to get administrative access was just a mistake in the code where it said if you could cause an error during the login process, instead of kicking you out, it lets you in with admin rights. Oh, that's a flaw. It was a check to see, okay. The first thing he did is that whoever logged in, it escalated you to admin. You're the administrator. Then it said, let's do this check to see if you're supposed to be admin. So if you threw something in there that made it fail, it would just go to continue. Wow. And continue means leave the person at administrator. And so this is bad code. This is horrible. This was really bad code. Someone had really messed up on this. We know it's 95. And do some kind of C code. This was also a website and I think HTML. Yeah, like try catch. This was in. No, this is just a regular if then else. Oh, wow. Yeah, it wasn't even a try catch, I believe. So that yeah, the error condition was just continue as administrator and let the person do what interesting a glitch that glitching attack. I saw another one where this was in the arsenal. It was called chip whisper. And this guy's been at this for a little while. And they basically monitor the power consumption of a chip, right. And by monitoring it, you can actually see the differences in the type of data that's clocking through it to the to the point where you can see the bits and the bytes and you can then decipher what they mean. So he is actually by by capturing the power on the chip. When it hashed an RSA 1028 key, he was actually able to decipher that key with the software he built that that, you know, decipher that power registry, you might say that that that piece of code, or the power monitoring that that chip did when it brought that key across. And he has to do it by introducing a glitch in the power wave to find out where it starts to see where the base. Yeah, base. So once he once he can restart it, and which he does by just just minor power fluctuation, then he can because it has to re initiate and so when it does, it hashes the key. And so then he could see that. And he's decrypted the key right forth right there. So I mean, it took minutes. This is why Red Bull and Monster are so popular and are doing so well right now. Because can you imagine how many Red Bulls you'd have to drink to stay awake and do this work and figure this out? This was that must to be in Yeah, this tremendous amount of work. This yeah, and this, you know, something I'm a feel I'm familiar with old scopes, I'm familiar with power waves and what I'm looking at, but I had just never seen someone take it to this level. And these are the chips that are like in our phones and stuff like that. There are chips apparently you can buy he talked about this some industrial grade chips that offset some of this problem where they they they they process like dual process or they process a one and a zero at the same time. So it it biases the power. So you really can't read this. But manufacturers don't want to pay for those. So they buy the cheap chips. And you get this hacking capacity or capability. I was very impressed with that. They made me feel like nothing safe. So that that process called probing. And you can do that with leads and the old scope. And there are chips out there that, you know, the DoD DHS all those people, they use the chips like you're saying, they offset some of that. So you can't probe them. But some of the chips, since probing actually can apply heat, you know, you can't you can't help it. As soon as those leads apply a certain amount of heat, the chip knows it's being hacked and burn itself will take the master two leads and connect them. And that's it. You're you have a permanent short and chips debt. They talked about the SIM cards in your phone. If you've ever seen a little sim chip, do the same thing. If it gets a serious error condition or you try to probe it, it'll burn itself. So they are safer than I think they are safer than you think. But it's just a matter of time. It's just someone's going to break it. If you make it, they'll break it. And if you look back at his this is a historical lesson for you and players out there, please listen to me. Don't ever think the walls of Troy will keep out the enemy. Over history, no matter how big the city was know how many how many men in your army there have been, no matter how good you are at fighting, someone takes you over. Sparta fell to Rome. Troy fell. Everybody falls. So build your walls. But just expect them to come down if you don't keep changing and adapting and doing things like going to these conferences and seeing what the latest hacks are. For instance, and this one just blew my mind, we sat in a presentation of the new Microsoft threat protection and Microsoft threat analytics. So this is the enterprise system that they put out on a master server controls the system where every host, which is a physical device on the network, actually runs this little piece of software called advanced start protection by Microsoft. And it's kind of like antivirus and malware and it reports back to the mothership, the ADA analytics engine. And this is great. And it runs as a host based security system. The DOD has been doing this for years. McCaffey at E policy orchestrated. It's the same thing. And it's kind of a it takes a village theory, you know, every piece of the network is participating. So you can analyze all the traffic and compare it to previous attacks and see if you should shut this one down and isolate that system and so forth. And it's already been hacked. What? Yeah, it demonstrated this right right in front of a demonstrated and then said, Oh, yeah, this is really advanced.  It's not looking. And here's the ports that are looking for here's the process. He had it to the process IDs and the task manager and windows. These are the process IDs that if you're faking something, don't use those. It's you it's looking for those. I see. Yeah, I listed like five of them. Wow. It's already been broken. It doesn't come out till next month. Oh, wow. And Microsoft presented this or was it was a security researcher aka hacker. And these guys get on the advanced list, you know, Microsoft push out his stuff for testing. And he's one of the guys that tested it. And I hope he told Microsoft, but I'm sure Microsoft has representatives walking around gathering this in Intel, right? I'm hoping. But yeah, it was hacked right in front of us. He told us five, six different ways to do it on the machine and on the network as a whole to capture the network. So these are these are important security conferences people present. We also saw a healthcare presentation that was just the most depressing thing I've ever seen in my life. Depressing. Oh, it's depressing. It is the state of some healthcare organizations, especially the smaller vendors in the more rural county, they just don't have budgets allocated properly, so they can upgrade their systems, secure their systems, hire the right people, or hire them at wages that actually will attract the talent. Yeah, that's a big problem, right? The islands are experiencing that. And that's something I just harp on all the time. If you hire the right talent, you need to show them that they're worth, you know, what you're looking for. If not someone else will.  So you know, if you got good people, you better better try to hold on to them. Yeah, we don't have those people yet. We keep trying to train them at all. There's a couple. I wish I was one of them, I could make some serious money. Yeah, but Silicon Valley takes them and Seattle, Chicago, New York, Manhattan is a big consumer of those people. Austin, Denver, Lake City, I mean, the tech hubs are coming up everywhere, man. That's right. Salt Lake City, and Sioux City, South Dakota, Sioux City, Sioux Falls. Yeah, Sioux Falls. Yeah, yeah, exactly. Falls, yeah. Tech hubs are changing. Yeah, what other presentations do you guys see that just freaked you out? We got a couple minutes for the break. Alright, I got I got a one, I got a cool one. This was this was interesting because it wasn't so much of a technical hack as this guy was had been contacted by companies that wanted to be able to fight drones. How can I detect the drones coming onto my property or coming looking at my development or my research or whatever. And so he went and tried to find some way to help these guys defend. Well, all of these people that advertise they have all this anti drone technology. He could find none of it that was actually available. He couldn't purchase it from anyone. They're like, Well, we're in we're in beta and we're in development. And these guys who showed you probably saw the trained eagles and the trained falcons. Well, there's like one of those that's been sold to this some military, right? And so like, it was really fun and you probably see people with drones carrying nets and drones shooting people shooting net guns and all this kind of stuff. And he did have one of those he got hold of and it's supposed to shoot like 50 feet and he shot it goes like 10 feet. Like it was it was just ridiculous. So it was really funny how he exposed that this anti drone industry that doesn't it doesn't really exist, you know, but it's apparently it's coming and if you and no one will give him prices for anything either. So he couldn't figure out what anything would actually cost if they actually did make funding. Yeah, that was an interesting one. Okay, so we're going to take a little break here to play some bills. We're going to come right back. Don't go away and stay safe. Aloha, my name is Steven Phillip Katz. I'm a licensed marriage and family therapist and I'm the host of shrink wrap Hawaii where I talk to other shrinks. Did you ever want to get your head shrunk? Well, this is the best place to come to pick one. I've been doing this. We must have 60 shows with a whole bunch of shrinks that you can look at. I'm here on Tuesdays at three o'clock every other Tuesday. I hope you are to Aloha. No, you're going to get home a lot. For every game day, a sign a designated driver. Welcome back. Thanks for staying through the break. I'm Dave Stevens host of cyber underground with me here today. The Professor Hal and Andrew the security guy. Hello everybody. We're talking about the wrap up what we saw and what freaked us out. How the world is broken at Black Hat and Def Con. And I wanted to share how and I were at Def Con. We actually met the inventors of this tour watching this demonstration. We couldn't quite figured out. So we actually asked the kid who invented it 19 years old. He and his dad came over and told us about it. This is this freaked me out. So most people will think if you if you put a device on a network to X fill data or we draw data off your network, they'll use regular Wi-Fi channels, which is about 2.4 gigahertz to 5 gigahertz summer in the range, right? And and he said people are looking for that. So he invented this one, he plugs in a network and it X fills data over FM on the which is I think 15 kilohertz on up to like 1.9. Okay, it's the lowest band. But he said wherever you go, you have to look to see where the radio stations are so you don't overlap on a radio station. But then you use regular FM and nobody's looking for it. And it broadcasts to everywhere just on an FM channel. So they don't know there's no endpoint written in, right? So you can be anywhere within and you just tune to it and you can download whatever it's broadcast. That's right. It's probably not all your data, but FM frequency. Well, it's modulating. How incredible. And he said he's trying to modify this this unit so that you could plug it into a network. It could compromise the network, take over whatever the network is. And it costs $5 and it leaves no clues. Well, the Raspberry Pi. So it's just this big. Yeah, just hide it somewhere on the network. And it just goes to work. Yeah, it should be the the rest should be fairly similar. There's enough of those tools built on USB sticks and stuff that I'll be able to get you in. Oh, sure. I mean, I would think that'd be a he's already done done that by now since it's been a week. Well, there's multiple barriers to overcome right. And as long as you're, you're grabbing an IP on the network, now you got to shelter your IP, you can't pretend to be a host on the network that's protected by a security system, it's going to see as a rogue IP on the network. But I'm sure he's figuring all these things out, because there's not old. This is not new information. Yeah, or come USB through someone else's connected machine that is allowed there, right, something like that. Right, right. So and this is, I mean, that to me was genius. Wow. The more low tech you get, the easier it becomes. For example, we saw a presentation on email phishing. So they were they're putting up these these images of some of the actual legitimate emails coming from some of the providers which I won't mention. And they're textual based. They might have an email link in there or something you to reset your password or there's something wrong, but contact us please. But it's very plain Jane teched with a little bit of like an email link in there. But people are replicating this feature, they're doing another email, and they're putting all kinds of fancy graphics and HTML and CSS in the email. And it doesn't look anything like the legitimate email, but it's got a higher click through than the legitimate really now. Wow, that's sad. So people are going for what's pretty and neglecting to think, Oh, does that what it actually looks like a lot of time? Oh, they must have just changed her style or something like that. People just assume that the fancy is pretty. It's looking one must be the valid one, right? Because hackers won't put that much work into it. Yeah. They must be able to afford to make it make it appealing. Yeah. Wow. This is something to look for because I use Amazon Web Services for some stuff. And they have features in there like lambda, which has been broken. I won't say how they did it because it was so simple. It was horrible. I'm sure AWS will fix this in no time. But when they send you emails, it's kind of plain Jane. But I've got phishing emails from people that are beautiful. I mean, they did wonderful graphics and CSS embedded into my emails. I mean, and then of course the JavaScript, which would work if I clicked on it, right? It's just amazing amount of work that goes in there. I guess the the output what they gain must be tremendous to put that much into it. Yeah. More people that can own. Yeah. Oh, they can get this just flashed into my mind. We were going to talk about this. Mark Hutchins, the man who is credited in was Great Britain, right? He's credited with stopping the first outbreak of WannaCry. So WannaCry, the ransomware, was infecting machines in Great Britain and the national health system going rogue. And he figured out that every time this virus activated, it needed to go to the internet and look for this one website. If the website did not exist, then the ransomware would continue doing its evilness. But if the website was there, it would figure that whoever created the Frankenstein, WannaCry, it would think, oh, he wants me to stop. So the kid just went out and registered the website and put an HTML page up there and done, stopped WannaCry. And it helped the US a lot, right? Because he did it before it really took off here. Yeah, it really I think it shut it down within a couple of days, right? He was just he was right on it. It must have taken a tremendous amount of work. Kids are absolute genius. And he came to DEF CON. And presented that. I think he talked about how he found that. On his way out at the airport. FBI swoops in and picks him up and wears him. For Chronos, the Chronos hack. He's the Chronos hack. So I think he currently they're saying he was involved with some of the malware creation or distribution of Chronos, which was ultimately led to some banks losing some money. So I don't know details but that's what they're saying. I think this is one of the main topics we need to discuss at some time. These security researchers are all people that have had a colored past. Let's just do you think? Yeah. And to get these people to come to speak is it's like bringing them to a honeypot where a law enforcement can just swoop in and take your pick. And I don't think I don't think that's right. I think we need to hear from these people. And good or bad the stuff that they bring to the table is actually helping us defend our country. And if they're afraid to come speak, if they're afraid to even to put something on the web, we're never going to know. And the attacks will be even more prevalent. So this transparency, this open network that they want to construct and keep working. Law enforcement, I think, needs to work with these guys. What do you think? Yeah, I hope so. But I mean, if you stole, you know, you should probably come clean and go talk to them about it.  If you committed crimes in your past, and you're going to be out there, but they don't really stop looking, you know, actually. So, you know, you should just say congratulations. Here's a new apartment. Well, you should maybe get us, maybe get a lawyer and have the lawyer reach out to him and let you know and admit your involvement and see what you can negotiate for yourself.  You know, they have ways of learning who you are eventually and what you've done. And so, you know, they've been mad at a lot of people lately. So it brings up another problem, though, right? Security research depends on people saying, yes, you can come research what I'm doing. But if they say no, right, the car washes, the three different car washes said yes, you can, you can do this. So the car washes were OK. But if you want to hack something like Microsoft's threat protection system or a bank or a bank, probably going to say no. No one's going to say yes. How do you research how to attack? Well, well, you can, you can do the research without stealing the money. You can, but you're still broken in. You're still broken. Of course. And so then that's where that ethics, you got to come up, go to the bank, say, look, here's what I've been able to do. And you need to talk to their people, right? Like, you might have to do it. And you can get arrested on the spot. You might, but probably, probably not unless you stake their money. If you take their money, it's different. I think you need to talk to them first before you even try to do, you know, to break into anything, because otherwise.  What's his hack work? Getting in and then doing things once you're in. There's a there's a line there. Once you're in, you've broken the law. I agree, but you can also go to them and say, this is that you have a flaw and this is how I can get in. And I don't know. Getting in and doing stuff is different. Well, if I came to you for your company, you were a bank and I said, hey, man, I actually got in. I didn't do any damage, but I got in. I'd say thank you. I think I'd pay you some money. I think you're unique. The banks might say, well, thank you very much and call the call the FBI. They may call the FBI on you, but I mean, is your crime getting in? Is your crime presenting the research? I don't know. I mean, it's definitely an area of business to deal with, because we need the research to happen. We need this. Yeah, we need the research. And I think everyone would agree that they need it to happen, including the bankers of the world and the critical infrastructures of the world. You know, we need to know what these problems are, but don't don't go in and open the dam. Don't go in and drive the nuclear rods up and don't go in and take money from this guy and put it in your account. I mean, come on, there's where the illegal action occurs is, you know, I think if I were smart enough to figure out some of these hacks, I think I would risk the taking it to them and saying, here's the vulnerability that I found. I think if you find you go through these steps, you can gain root access to this and then let them go through it.  And you can even say, someone showed me this, doesn't even have to be you that you did it. The people that are training these kids to do this, it's kind of a liability now. I mean, we're training the foot soldiers in this new war.  Like, we're accomplices to, we're going to make all the audience accomplices next week, we start showing them in-map and all this stuff. That's right, an app and Wireshark, you're going to go over the stuff that, so that there's pretty much seven agreed to phases in it.  The first one is recon. So we're going to go over a little bit of open source intelligence, you know, how to get, you know, stuff that's already out there, it's in the public and, you know, scanning the network with Wireshark and just capturing traffic in promiscuous mode, which you just grab everything or in-map actually starting to poke out there and see what's open and why. See what's open and why. But even so, we should, we should say that you should use this on your own network or network that you have permission to probe. You don't want to use this on the wrong network. Yeah, in Apple, it breaks a lot of IoT devices. Yeah, it's powerful, which is cool. I want to talk about this other thing, because this had to do with probing. This other one I went in was the guy who was researching the CAN buses in the cars, right? So cars and aircraft, I use this CAN bus to talk, you know, from your everything's digital, right? So that's talking when you push the gas pedal, that's all digital, that it shows up on your thing, that it actually accelerates the car, all this kind of stuff, right? So all these, and there's multiple CAN buses in the car. So what he does is he gets, and he works for car manufacturers, but he's built a tool that allows him to insert data, junk data, problem data to see what happens to these CAN buses. Well, it's not good. So he was just showing us like the whole, one of them like the car just keeps running, you can turn it off, you can disconnect the battery, there's nothing you can do about it, it just won't quit running. And then, and then another like so, so he had it disconnected and it would quit and it's, without doing anything else, you just hook the battery back up, it just comes back on, you know, and all the lights are going like it's, so these systems are very fragile. Totally vulnerable. And he was able to demonstrate this. So he's, but his, his research has led him to say, look, these guys need help understanding what can be done to these, because they just, they look to make them work, not to break them. Well, we're gonna have to wrap it up. Is that it? Every car has this now, that's scary. Okay, maybe next week we'll do some more. Thanks for joining us on the Cyber Underground. We're gonna come back next week with how to be a hacker part two on the recon phase of an attack. I hope you join us next week until then, stay safe.


Russia's death toll in Ukraine hits 95,000. Russia's death toll in its war in Ukraine has reached 94,260 since the start of the invasion in February. The general staff of the Armed Forces of Ukraine revealed on Tuesday. Some 500 of the soldiers were killed in the past 24 hours. In its official Facebook page on December 13, the general staff also gave an update of Russia's losses in terms of weaponry. It says that Russia's combat losses in the past 24 hours included two armored fighting vehicles, two artillery systems, seven multiple launch rocket systems, five motor vehicles and fuel tanks, and one special equipment unit. Russia has lost thousands of tanks, anti-aircraft warfare systems, unmanned aerial vehicles in its war revocations since February 24. Russia has not released official figures for its casualties. Niza has Ukraine.


Welcome to this folks. Tonight I'd like to draw your attention on something that is a little different than what we're used to and Something that is a little different than what we've actually showed you and It's the gap warning Right now in front of you you have the S&P 500 index the SBX You're probably used to looking at the spy spy is the exchange exchange traded fund ETF the SBX is in fact the real index One is traded after hours and 24 hours in fact if you're when your broker allows it spy can trade 24 hours as of the S&P 500 the index itself doesn't So what you will see is what happened last Thursday And that is a gap up on the morning This is the clothesline on Wednesday night, and this is the open on Thursday morning. So basically you have an area area here where there's nothing It's a void. It's a gap up And this is what was interesting. I'm not talking about looking at it to fill Right away. However, you have to keep an eye on possibility for it To eventually fill and this is where I'm looking at spy same time However, you see that this one has the after hours right here where this is the Wednesday When closing time and this is at the bell Right, so the gap that you saw on the SPX is this gap basically what we're looking at is a situation where we close At the low point a little under 422 I recall and we are opening 423 and what happened is let's say you're rock climbing you're going up and you put an anchor somewhere in this vicinity and then Oh, we're a market all-time high You put another anchor there the anchor. Let's go What's going to happen? You might hold on the next anchor right on this anchor and Then if this one goes Well, you're left with this anchor, right? Which is support and then if this one goes This one goes well, I Mean if this That's it. That's your lifeline right there and if this one was to let go. What's going to happen? Well, you're gonna hold from this guy here all the way down to the next support and you're gonna fall to Fill the gap now it's hard to see here because there's a lot of activity in The after hours, however, if we were to go back to where we were here, you will see that We closed Open Went up then our anchors didn't really hold well and we ended up bouncing Filling the gap This was the gap Make that a little clearer This was the gap and we bounced right on that gap now What I'm trying to draw your attention to is not Well, you could have been this could have been a very good put play however my attention is to grab the bottom here the bottom is The gap is filled we've broken many support lines, right and Now we're down lower if we're going if we go back to the Spy line This is when we entered we were interested in entering at this support line why? showed you the gap is filled and the Spocastic momentum index was down and if I recall in the five minute it was down at minus 94 Which is really really low? So basically it's really extended the bottom and it has to bounce at one point. So My point was at least We're going to try to fill The gap back up to 423 Right, we were down to 422 So this is why just a hair on the 422 this is why we called the 422 calls and 120 and When we reached the first target of 423, right? This line, which also is this line. You notice We were up and we called a partial exit at 182 182 and When we reached this area We were up 100% on the remaining position where we close it to 40 So basically what I'm trying to show you guys is this Look for possibilities of a gap to get filled and this morning that morning That gap got filled after the whole thing didn't last didn't hold Filled the gap and it started moving up afterwards It's not always the case but on all gaps keep an eye on and keep an eye open for this possibility To have the gap felt either trade the gap down or trade The move up after the gap is filled But keep your eyes open for this We managed to get pretty decent trade in no time. I Hope you guys will put this into your tool bag and maybe I'd be able to exercise it When time comes I Hope you're learning something from this guys and I'm glad to have us Alright, have a great weekend


Okay thanks everyone for coming it's more people than expected to see here I'm gonna fit in the abstract for this. Thanks very much. My name is Campbell McNeil and I'm an architect at Dell. I'm responsible for the online experience and the whole onboarding process and the sort of back office management processes of the Dell cloud console which we use for provisioning existing cloud services and I'm also heavily involved in what we're going to be doing for private cloud in terms of what we're doing with OpenStack, how we're integrating that with enterprises that kind of thing. Now apologies for the slight disaster here with the sidebar. I'll just progress with it because I could fit it with us all day. Okay so what am I going to talk about? First thing how many people in the room are either somewhat involved with a service provider or planning becoming a service provider that kind of thing can I get a show of hands of people who plan to stand up public cloud services. Great, good to see you here. It's something that you know OpenStack gives you some of the tools that you need for but there's so much more you got to go and do anyway to actually become someone that can sell cloud whether you can sell it to the the credit card paying public or you can you can go and sell it into an enterprise and actually have it you know managed within an enterprise. With OpenStack what you do do get is you get Horizon. I consider Horizon to be a consumption UI. Horizon allows you to consume resources but it doesn't get you to Horizon and there's a lot of process that needs to take place to get someone to Horizon and there's a lot of process that needs to take place after where Horizon fits in to actually provide services. Yeah of course. What I'll do is afterwards I'll put them in slideshare and tweet at the link and you can just email me or whatever. No worries. Okay so as I said Horizon is a consumption portal. It allows you to create your VMs, your networks, that kind of thing. It allows you to manage your storage but it doesn't get you there. You know it leaves that OpenStack as an island. If I stand up OpenStack as it is, what happens is I've got something there but separate identity services. I've got to manually put people on there that kind of thing. That's going to use them especially as a service provider. You know I can't sell OpenStack by you know having someone send me an email and say they want me to want an account and that kind of thing. I've got to go a lot further than that. Also it doesn't give you anything around operations. That's beyond the scope of this talk. But you know there's a lot of sessions here on operational management. That's obviously a key consideration for any service provider. Both a public cloud service provider and internal IT service provider. Okay in order to set the scene for what you need to do in terms of implementing these services we at Dell we use this thing called a reference architecture. I flagged up the NIST and this reference architecture for cloud computing. Once again there's links to all this stuff at the end you know if people really want to read up in this stuff. The purpose of the reference architecture is to give you a set of boxes. A set of you know what you need to do to become something. You know so if you want to stand up a service you can use the reference architecture to say these are the suite of services I need to build up my composite public cloud service. And just a bit more detail there. Around what we do as a service provider we need to provide a set of things you know service management or sometimes called business support services BSS and just as part of that you know you've got your you've got your whole things you need to include there in customer management contracts inventory you know accounting reports pricing you're gonna be able to provision you're gonna be able to meet her you're gonna be able to monitor you're gonna be able to manage your SLAs you might have to pay out if you don't meet an SLA that kind of thing and then there's this stuff not something to cover but you know you got the whole the whole notion of it I'm a service provider I stand up a cloud I've got to be able to get customers workload on to my cloud so you know these are considerations you need to make in terms of actually building up a service that people will pay money for. Yeah no exactly this is the scope of this is to you know explain beyond what OpenStack provides you is OpenStack being a cloud delivery platform you know a service platform for living VMs networks that kind of thing this is a bit the suite of services that you need beyond that to take and make money from it. Okay what I've done here is just provided in a very abstract level what it might look like if I'm a service provider I've got to provide something beyond horizon this is horizon on the right hand side here what I've got here is basically I call it service management portal service management console you can call it what you like the whole point in the service management console is before you actually get into the consumption of your cloud services you actually have the ability to manage the specifics around those services OpenStack Nova being you know compute being a cloud service object storage being a cloud service you might have SaaS applications in your cloud portfolio we certainly have some may have different cloud offers based on different platforms that kind of thing platform as a service that kind of thing at a higher level what you want to do is basically have a management console around that and allow customers to basically see things cross-cloud platform around a specific cloud platform and then what that does is that gives them access flips them over into the likes of horizon so you can do cloud consumption. Okay so what basically you know described there is what you want to do is you have your whole service management stuff that you're going to more detail in a minute on one side then you use OpenStack from the community differentiate in top of that as part of your cloud service platform and you stand up as a separate service but you consolidate identity between them and a high level architecture these are some of the problems you've got to solve when you're a public cloud service provider and you've got certain things that go beyond the core OpenStack platform which I've got down here things that you need to go and do which I'm going to go into a bit of detail on so you understand some of the problems you've got to solve as a you know a service provider you got a whole sign-up process and a couple ways you can do that there's obviously a process that people are probably used to when they think of cloud it's you know you go through a process she's like you give you a credit card number you get an account and then you go in do things you get provisions you go and do things. Another way that we do it now which is you know an interesting thing for service providers is we have a CRM driven process where a sales person can go and create a prospect basically create a lead then that lead can you know have a quote generated against it and then once the customer accepts that quote and basically orders that quote the orders created then you dovetail into a similar process that you would do at the end of a you know credit card checkout process so you get that that means you're doing things as well. Service management I've already talked about a little bit you know that's the whole notion of going around and actually managing that service. Support I'll talk a little bit more about that in a minute most people know what support is but you know it's a key consideration that as a service provider you got to be able to provide support for your offer and obviously billing you know I'm a service provider and on top of that you know you got to provide services around around what you're doing with OpenStack that not don't necessarily form part of OpenStack core. I say identity here because there's you have keystone for OpenStack identity but if you're a service provider one you might already have your own view of what identity is you know you might have a friend since Amazon has an Amazon account, Adele we've got a my account is called that kind of thing. You might have a notion of an existing identity provider which is going to drive some of the stuff you do with keystone. A rating engine, salamity provides meters it doesn't rate a rating engine basically takes the meters and turns them into something tangible you can charge for. Rating is the act of taking the usage and actually putting so the question is what's the difference between rating and billing? Ratings that act of taking the meters and turning them into something tangible you know like you actually putting against the price a rate plan as it were we call it a rate plan so you take you know I've used you know a hundred VCPU hours or something a dollar an hour that's a hundred dollars and then billing is the act of actually invoicing for that and getting the money in for it. Or it's something that we provide it's something that's important to consider but doesn't come directly out of open stack that's you know the notion of being able to provide a traceability across what people have done when who did what when so you can actually audit the service and provisioning is the act of when somebody orders something actually creating that service for them by means of that what I mean is you know creating your open stack identity is potentially creating a service plan in your billing engine you got to create a subscription in there that you know it's going to be reconciled against when you actually go into your rating in your billing that kind of thing is the sort of thing you do in provisioning. Okay so more detail I promise more detail around these things for each of the sort of four pillars that I've described there there's a lot of considerations you need to make as a service provider and this is kind of just a bit more detail around what the next reference architecture provides and what we do at Dell. So I just go through some of the things that we actually do is each of these processes. So when you sign up to a service you're going to have a service catalog you know you've got to have a feature in there which says these are all the things I can buy you know typically clouds pay as you go but you might have reserve rate plans you might have dedicated rate plans that kind of thing so that's part of the service catalog you got to provide that so somebody can sign up to something. You got to set up your login I kind of touched on that when I talked about identity. It seems it seems simple but the customer you might have your own identity provider as we do and the customer may not have an existing account with you so you got to set that up or you've got to create some sort of you know trust relation or some sort of you know associated account with your Facebook account or an open ID or that kind of thing it might be federated identity. You got to set that up. You got to validate when they sell their account you know you're not giving you garbage. Okay so we've got several steps around that. Validating the address is correct. Set up their payment. At Dell we accept both credit cards and purchase orders. Purchase orders is a back-end process to reconcile with a purchase order system but in terms of credit cards you got to validate that you know your credit card first you need to check some ID on the credit card number make sure they haven't typoed something you got to go away and actually validate that credit card blums that they're stated address. You got to check their CV2 number whatever it's called and you got to validate that. Basically going to make sure you're not getting garbage and in addition you've got to carry out a fraud check. Now you get as a cloud service provider you get an awful lot of people trying to use stolen credit cards to try and sign up for your services they're always trying to get something for free. You got to put a fraud prevention check in there to try and mitigate some of that. The way you can do that is you can use fraud providers a simple way is to you know validate their phone number actually belongs to them. A lot of people who try and do fraud use dodgy phone numbers i.e. phone numbers that might go to a switchboard a company they're pretending to represent or something like that or you know to a track phone that kind of thing. It's an important consideration to use some sort of you know some sort of mechanism there to try and make sure that person who's signing up for that service is actually a genuine person they actually do own that credit card and they actually do represent whoever they say they represent. Credit checks something that's important you know if you know if someone signs up for your cloud with a credit card that's got a $500 limit on it you probably don't want them going away going crazy and consuming a lot of resources and likewise if your company already has an existing business it might be an existing company but you're going to have a credit department who's going to basically have standard credit terms for that customer and that's going to influence what you can actually let allow them to use in the cloud. That's an important part of the process. And compliance check most you're probably already aware America's not very friendly with Iran and you know North Korea and people like that. A compliance check will be a trade compliance check or an export compliance check whereby you're actually making sure that the customer who's signing up is an allocation that you've validated and aren't trying to do something from an embargo country which if they did do something from an embargo country you'd leave your company open to a lot of fines and bad press that kind of thing. And then there's the concept you know somebody's got to sign terms and conditions you know we've got two means of doing that you know click I approve once you've read this huge bit of legalese and when we do our sales person driven process we've got an electronic signature mechanism we use so people can actually electronically sign for the service and agree to move forward we can move forward at that point of provisioning. Okay considerations for service management. Upgrades if I might you know let's just say my page you go customer I might want to upgrade my account to a reserved account you know I've been using the cloud for six months now I know what my utilization is like I want to look in that utilization in a reserved account so I'll pay for a certain amount of CPU hours for a fixed rate per month that kind of thing. That's great as a service provider as well if you can get people to look in a reserved as well because it allows you to capacity plan a lot better. Downgrades once again just to reverse people are you know looking to downgrade their subscription they might have a certain amount reserved they might want to go to a smaller amount reserved that kind of thing you've got to put a process in place for that. User management is describing the ability of managing users across cloud the reason I say across cloud is you do have user management and open stack at a project level but if you have multiple services out there you know at Dell we certainly do you want to be able to manage the same identity and entitlement of that identity across mobile services. Payment change represents your ability to change how you're paying how you're paying different credit card that kind of thing. If someone wants to change their credit card you're gonna have to go through all this again. You've got to validate that they know they haven't gone from a good credit card to a bad credit card that kind of thing. Invoicing you know historical invoices I'll talk a little bit about invoicing here but we've got historical invoices people in their service management portal expect to be able to see what they paid for when over a period of time. Obviously that's a role-based consideration if you're setting up an account for a big corporate customer not every user is going to get to see the invoices there's going to be a finance type user there once again that goes beyond the roles that you typically get with Keystone you've got that kind of role management you implement your service management level. Run rate represents how much have I consumed for this billing period so you know how much have you spent maybe up to the last midnight we'll run a rating run every midnight so up until that last midnight somebody can see where they're at allows you to implement cost control as a consumer. Use of statistics slightly different from run rate what I consider use of statistics to be is you know what users are using what in my cloud that kind of thing once again from service management point of view as a consumer if I'm the admin I want to see who's doing what and who's using up all the resources versus maybe I expect some people would be doing something and they're not. Audit I mentioned earlier audits the ability to see who did what when and for you know someone creates a VM you kind of want to know who created it if someone powers off a VM you probably want to know who did that you know all this could ultimately you know influence you know like an audit if someone actually wants to put their their actual their actual production IT infrastructure up in the cloud. Quota management obviously as a service provider I've got a quota that ties in with the credit check I don't want someone generating any more spend than what I did them to be credit worthy to do but also internal to service management you may want to manage quotas for subtenant in your cloud subscription so if I'm the if I'm a you know a CIO and I've gone to public live from a Dev and QA I don't want to set up quotas for each sub team that are going to consume off that account and obviously people may get fed up with your service we need to automate a process to let them to cancel service you know that would be no things like finalizing their invoices the ability to you know shut down their VMs kill kill their data after a certain period of time you know for instance at Dell we attend it for 60 days before before actually bleeding it in case there's a service restart that kind of things part of the SL or part part of the service agreement. From a support point of view you've got to provide means that people can get help with using your cloud and it's not something that comes out the box unfortunately and there's quite a lot of opportunities and support to implement some certain things I'm considering from what we are doing is you know if I'm in a VM and I'm having a problem with it when I create a support ticket I want to be able to you know snapshot all the data and all the details of what that person is doing then and there and so that when the support agent picks up that ticket they can see the VM they can maybe click on a link to get directly to the VM you know it's a big opportunity with support to create a very great experience there for getting people help and making the people who give the help very efficient and beyond that you know you want to maintain a good good database of how to use that kind of thing for them so people can help each other you know something you might support is you know an image repository as a service provider if you're supporting an image repository let's just say I'm supporting Windows site if I put a Windows image out there that I'm going to charge for you know what's my customer's expectation on the state of that image you know you got to provide support around that and I mean that I just put Windows Server 2008 R2 out there and just leave it I can't do that there's a big liability associated with that because if I leave that for six months it's so unpatched as soon as someone spins that image up it's going to have problems so you know you have the whole notion of supporting that kind of thing and making sure that any service you do provide is evergreen as it were and we like to provide white papers and documentation and you know how people can do things the best practices how to get your lamp stack up and running in five minutes and come in and last but not least in this in these in these pillars billing billing I mentioned previously once you've rated the data you got an invoice for it so you get the whole process of either sending email and someone an invoice having payment coming and reconciling that payment with that invoice if it's a purchase order or you have the process of charging someone's credit card you probably got to implement processes while they're where you know if someone's credit card declines how do you deal with that you know that kind of thing part of the billing process tax calculation is an important consideration you got different types regimes in different states we do and we've got you know different types regimes in different states if you do business in states you got to charge sales tax in those states and likewise if you go globally you've got different tax regimes in different countries you do business so we've had to put a system in place for you calculate tax based on where that customer is and where you do business that kind of thing. Sales compensation sounds like a weird one but it's a big consideration for instance if you've got a salesman that's sold how do you compensate that salesman wants to customer use it depends on what your sales compensation plan is you typically assist them to do that so the sales guy gets comped on what he's actually sold and I put general ledger there because ultimately all the money you're making and how you're making that money and where it goes to goes back into your company's book somewhere so it goes against the bigger the bigger financial reporting things which are way beyond my pay grade. Okay so that was all about public cloud service provider type stuff. Private cloud in the enterprise is kind of similar but it's a way a bit cut down but there's a couple of different considerations of some of the considerations I make that I want to point out might be useful for some people.  One of the things we do is we want to provide a means of managing service entitlement inside an enterprise so let's just say a company's you know got a very strategic point of view that we want to move all of our infrastructure on the cloud we're sick of all these teams with siloed little pieces of infrastructure virtual infrastructure whatever you've got we want to invest big stuff we want to go big and open stack we want to build that in there and we want to basically move all of our workload on to open stack so we have a single management paying for that workload and in a small company it's easy to manage just with you know just for this but in a large company it becomes a bit more of an arduous process so to do that what we do is we provide basically a service enablement portal and website or if you want to call it which allows people to provision services within the enterprise well some could be within the enterprise some that could be without with the enterprise but ultimately it allows people to provision stuff as far as what they're entitled to do and so the user experience around this is I'm a dev lead I need any I'm gonna need ten VMs for my project for my dev and go in this I can click on I want something in the computer lab and that can provision me an entitlement in the computer lab there's a process behind that that needs to be considered and I'll go on to that so now a similar slant with regards to the the sort of overall architecture it's similar to what you saw before but the semantics of what's in these pillars is different I've not called it sign up because it's more of an onboarding process and inside the enterprise you know to get that user on board onto the system from an entitlement point of view there's certain other considerations there bearing in mind that just because it's internal doesn't mean you're not you know you're not incurring spend by using those resources support once again similar and billing is slightly different but it still needs to be there so going to a bit more detail around those you still have a service catalog you know and open that compute as a service and swift that's a service you might have other services for instance we have to manage entitlement around salesforce.com you know you pay sales force 500 seats and you got to manage that entitlement you know it's a cloud server so it's an internal service it doesn't really matter the fact of the matter is is someone's got to basically ask to get it they don't just get it and then there's a notion of approval because there's a cost so say with fish you know it's going to get built by a charge back within the same company and you've got to basically go through the process of having your manager sign off or whoever pays the bill sign off that that resource utilization and then based on that I'm going to set up an entitlement you know if I'm a dev lead I get 10 VMs I'll get set up an entitlement from a 10 VMs and you got to record the cost center you know my department whoever whoever I work for who's going to pay the bill I got to record that cost center. Inside the you know in the process of managing entitlement slightly different from what we've seen before policy management some of the policy management is you know if I've got an environment who has rights to do things in that environment versus other environments if I were not like an application development lifecycle process I might have some entitlements which are using the dev environment whereas other people can promote code to the QA environment that kind of thing. CMDB you're inside an enterprise now you've got to record the VM based on the VM name that doesn't tell you very much you got to record what the workload is in that VM that's part of what has to be integrated there. User management as I said before service change is you know changing the entitlement around that service you know or you know like I need more VMs how do I manage that these are just the same as before what am I using when am I using it. Audit as before and quote management and service cancellation a project comes to an end they might not need the resources anymore it'd be nicer to freeze them up so I could reuse them. Support just as before but obviously you're gonna have to integrate in this case with that probably when you when you build a cloud for an enterprise they're gonna have an existing support system so rather than roll your own or use your own point of view you've got to integrate with what they already have. Cost center charge back. Just say charge back. Once you've actually used it you've got to do your internal billing integrate whatever system a customer has for internal billing and once again financial reporting around the use of the cloud. Just a couple of pointers from what I've learned at Dell on user experience. User experience around using the cloud. What you do with horizons great at low level you know you create VMs you create networks you you can deploy images that kind of thing but it's kind of it's kind of pretty pretty hands-on pretty step intensive that kind of thing. What we like to do around common tasks etc is basically provide you know a composite API effectively which actually rolls up and means that you know from the client side you're not having to go through a lot of steps a lot of chatty steps a lot of slow things to actually build up a service so you know when you're providing you know UIs and extensions as a provider you want to basically you know make long running and complicated tasks easy but providing composite services to provide those and another tip that we learned at Dell is a lot of our customers are very very afraid of running up a big bill so when you're on a page you go model inside your cloud that kind of thing what you want to do is really you know roll up and pull cost into every bit of consumption so if I create a VM rather than just create a VM I want to see that you know if I'm a consumer of public cloud this VM is going to cost me X a month amount per billing period and see it right then in my face you know big criticism of Amazon as you kind of don't know what you're spending and how you spend it it's very very difficult to actually see what things are going to cost so there's a usability type tip it's really good to be able to pull that in around the consumption UI. That's basically all I like to talk about one thing that's just very very interesting to me and hopefully interesting to everyone in this room in terms of standing up the service is the keystone work that's going around Federation you know off it's something as a service provider I really need to see so that when I stand up a cloud either private cloud or public cloud I can allow customers to use what they already have as their current identity providers and you know create that consumption experience has been as seamless as possible isn't it great as possible with what they already have so I'll be at those sessions this week and I'll put the links out there for some of the other stuff shown as well so any questions or happy questions how difficult is it to integrate identity management it depends on what identity management you really have and in our experience keystone is not too bad but it depends on how you manage the identities between them with when keystone supports Federation will be a lot better because then you have the concept of you see our part this and STS you know you you and this you party STS and keystone would be our line party STS and you have trust between them if you don't you've kind of got to go through a push mechanism of fishing identity out to keystone then doing some sort of proxy mechanism to basically get a single sign on through if you don't have that set up it works but it's just a little more clunky because then you have to synchronize identities between the two the great thing if you get to a Federation which we hope to get is I'd be able to go to horizon and use my NTA I can't straighten horizon rather than having to you know go through a step what we found is where where where the services we're providing for don't support that level of Federation you have to go through dodgy steps like right now cookies that kind of thing and syncing passwords with rear-end back-end databases and you can get into some edge cases there where you listen to my station few considerations thanks very much I'll send out links to the slide


Hi guys, there's a new class available over on my teaching site, and the preview video for it is on my Bible Journaling channel. The link is in the doobly-doo if you want to go see it, and I will talk to you guys later. Have a great weekend!


The conclusion is that using p equals 0.05 to suggest a discovery will result in being wrong at least 30% of the time, and experiments underpowered will increase this rate. This is demonstrated through tree diagrams, simulations, and evaluations of effect sizes. To keep false discovery rate below 5%, a 3 sigma rule or p less than or equal to 0.001 should be used, and the word significant should not be used. This article was authored by David Kahoon.


Good day fellow investors. There is so much talk about stock market crashes, economic collapses, currency collapses and I want to tell you a crash would be great for you. Now you might consider me crazy but I'll show you, I'll give you a mathematical proof by the end of this video how any kind of crash with stocks, with other assets would be a great thing for you long term and you would be better off to quote Warren Buffett whether we are talking about stocks or stocks I like buying quality merchandise when it is marked down. Despite Buffett's logic it's really hard to think that when the stocks you own go down you should be happy because everybody's happy when stocks go up. When I see a stock that I bought go up 20-30%. I see the excitement on my stock market research platform everybody saying goodbye, goodbye but actually you should be happy when your investment goes down and I'll show you why in this video. Let's start. Let's take a simple example of the SAP 500. To make things easier let's assume you only own one stock. One stock of the SAP 500 and your portfolio is $2,839.21 which was where the SAP 500 was when I was writing this article. That's all we have one stock of the SAP 500. The dividend yield of the SAP 500 is 1.94% and the trailing dividend in points if you compare it is 55.23 SAP 500 points it means that you get a dividend of $55.23 for each share of the SAP 500 you own. Let's now make two scenarios one where the SAP 500 grows constantly for 7% per year over the next 10 years so just up up up and up and the other scenario when it drops 30% in 2019 to 1940 points and then it stays flat for the next 10 years and you will say okay Sven this is really crazy but stick with me you will see at the end how you end up better when there is a crash. One scenario SAP 500 crashing to 1940 points 30% forum the current level and the other scenario is where the SAP 500 grows at 7% per year and this is the result so if the SAP 500 would crash it would go to okay in this case 1900 below 2000 points and stay there if it would continue to grow at 7% per year it would go to $5500 in value for one share. I cannot even imagine the panic headlines produced by the media outlets if the market would crash 40% during this year nevertheless we should all be happy if that would happen and here is why now the key when it comes to being happy about crashes is a dividend so you reinvest that dividend and if you do it now you get 0.019 of an imaginary SAP 500 share however if the SAP 500 is down 30% and below 2000 points at 1940 points then you get 0.028 of an imaginary SAP 500 share and this difference over time makes the difference between an investor and a speculator and over time owning more businesses thanks to higher purchases when you reinvest the dividend leads you to higher returns in the long term let's dig into the mathematics so this is the value and number of shares after growth of 7% per year and reinvested dividends so after 10 years you have 1.21 shares of the SAP 500 for a total value of $6771 however if the SAP 500 crashes 30% doesn't grow for 10 years and stays below 2000 points up to 2029 you end up with 1.45 shares of the SAP 500 for a value of 2900 the total dividend on your 1.46 shares with 5% estimated dividend growth would be 140 now the comparison is between $6771 with no crash and only growth and $2,900 for the portfolio with a 2019 crash and no growth so you must be thinking Sven you might be well educated but this is idiotic 6,700 is much better than 2,900 so why would a crash ever be better now here you have to answer one question are you an investor or a speculator are you happy when the prices of what you own go up goes up or are you happy when what you own becomes bigger bigger and bigger when you own bigger parts of a business when you're more shares of a business where the dividend yield is higher and you can buy more more of the good things you are if you are a speculator then you are always basing your future your financial future your retirement on the valuation of the market on the market and the market in history has been crazy it is irrational so it is just paper gains you have to sell now to get those gains but you're always thinking if I sell now it can go higher so you are not really an investor you're a speculator I cannot help speculators on this channel so if you feel like an investor if you are like Buffett that likes owning businesses then stick around and please also subscribe let's go into the mathematics of how even investors do better than speculators now let's imagine that in 2030 so in the 11th year the SAP 500 in the growth scenario crashes 40% and the SAP 500 in the no growth scenario with the crash in 2019 jumps 40% in 2030 the result for both investors with reinvested dividends is equal 4060 or 62 dollars so given that it is impossible to predict how will stocks move except that the stock market will fluctuate to quote JP Morgan I firmly believe one should be happier when stocks go down than when stocks go up because it allows you to buy more of what you already own so when goods things are marked down you buy more and perhaps the most important thing our little 2019 crash portfolio would have a dividend of 141 dollars in 2030 because we own more of the SAP 500 thanks to the reinvestments and the 7% percent constant growth portfolio would have a dividend of 117 dollars in 2030 this might look like an unimportant difference but the difference between a dividend of let's say 141 thousand per year and 117 thousand per year when you retire might make the difference between you having to sell stocks to finance your retirement or having the opportunity to cover all your costs and not having to sell anything so if you wish for a better future you better own more that will lead to higher dividends yield in the future which might be enough for your lifestyle so you don't have to sell anything because when you start selling your nest egg the dividends in the future get lower lower and lower and lower and the compounding actually works backwards so whenever you see a stock market crash happening if you own good things you should be happy because over the long term you are better off because you can reinvest those dividends and this video doesn't even touch what 99% of people do which is constant monthly investments your employee employer gives contribution you invest in your 4 on 1k or something so you are investing on a monthly basis so you should hope for a crash of 80% invest on cheap valuations for 30 years and then just in the year you retire nothing you just enjoy the huge dividends you have accumulated by reinvesting at a high return on capital so the next time you see a crash the next time you see a headline panicking how did something crash so much or so much don't worry buy businesses buy more of those businesses and actually be happy because you can buy more when there is a sale and this is typical my wife whenever she comes back she says oh look at this purse I got it at the discount and why aren't we investors also so excited when we come home or when we are home oh look I can buy this stock at the discount yeah I can reinvest my dividend at the discount so perhaps it's hard to grasp at the beginning but if you focus yourself on becoming a value investor you will see how you will become excited when stocks drop instead of when stocks go up looking forward to your comments please subscribe if you like this month's mindset and I'll see you in the next video


Thanks for coming this afternoon, ladies and gentlemen. You would be aware that today in the Townsville District Court, Benjamin Price, a former officer, was convicted on four counts in relation to assault occasioning bodily harm and common assault. He received various terms of imprisonment. The most lengthy term is 27 months imprisonment and all were concurrent. I understand that he is eligible for parole in July of next year. This has been a very disturbing case for us and, again, on behalf of the Queensland Police Service, I apologise both to the victims, their families and the community of Queensland for what is inexcusable behaviour. I'm happy to take any questions that you may have. In terms of the other officers who stood by and witnessed this but didn't report the activities of Benjamin Price, at what stages of disciplinary action are they? Five officers have since resigned in addition to Price themselves. There are three officers where disciplinary processes are now being considered. There are three extra serving officers. That's correct. And what's the time process? We'll just have to await the processes as it runs out. What kind of message does his jail time send to that small minority of officers who do have the cowboy attitude and a very gung-ho when it comes to violence? The issue of use of force by all of our officers is obviously critical to the credibility of the Queensland Police Service. For those who have heard the actions of Price through the court process, I have no doubt that there would be not one police officer or a member of the community who could condone Price's actions in the way that he used excessive force against a number of people. The Queensland Police Service certainly does not condone his conduct in any shape or form and I think it sends a very clear message to any member of our organisation who would even be thinking of that, that they should obey our codes of conduct and our use of force models. What do you say to Price's defence which was that Ellie Beach is a difficult post for any police officer due to a high level of intoxication? Obviously the issue of binge drinking, high levels of intoxication are issues right across the state at certain times and in certain places. Our officers are trained to deal with that in an appropriate professional way.  I mean the comments that he made about wanting to napalm, the polygob, obviously there was clearly issues there that perhaps the system, there was no flagging that he was clearly having problems with? Certainly our systems are designed to try and identify problem officers. We know that because of the price incident that we have to redouble our efforts in that regard and in fact we have been working on this for some time to try and identify key warning signs. As you know some of the areas our people work in are quite challenging in this regard. Night after night as they go out to work they are faced with very, very difficult situations, high levels of drinking, high levels of violence but again it's up to us as an organisation to try and interpret what those warning signs are, moodiness, shortness of temper but it still comes down to supervisors identifying those issues and taking those officers into their care, giving them counselling, making sure that appropriate high level authorities are aware so that we can deal with those officers appropriately. How much of tax pay station for the victims? I don't have those figures with me and in fact some of those amounts of compensation are yet to be determined in the price case. Are you confident that the culture of the L.E.B.T. police station has improved since the time that the price was having it? I'm absolutely sure of that, yes. And what about the community sentiment that obviously it's really important that tourists are, you know, it's a vital industry for them in L.E.B.T. do you think the community will respond positively to the sentiment? I think that we've still got a lot of work to do to regain the credibility that we previously had in that particular community. I would hope that in most communities across the state there is an understanding that whilst the police officer's job is complex and somewhat dangerous at times there is still the expectation and we certainly recognise that officers must meet proper standards of conduct no matter what the situation they're confronted with. Do you acknowledge the difficulty the young officer who blew the whistle on this must have faced at the time? I'm certainly very proud of that officer. I know the whole of the Queensland Police Service is proud of that officer for the stand that she took. She was prepared to get up and say this is not right and bring it to the appropriate knowledge of the senior officers in that area. And as a result of that action was taken her actions are in the finest tradition of our organisation and we congratulate her. We've also taken steps to support her right throughout this whole issue as we would do for any officer in that situation. But what stage do we even know obviously office prides over reacted? When we draw the line between police being provoked and the difference between assault, heavy handedness and restraining people who were drunk and abusive, spitting and that sort of stuff. One of the things that we are careful to do with all of our officers is to help them to understand that the environment of which they work is often complex and is often quite dangerous in terms of the use of force against them. However our training, our codes of conduct are all designed that under the circumstances only an appropriate and reasonable level of force is used to overcome force provided to the officers. Certainly in process cases that was not the case and certainly nowhere near the mark. You can see that it must be frustrating for officers who are clearly provoked in the line of fire so to speak by these abusive sorts of people. But these are professional police officers just as you see ambulance officers, fire officers, doctors, anyone in the professions who has to deal with people at times who are violent, who are unruly. The level of response is always has to be measured and professional. What do you say just to other bad police as far as being a whistleblower because obviously it was very difficult for that young woman to come forward and do what she did but today at least she's seen some justice being done. Absolutely. I say to all police officers if you see another police officer doing the wrong thing and particularly, particularly when levels of violence are perpetrated against victims, community victims, whether or not those victims have actually provoked the initial violence themselves. Those officers should come forward and provide advice to senior officers so the matter can be appropriately dealt with sometimes as we know. I mean people will crack there's no doubt about it but we can do things to help those officers and take the appropriate action whether that's through the disciplinary system or the welfare system in dealing with those issues.


Nucleic acid, Na-based biopharmaceuticals have emerged as promising therapeutic modalities. These drugs are based on RNA or DNA molecules and include antisense oligonucleotides, CERNA, mRNA, mRNA, small activating RNA, and gene therapies. However, these drugs present several stability and delivery challenges, making them costly to produce. In this paper, we review the current progress in addressing these challenges and the significance of novel drug delivery systems, DDSs, associated with NA-based biopharmaceuticals. We also highlight the European Medicines Agency, EMA, and US Food and Drug Administration, FDA, approved NA-based therapeutics with their formulation profiles. Finally, we discuss how these drugs could impact future markets if the remaining challenges and requirements are addressed. This article was authored by Rahul J. Engel and Weijia Feng. We are article.tv, links in the description below.


Everybody forced here ripping the sports card Almanac high-end multi sport volume 14 case break number five live hit draft We'll do two randoms in a moment here first one is going to determine which case number we rip second one is for the draft order Two rules for this no discussing card values for the break and no influencing the draft There's no mem it's just a raw and graded cards Two minutes per pick. I'll type in chat. I'm reading YouTube and Twitch chat when you're making your pick. Please have your Order number or zip code ready so we can confirm that you are you when you're making your pick That pretty much covers it Let's go ahead and get started everybody Thanks for filling all these Almanacs up and good luck. We got Star Wars chrome black quad case tonight random packer auto style and we also have A 2022 flawless football case random team style later on I'm gonna give you a link for Star Wars chrome black right now And you get it as one of the sealed packs or the encased auto Per spot there. So usually you're gonna get a numbered card in every pack usually and then or you get it in case auto So pretty cool way to break that product. Good luck everybody. Let's do our randoms There's an eight five and three Go eight on each year Case number is the first random one two three four five six seven and eight It'll be case number two Who does number two work for and the draft order? Good luck everybody after eight the one through ten that shows up will be the draft order One two three four five six seven and eight Joe L with the first pick and you've got Sam a Dutch D Jeremy Y and Nicholas s Joshua R Daniel F John a Troy M and West L. Let me refresh make these bigger so you can see That is your order Go Joe L one Sam a two Dutch D three Jeremy Y for Nicholas s five Joshua R with six Daniel F Seven John a eight Troy M nine West L with ten. Good luck y'all What do I say case eight? Or case two Let's see some sick cards here. I'm gonna start with a wow Justin Herbert Immaculate moments autographed at 25 It's on card from 2022 immaculate it's a clean-looking card man great design on this thing Four touchdowns in his Monday night debut 12 to 25 Herbert immaculate moments auto That dude's great Rooners hating Nolan Ryan Jersey auto from diamond icons number to 10 Game war in Jersey auto of the Nolan Ryan express Ryan express That's 2020 just 2020 icons 20 20. I love the 2020 design Nolan Ryan Astros Ryan there too That is a Trey young on the flashback prism auto Ice Trey there 21 22 prism auto Trey young We go that flashback design love the flashback design going back to the og prism Patriots better dude Meet the bills dog Got Kaboom sp. Kyler Murray Second year 2020 absolute Kaboom Kyler Murray BGS 9 5 centering edges and surface 9 5 and corners at 9 pretty one there. What's up Daniel? What's up, man? Think absolute's coming out kind of soon, right? What's going on this weekend? Dolphins passes weekend. Yeah It's weird. They're playing twice so early in the season. I thought it was quick, but Because usually it's like September and then like December they play interesting Oh Wasn't they doesn't make a difference with bats. We're just gonna walk in there and destroy them Oh That's pretty you got Halligod 2020 optic Halliburton rated rookie auto blue PSA 9 the auto was authenticated not the perfect auto there, but PSA 9 Summer to 49 20 to 49 Halliburton rated rookie auto Yeah, it's very odd Paul very odd I Think the Rangers are gonna win. I don't know though because Like Montgomery and of Aldi and Scherzer like they're so reliant on those three pitchers right there And if one of them has like a down game it could it could it could spell some trouble Like if the if Zona wins tonight, I'm changing it up going. I just think I just think of Aldi's gonna do well here Like he does well in the big moments. It seems like I'm up tonight. Nah. Nah. Oh, that's nasty Vaulted veteran Jersey auto Aaron Rogers Number to ten from 2020 encased Back when they graded the encased cards for you nine five And the auto got a ten That's a nasty Rogers there, and it is player war in Jersey as well BGS nine five ten auto Alted veterans Jersey auto. Yeah, Pacer's killed it Magic gonna win tonight. I didn't imagine he was on Think we got here what we got here Nasty patch Kenny pick it penny one rookie patch auto 10 of 25 Keenie 10 of 25 in the picket. That's a rookie Premier Jersey It's definitely the oh from the rookie part of that rookie Premier Jersey. Nice picket Keenie Moving along moving along gorgeous 98 tops chrome Randy Moss pristine 10 tops chrome rookie Randy Moss PSA or no BGS 10. Excuse me Edges nine five everything else 10 Christine Randy tops chrome rookie. That's what's up right there. That's what's up right there Randy What is this card? What is this card? The say hey kid Willie maze It's cut auto Authentic signature Willie maze Say hey kid Oh five Don Russ playoff Yeah Prime cuts biography authentic signature That's pretty nasty That's not the back of the car. That's just so the car doesn't move in the mag. You'll oh five Don Russ playoff Sick one of the best players of all three right there one of the best players of all time Maybe the best all-around player ever As far as like defense and hitting not like certainly pitching you know what I mean Amazing center field just almost 700 home runs like you could do it all Kobe 1718 encased perfect 10 auto Kobe Bryant 40 of 49 serial number BGS 9 5 signature got a 10 Kobe right there Fire fire cards, dude Love that Willie Anything anything historic like that. I'm I'm all about very bonds with it Wasn't uh, isn't his godfather very bonds godfather was uh, yeah, that's just insane to me. That's so crazy There's a lot of home runs between those two You know my godfather's with a base card set up a little glare there. Okay. No, he's actually all right Put a reverse put a verse There perverse Terry That's not that's not classic. Oh when they put it to people too. It's so good RIP black Mamba two minutes on the clock for you Joe Joe You mean you mean the you mean the maze not the Hank. I Know you mean though Those guys combined also hit a ton of home runs. All right Joe law is up Tough first pick though. I agree. I agree Man, I this might my favorite case so far just as far as like overall. I don't got so tough to choose though Dude Lane twist your arm Twist all your guys arms every pick Those picks are difficult should be that way those almanac We want to see the the broad spectrum of cards that are out there to be fair Paul He did pick like ninth in the first case or something like that And he had two and another one he drafted like one of the last picks as well It was like three and like seven or three like eight or something. So a typical almanac night for Joe To be fair guys, he does buy a lot of almanac spots So it's not it's not like he's just buying like one and getting the top pick Yeah, I got yeah, hard to say no to a Kobe, right? nine five ten 1718 in case perfect 10 auto number to 49 as well number 49 Kobe love that guy steakhouse Kobe steakhouse You see how many kids the past world players and like named Kobe nowadays we're doing prism draft There's like three kids named Kobe and I'm like that's pretty sick. I love that Sam a pick number two I mean we're about to that time we're gonna start seeing kids making the league name like we're brawn Oh, yeah and stuff like that for sure like that's gonna that's cool. I love seeing stuff like that Sam a pick two you've got a kaboom on the board. You got Nolan Ryan up there You got Halliburton a lot of young stars a lot of legends Young QB legend QB Other young QB back there with Herbert if you want to see something up close, let me know Trey young back there as well Kyler kaboom bgs 95 second-year Kyler kaboom. Can I see Halle? Yeah, of course. It's a PSA nine Halliburton rated rookie blue auto From 2020 optic PSA nine the auto is authenticated and it's number to 49 That guy is he is so good He's so underrated in my opinion I know he was an all-star last year. So like if you know ball like he's not underrated You know how good he is but as far as like the grand scheme of things. He's not talked about enough PSA nine to 49 rated rookie blue auto of Halliburton Yeah, Richard prime cuts Willie Mays Prime cuts two and three. They're great designs, too Like they're just very classic looking for what they have in them. All right, Sam About 15 seconds from right now This is a hit draft break thunder Hit drafts. We make the product called the sports car at Almanac. All right. It is time to pick Sam. Go Sam What you going with? It's a toughy. It's a toughy. Oh my head hurts so much. I have your zip club zip code Or order number or order number says Hallie. It's waiting on confirmation, but it's going with the Hallie Hallie god. Thank you, sir. Appreciate it. He's good. Appreciate you Sam. I like that one. That's Sam. Nice card, bro Nice card That's what makes optics stand out right at the on-card autos the on-card radar key autos that are numbered sick over like the Prism stickers and stuff like that Dutch with pick number three Oh Second pass the duchy. Oh boy. Oh boy That's a great song though Dutch D pick number three see the kaboom, please. Yeah, so it's a 2020 absolute second year Kyler Murray BGS nine five.  That's one of my favorites one of my favorite pc cards is a t-max kaboom Basketball All the kabooms man. I love them Kyler coming back sometime this year too Why can't you I don't know John? I don't I don't it's a randomizer. I'm sorry Uh About a minute about a minute left on the clock We need like the uh, the who wants to be a millionaire sound effect and the lights like come down Or just a timer throw them right here That'd be kind of cool There's got to be a way to do that We should get a gold horn an lsc gold horn. Yeah, we need some we need some disco lights A disco ball.  Can I see the maze please? Absolutely. So this is 2005 Don Russ playoff prime cuts. I think is what it's called Back is not there Um, it's a willy maze cut signature V say hey kid. Yeah 2005 Don Russ playoff willy maze prime cuts biography authentic signature The back is covered up. We have it. We have some filler in there So it doesn't uh But pretty solid. I mean Nothing too crazy on the corners and edges But with the maze Yeah, yeah, yeah, he's good. Thank you dutch. Congrats on the maze cut One of my favorite cards tonight so far great pig man dope card awesome pig appreciate you dutch next We are Jeremy why Jeremy Yeah, but hey, you like what you like that's that's dude. That's why it's almanac.  I was quick Jeremy's quick.  There we go There we go I think I can fit all these six on the same level here. No All right, we're down to six cards. Yeah Make it work. I'll make it work.  There you go nick Nice randy straight cash straight cash. I'll be I mean look at the fit Look at the fit draft knight fit straight cash He fell the draft too Didn't he go like late first or something like that? Joshua Joshua are Two minutes for you joshua.  All these cards are so dope nine five 10 on encased rogers jersey auto to 10 in 2020 Vaulted veteran material first ballot hall of famer in a few years whenever he decides to no doubt retire No doubt. We'll see though. He's seen he seems pretty determined after that injury. He seems like he wants to come back and It almost like it seemed like he'd almost motivated him like more like his tone kind of changed after the injury. It was weird Daniel Like he's a guy that always tries to appear laid back when he was like i'll be back Like he was like, you know what that ain't that ain't how this is gonna end All right, Daniel left pick number seven I see the nullan Plus you win in new york you'll you'll you'll be immortalized forever Nolan jersey auto from 2020 icons. It'll be game used of course seven of ten 2020 diamond icons Uh, the herbert is not jersey number. It is uh 12 of 25 One of the rogers Yeah He's a great one. Uh, you got the 2021 tray young prism auto Got the immaculate moments of herbert Kyler kaboom 95 second-year kyler kaboom Let's go with the ryan 243406 That's my dude going with the ryan 2020 icons game used jersey auto I loved diamond icons always look good, but the 2020. I don't know what it is I think it might be the color that makes it look so nice to me anyway Ryan express seven no hitters Seven no hitters Like half as many as me in the show That's the only one that matters. That was the show so John a The tray is not numbered Uh, 21 22 on the Um flashback signature tray young So the design on this one definitely adds to it because it's that like original prism design 21 22 would have been his, uh, third year. Yeah, yeah, yeah We're in his third year The herbert is the 25. It's immaculate moments in his third year as well 2022 And then second year kyler kaboom 95 What the herbie herbie immaculate moments auto from his, uh Monday football debut for four touchdowns Nice card four touchdowns Clean I love this one too, man It like I like the imac on cards that acetate just hits a little bit different than some of the other on cards But I don't have the acetate as long as the design is clean and everything is clean. It looks great Uh, then we're down to two cards here. You got trey m trey m kyler Going with the kyler. That's a great pick man. I He has it. He just got to put it together, right and the cardinal's got to get a little better But he's got it. He's got that talent We've seen it before man I'm gonna be back this year and then uh number 10 will be uh west with the trey young prism flashback auto here That guy's got he's a little lower right now.  That does it for number five number six is up next. Thank you all very much


The abstract states that rice reprotation is a common farming practice in China, but it can lead to increased levels of cadmium, cd, and zinc, ZN. To better understand how this affects the soil, researchers examined the physical and chemical properties of the soil, as well as the bioavailability of cd and ZN in the soil. They also looked at the accumulation of these elements in rice and rake seed plants. Finally, they investigated the relationship between soil properties and the bioavailability of cd and ZN. Their results showed that the physical and chemical properties of the soil, such as its particle size, composition, pH, redox potential, and organic matter content, all affected the bioavailability of cd and ZN. Additionally, the concentration of cd and ZN in the soil was higher in deeper layers than in shallower ones. Furthermore, the concentration of cd and ZN in the plants was correlated with the soil's physical and chemical properties. Overall, this study provides valuable insight into the impact of rice rake rotation on the soil and its effect on the bioavailability of cd and ZN. This article was authored by Chuxiao Yang, Huifang, Daoping Wang, and others. We are article.tv, links in the description below.