Hello. This is Forrest. I am here to speak to you today about some certain shenanigans that I pull off once a year with hacking college kids and telling you exactly how they do it wrong. Let's go ahead and get right into the slides. So, if you want more information about me, you're welcome to look at jrwr.io. I'll be happy to provide guidance. You have a contact page and sorts. You can get ahold of me on Twitter of sorts. So, what I do, well, I should say, who am I? Some of you have probably seen me floating around Defconn before. I am Hachan, pretty much. Everybody knows me of this crazy hat of mine. It's a Pith helmet with Wi-Fi access point on it. Everybody generally loves it. But I've done a couple of other weird things over the years. Right now, I'm a Department of Defense subcontractor, cyber security auditor. Pretty much, I do audits for small military manufacturers. They make parts, whatever. And they do it terribly usually. It's rather boring, though. It's working to stay 101-21. If you want to look up that in Tom Fullery. At one point, I was a Dogecoin mining pull operator in Sassaman for a fundraiser for the Doge car. That was also awesome. And that's also where the Pith helmet comes from, was way back then. As you can see, the Doge car was amazing. You should Google it. There's some videos out there of me being chased with a beer cooler because I had to steal it for some ice shenanigans. But for this talk, the really relevant is that I've been a red team member for any CCDC for about three years now. It's Northeast Colgate Cyber Defense Competition. The basics of the competition is that there is a blue team, which is college students, being trusted into a network of sorts, a standardized business network that they would come across, and they have to do all the things. So it's several teams of students from local regions for the Northeast corridor and there's others for each region. And so they're kind of like an emergency blue team, right? So they come in and they have to fix the network, whatever's wrong with it, to get it stable. They have a list of services that they have to keep online. We've already been given about an hour already to attack them as red team before they could even get hands on keyboard the night before. So we've got all of our implants in place to make sure they're nice and imponed. Generally it's a two day event. The red team is a group of chosen pen testers and infosec nerds. Generally, it's from mostly people who've been working with a professor that's running at Darryl Johnson, at least for the Northeast corridor. Darryl's great. He goes to RIT, Rochester Institute of Technology, and they run the red team. So there are other teams of black and white support as well. White teams is people in the rooms that help the teams out, just basic support roles, filing tickets if something explodes. Things of that sort, things get fired. The black team is the one who actually manages the infrastructure, making sure that everything's up and running and such. They generally have physical hardware that they're dealing with.  So on top of defending themselves from red team, they also have to do other things that are worth points and some of it's worth a lot of points, right? So there's incident response, right? So they have to write up a report stating that, you know, this is how we were compromised or this is what happened. You know, this is the current state of the system. This is what we did to fix it. And such, these are called injects. Maybe it's a request from the CEO to do something like change his password or allow him VPN access. The black team is always throwing them new stuff to do. And those are worth a good amount of points. Those are considered daily operation stuff, right? Stuff you'd have to do on a day-to-day basis as somebody who is booting or just general IT in the network. So then, from there, scoring is really based off of how long red team had access, the reports made, and the services kept alive and the scoring of the services is automated. And that's what's with that as well, you know, our spoofing and such. So the first hour that we get access to the network. We infect everything. We have all of their passwords in a table already. So we have scripts in place. First thing we do is hit enter and fax everything that we can get hold of. And we do all the crazy. Cobalt strike, which a lot of you might know from your toolkits was actually written for any CCDC by Raphael Mudge. Great guy, by the way, if you ever meet him at DevCon, he does float around there. Dude is crazy good at it. He does these DNS slow burn beacons. So he'll like stack beacons on top of one another. So he'll do these really fast HTTP beacons, but then we'll have these beacons to like a special domain that he's only registered for this where it only pulls once every six hours. Right. So if they haven't removed it from the system, they're not going to notice the traffic. And then he uses that to pivot more beacons into the system for the faster ones.  He does, you know, DNS fronting IMCP pings beacons IPv6 base beacons we've done once before that was fun because the Palo Alto's don't filter that very well. But if you use Cobalt strike now you know why some of the features are like the way they are. The quality, you know, at least from what I understand from much. It was written for any CCDC and it was solving a problem armatures would just wasn't solving right so he was improving armature and he just got better with it and he started selling it as a product because it was it was a good idea. Disable the antivirus infect the networking hardware you know the Palo Alto their switches their firewalls, we have access to it all so we just go to town. You know we have full access to practically everything we have the domain admin password so we just start deploying everything that we have our arsenal. So if you think of every single piece of kit that you can deploy against what you have as domain admin for persistence we generally do it right we have a team of about 15. We're having to manage. I think it was 10 teams last year. So we do have to kind of it really is a high workload that's why there's, there's a lot of grouping and stuff like that and Cobalt is because we have to do it on a per team basis we have to score per team. We're doing Linux backdoors because I'm a Linux nerd, I do all kinds of fuzzy things. For instance, you know, Pam backdoors and things that sort and we'll cover that here in a moment. But we try to keep low. And we watch as teams try to find us right like a lot of times their services just go down because they're they're just breaking it for themselves right like we're just persisting. So what we'll do is steal some passwords the Cobalt strike key logger is amazing for this. We will steal some SSH keys AWS keys if they're doing cloud that year. They love just leaving them on your Linux boxes. Right. We're also going to put it. We'll reinfect using where we can some of the common backdoors that we use we have an IS backdoor that was written. I don't think it's publicly released, but it is signed using unleaked certificates whenever he actually had a code signing cert but they wouldn't renew it on them this year. And Pam has to say it's backdoors we would use nothing forever. Still get students we can just log in with whatever password you want as route bash backdoors. These are my specialty. I've actually recompiled bash for systems and place backdoors or do some home it just run an extra curl command and pipe that into whatever. We're doing DNS backdoors that way with there's a environmental variable that you can set right off hand but there's an environmental variable that you can set where it's a callback it's supposed to be the missing command callback or just a command callback and it will run it after every successful command. You just run that every time right you set it in the ETC profile nobody ever looks at their at their environmental variables for compromises right. Not for two years at least. We were piping dig directly into bash for that. We're doing TXT records and just shoving shell and Aaron, waiting for him to show up on their firewall wasn't like we're encrypting it or anything. We still have monitoring place like Splunk, and we'll just backdoor it. We got a guy who's we call our Splunk nerd, and he has a custom application that he'll attach to their Splunk instance. And what he'll do is that it'll become his managed instance so they're all kind of upstream to a centralized orchestra system. He just manages everybody Splunk forum so he can do deployment payloads that way. Most team members don't notice that this is happening. It's very, very stealthy, and it's great for my understanding the code for it to relatively easy to implement you can just take one of the sample applications and just have it be managed by something else. It loads through it. Most of the time they don't notice it's happening and you'll see that in some of the screenshots as well that it's coming down through Splunk. We'll backdoor the Palo Alto, put our own accounts in there's certain hacks that particularly happen with some of the web interface they'll add little JavaScript snippets that report home. They'll get blocked because they're just blocking all HTTP traffic at this point but we'll actually inject custom theming where it it'll send there when they change the password to the web interface it sends it back to us. I have a thing where I'll do, I'll backdoor all the elves on a file system like I'll take busy box. Take all you know full compile it put the backdoor in there just runs the command through DNS again. You can compile it. Some link it all out into into the Debian system real fast or anytime they run an application at all, it gets compromised and it links back to the busy box parameter. And I thought with their path a little bit and I am pointed, I rearrange it so that it's in like user local bin is first. So you set that first you throw a busy box in there. They'll never find it. Nobody whoever looks and use their local bin, come on. Right. So, we'll also do some some time fullery. If we notice that they're trying to install detection tools right on Windows or Linux, especially on Linux will try to compile stuff will backdoor it we have the C backdoors that we just throw in any application. And we'll just, you can find them on GitHub, they're everywhere, you throw them in there and they compile it and they run it. It's backdoor now the group get hunter backboard. We only have two days we're just throwing anything that we can it'll stick right.  You know, they're trying to be clever there's they're going through process monitor prokman and going. No, and then crash the box. Right we'd rather just crash the box before they get ahold of our loot.  And just crash the box. We'll reboot it that'll be fine but maybe put some dancing bananas on a screen. We'll get later to that. Sometimes you like to do anoints a lot of annoyance really kind of annoy some of the teams like there's some teams that really like to use Tmux. And when we replace it with screen. You can't run Tmux. Oh, but if you try to run screen that just dev you random to your terminal. But if you try to run a Maddox, it'll actually open them and if you try to open them and opens up nano, which is super fun. They really hate that when you do that to somebody who's trying to remediate a box is commands keep changing out underneath them. And they're trying to figure out how are you in the box, you're not even showing up. Well, we have a TTY and they have three Metasploiter something like that and we're just pop, you know, which is screwing with you. Automation is key though, right if you're popping this many boxes we're having to handle over 100 boxes. Automation is key until you start noticing somebody trying to be clever and you go and fucks with them for a couple of minutes. We'll reconfigure their DNS to make them distracted and we'll just drop their DNS into a black hole. Our beacon still work but their DNS doesn't. Right. We'll be pointing to our DNS servers which drop everything but our beacons. We've screwed up a couple of teams doing that. That was super fun. Reconfigure the Palo Alto right underneath them. Right. They keep adding a block rule will drop that block rule or we'll reconfigure it that block rule where it doesn't work. The orders out of place and the allow rules just stuck up there and all the block rules don't work, you know, order of operations. We reconfigure services to bring them down. Right. That's part of the scoring, you know, we don't have a particular score ourselves but we want to make them score as least as they can for all the teams. So we'll add, we'll deface web pages, we'll deface the backgrounds, we'll deface services, anything that we can get a hold of. All services are scored with ping SSH and then maybe the contents of the web page itself. Right. So if it doesn't match a checksum, then it's considered down and we'll deface them bring them down. My personal favorite was was uninstalling engine X and replacing it with Apache, kind of configuring it right and then just leaving it half broken and letting them to fix it. So, I mean, you know, trying to get as much time as you can to leave them leave your main beacons alone have them misdirected right you want them to kind of focus on on the crazy that is happening. So, this is going fast than I expected but hey, that's working. So day two is when the fun really starts right because we don't really want to blow up their boxes on the first day. But we do want to do it on day two. So we install the new back doors anything that we cooked up overnight because we don't sleep. That's what caffeine for. And then we just activate all my prank scripts. I started doing that when I first joined. I just, I had some on hand. And we'll see some of these by the way I got a little treat for you rotate the screen by 90 degrees every 30 seconds makes it really hard to admin a box. Dancing bananas all over the screen it's actually a fork bomb I written you can see an example of that in the bottom right hand corner them trying to kill it and it's not working. 500% sized mouse. Super funny when it happens they can't really use the mouse because it's slightly broken but it's good fun.  Good luck. You can't change it now by the way we've we've disallowed administrators from changing that registry key, you're going to have to change the ACL on that sorry, you're going to have to go find it. ACLs are very powerful in Windows for registry keys you can set some insanity in there and make it where they can't remove your shit, unless they they actually go in and rip those ACLs out right. So if you had like, I had one where as part of the banana script actually is it.  And it just won't run programs will say program that found or my particular instance every time you run the program it would just spawn a new banana. Task Manager Procman, a lot of the AV software that they were trying to run would kind of be dynamic with it you know so you know we kind of work with it. Generally, it was kind of a dynamic environment on day two trying to really screw with them because they had a lot to think about right like they're really trying to keep the services up from us because you know, they have 15 people going on and they're just, you know, they're a team of eight. Um, later on in the day will really start screwing with services, memes, you know defacing backgrounds things like that really let them know that we're home. Deleting files programs changing passwords right will delete files underneath will when they're writing a report.  You're so mean. But that's what makes it so much fun. You got to try something. So it will delete stuff they're writing the drawing something in MS paint will will draw something for them and they freak out because we're controlling the computer. We'll start Googling things for them on their own computer that's super fun, you know, brick rolling them things like that you know just opening up URLs sending them helpful messages, offering help. Ransomming the domain controller for donuts. It was the funnest thing we've done. We did that a couple of times where we would ransom a service and we'd want donuts and they would have to go and hunt down donuts. Or other various things for us. We had a dance off to get your domain controller back after we'd pwned like six of them. They are force one. So, as you can see, this is the most fun you'll ever have as red team ever two days of packed full of craziness, but it gets better. So after we've done all the shenanigans. There's a slight story here. So if you look in the very very bottom there. There is a search for it. We had one year, the local, the local police department decided that they're going to help out and we asked them hey you want to do a no knock raid on some of the students rooms. So we coordinated that with them and they did it for all the teams they rated and took their domain controller just stole it.  It was great though, as it was hilarious the whole time. There is some video of this I will show you later. But shenanigans, lots and lots of shenanigans, the most shenanigans you'll ever have being a red teamer. The burn right this is the last hour right this is what we're we're nuking the discs we're, you know, you can see here we're doing rmrf. No preserver screw the desk you know ddi ddu random the desk blue screen the boxes, delete the AWS account. It doesn't like when you do that by the way. We can cat the boot loaders anything that we could do to destroy their systems where they're no longer anything that we have access to left is destroyed. Nuclear right. So, after all of this is, you know, done. We tell them what we did, right, we actually sit down with them with every team and say well okay so your team seven well. We kept giving us your passwords to the key bloggers. You never found the Pam back door. Right, it's it's here it's here every year we told you this last year.  A lot of it was they just weren't looking. You know, anybody with wire shark and a mirror pork and really see us like when 90% of the traffic coming out of your box is DNS and it's like gigs of it. You have a problem. And a lot of times they just don't block it. I always said. I had a good firewall guy somebody who had wire shark open your poor just streaming logs right, maybe booted off of live CD or something that they'd be able to find us right we're very noisy right maybe this is long term begins. I did not but you just do standard incident response and you know, most of our stuff is detected right cobalt strikes super detectable.  Right, even if you bring services down an incident response and mind you this is a compressed timeframe and this kind of goes for most incident response right. Don't be afraid to turn off the network.  Just those traces down kick us out because if you kick us out we can't get back in if we don't have your passwords we don't have any beacons we're not getting back in right like we have some of the back doors and sometimes they stay but a lot of the older ones you know they're all picked up by a V nowadays so A lot of it is they just haven't had a lot of experience with dealing with these computers and dealing with systems like this right like they they're in a system administration role trying to do security here and they're all they've been taught a security. So, and they gotta treat the happening systems hostile. They're not doing that most of the time, right, they trust in the permission they trust in the files they're leaving on the system. They're trusting their backups. We've infected the backups we've done that they're going to restore from a backup, and we'll re infect them again because it's an old password and we always try the old passwords right like this is how it works. So, most of you just trying to get the air out about what we're doing, right, it's really easy to spot us once you know what we're doing because we're up to all kinds of shenanigans. And so, it's not, it's not, we're not doing anything revolutionary here most of this stuff is just a grab bag of anything that we can find off a GitHub for the most part I mean, it really strikes really nice and we do write some shenanigans for some of the scripts but really though, we're not doing anything particularly special but a year after year, and we have students we have teams, we have teams that are amazing at this right. Don't kick us out in 15 minutes and maybe we'll get back in second day, right. Maybe they'll fall for a phishing email. We've had that happen once or we'll steal something from the room. I suppose there's physical security kind kind of involves we keep it, you know, we don't do it that much but we'll still laptop or you know or you know give it back to them with put this XP on it and expect them to use it because there was a service on it. So, I have I have videos I'm going to show you I'm going to talk over them I'm not going to play the terrible music sits on them. Both of these are on YouTube. You can look up any CCDC. And you can find all over all of our previous years videos right they're not very long, and they really showcase some of the payloads that we're getting back right in a lot of the way that I can show. So, my number one here. So this is from 2019. I'm going to just a smidgen ahead here so we have back door the Wi Fi router. It was. We just get a custom update server. Here they're googling how to do security. You know, Wi Fi passwords. So we got a little bit of a backdoor stream from white team and they'll post in the Slack some of the things that they find from us but I read team. You know, passwords to the key loggers. And you can see, you know, we we really it's just password discipline is so terrible with these people sometimes. You know, they're trying to track us down and Procman and management corp. Beaver. I don't think it's supposed to be that. They're futzing with their DNS. You know, changing their administrative passwords because they don't know it might as well we run it. King size mouse was ran on a couple of machines you can see it here in action and cobalt strike makes the machine very hard to use but you can get rid of it. So let's figure out why their DNS has been changed to another server because it's ours now. Yeah, we were dropping some Rick roles on them several times. A lot of kids they just don't they just don't know the memes. Yeah, we did that a couple of times will change out the Wi Fi password or the Wi Fi AP to what their what their password was just just to show we care. So we were we had a backdoor they had to keep Wi Fi up. And so we have a little Wi Fi router up that we are actually using as a backdoor, or getting all the teams with it. You know, making some puns and jokes and things of that sort we did a lot. Sometimes the likes of only paste the password in a slack don't do that. That's being managed by red team that's a pretty common problem. This is all set to terrible music that I'd rather not play them trying to install security essentials. Are they not teaching them what accounts as antivirus on Windows nowadays. You just not work on Windows server. Sorry. You really should turn that on and setting your passwords not going to do any good if we have a key logger on the box, right. We'll send them helpful messages, you know to annoy them that we see them that they're editing their firewall it's not doing any good. More passwords of course. Really the key logger is a key lockers are so old school right like oh who installs a key logger, but they just give every time really looking to install the key lockers if you're popping a box. More dancing bananas shenanigans as usual. I always like to drop them on boxes that we kind of have access to that haven't done anything on in a while. We want to show us a proof that we're we're in their box right we want to give them that little tickler that we're still fussing with their systems. They try killing it but each banana is a separate process so if they don't know how to mass kill stuff then our bites and get to help you. You can see here they're they're actively being ran. Mind you, these are these recap videos are made like an hour before the competition ends so they're made in a rush. More helpful messages of banana man, they weren't killing them fast enough I just kept spawning more of them just to annoy them. The banana itself it's not backdoored it does change some. Yes, yeah, can he so this is this is it rotating by 90 degrees every 30 seconds and we actually got video from one of the white team.  This is you know, it works fine now but given 30 seconds and it won't. They're trying to figure out how to kill it and I'm playing yackety sacks over their over their audio at the same time they still haven't closed it. We do this to all the teams is the one we got video of. And so this cracks me up every time I watch it. You know we give them some encouragement to get demoralized very quickly. But we'll actually back off of people that we have access to towards the end there. Mostly because, you know, kicking the puppy while it's down. We don't like to do that too terribly much but you know more bananas on it on write ups is super great oh yeah nothing's infected bananas everywhere. They write on the board sometimes will see a password is off the whiteboards will take photos from cracks in the walls and stuff. More bananas. This spot I have one that'll just fork bomb a machine to the point where it just won't run anymore. A team challenged us saying hey, we don't have any bananas on ours. Yeah, give it 10 minutes. We really shouldn't be killing SVC hosts. We had sign in sheets and we did actually sign in as red team and nobody checked. They're trying to run clam AV on the box and that's not going to do it again the definitions are too old. These are examples of some of the injects. Some of it is quite going fast but more more words of encouragement. At this particular point right they got so much stuff running that it's it's starting to bog down their boxes but you know they'll give us keys and really we're just googling stuff better than them. We're letting you know them know that their boxes still pops. There's really the WAP that's what they have in the rooms one of the teams did that. Yeah so we stole the laptops and we gave them Windows XP. It was great. We put all of our malware on it too and we stole it without them knowing it was great. All the teams did not notice that we had stolen their laptop and we just gave it back to them. Some encouragement from remote tech support. So this one. So they're doing some role playing here so this guy is yelling at them. If you watch this video on YouTube it's a little bit better but this guy is yelling and I'm like well why did he steal the laptop? Do you like record it down? Like who was this person?  Like he doesn't know how to respond. So the students are giving real words and areas like well what the fuck? Why did the laptop walk off? Right so he's trying to explain himself and it's not very good. He's trying to figure out well just steal it from underneath your keyboard? Like how did this work? Right did you give him the laptop? And why is he playing Tetris? Tetris didn't hit bootloader. So that happens so many times right? We hardly get to see that as red team but here's us imaging them all. Somebody actually had an image for this laptop for Windows XP and they just downloaded it from work. And we were getting beacons off of them. So this is some of the searches and typings that's coming in while we still have beacons for days. Bad passwords. At this point they've changed their passwords six, seven, eight times and they're just done. We made good friends with him. He's going to pawn his own box but unfortunately the beacon had disconnected. But he was one of the team members. He'd wanted the dance off to get his domain controller back. So here you can pawn your domain controller again. They had signed in sheets. We were signing in with anything and everything under the sun and nobody was checking in when they should have been. We had to escort against that too. We're starting to delete things now and it's just out of control at this point, right? So, you know, a CEO is asking why are you playing Tetris? We still run gateways. I thought we all had Dells. Because their gateway was down. They didn't have internet because we'd nuked the Palo Alto. And that's just because wall messages back and forth, you know, chatting with the teammates going, you know, can we pop a box? There's always women in our technical capable of breathing fire. Definitely so. So this one's where, you know, the network is down and he's losing money. And he's yelling at the teammates going, well, what's going on? Like, I'm not going to sell the other house in the Hamptons.  Classic CEO speaking. He's walked out. We saw Mr. Dino a lot of times. You'll still have beacons. Oh, this is the group shot. This is all the red team for 2019. You can see me there in the corner. Mudge is in the center.  We don't meet that often, but I have a mug with all their names on it though. Daryl's on the left there. But this is where they have to defend themselves against, right? They're Silas. He used to work at VirusTotal. He used to, he would weaponize Malware that he would, that he would get in from Google and VirusTotal and sick on students. The madman. He would neuter it, right? There was an incident, but he would neuter it and repurpose it for students. So he would actually infect them with Malware. Just the beacons were going back to him instead. Crazy, crazy fellow. Most of these guys are networking engineers. Most of them aren't even ready. You know, they aren't like, this is what they do as a red team. They're more dangerous because they're in the field every day, right? They're networking engineers, Splunk engineers, but they know the full depth of those applications. They know what they can do. And then you take that and twist it. That's what I think is fundamental to being a red team, right? You know how that stuff's supposed to work and then you twist it to your needs, your evil, evil needs to do what you needed to do, right? You have much more scope availability. You have ability to hide better if you know more about what you're dealing with, especially with applications. Well, I'll just talk about near off. We'll go ahead and go on to the second video here. Let's skip ahead a little. This is from 2018. More shenanigans, you know, giving us their keys for AWS. Yes, we would persist with a team, with a team name called white team on the box. They had to go in through the serial console that year. They really didn't understand what was going on. They didn't know it was serial. I think they were trying to screw with each other. Allowing us to say traffic is always a bad idea. By the way, you're generally very flat networks. Us, Wall and them are spunk admin going, hey, do you need to get your spunk working? Yes, we've done that. We've installed Linux on a box. You know, always check your agent names. We're always changing your passwords for you because you should be changing them often. And if you're not, we're going to. We'll wipe your backups always, right? That's just what we do. PowerShell is in great guests of what we do as well. No, you can't get rid of DNS. That's just terrible. More keys. That's our key added in. Us taking surveillance photos of passwords on the whiteboard. You know, that's not a good place to put them. Dockers should not be running on your laptop. This is kind of what our desktop would look like, right? Because we have all the teams open. Somebody thoughts in with the Palo Alto, at least trying to. Mudge sending beacons down. This is just, you know, SSH keys being sent in. Me playing annoying noises because they had all on once and I couldn't turn off the speakers. Oh, that was great. We'll meme them up, change their logins to whatever we want. We'll change their MOTT and they forget it's there and it's backdooring every time that MOTT runs. We will sometimes, if you ask us to stop, sometimes we will. If you're nice to us, just let our beacons live and we'll stop messing with your box. That actually is probably pretty, pretty good advice to somebody's actively in your network and you're trying to fight them, but really you should just be unplugging the internet. I played Tetris with, I attempted, and this is a really bad demo, but I attempted to play Tetris with somebody over their own T-Max session while in front of them. So I'm actually attached to the T-Max session and I'm trying to get BSD games to work. But, you know, if you've lived in Debian land, that's actually kind of hard. But I'm playing some worm with them, at least trying to. Well, attempting to. There's actually kind of a fub. Oh, well, there's their keys. Well, while I'm for various effects, you know, their AWS access keys, because they're leaving them in configs everywhere. Yes, it is our router. Some people don't know what cloud trail is. It's great.  That's always, always TSS problem. Yes, we stole your passwords.  One team decided to go this kind of advanced format for their passwords. They didn't know what echo is. We find that a lot. A lot of kids don't know what what is going on with some of the messages to their Splunk. We'll actually interject bad Google's results. We've actually had it where Google would redirect a Bing and it would be the third page of Bing. And that's all they could access. This is Beacons coming in from Splunk as he started to manage their system for them. Somebody trying to do some art because they're bored and they don't have anything to do. We decided I did at least that I was going to make a little bit of fun.  Would you like to try to tell that instead slipped it under everybody's door? We actually got them back a couple of them. There's the search warrant. That was fun. There's Clippy. We got him back from a couple of teams. This is us ransom wearing their team. Yes, that happens a lot now. So this, this is great. We made them take this photo for us and we made them apologize for trying to steal our firewall, which was their firewall. But it was really our firewall now. We gave them back their firewall eventually, but no, no guarantees there. Let me just start deleting stuff, you know, from them. It's the same stick every year practically. I know running Docker and we'll have beacons inside of Docker and they'll never see him in there. We're starting to get beacons climbing out now.  Yep, we're starting to delete this 32 now. Teams start usually playing music at this point because there's not a whole lot they can do because we're just starting to pop boxes now. Disable their internet, you know, anything that we can do to destroy the box. At this particular point, so you get the general idea. We start deleting other AWS instances which are scored, which has a bunch of stuff in it, making sure to delete all the snapshots, all the beacons are dead. This is the write up where they had to do the search and seizure. Actually, kind of go back to that a little bit. This is the leading sis 32 and the such. So, as you can see, we're up to all kinds of shenanigans. Obviously, we've had some disruptions this morning numerous rays under my standing is law enforcement officer in the room and collected some device or devices. This is obviously concerning to the executive staff as we need to talk and make sure we understand all the facts and now. This is the search and seizure that was pretty good. We don't have any video of it though it wasn't recorded because they just kind of surprised us on it. They even rated red team room at one point. So you can see we generally have. We generally have our standard means it just is just the Northeast corridor right like there's there's teams for every corridor. And yeah, so there's teams for every corridor.  So they don't release and it's for good reason because they're very dangerous actually. And they're meant for only use some competitions but you can find it right like now that you know this terminology is CCDC start trying to find some of the other. Some of the red teamer tools out there for there's some amazing stuff out there, and we generally do tag it for CCDC. If you take a look here I got some URLs for you if you want to check some stuff out for the northeastern corridor, you could do any CCDC any CCDL.org. We want to check out the national competitions. Yeah, maybe even become a red teamer there. Check out national CCDC.org, but overall check your local colleges you never know they may want to participate in this and they haven't had anybody to actually start a program there right volunteer program get with a professor something along those lines. See if they already participate. You can help them with training become a red teamer for them set up a scenario for them let them attack you attack them that type of thing. It's good fun and allows you to kind of structure muscles as a red teamer without having to really worry about scope right like if you blow up a box who cares.  Right you can't really simulate being a hacker, because really not going to, you know, delete the domain controller, but in this competition he would. It's the best two days you could have right just just alright. It's the best two days you can possibly have it allows you to test new tools and tactics in a controlled wild environment you can just let it loose and go to town. As long as it doesn't leave the network they don't really care what it does. As long as it doesn't like make the box catch fire like literally catch fire I think we had that one year. But, well, I've had my 50 minutes Omar you want to come on back.


Hello everyone and welcome back to Nintendo Prime and we are going to talk to you today about Nintendo potentially launching a new Symphony now for those who aren't aware and I don't know how you can't be aware at this point given how long it's been running But the master quest aka symphony of the goddesses It has been a masterful piece of Symphony work based on the legend of Zelda that has been going on essentially every single year Except one since the release of skyward sword and skyward sword mark the 25th anniversary of the series so we are what both six years later from that point and Yeah, there's been a zola symphony going on all year every year worldwide except for one there they did take a year off now Jason Michael Paul has been the one producing that symphony But it appears that he wants to do more than just Zelda Earlier this year Jason Michael Paul said he wanted to make a Nintendo all-star concert in a new interview of game industry He apparently has also stated that he's created a proposal for a super Mario symphony that he hopes will stick Unfortunately Paul noted that his idea for a super smash symphony won't happen since it's too complicated Here is Paul's exact words on this I recently put together a really nice proposal for a super Mario symphony and we'll see hopefully it will stick I also had another concept for super smash symphony, but that's not going to happen. It's too complicated it So one Yes, all of my yes on a Mario symphony If there's all the symphonies anything to go by a Mario symphony would be fantastic Up, you know, there's been variations of Pokemon symphonies over the years So like an official one that runs you around would be fantastic. I'm all about this Jason Michael Paul I really hope that your proposal for a super Mario symphony gets approved by Nintendo because I feel like all of Nintendo's amazing music should be represented what what I don't like About this though is it Paul said he wanted to make a Nintendo all-star concert earlier this year And then he said he also had a concert for super smash ball symphony when it sounds like it's not gonna happen It's too complicated it that bothers me a little bit I don't I'm not putting this on Jason Michael Paul. It might not be his fault The complications behind a symphony like that are gonna have to do with IP rights Gathering the music for different Nintendo games really shouldn't be that hard because the source material Should all come from the same place of you know, Nintendo of America should be able to provide him the material He needs to create a symphony out of it, but No, I shouldn't say to create a symphony out to create orchestrated music out of it for a symphony to play but what I don't get is why This has to be something that is just Mario just Zelda as much as that's awesome Because there's so many video game series that Nintendo owns that deserve this kind of treatment That are never going to have a shot at a full concert series And I'm not saying that this terrain on the Super Mario Symphony Parade. Yes, absolutely do a Super Mario Symphony It makes a ton of sense Especially coming off a Super Mario Odyssey if they could launch it next year that would be amazing Imagine having him the opening act me and jump up Superstar performed live with an actual singer That would just be an amazing way to kick off a stellar show or if they want to end the show that way I feel like it's it's a good way to kick it off though You know, especially with how upbeat it is get people all jazzed up You know literally jazzed up for the rest of the amazing Mario Symphony concert, but here's the thing I Want Nintendo and Jason Michael Paul and you know Whoever else they wish to work with to come up with an all-star concerts Concept a Super Smash Bros. Symphony concept as it were, you know, there's so many series out there that deserve love You know imagine some of the very best pieces of music from the mother series being represented There's never gonna be an actual concert just for mother music But an all-star concert could feature mother music and I mean that could bring certain mother fans to literal tears as they think about their adventures in earthbound and You have to consider songs from Metroid, you know another series that might not be quite popular enough to run on its own symphony But magical pieces of that featured just amazing Obviously, you know, you have your Zelda and your Mario's You got your F zeros you could throw in there Really, there's so many Pokemon There's just so many franchises and I understand the complications with a Smash Bros. One because then you have to consider like Mega Man music You'd have to consider You know possibly Final Fantasy 7 music since cloud was in the most recent one and I understand that there's some complexities with that But I don't think based on how many video game symphony concerts have happened worldwide I don't think the complications behind it are as bad as Jason Michael Paul might think I feel like if you just gave the proposal to Nintendo Nintendo themselves could do the legwork to contact Square Enix contact Capcom Etc and get permission to do a full cuz like a super Smash Bros. Symphony to me is essentially what I want to happen I there should be a yearly running symphony that is a culmination of All of Nintendo's goodness. I mean really there should be a yearly running symphony worldwide That's a culmination of all of gaming be it Nintendo Sony Microsoft EA Ubisoft blah blah blah bring all that together in a symphony But you know barring how long that would have to be to satisfy all crowds that would have to be like a six-hour performance If you're just gonna stick to a more Nintendo and fine Nintendo all-star, you know performance and bringing all that together to me Just oh man, it's everything I want. See here's the thing. I have never seen Symphony of the Goddess I know just get mad at me now that I have not seen it. I'm actually mad at myself It they did play in Minneapolis. I do think it was last year or earlier this year I can't remember. I'm Minneapolis is the closest one. I would be able to attend It's about an hour and a half drive easily something that I could have done Should you know, I had the money and the time to do it unfortunately, I didn't have the money or the time to do it at that time but It's something that I regret that I haven't seen Because I'm obviously a massive Zelda fan if you guys have followed this channel for any amount of time you probably know that Zelda is my favorite franchise and Going to a symphony like that would have probably brought me to tears Just how impactful so much of this music and these games and the memories that would wash over me And how these games have impacted me emotionally helped me deal with depression Help me deal with so much stuff in my life I was also was afraid to go to the symphonies I didn't want to be that guy that will everyone is cheering. I'm just bawling my eyes out at how beautiful this all is and Just just a magical moment it could be and heck for you guys Maybe it would make for entertaining, you know footage because you have my friend record me as I'm just can't control myself But I never got to go just like I didn't get to go to the I forget what it was called, but there was that Zelda Escape room thing they had going on that was down in Chicago And I had a chance that I could have went to that and I didn't go And I kind of regret not going to that either even though that seems a little bit more low-key a little more homegrown It's still something I would have liked to have attended And participated in so I don't get a chance to go to a lot of the stuff just what happens you're a family man I'm a family man anyways but Heck the escape room thing I got to my kids. I might have been really fun with my kids, but this is just I Really hope that not only Nintendo grants him the ability to do this Super Mario Symphony Which look at the success of the Zelda one and how many years it's been running It should be a given that it should be followed up by a Mario one at this point But I'm hoping that he can get his dream of the Nintendo all-star concert because there is just so Many franchises that'll never be represented in an in an orchestration live otherwise And as amazing as all of the fan mixes and fan re-orchestrations of this music are on YouTube Nothing compares to a live performance by a real symphony It's just Man, I mean, I'm literally like having what dreams you're thinking about it Um Yeah, you guys let me know if you think about all of this in the comments below You know, is there a specific franchise you would like to see them make a symphony out of what franchises if they were to do a Nintendo all-star concert would you like to see them make a symphony out of you know, is there In my dream of this Nintendo all-star concert And apparently potentially Jason Michael Paul's dream as well What franchises do you want to see represented and not only what franchises what pieces of music would you like to see represented? In fact, tell me the names of those music and I don't know Maybe I'll find a way to find some fan mixes of them and mix some of them into my videos For like the next week or so just to throw a little little background noise and a little flavor in there and a little love to you Guys for suggesting some fantastic pieces of music Anyways folks, I am Nathaniel Robledance from Nintendo Prime and if you liked this video You know what to do and if you disliked the video hit that dislike button Subscribe for more content and I will catch you in the next one


Rocky! Shoot him for no free. Dude, will you wait till he's way over there? There's a lot of heads up. Huh? His head's up. Okay, okay, get him, get him bud. Good boy. Catch him up, good dog. He was so low, these two of you were in my, I couldn't see him. I was like, why are you waiting until you got way across the hole? Hold, leave, on the board. Thomas just shot another one. Come on bud, good dog. Chill out, chill out. Sit. Here, Rocky, good boy, good boy. Here, good boy. I shot the single because he wasn't gonna, good boy, leave, because they didn't want to get him. I have to try. Good boy, chill out, good shot. All right, man. I was trying to, to figure out the drake. Rocky's seen him, I think. Luckily, I think he's seen where he fell. Get him bud. Catch him up, get the bird. He's slapped, he's slapped water. Catch him up, Rocky.  Good boy, good boy, good dog. That was a hard one. Good boy, that green, that heavy 12 is doing his work. Here's a couple of the group, big one, right there. Rocky, do you want to take that one? I'll go get him. If it works, come, I'll hide. Rocky, here bud, Rocky, here. Stay, yeah, right here, right? On this line? Right there? Come on, Rocky. Yes, three down, back. Good boy. We're at number three for me. Honest is at two or three, I think. Just running out great. Hold, leave. Good dog, good dog. Nice, wow. Sit, sit, Rocky. Good boy, good shot, dude. The way to take your time, I know you pulled up on the first bird and then you realized what it was and it was fun, so good job. Good boy, you put some feathers on there. Good boy, Rocky. Good dog. That's fun. Good dog. Well, we decided to put the old GoPro on a day so we can maximize our potential. Here, come here bud, come here. Oh boy, good dog. Good boy. Good shot. That a boy, Rocky. Missed you last week, except for that. Except for that.  Good boy. I know. Sit, sit, Rocky. That's what, Brock. Wait, you know what, do you have a line? Get the bird, bud. Get the bird, get him. Good boy, good boy. That was easy, huh? Good dog, come here, come here. Hey, leave. Good boy. I definitely got him on the second one. I hit him on the first one, I think I was behind. I'm not falling on him, I missed the plaster. Cause he's, his son did. Nice, I'm glad I went for it. You're feeling that fast. Yeah, I think I'm right here. He's pulling his brutal. Here, heel, heel, heel, get the bird back. Get the bird back. Five drinks. Nice. Good boy. Good boy. Good boy. Lead him, lead him. Set, Rocky. I might need to put another one in that one. Catch him up. Good dog. Old business. Oh my goodness, they're wanting to work too. Everybody see, he'll get him too. Come here, come here. Here, Rocky. Here. Hold, hold. Leave. He's dead. It's so weird, cause when he went down it, he wasn't dead, yeah. That's the business, dude. It's a nice one. Notice these birds aren't getting blown to bits. Yep. Cause they're mallards. Same animal, same chop. Going, Rocky. I almost walked into that. That would not have been good. Oh my word. It's a nasty spider I've seen out here. Hold, hold. Hold, leave. Leave. Boy, I wouldn't have found that one. Good job, Rocky. Well, good morning, but not really good morning because it's eight o'clock on a button. And Thomas just dropped his six-strake mallard. I have five drake mallards. We've been taking turns, but I used the GoPro today. Okay, take that back. It's nine o'clock. And anyways, Thomas has six drake mallards. I have five. I've been taking turns. And anyway, so I guess I'll probably shoot the next one, but we'll see. And it's been really good. Rocky's found probably three or four of those that we didn't drop in the open. Yeah. Several of them dropped in the open. So anyways, I think we're getting good footage. It's been fun. It's been awesome. I mean, we have 11 green heads in the bag right now. Kind of been behind them a little bit, but we haven't lost any birds yet. Thankfully, due to Rocky. So it's just been an awesome day. Yeah, if we ended it right now, the way it is, I'd be happy, but I would like to shoot one. So we're going to get off. They're just kind of trickling every five, 10 minutes, but it's been pretty steady. So we want to get out here soon, get our birds and get out here as soon as possible though. There might be one more hunt out up here. I don't even know. Honestly, the way mallards are, they learn quick. We got six mallards and a pulsator over there. And then we got up against the tulies over there. Then we got like six over here in a pulsator. And then to the left on this wall, tulies were on and we got six and a pumper. Rocky! That was beautiful. Oh my God, that was amazing. That was awesome. That was awesome. That was beautiful. Oh my word. I probably should have shot him right here. Or you know what I kind of did? Cause he felt, look at feathers, feathers. Heavy 12, maybe. Stuff is hardly. We can do it. We can do it. Come on, buddy. Come on. Oh yeah, good boy. It's a pretty one. Talk about a bummer. My stinking GoPro went kaputz on me and I just shot my seventh Drake Mallard. He just swung right around and he was 30 yards. He was flying barely, flying just barely flapping.  This has been amazing. Face, ring your face. I'll be kidding me, dude. I had my phone out. You're kidding. Dude, he almost ran right into you. I could. Good shot, baby. He done. Redemption, baby. That is an epic day for us, man. 14 Drake Mallards. I'll say 946. You were done. Yeah. 936 is crazy. Open the hauler, but. Two, we could have been done. 930. Look at that. Oh, excuse me. I didn't know what time it is. Oops, I was tearing up something. Don't mind if I do. Yes, sir. What an awesome day. Cheers. It's probably gonna be one of the better mountaineers this year. Going deep. Boy, those taste so much better. That's beautiful.  That was so fun. It was just fun because it was just me and you on the board's work picking our shots. Man, I was shooting that heavy 12 today. My goodness. That 3-inch 6-shot. And then the Pattern Master Copalac joke. Tom says he's using a Bismuth 3-inch 6-shot with his factory full. We talk about a lot of that stuff on our podcast too. You guys check it out at the NVM show. It's on iTunes, Spotify, Stitcher. We do waterfowl content mainly on our podcast, but we also do political stuff and military, EMS, really anything mostly. Did they see that pile yet? I don't know if you showed them yet. I don't know, but that's what happened, Sterna. I wouldn't change anything about it. Besides, maybe my shooting was a little off. I missed two other drinks. All banless, but all beautiful. I don't know what they say. What are you building?


And we'll go back to this part too, to where we're watching along of Krish, the 2006 sequel to Koimigila. Koimigila! Alien movie. If you haven't seen the first part, please go check out the first part. If you're watching this on YouTube, you can see a very cut-up version. If you like to see a full-on cut version, you can have it on Patreon. I'll put a good shoo-sho-sho on the pinned comment. And let's just get back into this, huh, babe? Oh, Naseer! Welcome to Singapore, sir! Why? Today, your welcome looked different. And it was nice. Good afternoon, sir. Very good afternoon to you, Dr. Martin. Good afternoon, sir. Good afternoon, gentlemen. Good afternoon. But, sir... Good afternoon. Good afternoon. The computer Rohit made in two years, it took so many years to make it. They were lovers. Excuse me. No. He definitely killed him. He's monologuing. We love a good villain, monologue. It's true that the person who sees the future and can change it is considered to be equal to God. Wrong is equal to God. God is considered to be. I liked it. I want to do it. Wow, like father, like son. Do we think Naseer is going to win? No.  Mother? She was going to come. It would have been better if she had come. She would have asked for your hand here. And we would have gone back to India from here. Grandmother is alone there. Hong Kong? Hong Kong is gone. Hong Kong is gone. Hong Kong? She will come back in 10-15 days, right? Yes, she will come back. 10-15 days? But what will I do here in 10 days? Why can't I stay with you here? Because there is no mother there. Yes, there is no mother there. I don't like it. He had so much love and trust in him. I can't believe all this. I can't hurt Krishna. Hurt? He will become famous because of you. He will become a celebrity. And finally we will get a promotion. Okay, Chris Lee. Nice name. My name is Krishna. Krishna Mehra. Krishna? India? Yes, India. I work here in Great Bhome Circus. Must come. Okay? Okay. And on the other side is Indian Superboy Krishna. What is going on, Pia? What happened? You were about to show me the shooting, right? Yes, I thought if you can see the shooting, you can do it. But what if you lose? I will marry her. No, no. I won't let you do that. Action! You don't get your act together. You are out of my show, okay? Ma'am, you are talking to a monkey? Okay, okay. Okay, guys. Sport noises. Owned. I have to do it myself. Sometimes I have a can, sometimes a shoe. Sometimes I have to hold it. Wow, Pia. Smile. No, I know the real problem. You support me. But you are not supporting me.  Okay, gas lighter. Good Lord. And? We will always support each other in good times.  You will see your dreams. I will do it.  He's Prince Eric. Prince Eric's outfit. Is it not? Pretty close, yeah. Go save him. Oh, I thought that was a kid. I was like, what's a kid doing up there? Come to Jadoo, you know you are. They don't deserve their child. Great job, Jadoo. Are you okay? What a superhero change. The most sensational news in Singapore. He said his name is Krish.  So his name is Krish. Krish. But his identity is still a secret. This piece will be matched with his mother. He will be considered as Krish. And he will be presented as Krish. Krish. Krish. Who is this Krish after all? You both are fired. What? You go to India. Go to the jungle with Krish. Go. But... Don't waste your time. Go. Go. Out. I think this is Krish. No one else. This is Krish. What? Yes. She's awful. Leave her. Really, goon? Abhi, take on the ground. I tell my sister. For your sister? The biggest news of today. Superhero Krish has revealed his identity to the media. And the broken piece of the mass fitting his mask has confirmed his identity. Here today, Hero Hunter is honouring Krish for his bravery. She tricked you but she loves you and all is forgiven. The explosion that happened in the circus the other day, I was unconscious but I think my camera is on. It looks so different. Mom, office. I'll see you, okay? Office? Come honey. Boss, go back.  Priya, you know everything about me, right? No. Priya, you know nothing about you. Yes, Priya. You're going to catch on to the ruse. Yes, Priya. Now you see. The truth in front of the people. The snakes that they are. That's the lie that you love. You brought her here from India. And imagine, now we're going to create a big sensation. Bacosta. I got B's poster. Already said. What do you say, honey? His truth made my false love the truth. Too late. No. Nope. I didn't know. Then why did you go to the office? Too bad. Why did you go to the office then? Krishna, I'll teach you.  She tried her best to hide herself. Who kept me in the dark till date. Facts. Worthy Rithika. Please stand with Rithika. Justice for Rithika. I admit that I lied in the beginning. But now, I love you, Krishna. Bacosta. Why should he... The whole world will know about your powers and qualities. That's what I don't want. What do you think? Why did I wear the mask? Because I promised my grandma that I'll hide my identity. Why don't you want the whole world to know your talent? What does that mean? Priya!  Krishna! You're gonna exploit him again. Hello, honey. Mr. Alikaz, stop. Where's the boss at this time? Don't talk about that. You're also given the take. My investors in Singapore. The media should understand this. My genius friend, Rohit Mehra's death. My dream's death too. Excuse me. Sir, I need to speak to that lady for just one minute. He doesn't want any more of your lies. No, sick burn, man. Burn. I want to say something. Oh, good. You brought the bill on here. Krishna, your father Rohit Mehra is alive. Probably from Priyanka again. After this computer's inauguration, Dr. R.A. will handover this. I'm going back to my family, Mr. Alikaz. Don't mind the chief. But I still can't believe that we can see the future. It's ready, isn't it? The recognition of my eyes. Let's see if I'll become uncle Bhateeja or Bhateeji. So, let's go. Let's see. Sun meets a conniving little. Your son has gone to my Rohit. Isn't it? Look at this. Okay, okay. Go to him. I'm going to have my son. Congratulations, chief. What did you say? What happened to my Rohit? What happened, mother? No. It can't be like this.  My Rohit is alive. No. Shah Jahan had put the hands of the workers who built the Taj Mahal so that the other Taj Mahal couldn't be built. Rohit Mehra is a worker for me. And I'm Shah Jahan for him. This means... I've hit the wrong button. This world was too big, mother. But don't worry at all. I'm coming.  I'll make this computer again. I'll use your research. But now, you need me. Thank you so much for everything, Rohit. If you've killed Rohit then you can make this computer again. But you won't be able to start it. Until its eyes are ready and its heartbeats won't be in the computer then the computer won't start. But you'll have to die. Breaking news for the world. A shocking news. Due to a sudden fire in the technology laboratory Prasiddh Bharatiya Vidwan Shri Rohit Mehra's death. I like those old moments with Naseer. I'm helpless to work for Dr. Arya. Dr. Arya has kept him in this state for many years through machines that only his mind is alive and the body is unconscious. Breaking news for Dr. Arya Kabir Yadav. Kaal Kare So Aaj Kar Aaj Kare So Ab. That's why Dr. Arya has decided that he will start the computer today and today is Rohit's death.


hosted a tour guide for the next 45 minutes. My name is Mark Bates. That's me there, patient enough, proof of identity. I've been a Rubyist since about 2005, so longer than some, but not as long as, say, Max. I'm a freelance consultant for Boston, so hiring, I think is what that particular goal points at. I'm a musician in case you couldn't tell. And I'm also an author. And this last point is actually pretty important to today's talk, as I am the author of Distributed Programming with Ruby. That's published by Addison Wesley, came out this year. Definitely worth looking into and reading, if you're interested in distributed programming. I know it's a plug, but I have to do it. That publisher can kill me if I didn't. And with that said, if anybody follows me on Twitter, know that I'm going to be giving away some free books today, which is also pretty exciting. And there's just very simple rules to this little game. You got to tweet me at Mark Bates. And during the show, I've got about five images in my slide deck from TV shows and movies. So it's the first few people to tweet me those five TV shows and movies win a copy of a book. Pretty simple. After the Q&A, come up, see me. We'll check Twitter together. And if you want to look at a few, you got to copy the book. So, what are we going to talk about today? Well, distributed programming in general is a big topic. Can't cover all of it in 45 minutes. That should be kind of go without saying. So I've chosen three of my favorite subjects of distributed programming. And we're going to kind of cover those three areas. Most three areas are RMI, which is remote method invocation. If you're a Java person, please don't go running towards the back of the room. It's not that bad, I swear to you. In the book, I do a little comparison of RMI and Java and RMI and Ruby. And the Java one's like three pages of code to say hello world. And in Ruby, it's like three lines. So it's much more fun and really cool in Ruby. We're also going to talk about messaging queues, a very hot topic. Several people have talked about them already. And we're going to kind of go into what they are and some little more detail into them. And we're also going to talk about background jobs. These were the three that I managed to actually get into 45 minute presentation. I wanted to talk about MapReduce, I wanted to talk about web services, but there's just not enough time. I'm really interested in those subjects. I highly recommend the book, it covers all of them. Okay, so let's talk about how we're going to do this today, right? We're going to talk about the who, the what, the when, the why of each of these subjects. Not so much the how, I'll talk about that in a minute. What I really want you to do is walk away from this talk knowing what a message queue is or what a background job is, when you should use it, why you should use it. And then who are the kind of big players in each of these areas.  And you go home and you use it and you're not using it the right way. And it's not that you're doing it wrong, you're not programming it wrong. You're just not using it when you should be using it. So it's very important to understand when you should be using these technologies and why you should be using them, not just because they're cool technologies. And that's really what I want you to pull away from today. So I know you're probably saying to yourself, the how is why we're here. We want to figure out how to do these things. So what's the point if we're not going to talk about the how? And again, it's really about the when and the why. Very important, we will look at code, we will talk about the code to help illustrate the points about each of these technologies. But to go into them into detail that they need to be covered in, it's too much for 45 minutes. And I've seen too many talks where it's just code after code after code and flying through it and you don't really get anything out of it. So take this away, again, check out the book perhaps. A lot of great in depth coverage there to get into the how of all of this stuff. Okay, this by the way is image number two for those of you keeping track of the free books going. We're going to talk about remote methodification now. Some of its aliases, as you might know by, are PRP, DeRuby, Distributed Ruby. Those are a few of the ones here. So what is it? Well, the name kind of gives it away. It gives you the ability to call methods remotely. Talk the server, client, talk together, call methods, serialize data back and forth. Pretty cool stuff as you'll see. It's in the standard library so no additional packages needed. Very quick to get set up, you can get set up right now. You're fast enough you can actually copy down the code that I'm gonna put up in these slides and actually run these examples locally. They're that easy to get up and running. So it's also very, very easy, very, very powerful to use. As you'll see, it's really cool stuff very quickly. It is also extremely dangerous. And we will talk about security here in a little bit. I'm not gonna go into great detail but I will show you a very quick way to actually wipe out an entire server's file system in three lines of code using this. So there's definitely an edge of danger here and you wanna heed that as you go forward. So why do we wanna use DRB in our applications? Well, it's very fast and easy to get set up and running. Built into the standard library, no problems there. Almost zero configuration, you'll see this in a minute. I'm using straight DRB, almost zero configuration. That's not including SSL and that sort of stuff but just to get up and running in your Dev environment pretty quick. No need for any of the standard web services stuff you use. No need for controllers with JSON or Apache or nginx configurations. You fire up two standard Ruby files you're often running. And most importantly, when would you use? You use a closed environment. You don't wanna offer this up to the public. You don't wanna say, hey everybody, my DRB port is port 8080, feel free and start calling remote methods on it. You don't wanna do that. You wanna do it internally behind firewalls in a closed environment. As you'll see when I show you that security example, why that is important. Okay, so here's a quick little graph that kinda shows what a typical round trip would look like when using remote methodification. We have a client here, right? The client sends a message to the low world server saying, say hello for me. The low world server says I got that message. I know what to do with it. I'm gonna respond with a string below world. It serializes up that string, sends it back down to the client. The client then deserializes that string and does whatever it wants with it. And then serialization is very, very important to what we're gonna talk about and it's how this whole thing works. Everything is serialized between these two and the deserialization, as you'll see a little later, is also incredibly important. So let's look at a quick little demo here. I need to build essential authentication system. I've got 10 to 20 apps. They're all these big apps and every one of them has usernames and passwords. What I really need is a system where I can send the username and password to it. It's going to check it against the database or whatever way it checks to verify those username and passwords correct. Then it's gonna send back a hash of information about that user to me and then I can do with it as I want. And if not, I wanna send some sort of message that says it's been a security breach. So let's look at how we would do this using DRV. Obviously, we could do it with cast systems that are already built but this is kind of a little more fun. So we have a user service class here. It's a standard Ruby library. We're sending Ruby class, nothing special about it at all. On this class, we have an authenticated method. It takes a username, it takes a password. We run it against this incredibly complex algorithm for determining whether they're valid username and password. If they are, we send back some details about this person as a hash and if not, we return a string that says it's been a security breach. What's really interesting about all of this is down the bottom of this file here and unfortunately people in the back probably have a hard time seeing it, there's one line that says start service. We give it a user, we give it an IP address and a port and a copy of the instance of the user service class. So we're gonna buy the instance of this user service class to that IP address and port so that other people can then call off the authenticated method on it. That's all we've done.  So our customer service app that we're gonna build for this, very simple, the customer service reps just need to know the username and password so they can retrieve your details and say oh yeah, your email address is marked at markface.com. So we're gonna connect to that IP address and port that we specified earlier. Get a copy of the user service back and then our loop here, we're just gonna keep asking for username and passwords. Then we're gonna call the authenticated method on it on that user service we got and pass it to username and password. That's honestly that's all you need to do to actually get DRP running. So here it looks actually running. In the top panel we have our user service in the bottom panel we have our client. So I'm gonna type my username here markbakes and my password of bad passwords, see what happens. And I have a security breach which is exactly what I want to happen. I type my correct username and password this time I get the hashed on the bottom here. The string of the hash, the inspect of the string. The inspect of the hash or other. Print out the bugs, my username, my email, my created app date. Everything works great. Through to the top here you can see that I'm printing out that I'm trying to authenticate the user. That was it. There was no third server I had to run. No third file I had to kind of implement. No Apache settings I had to do. I now can, I can now use this hash in my client to do whatever I want. I get the email off it, print to the screen, send them an email, change their email, do whatever I want with this hash. And it's there. So what happened was I asked the remote server, authenticate this here is using a password. I serialize that, send it to the service. The service then found the hash, serialized the hash, send it back down to the client. The client deserialized it, created the hash object and then gave it to me. Now I want to get a little more fanciful with it. We want to actually get, return a user object because that's what all of our apps use. They're going to use a user object. So we're going to change our service here just slightly. Instead of a hash, we're just going to return a user object instead. That's it, let's see how it's changing our service. Here's what our user object looks like. Pretty straightforward, pretty standard Ruby code. And particularly to note down here is our 2S where we're going to print out a nice active record S type of two string on this. Okay, so if we're going to run our fancy user service again this time. And we're going to type in Mark Bates and our password and password. Let's see what happens. Okay, well we got a response. We didn't get a security breach but we didn't get a DRB unknown object. And the question is why do we get a DRB unknown object? And the last example, we got the hash and the hash worked just fine. We should be seeing the 2S of our user object. And the answer is very simple. When we serialized up the hash, deserialized it on the other end, Ruby knew what a hash was. It had the class definition of hash. It does not have a class definition for user. So how do we solve that? Well, we can solve it by creating a class definition of user in both environments. But then it's not very dry. Or we can maybe put it in the gem and bundle up the gem and install the gem in both places. Not the greatest solution either. But Ruby has our backs here. So what we can do is we take our user class and we can have one line, the DRB on dump line. And for those of you who've ever seen this line before and wondered exactly what it does. When I was writing the book, I was really diving into the source code of this and looked up this module to find out what this module does. And all this module does includes one method into your class, the underscore dump method. And all that method does is raise an exception. That's it, that is all that module does includes a method to raise an exception. So what happens is when Ruby tries to deserialize this class up and send it down the wire, it gets the exception and says, okay, I don't know what to do with this. So what I'm gonna actually do is send down our reference to this object.  So it's a little like this. So our client sends a message to user search saying find the user with the IDM1. User service says, okay, I'm gonna send it back to you, but I can't. So instead of actually sending that, this is DRB object that contains a reference and the reference ID of the actual user object which is now stored in the user server as opposed to sending that down to the client. The client then uses that reference as if it was local and says, okay, well, I need to print out the user name to the screen now. So it calls dot username on this potential user object. And what that does is actually sends a message back up to the server saying, here's my reference ID, here's the message I want. Do something with it on this side and then it serializes up and sends down a response on the other side. So let's actually see this work, this time over with our DRB and I've done it. And hopefully it will work, it's pre-recorded. So user name is in my face. You never know what demo is, you really don't. Okay, great, so we got what we expected, we see the nice, beautiful two-story down at the bottom. So it did work, which is fantastic. Now there's two things wrong with what I just showed you. And most importantly, I'll actually start by saying, don't do this, don't ever do this. And the reason is like I said, there's two things wrong with it. The first thing is it's incredibly slow. Every time I make a method call on this object, it serializes up that method call and any parameters you send to it back up to server. The server is now responsible for chugging on it and doing all the processing, not the client. Once it gets that information, then serializes it, sends it back down the pipe and then has to be deserialized again. This is every single time you make a method call. With the hash, we had a local copy, here we don't. So you're passing on these user objects and now everybody's just talking and overloading that main service, not a good idea. The second reason is security. We'll show you that in just one second. But one last thing I kind of want to point out here is you can see we're printing out, asking for email up here at the top service, which was in my user class. And I wanted to point that out just so you saw that it was actually executing on the server side, not the client side, when we called self.email and the inspect. Okay, so this is slide number three of images. So this is the danger we were talking about. Right? When DRB encounters a method on a class that it doesn't know of the client, it sends that message up to the server and says, hey, can you do me a favor and execute this method on your side because I'm hoping you have a copy of it. And the server says, yeah, I'll try my best and I'll do my best for you. So what happens if you take an undeath method that is on, say, every object in Ruby? You undeath it on the client side. What's gonna happen is it's gonna make that method call on the remote side. So if we have a class, a little Ruby file that looks like this, and we get our DRB object, and we undeath instance of AL on that, and then we call instance of AL with rm-rf star. Do not run this code, by the way. Anybody ever run this code? Please, I really can't stress that enough. I've never actually run this code. I'm taking on faith this code works. So please do not do it. So we undeath instance of AL, then we call it on the remote object. It doesn't know what to do with it, so it calls back up to the server and it says, oh, I know what instance of AL is. I'm gonna run it. And then it runs the system command and destroys our entire file server. Not a good idea. Please do not run this. Ruby does have our back. There are flags you can set that prevent the entire family of the vows from running. And I highly recommend you set them on every single DRB file you ever write. Regardless, you only need to set it once, but set it on every single file because you can never have it set enough time. That's what I can really say about that. Okay, so that's kind of DRB in our mind in a quick little nutshell here. There's a lot more you can do with it and I really recommend going deep dive into it. When you set up a radio servers using Rinda, now all of a sudden you can have automatic service discovery so we can get rid of these nasty IP addresses in ports and actually start looking for objects and checking objects out of the service and putting them back in again. A lot of really fun stuff you can do with this. But again, there's always that caution and I can't caution you enough just how unsecured this can be. Every instance, every object you share and every object you send out a pipe, any method on it is now available. This is not a web service where you say, here are my half dozen end points. You can only call these and then I am going to control them and I'm not going to call a valve on any user programs you set through or at least you shouldn't. I'm sure somebody out there is and is in for a surprise one day. You're not in control of that anymore. I could call any method and I could undef any method. This is Ruby. You can do whatever the hell we want with it, remember? So really be very, very careful with it. But it is a lot of fun when you use a really cool shit with it. And again, the book goes into a lot of examples and a lot of cool stuff you can do. Definitely check it out. Okay, so who are the big players in this area? Well, DRB and Render are really the biggest players. There have been a few others that have tried to kind of fall off the line. There is a little gem I wrote called Distribunaut which wraps a lot of this kind of stuff and does a lot of cool magic where it automatically looks up objects and namespace and finds them in services and locks them and checks them out and it's also cool stuff. But if you got to use it, I would definitely recommend checking that out. Okay, so message views. This is slide number four, I think. No, I was just about to say his name in the speed of delivery. But I'm not going to. So what are message views? Well, they're also known as asynchronous message views although there are synchronous message views but they're not the norm. They're active message queuing protocols, big protocol for them or AMQP. So what are they? Well, I think the name kind of gives it away. They're a stack of messages to queue. You put messages into it, messages come out on the other end. They typically run on a FIFO system. So first in, first out. You put message at the top, the bottom message comes up. Obviously when it's processed. Fire and forget. There is typically no interaction between the person putting the message on there, the queue and then the queue sending back some sort of message to that person. You typically put the message on the queue and then that's it, let the queue do what it does and maybe it puts another message on another queue that you pull off later. But that's not really that kind of communication. Very fire and forget. So when and why do we use a message queue? Right, well they're extremely fast and efficient. Incredibly fast. Most of them, like RabbitMQ is written in Erlang. So it's incredibly fast. Reliable delivery. They all offer reliable delivery. You can turn off persistence on the wall. But if you turn off persistence, they're incredibly even more fast. But you kind of lose reliable delivery. They are immediate. So typically the message itself is not actually stored. You send an object to the database, you say here's my object, store it, I wait for a response from the database saying it's been stored. With message queues you say here's the message and then you leave. You don't get a response saying it's been stored. It doesn't say hold on a second, let me just make sure that it's a good message. You just take the message and you walk away from it. So very immediate in terms of that. And typically there are several workers or processes per queue that are constantly kind of being pushed all these messages and they're constantly working. And this is an important difference when we look at background jobs in a little bit. It's one of the things that differentiates background jobs and message queues. Here you would say you have three or four, 10 processors all working on one queue. And they're also very good for inter-process communication. So you have several apps. You want to put a message on the app. AppA puts a message on there for AppB. AppB comes along, picks it up and says oh thank you. This person's registered so I set up an email now. We'll do something fun like that. Okay, so I'm gonna do a little demo. For this demo I use Starling, which is a Ruby-based messaging queue. It was originally written by this little startup in California called Twitter. They use it for a while. I don't think they're using it anymore. It's a fun little message queue. I wouldn't really recommend it for high-skill production because it is all Ruby-based. But it's very easy to get up and running, get started with just why use these demos. Typically I use RabbitMQ, which is fantastic, but it's a lot more work to kind of get up and running and to kind of do some of the examples. So I thought simplicity was best for practical demonstration. So let's see what we got here. So we're gonna connect to Starling server. Now all we have to do is run the Starling command line to the Starling server. We'll show you that in a second on a particular address and port. And then we're gonna ask you for something silly to say. And then that message, whatever you say, is gonna get shoved onto the login queue with a timestamp. So basically a little logging system here. So imagine we have our application every time a user comes to our app. We're gonna send the request information just popping onto this queue. And then we're gonna process it in our logger. Later we're gonna do analytics. We're gonna do all sorts of heuristics on it right then and there instead of just running into a file. So here's our login queue. It's very simple. We're just going to loop through the queue. We're gonna flush the queue. So every time they're messes in the queue, they're gonna get popped up into this block. And we're gonna print it to the screen. That's it. That's all we need to do to get Starling kind of up and running and going and connecting to our login server, a login queue. So that's a good example. At the top here, we're gonna start Starling. Very simple. Get rid of that. We're gonna start our log worker. Just gonna sit there and wait for stuff to go in. Now it's gonna ask me a question. Something to say. Yes, I'm gonna say hello, we're in the conf. And then boom, it shows up right there at the top. The time stamp we put it in, which obviously was a few days ago, Wednesday. And then another one down the bottom. So that's it. So don't imagine the power of that to do some really cool stuff. In this case, I'm using logging as an example. Logging is a great example of message queuing. Cause we're always wanting to do stuff for our logs. Why not pop them on there very fast? Probably faster than writing to a disk. When you've got all those files, oh and everybody trying to write to that same file, putting stuff on a queue can be very, very fast. And then let it do processing and formatting and whatever you want to write to a database or create a pie chart on the other end. All right, so show you a little more interesting example. We're gonna create a number queue. And from this number queue, we're gonna send it spaced limited numbers. We're gonna add those numbers up in our queue. Pretty simple, pretty straightforward. If you don't know what this Ruby code is, I can't help it. So here we go, start client, what numbers you wanna add and it's gonna set them on the queue. Here we go, we're on our number adder. Do some numbers. Two and two is four. One, two, three, four, five, six, seven, eight, nine. Should equal 45. Here we go. So here we're doing something a little more interesting. We're giving it kind of a message. We're saying, do this thing, add these numbers together. So you can do some fun stuff with it. You can't really send complex objects, but that's probably a good thing. You know, I probably could have created some sort of number adder class and sent that along with all my attributes. I can also send an array. It can deal with basic stuff. You really wanna try to stick with your very basic class types when dealing with messages. One, because if you create these large objects, you're really starting to feed the point of that immediacy. Just take what you have and send it as quick as you possibly can. Don't create large complex objects. Let the processor do that. Just send over the string. I've sent over a string of numbers that I grabbed. I didn't split them. I didn't send over the read. I didn't spend the time on my inside to do it. Use that immediacy to your advantage. Let the processor do that work for you. That's what it's there for. Okay, so who are some of the big players in this area? When we talk about RabbitMQ, which I said is my favorite one I use all the time. I just love it. Along with the AMQ PGM. Fantastic. Starling, very good for just getting started. One player to stuff today. Starling is really easy to do and get out of the planning very quickly. An active MQ. I don't really have any experience with it, but I've heard lots of really good things. So, check it out. That's your thing. Last image that your tweet's in. Background jobs. By the way, if you guys don't know who this is, I mean seriously, there's something like, I got the first four. I am totally lost with these two. Honestly. Just, you'd be surprised, I guess. It's actually my son's favorite show, which is The Rage, which is really sad. Anyway, so no one else says on background jobs here. Offline tasks, background workers, you probably heard them refer to as that. Just play a show of hands. How many people actually use background jobs in their apps today? Okay, so a decent amount of people. That's good. You should be. So what are they? Well, they're dedicated workers to a dedicated task. I apologize you put that on there. And that's a big differentiator from a message queue.  Here you're actually bundling up information about a very specific task, and that could be a whole bunch of information from instance variables to message IDs, user of object IDs, to whatever it is you need to do, large images, whatever you're bundling up and saying, here process this when I tell you to process it in the background. It typically use priority and run at base queues. So instead of first in, first out, you wanna tell it, well, this worker, this job is more important than this other job. The example I always like to use is every site, most websites will send you a welcome email when you register with your confirmation like you click on it and confirm your email address. And a lot of sites will also send an email when say you have a to-do that's overdue, right? Well, what is more important? Welcome email or to use overdue? And obviously the to-do is overdue, is the most important of those two emails. Okay, obviously it's a welcome email. So you wanna shove that in there as urgent and run at now, and the other one you might wanna say, you know what, kind of low priority if it gets delivered at midnight tonight, like I wanted to, that's great, it gets delivered at 12 o'clock, five, I don't really care, if it's something more important, they're also fired and forget, but without the kind of immediacy. The reason they're using, without the immediacy is you see in a minute, they're typically database backed or stored by some sort of service somewhere, typically a database. And you have to kind of build the object before you save it, before you give it off to the queue. Okay, so when and why we use this? Well, here's a few good examples, right? You wanna process large files. That person uploads that 10 megabyte avatar, that's not gonna be, you need to cut up some thumbnails for it. You don't wanna do that while a person's waiting, right?  Offload long running tasks. One of my favorite examples of this is every site typically has the invitation system.  So that works great, you know, you put in 10 email addresses, find, it's gonna send out 10 emails. Not the best, I mean, what happens if the S&P servers down, or is some other reason why a site's getting slow? What happens if you type in 1,000 email addresses or 10,000 email addresses, right?  That sounds like an awful user experience to me. Why not take it, shove it in the job, and let that job then sit there and spend its cycles, sending out 10,000 email addresses, and retrying again if one of those addresses fails or the S&P connection is down, and just return back to the user and say, thank you very much, we sent your emails. They'll be done the way they are. All right, I said they're typically database backed, so they're very easy to usually get started with, you usually have a database in your application. And again, if priority is important to you, then this is definitely a win over a message to you. And also great for recurring tasks. I know you can say, well, we've got cron, we can just run a cron job every night of midnight to do my to-dos or every hour to calculate up how much the person has used in bandwidth or every five minutes to pull down that hashtag from Twitter. Yeah, you could write cron jobs to do all of those things, but what if you don't have cron? Or you're on Broca, right? Broca, you have to pay for an hour of the cron, and I'm gonna get that five minute Twitter cron going. Recurring tasks, very good. They also will sell me, you can set them to self and read to you. They'll retry for you if there's a problem. It's a great solution to that cron problem. And writing cron jobs kind of sucks, not gonna lie. So let's do a little demo. I scratched my head trying to come up with a demo to show you that demonstrates long running background processes and stuff like that. So what I came up with was a little news reader app. It's gonna be a killer news reader app. Everybody's gonna go flop to it by the end of this tutorial. And what I'm gonna do is I'm gonna create a, add a URL, that's one go, and aggregate all the articles from that news feed. Pretty straightforward. I have this active record class here. It has many articles. And then on my app to save, so every time I save this, I'm gonna go and get my articles here. I'm gonna aggregate them using this aggregate method. So I connect to the URL that I have, I parse the feed, I then loop through the entries of that feed, and then create my article objects, and then my server gets a little sleepy after it does that, so it takes a little second break, and then does the next one. So if you have 20 and 30 articles, it's gonna take 20 and 30 seconds minimum to run. That's not including the length of time it takes here. It actually connects to the site. Length of time it takes here, it pars the body, loop through them to the database creation here, and all that fun stuff. So let's actually see what happens when we try to do it from a user's perspective. I create my Netflix news feed here. I'm gonna get the new releases. I click create feed. You can see down here it's processing. And we're still processing. And this is just a great user experience. And this is wonderful. What happens if that news feed timed up? Then my session, my browser's gonna time out, or if it takes longer than 30 seconds or a minute, my browser's gonna time out, and then everybody's gonna freak out, they're gonna have to create, so you get that error message, and I can create it again, and maybe it's gonna do it again. It's just not very good. If we look down here at our log, we can see that it took a total of just over 25 seconds for that to actually return back. Now granted, they have, here are their movies and their articles rather up here in the top. I believe that's Jonah Hex, so obviously a good one. But it's there now, but now every time they say this, this is what's gonna happen. It's gonna take the 25 seconds to get a response back to the server, and that is just an awful user experience. So how do we use a background job? Now this could obviously have been an image or anything. So how do we make this work? Well let's change our feed class around just a little bit here. Instead of the aggregate method, we're gonna call this inque worker class. All that's going to do is call this aggregate worker class and inque it and give it the idea of the feed. That's it, that's all it's doing. So now when I click save, it's going to inque worker and complete. It's gonna come back to user. Nothing else changed, but here's my aggregate worker. We're using a delayed job under the covers, which is a great system for doing background jobs. And using a gem I work called DJ remixes that gives you unique workers, re-enqueable workers, hot-toed supports, hooks, really kind of cool, fun stuff we're using.


The private sector has a huge role to play when it comes to insurances, for example. Lots of G20 countries have a very interesting, different background. In some countries, insurance markets are very active. In other countries, the disaster financing comes very much from public sources. So what we've been discussing is how can we bring the private sector in? We need to find ways of improving the cooperation, because clearly, as you said, it's absolutely necessary to bring them in to build that actor after the disaster. We've been seeing the tragic event in Turkey and Syria, and that really reminded the international community of the importance of this DRR topic. And especially, resilient infrastructures is a very important topic. This morning, I had the opportunity to participate as a panelist in the side event, and I emphasized the importance of how to link those discussions in the conference rooms to the reality on the ground. Disaster management is very much important, and disaster financing is very much important to help the disaster-borne areas. And in this area, India has got tremendous development, which I found in the previous working group sessions. I think that Indian Presidency would like to present the activity for the future, but not just for these two additional meetings, but a roadmap for the future, for the next five, six, seven years. And I think that this is very important, because disaster reduction cannot be achieved in one shot. It's a long path.