CHAPTER 78 The New Ministry When the ex-prime minister was left by himself after the departure of his old friend, his first feeling had been one of regret that he had been weak enough to doubt at all. He had long since made up his mind that after all that had passed he could not return to office as a subordinate. That feeling as to the impropriety of Caesar descending to serve under others, which he had been foolish enough to express, had been strong with him from the very commencement of his ministry. When first asked to take the place which he had filled, the reason strong against it had been the conviction that it would probably exclude him from political work during the latter half of his life. The man who has written QC after his name must abandon his practice behind the bar. As he then was, although he had already been driven by the unhappy circumstance of his peerage from the House of Commons which he loved so well, there were still open to him many fields of political work. But if he should once consent to stand on the top rung of the latter, he could not, he thought, take a lower place without degradation. Till he should have been placed quite at the top, no shifting his place from this higher to that lower office would injure him in his own estimation. The exigencies of the service and not defeat would produce such changes as that. But he could not go down from being Prime Minister and serve under some other chief without acknowledging himself to have been unfit for the place he had filled. Of all that he had quite assured himself. And yet he had allowed the old duke to talk him into a doubt. As he sat considering the question, he acknowledged that there might have been room for doubt, though in the present emergency there certainly was none. He could imagine circumstances in which the experience of an individual in some special branch of his country's service might be of such paramount importance to the country as to make it incumbent on a man to sacrifice all personal feeling. But it was not so with him. There was nothing now which he could do which another might not do as well. That blessed task of introducing decimals into all the commercial relations of British life which had once kept him aloft in the air, floating as upon eagle's wings, had been denied him. If ever done it must be done from the House of Commons, and the people of the country had become deaf to the charms of that great reform. Otello's occupation was, in truth, altogether gone, and there was no reason by which he could justify to himself the step down in the world which the old duke had proposed to him. Early on the following morning he left Carleton Terrace on foot and walked as far as Mr. Monk's house which was close to St. James's Street. Here at eleven o'clock he found his late Chancellor of the Exchequer in that state of tedious agitation in which a man is kept, who does not yet know whether he is or is not to be one of the actors in the play just about to be performed. The duke had never before been in Mr. Monk's very humble abode and now caused some surprise. Mr. Monk knew that he might probably be sent for, but had not expected that any of the ex-prime ministers of the day would come to him. People had said that not him probably he himself might be the man, but he himself had indulged in no such dream. Office had no great charms for him, and if there was one man of the late government who could lay it down without a personal regret it was Mr. Monk. I wish you to come with me to the duke's house in St. James's Square, said the late prime minister. I think we shall find him at home. Certainly I will come this moment. Then there was not a word spoken till the two men were in the street together. Of course I am a little anxious, said Mr. Monk.  You, of course, must return to office, Mr. Monk. With your grace I certainly will do so. And without, if there be the need, they who are wanted should be forthcoming, but perhaps you will let me postpone what I have to say till we see the duke. What a charming morning, is it not? How sweet it would be down in the country! March had gone out like a lamb, and even in London the early April days were sweet, to be followed no doubt by the usual nipping in clemency of May. I never can get over the feeling, continued the duke, that Parliament should sit for the six winter months instead of in summer. If we met on the first of October, how glorious it would be to get away for the early spring. Nothing less strong than grouse could break up Parliament, said Mr. Monk, and then what would the pheasants and the foxes say? It is giving up almost too much to our amusements. I used to think that I should like to move for a return of the number of hunting and shooting gentlemen in both houses. I believe it would be a small minority. But their sons shoot, and their daughters hunt, and all their hangers on would be against it. Custom is against us, Mr. Monk, that is it. Here we are. I hope my friend will not be out looking up young lords of the Treasury. The Duke of St. Bungay was not in search of cadets for the government, but was at this very moment closeted with Mr. Gresham and Mr. Gresham's especial friend, Lord Cantrip. He had been at this work so long and so constantly that his very servants had their ministerial crisis manners, and felt and enjoyed the importance of the occasion. The two newcomers were soon allowed to enter the august conclave, and the five great Senators greeted each other cordially. I hope we have not come inopportunely, said the Duke of Omnium. Mr. Gresham assured him, almost with hilarity, that nothing could be less inopportune. And then the Duke was sure that Mr. Gresham was to be the new Prime Minister, whoever might join him or whoever might refuse to do so. I told my friend here, continued our Duke, laying his hand upon the old man's arm, that I would give him his answer to a proposition he made me within twenty-four hours, but I find that I can do so without that delay. I trust your grace's answer may be favourable to us, said Mr. Gresham, who indeed did not doubt much that it would be so, seeing that Mr. Monk had accompanied him. I do not think that it will be unfavourable, though I cannot do as my friend has proposed. Any practicable arrangement began Mr. Gresham with a frown, however, on his brow. The most practicable arrangement I am sure will be for you to form your government without hampering yourself with a beaten predecessor. Not beaten, said Lord Cantrip. Certainly not, said the other Duke. It is because of your success that I ask your services, said Mr. Gresham. I have none to give, none that I cannot better bestow out of office than in. I must ask you gentlemen to believe that I am quite fixed. Coming here with my friend Mr. Monk I did not state my purpose to him, but I begged him to accompany me, fearing lest in my absence he should feel it incumbent on himself to sail in the same boat with his late colleague. I should prefer to do so, said Mr. Monk. Of course it is not for me to say what may be Mr. Gresham's ideas, but as my friend here suggested to me that were I to return to office Mr. Monk would do so also, I cannot be wrong in surmising that his services are desired. Mr. Gresham bowed assent. I shall therefore take the liberty of telling Mr. Monk that I think he is bound to give his aid in the present emergency. Where I as happily placed as he is in being the possessor of a seat in the House of Commons I too should hope that I might do something. The four gentlemen with eager pressure begged the Duke to reconsider his decision. He could take this office and do nothing in it, there being as we all know offices the holders of which are not called upon for work, or he could take that place which would require him to labour like a galley slave. Would he be privy seal? Would he undertake the India Board? But the Duke of Omnium was at last resolute. Of this administration he would not at any rate be a member. Whether Caesar might or might not at some future time condescend to command a legion he could not do so when the purple had been but that moment stripped from his shoulders. He soon afterwards left the House with a repeated request to Mr. Monk that he would not follow his late chief's example. I regret it greatly said Mr. Gresham when he was gone. There is no man said Lord Cantrip whom all who know him more thoroughly respect. He has been worried said the old Duke and must take time to recover himself. He has but one fault, he is a little too conscientious, a little too scrupulous. Mr. Monk of course did join them making one or two stipulations as he did so. He required that his friend Finneas Finn should be included in the government. Mr. Gresham yielded though poor Finneas was not among the most favored friends of that statesman. And so the government was formed and the crisis was again over and the lists which all the newspapers had been publishing for the last three days were republished in an amended and nearly correct condition. The triumph of the people's banner as to the omission of the Duke was of course complete. The editor had no hesitation in declaring that he, by his own sagacity and persistency, had made certain the exclusion of that very unfit and very pressing candidate for office. The list was filled up after the usual fashion. For a while the dilettante politicians of the clubs and the strong-minded women who take an interest in such things and the writers in newspapers had almost doubted whether in the emergency which had been supposed to be so peculiar any government could be formed. There had been so they had said peculiarities so peculiar that it might be that the much-dreaded deadlock had come at last. A coalition had been possible and, though antagonistic to British feelings generally, had carried on the government. But what might succeed the coalition nobody had known. The radicals and liberals together would be too strong for Mr. Dobney and Sir Orlando. Mr. Gresham had no longer a party of his own at his back and a second coalition would be generally spurned. In this way there had been much political excitement and a fair amount of consequent enjoyment. But after a few days the old men had rattled into their old places, or generally old men into new places, and it was understood that Mr. Gresham would be again supported by a majority. As we grow old it is a matter of interest to watch how the natural gaps are filled in the two ranks of parliamentary workmen by whom the government is carried on either in the one interest or the other. Of course there must be gaps. Some men become too old, though that is rarely the case. Appeal may perish, or even a Palmerston must die. Some men, though long supported by interest, family connection, or the loyalty of colleagues, are weighed down at last by their own incapacity and sink into peerages. Now and again a man cannot bear the bondage of office and flies into rebellion and independence which would have been more respectable had it not been the result of discontent. Then the gaps must be filled. Whether on this side or on that the candidates are first looked for among the sons of Earls and Dukes, and not unnaturally as the sons of Earls and Dukes may be educated for such work almost from their infancy. A few rise by the slow process of acknowledged fitness. Men who probably at first have not thought of office but are chosen because they are wanted, and whose careers are grudged them not by their opponents or rivals, but by the Browns and Joneses of the world who cannot bear to see a Smith or a Walker become something so different to themselves. These men have a great weight to carry and cannot always shake off the burden of their origin and live among begotten statesmen as though they too had been born to the manner. But perhaps the most wonderful ministerial phenomenon, though now almost too common to be longer called a phenomenon, is he who rises high in power and place by having made himself thoroughly detested, and also, alas, for parliamentary cowardice, thoroughly feared. Given sufficient audacity, a thick skin, and power to bear for a few years the evil looks and cold shoulders of his comrades, and that is the man most sure to make his way to some high seat. But the skin must be thicker than that of any animal known, and the audacity must be complete. To the man who will once shrink at the idea of being looked at a scant for treachery, or hated for his ill condition, the career is impossible. But let him be obdurate, and the bid will come. Not because I want him do I ask for him, says some groaning chief of a party, to himself, and also sufficiently allowed for others' ears. But because he stings me and goads me and will drive me to madness as a foe. Then the packy dermatus one enters into the other's heaven, probably with the resolution already formed of ousting that unhappy angel. And so it was in the present instance. When Mr. Gresham's completed list was published to the world, the world was astonished to find that Sir Timothy was to be Mr. Gresham's attorney general. Sir Gregory Grogrum became Lord Chancellor, and the Liberal Chief was content to borrow his senior law adviser from the conservative side of the late coalition. It could not be that Mr. Gresham was very fond of Sir Timothy, but Sir Timothy in the late debates had shown himself to be a man of whom a minister might well be afraid. Immediately on leaving the old Duke's house, the late Premier went home to his wife and finding that she was out waited for her return. Now that he had put his own decision beyond his own power, he was anxious to let her know how it was to be with them. I think it is settled at last, he said. And are you coming back? Certainly not that. I believe I may say that Mr. Gresham is Prime Minister. Then he oughtn't to be, said the Duchess crossly. I am sorry that I must differ from you, my dear, because I think he is the fittest man in England for the place. And you? I am a private gentleman who will now be able to devote more of his time to his wife and children than has hitherto been possible with him. How very nice! Do you mean to say that you like it? I am sure that I ought to like it. At the present moment I am thinking more of what you will like. If you ask me, Plantagenet, you know I shall tell the truth. Then tell the truth. After drinking brandy so long, I hardly think that twelve shilling claret will agree with my stomach. You ask for the truth, and there it is, very plainly. Plain enough. You asked, you know. And I am glad to have been told, even though that which you tell me is not pleasant hearing. When a man has been drinking too much brandy, it may be well that he should be put on a course of twelve shilling claret. He won't like it, and then it's kill or cure. I don't think you're gone so far, Cora, that we need fear that the remedy will be fatal. I am thinking of you rather than myself. I can make myself generally disagreeable and get excitement in that way, but what will you do? It's all very well to talk of me and the children, but you can't bring in a bill for reforming us. You can't make us go by decimals. You can't increase our consumption by lowering our taxation. I wish you had gone back to some board. This, she said, looking up into a space with an anxiety which was half real and half burlesque. I had made up my mind to go back to no board for the present. I was thinking that we could spend some months in Italy, Cora. What for the summer so as to be in Rome in July? After that we could utilize the winter by visiting Norway. We might take Norway first, and be eaten up by mosquitoes. I've got to be too old to like travelling. What do you like, dear? Nothing, except being the Prime Minister's wife, and upon my word there were times when I didn't like that very much. I don't know anything else that I'm fit for.  Only we should have to lend him Gatheram or there would be no room for the display of my abilities. Is Mr. Monk in? He keeps his old office. And Mr. Finn? I believe so, but in what place I don't know. And who else? Our old friend the Duke and Lord Cantrip and Mr. Wilson and Sir Gregory will be Lord Chancellor.   Well plantagenet I'll go anywhere you like to take me. I'll have something for the malaria at Rome and something for the mosquitoes in Norway and we'll make the best of it. But I don't see why you should run away in the middle of the session. I would stay and pitch into them all round like a true ex-minister and independent member of Parliament. Then as he was leaving her she fired a last shot. I hope you made Sir Orlando and Sir Timothy Pears before you gave up. It was not until two days after this that she read in one of the daily papers that Sir Timothy Beeswax was to be Attorney General and then her patients almost deserted her. To tell the truth her husband had not dared to mention the appointment when he first saw her after hearing it. Her explosion first fell on the head of Phineas Finn whom she found at home with his wife, deploring the necessity which had fallen upon him of filling the fainting office of Chancellor of the Duchy of Lancaster. Mr. Finn she said, I congratulate you on your colleagues. Your grace is very good. I was at any rate introduced to many of them under the Duke's auspices. And ought I think to have seen enough of them to be ashamed of them. Such a regiment to march through Coventry with. I do not doubt that we shall be good enough men for any enemies we may meet. It cannot be but that you should conquer all the world with such a hero among you as Sir Timothy Beeswax. The idea of Sir Timothy coming back again. What do you feel about it? Very indifferent, Duchess. He won't interfere much with me as I have an Attorney General of my own. You see I'm especially safe. I do believe men would do anything, said the Duchess, turning to Mrs. Finn. Of course I mean in the way of politics. But I did not think it possible that the Duke of St. Bungay should again be in the same government with Sir Timothy Beeswax. CHAPTER 79 OF THE PRIME MINISTER This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox.org. THE PRIME MINISTER by ANTHONY TROLLUP CHAPTER 79 THE WORTON WEDDING It was at last settled that the Wharton marriage should take place during the second week in June. There were various reasons for the postponement. In the first place Mary Wharton, after a few preliminary inquiries, found herself forced to declare that Messer's muddocks and cramble could not send her forth equipped as she ought to be equipped for such a husband in so short a time. Perhaps they do it quicker in London, she said to Everett with a soft regret, remembering the metropolitan glories of her sister's wedding. And then Arthur Fletcher could be present during the Whitsentide holidays, and the presence of Arthur Fletcher was essential. And it was not only his presence at the altar that was needed. Parliament was not so exacting but that he might be given that. But it was considered by the United Families to be highly desirable that he should on this occasion remain some days in the country. Emily had promised to attend the wedding and would of course be at Wharton for at least a week. As soon as Everett had succeeded in resting a promise from his sister, the tidings were conveyed to Fletcher. It was a great step gained. When in London she was her own mistress, but surrounded as she would be down in Herefordshire by Fletchers and Whartons, she must be stubborn indeed if she should still refuse to be taken back into the flock and be made once more happy by marrying the man whom she confessed that she loved with her whole heart. The letter to Arthur Fletcher containing the news was from his brother John and was written in a very business-like fashion. We have put off Mary's marriage a few days so that you and she should be down here together. If you mean to go on with it, now is your time. Arthur, in answer to this, merely said he would spend the wits and tide holidays at Longbarns. It is probable that Emily herself had some idea in her own mind of what was being done to entrap her. Her brother's words to her had been so strong, and the occasion of his marriage was itself so sacred to her that she had not been able to refuse his request. But from the moment that she had made the promise she felt that she had greatly added to her own difficulties. That she could yield to Arthur never occurred to her, she was certain of her own persistency. Whatever might be the wishes of others, the fitness of things required that Arthur Fletcher's wife should not have been the widow of Ferdinand Lopez, and required also that the woman who had married Ferdinand Lopez should bear the results of her own folly. Though since his death she had never spoken a syllable against him, if those passionate words be accepted which Arthur himself had drawn from her, still she had not refrained from acknowledging the truth to herself. He had been a man disgraced, and she as his wife, having become his wife in opposition to the wishes of all her friends, was disgraced also. Let them do what they will with her, she would not soil Arthur Fletcher's name with this infamy. Such was still her steadfast resolution, but she knew that it would be not endangered, but increased in difficulty by this visit to Herefordshire. And then there were other troubles. Papa, she said, I must get a dress for Everett's marriage. Why not?  It is not useless, and such expenses as that I can surely afford without groaning. Do it handsomely, and you will please me best. Then she went forth and chose her dress, a gray silk, light enough not to throw quite a gloom on the brightness of the day, and yet dark enough to declare that she was not as other women are. The very act of purchasing this, almost blushing at her own request as she sat at the counter in her widow's weeds, was a pain to her. But she had no one whom she could employ. On such an occasion she could not ask her Aunt Harriet to act for her as her aunt was distrusted and disliked. And then there was the fitting on of the dress, very grievous to her, as it was the first time since the heavy black morning came home that she had clothed herself in other garments. The day before that fixed for the marriage, she and her father went down to Herefordshire together, the conversation on the way being all in respect to Everett. Where was he to live? What was he to do? What income would he require till he should inherit the good things which destiny had in store for him? The old man seemed to feel that Providence, having been so very good to his son in killing that other heir, had put rather a heavy burden on himself. He'll want a house of his own, of course, he said, in a somewhat lacrimose tone. I suppose he'll spend a good deal of his time at Wharton. He won't be content to live in another man's house altogether, my dear, and Sir Al Ured can allow him nothing. It means, of course, that I must give him a thousand a year. It seems very natural to him, I daresay, but he might have asked the question before he took a wife to himself. You won't be angry with him, Papa? It's no good being angry. No, I'm not angry. Only it seems that everybody is uncommonly well pleased without thinking who has to pay for the piper. One that evening at Wharton Emily still wore her morning dress. No one indeed dared to speak to her on the subject, and Mary was even afraid lest she might appear in black on the following day. We all know in what condition is a house on the eve of a marriage how the bride feels that all the world is going to be changed and that therefore everything is for the moment disjointed, and how the rest of the household including the servants are led to share the feeling. Everett was, of course, away. He was over at Long Barns with the Fletchers and was to be brought to Wharton Church on the following morning. Old Mrs. Fletcher was at Wharton Hall and the bishop, whose services had been happily secured. He was formally introduced to Mrs. Lopez, the use of the name for the occasion being absolutely necessary, and with all the smiling urbanity which as a bishop he was bound to possess he was hardly able not to be funerial as he looked at her and remembered her story. Before the evening was over Mrs. Fletcher did venture to give a hint. We are so glad you have come, my dear. I could not stay away whenever it said he wished it. It would have been wrong. Yes, my dear, wrong. It is your duty and the duty of us all to subordinate our feelings to those of others. Even sorrow may be selfish. Poor Emily listened but could make no reply. It is sometimes harder for us to be mindful of others in our grief than in our joy. You should remember, dear, that there are some who will never be light-hearted again till they see you smile. Do not say that, Mrs. Fletcher. It is quite true and right that you should think of it. It will be particularly necessary that you should think of it to-morrow. You will have to wear a light dress and—'I have come provided,' said the widow. Then try to make your heart as light as your frock. You will be doing it for Everett's sake and for your father's and for Mary's sake and Arthur's. You will be doing it for the sake of all of us on a day that should be joyous. She could not make any promise in reply to this homily, but in her heart of hearts she acknowledged that it was true, and declared to herself that she would make the effort required of her. On the following morning the house was, of course, in confusion.  But before the great breakfast there was, of course, a subsidiary breakfast, or how could the bishop, bride, or bridesmaids have sustained the ceremony? At this meal Emily did not appear having begged for a cup of tea in her own room. The carriages to take the party to the church, which was but the other side of the park, were ordered at eleven, and at a quarter before eleven she appeared for the first time in her gray silk dress and without a widow's cap. Everything was very plain, but the alteration was so great that it was impossible not to look at her. Even her father had not seen the change before. Not a word was said, though old Mrs. Fletcher's thanks were implied by the graciousness of her smile. As there were four bridesmaids and four other ladies besides the bride herself, in a few minutes she became obscured by the brightness of the others, and then they were all packed in their carriages and taken to the church. The eyes which she most dreaded did not meet hers till they were all standing round the altar. It was only then that she saw Arthur Fletcher, who was there as her brother's best man, and it was then that he took her hand and held it for half a minute as though he never meant to part with it, hidden behind the widespread glories of the bridesmaids' finery. The marriage was as sweet and solemn as a kind-hearted bishop could make it, and all the ladies looked particularly well. The veil from London, with the orange wreath also metropolitan, was perfect, and as for the dress I doubt whether any woman would have known it to be provincial. Everett looked the rising baronet every inch of him, and the old barrister smiled and seemed at least to be well pleased. Then came the breakfast and the speech-making in which Arthur Fletcher shone triumphantly. It was a very nice wedding, and Mary Wharton, as she had been and still was, felt herself for a moment to be a heroine. But through it all there was present to the hearts of most of them a feeling that much more was to be effected, if possible, than this simple and cozy marriage, and that the fate of Mary Wharton was hardly so important to them as that of Emily Lopez. When the carriage and four was gone there came upon the household the difficulty usual on such occasions of getting through the rest of the day. The bridesmaids retired and repacked their splendors so that they might come out fresh for other second-rate needs, and with the bridesmaids went the widow. Arthur Fletcher remained at Wharton with all the other Fletchers for the night and was prepared to renew his suit on that very day if an opportunity were given him. But Emily did not again show herself till a few minutes before dinner, and then she came down with all the appurtenances of mourning which she usually wore. The gray silk had been put on for the marriage ceremony and for that only. "'You should have kept your dress at any rate for the day,' said Mrs. Fletcher. She replied that she had changed it for Everett and that as Everett was gone there was no further need for her to wear clothes unfitted to her position. Arthur would have cared very little for the clothes, could he have had his way with the woman who wore them? Could he have had his way even so far as to have found himself alone with her for half an hour? But no such chance was his. She retreated from the party early and did not show herself on the following morning till after he had started for long-barns. All the Fletchers went back, not however with any intention on the part of Arthur to abandon his immediate attempt. The distance between the houses was not so great but that he could drive himself over at any time. "'I shall go now,' he said to Mr. Wharton, because I have promised John to fish with him to-morrow, but I shall come over on Monday or Tuesday and stay till I go back to town. I hope she will at any rate let me speak to her.' The father said he would do his best, but that that obstinate resumption of her weeds on her brother's very wedding-day had nearly broken his heart. When the Fletchers were back at long-barns the two ladies were very severe on her. "'It was downright obstinacy,' said the squire's wife, and it almost makes me think it would serve her right to leave her as she is. "'It's pride,' said the old lady. She won't give way. I said ever so much to her, but it's no use. I feel it the more because we have all gone so much out of the way to be good to her after she had made such a fool of herself. If it goes on much longer I shall never forgive her again. "'You'll have to forgive her,' mother said her eldest son, let her sins be what they may, or else you'll have to quarrel with Arthur.' "'I do think it's very hard,' said the old lady, taking herself out of the room. And it was hard. The offence in the first instance had been very great, and the forgiveness very difficult. But Mrs. Fletcher had lived long enough to know that when sons are thoroughly respectable a widowed mother has to do their bidding. Emily, through the whole wedding-day and the next day and day after day, remembered Mrs. Fletcher's words. There are some who will never be light-hearted again till they see you smile. And the old woman had named her dearest friends and had ended by naming Arthur Fletcher. She had then acknowledged to herself that it was her duty to smile in order that others might smile also. But how is one to smile with a heavy heart? Should one smile and lie? And how long and to what good purpose could such forced contentment last? She had marred her whole life. In former days she had been proud of all her virgin glories, proud of her intellect, proud of her beauty, proud of that obeisance which beauty, birth, and intellect combined exact from all comers. She had been ambitious as to her future life, had intended to be careful not to surrender herself to some empty fool, had thought herself well qualified to pick her own steps. And this had come of it. They told her that she might still make everything right, annul the past, and begin the world again as fresh as ever, if she would only smile and study to forget. Do it for the sake of others, they said, and then it will be done for yourself also. But she could not conquer the past. The fire and water of repentance, adequate as they may be for eternity, cannot burn out or wash away the remorse of this life. They scorch and choke, and unless it be so, there is no repentance. So she told herself, and yet it was her duty to be light-hearted that others around her might not be made miserable by her sorrow. If she could be in truth light-hearted, then she would know herself to be unfeeling and worthless. On the third day after the marriage, Arthur Fletcher came back to Wharton with a declared intention of remaining there till the end of the holidays. She could make no objection to such an arrangement, nor could she hasten her own return to London. That had been fixed before her departure, and was to be made together with her father. She felt that she was being attacked with unfair weapons, and that undue advantage was taken of the sacrifice which she had made for her brother's sake. And yet, yet how good to her they all were! How wonderful was it that after the things she had done, after the disgrace she had brought on herself and them, after the destruction of all that pride which had once been hers, they should still wish to have her among them. As for him, of whom she was always thinking, of what nature must be his love when he was willing to take to himself as his wife such a thing as she had made herself. But thinking of this, she would only tell herself that as he would not protect himself, she was bound to be his protector. Yes, she would protect him, though she could dream of a world of joy that might be hers if she could dare to do as he would ask her. He caught her at last and forced her to come out with him into the grounds. He could tell his tale better as he walked by her side than sitting restlessly on a chair or moving awkwardly about the room as on such an occasion he would be sure to do. Within four walls she would have some advantage over him. She could sit still and be dignified in her stillness, but in the open air when they would both be on their legs she might not be so powerful with him, and he perhaps might be stronger with her. She could not refuse him when he asked her to walk with him, and why should she refuse him?  I think the marriage went off very well, he said. Very well, Everett ought to be a happy man. No doubt he will be when he settles down to something. Everything will come right for him. With some people things seem to go smooth, don't they? They have not hitherto gone smoothly with you and me, Emily. You are prosperous. You have everything before you that a man can wish if only you will allow yourself to think so.  It is all nothing. That is the general discontent of the world. It is all nothing unless I have you too. Remember that I had said so long before I was successful when I did not dream of Parliament, before we had heard the name of the man who came between me and my happiness. I think I am entitled to be believed when I say so. I think I know my own mind. There are many men who would have been changed by the episode of such a marriage. You ought to have been changed by it and by its result. It had no such effect. Here I am, after it all, telling you as I used to tell you before that I have to look to you for my happiness. You should be ashamed to confess it, Arthur. Never, not to you nor to all the world. I know what it has been. I know you are not now as you were then. You have been his wife and are now his widow. That should be enough.  If it were not so, do you think that all my family as well as yours would join in wishing that you may become my wife? There is nothing to conceal. When you married that man, you know what my mother thought of it and what John thought of it and his wife. They had wanted you to be my wife, and they want it now, because they are anxious for my happiness. And your father wishes it and your brother wishes it, because they trust me and think that I should be a good husband to you. Good, she exclaimed, hardly knowing what she meant by repeating the word. After that you have no right to set yourself up to judge what may be best for my happiness. They who know how to judge are all united. Whatever you may have been, they believe that it will be good for me that you should now be my wife. After that you must talk about me no longer unless you will talk of my wishes. Do you think I am not anxious for your happiness? I do not know, but I shall find out in time. That is what I have to say about myself. And as to you, is it not much the same? I know you love me. Whatever the feeling was that overcame you as to that other man, it has gone. I cannot now stop to be tender and soft in my words. The thing to be said is too serious to me.  There is not one among us all, Fletchers and Whartons, whose comfort does not more or less depend on your sacrificing the luxury of your own woe. Luxury? Yes, luxury. No man ever had a right to say more positively to a woman that it was her duty to marry him than I have to you. And I do say it. I say it on behalf of all of us, that it is your duty. I won't talk of my own love now, because you know it. You cannot doubt it. I won't even talk of yours, because I am sure of it. But I say that it is your duty to give up drowning us all in tears, burying us in desolation. You are one of us and should do as all of us wish you. If indeed you could not love me, it would be different. There, I have said what I've got to say. You are crying and I will not take your answer now. I will come to you again tomorrow, and then you shall answer me. But remember when you do so that the happiness of many people depends on what you say. Then he left her very suddenly and hurried back to the house by himself. He had been very rough with her, had not once attempted to touch her hand or even her arm, had spoken no soft word to her, speaking of his own love as a thing too certain to need further words. And he had declared himself to be so assured of her love that there was no favour for him now to ask, nothing for him which he was bound to pray as a lover. All that was past. He had simply declared it to be her duty to marry him, and had told her so with much sternness. He had walked fast, compelling her to accompany him, had frowned at her, and had more than once stamped his foot upon the ground. During the whole interview she had been so near to weeping that she could hardly speak. Once or twice she had almost thought him to be cruel, but he had forced her to acknowledge to herself that all that he had said was true and unanswerable. Had he pressed her for an answer at the moment she would not have known in what words to couch a refusal. And yet as she made her way alone back to the house she assured herself that she would have refused. He had given her four and twenty hours, and at the end of that time she would be bound to give him her answer, an answer which must then be final. And as she said this to herself she found that she was admitting a doubt. She hardly knew how not to doubt, knowing as she did that all whom she loved were on one side, while on the other was nothing but the stubbornness of her own convictions. But still the conviction was left to her. Over and over again she declared to herself that it was not fit, meaning thereby to assure herself that a higher duty even than that which she owed to her friends demanded from her that she should be true to her convictions. She met him that day at dinner, but he hardly spoke to her. They sat together in the same room during the evening, but she hardly once heard his voice. It seemed to her that he avoided even looking at her. When they separated for the night he parted from her almost as though they had been strangers. Surely he was angry with her because she was stubborn, thought evil of her because she would not do as others wished her. She lay awake during the long night thinking of it all. If it might be so—oh, if it might be so—if it might be done without utter ruin to her own self-respect as a woman. In the morning she was down early, not having anything to say, with no clear purpose as yet before her, but still with a feeling that perhaps that morning might alter all things for her. He was the latest of the party, not coming in for prayers as did all the others, but taking his seat when the others had half finished their breakfast. As he sat down he gave a general half-uttered greeting to them all, but spoke no special word to any of them. It chanced that his seat was next to hers, but to her he did not address himself at all. Then the meal was over and the chairs were withdrawn and the party grouped itself about with vague, uncertain movements as men and women do before they leave the breakfast table for the work of the day. She meditated her escape, but felt that she could not leave the room before Lady Wharton or Mrs. Fletcher, who had remained at Wharton to keep her mother company for a while. At last they went, but then, just as she was escaping, he put his hand upon her and reminded her of her appointment. I shall be in the hall in a quarter of an hour, he said. Will you meet me there? Then she bowed her head to him and passed on. She was there at the time named and found him standing by the hall door waiting for her. His hat was already on his head and his back was almost turned to her. He opened the door and allowing her to pass out first led the way to the shrubbery. He did not speak to her till he had closed behind her the little iron gate which separated the walk from the garden and then he turned upon her with one word. Well, he said. She was silent for a moment and then he repeated his eager question. Well, well? I should disgrace you, she said, not as firmly as before but whispering the words. He waited for no other ascent. The form of the words told him that he had won the day. In a moment his arms were round her and her veil was off and his lips were pressed to hers and when she could see his countenance the whole form of his face was altered to her. It was bright as it used to be bright in old days and he was smiling on her as he used to smile. My own, he said, my wife, my own. And she had no longer the power to deny him. Not yet, Arthur, not yet, was all that she could say. End of chapter 79. CHAPTER 80 THE LAST MEETING AT MATCHING The ex-prime minister did not carry out his purpose of leaving London in the middle of the season and travelling either to Italy or Norway. He was away from London at Whitsun Tide, longer perhaps than he might have been if still in office, and during this period regarded himself as a man from whose hands all work had been taken, as one who had been found unfit to carry any longer a burden serviceably. But before June was over he and the Duchess were back in London and gradually he allowed himself to open his mouth on this or that subject in the House of Lords, not pitching into everybody all round as his wife had recommended, but expressing an opinion now and again, generally in support of his friends, with the dignity which should belong to a retired prime minister. The Duchess too recovered much of her good temper, as far at least as the outward show went. One or two who knew her, especially Mrs. Finn, were aware that her hatred and her ideas of revenge were not laid aside, but she went on from day to day, anathematizing her special enemies, and abstained from reproaching her husband for his pusillanimity. Then came the question as to the autumn. Let's have everybody down at Gatherham just as we had before, said the Duchess. The proposition almost took away the Duke's breath. Why do you want a crowd like that? Just to show them that we are not beaten because we are turned out. But in as much as we were turned out we were beaten, and what has a gathering of people at my private house to do with a political maneuver? Do you especially want to go to Gatherham?  Then why should you propose to go there? He hardly yet knew his wife well enough to understand that the suggestion had been a joke. If you don't wish to go abroad, I hate going abroad. Then we'll remain at matching, you don't hate matching. Ah, dear, there are memories there too, but you like it. My books are there. Blue books, said the Duchess. And there is plenty of room if you wish to have friends. I suppose we must have somebody. You can't live without your mentor. You can ask whom you please, he said almost fretfully. Lady Rosina, of course, suggested the Duchess. Then he turned to the papers before him and wouldn't say another word. The matter ended in a party much as usual being collected at matching about the middle of October, Telemachus having spent the early part of the autumn with Mentor at Long Royston. There might perhaps be a dozen guests in the house, and among them, of course, were Phineas Finn and his wife. And Mr. Gray was there, having come back from his Eastern mission, whose unfortunate abandonment of his seat at Silverbridge had caused so many troubles. And Mrs. Gray, who in days now long past had been almost as necessary to Lady Glen Cora as was now her later friend Mrs. Finn. And the cantrops, and for a short time the St. Bungays. But Lady Rosina de Corsi on this occasion was not present. There were few there whom my patient readers have not seen at matching before, but among those few was Arthur Fletcher. So it is to be, said the Duchess to the member for Silverbridge one morning. She had by this time become intimate with her member as she would sometimes call him in joke, and had concerned herself much as to his matrimonial prospects. Yes, Duchess, it is to be, unless some unforeseen circumstance should arise. What circumstance? Ladies and gentlemen, sometimes do change their minds, but in this case I do not think it likely. And why ain't you being married now, Mr. Fletcher? We have agreed to postpone it till next year, so that we may be quite sure of our own minds. I know you are laughing at me, but nevertheless I am very glad that it is settled. Pray tell her for me that I shall call again as soon as ever she is Mrs. Fletcher, though I don't think she repaid either of the last two visits I made her. You must make excuses for her, Duchess. Of course, I know. After all she is a most fortunate woman, and as for you I regard you as a hero among lovers. I'm getting used to it, she said one day to Mrs. Finn. Of course you'll get used to it. We get used to anything that chants sends us in a marvelously short time. What I mean is that I can go to bed and sleep and get up and eat my meals without missing the sound of the trumpet so much as I did at first. I remember hearing of people who lived in a mill and couldn't sleep when the mill stopped. It was like that with me when our mill stopped at first. I had got myself so used to the excitement of it that I could hardly live without it. You might have all the excitement still, if you pleased. You need not be dead to politics because your husband is not Prime Minister. No, never again, unless he should come back. If anyone had told me ten years ago that I should have taken an interest in this or that man being in government I should have laughed him to scorn. It did not seem possible to me then that I should care what became of such men as Sir Timothy Beeswax and Mr. Roby. But I did get to be anxious about it when Plantagenet was shifted from one office to another. Of course you did. Do you think I am not anxious about Phineas? But when he became Prime Minister I gave myself up to it all together. I shall never forget what I felt when he came to me and told me that perhaps it might be so, but told me also that he would escape from it if it were possible. I was the Lady Macbeth of the occasion all over, whereas he was so scrupulous, so burdened with conscience. As for me I would have taken it by any means. Then it was that the old Duke played the part of the three witches to a nicety.  Nor need you be afraid, though all the woods of Gatheram should come to matching. God forbid I will never see anything of Gatheram again. What annoys me most is, and always was, that he wouldn't understand what I felt about it, how proud I was that he should be Prime Minister, how anxious that he should be great and noble in his office, how I worked for him, and not at all for any pleasure of my own. I think he did feel it. No, not as I did. At last he liked the power, or rather feared the disgrace of losing it, but he had no idea of the personal grandeur of the place. He never understood that to be Prime Minister in England is as much as to be an emperor in France, and much more than being President in America. Oh, how I did labour for him, and how he did scold me for it with those quiet little stinging words of his. I was vulgar. Is that a quiet word?  I bore it all though sometimes I was dying with vexation. Now it's all over, and here we are as humdrum as anyone else. And the beeswaxes and the robes and the droughts and the poutneys and the lopeses have all passed over the scene. Do you remember that poutney affair and how he turned the poor man out of the house? It served him right. It would have served them all right to be turned out, only they were there for a purpose. I did like it in a way, and it makes me sad to think that the feeling can never come again. Even if they should have him back again, it would be a very lame affair to me then. I can never again rouse myself to the effort of preparing food and lodging for half the Parliament and their wives. I shall never again think that I can help to rule England by coaxing unpleasant men. It is done and gone and can never come back again. Not long after this the Duke took Mr. Monk, who had come down to matching for a few days, out to the very spot on which he had sat when he indulged himself in lecturing Phineas Finn on conservatism and liberalism generally, and then asked the Chancellor of the Exchequer what he thought of the present state of public affairs. He himself had supported Mr. Gresham's government and did not belong to it because he could not at present reconcile himself to filling any office. Mr. Monk did not scruple to say that in his opinion the present legitimate division of parties was preferable to the coalition which had existed for three years.


Hey, what's up YouTube? It's your boy Zeta CryptoMiner and today I'm gonna bring you a video on how much money Do you need exactly are close to in order to have to make? $100,000 every year from your dividends by the time you retire All right, so YouTube now that we're here, how much money do you need exactly? How much money will you make off your investments if you invest every single month into a Dividends account and how much do you need to make that $100,000 per year? But before we get into that, let's just say you have a dividend account that grows that yields You know, there's some accounts that use 12% there's some accounts that use a little bit as 2.5% But let's just take a AT&T for example that one yields around 7% so let's just go beneath that it's it's kind of easy to build an account that yields 6% Actually, it's not that easy It's kind of tough to build a good account that yields around 6% But it's very doable. It started getting dangerous around the 8 to 12% yield And very conservative for an under so let's just say um a 6% account that you yield 6% dividends on a hundred that up to make $100,000. So in order to make that $100,000 You will put in $100,000 and divide that by 0.06 All right, so you need 1.6 million so 1.6666 million dollars in order to Yield $100,000 in that single year you would need 1.6 million dollars in your account All right, but before we go into calculating Exactly, how much you need to invest every single month? Let's look at how you should calculate. All right, if we go over to seeking alpha The dividend in dividends there are companies that increase their dividends over time and This shows the dividend increase percentage over the years versus the inflation inflation rate of the US dollar Okay, so we scroll all the way down This is how much Over the last 51 years the average is that the dividend yields increase over 5.4% in the stock market This is the average over the last 51 years for so that is a lot of data is just not the last 10 15 years It's the last 51 years so 5.4 in the inflation rate is 4.1 So your dividend yield does outperform the inflation rate of the US dollar So it's 5.4 to 4.1 So you don't have to worry about if I invest a thousand dollars today, but at five with that one thousand dollars be worthless 40 years from now Due to the inflation rate no because your dividend yield does outperform the inflation rate of the US dollar And this is the average is over the last 51 years So I think you'll be doing all right if you invest into the stock market You're not throwing your money down the drain as long as you're making money in your investments All right, so if we're looking at exactly how to calculate this if we go over to the street And let's look at the SP 500 right over the last 20 years The SP 500 has returned a 7.2 percent a year after adding adjusting adjusting for inflation If you only measure the price and change that did not include dividends All right, the SP 500 has a return of 5.2 over the same period All right, if you do if you do not include dividends payments and your analysis You're missing out on 27 point eight percent of the real total return of the SP 500 I saw the stock market has a average of increasing of seven percent a year But that's not including the dividends if you include the dividends. So let's say a 10 t goes up Three percent, but they have a seven percent you you would actually have that seven percent plus the three percent of the Growth of that company add it on so it'll be around 1010 percent. All right, so we take a look they have a great example here about Pepsi Coke Pepsi Coke expected learn time growth of 6.3 percent and the current dividend yield is 2.7 percent, all right, so over the last 20 20 us 10 years over the last 10 years Pepsi Coke has grown 6.3 percent every single year. So the last 10 years Pepsi Coke has grown 6.3 percent every single year and It's current dividend is 2.7 percent. So Your growth of the stock is 6.3 is 6.3 All right, here we go your growth of the stock is 6.3 But you also have a dividend yield of 2.7 percent So your expected return total return is nine percent, okay? So that's how you calculate it So you actually add the growth of the stock market average is seven percent But if you have a dividends account, you have to add in your dividend yield to that growth of the market Because we're going to reinvest that we're not going to pull out our dividend We're going to reinvest our dividends every single month every single quarter We're going to reinvest our dividends. All right, so let's go over to a financial calculator and set our goals for retiring and We said that we needed 1.666666 alright, and Let's say the average rate of the market is seven percent. That's it's been calculated Okay, but let's just say the market slows down for the next 40 years and only have an average return and your return rate of 6% but let's say you have a a dividend account That's not averaging. That's not yielding six percent, but let's just say four percent So all right, so you have your yield of your dividend account is four percent and the average of the and your return rate of your Stocks is six percent. So that will put you at a ten percent And you with ten that will put you at a ten percent right there and your return rate and let's hit calculate All right, there it goes. Yes, so if you're 25 years old you would need to save $314 Every single month to retire at the age of 65 if you're 30 See, I'm under 30 so I could save up to five hundred and twelve dollars every single month with the annual return rate of The stock market have been six percent and I have a dividend yield account that averages four percent So ten percent annual return rate at the age of 30. I will need to save $512 every single month until the age of 65 and when I retire at the age of 65 I should have around 1.6 million dollars in my Robin Hood account and I would be collecting a hundred thousand dollars worth of Dividends in a single year if you're 35 844 dollars a month once you start It's best to start investing early the earlier in the vest earlier that you invest the better and the longer that you wait It's gonna be very very tough to catch up. It's just at the age of 40 You have to save one thousand four hundred dollars a month at the age of 45. You have to save two thousand four hundred and 25 dollars a month in at the age of fifty four thousand dollars three hundred and seventy one dollars a month and If you're star seven get the age of 55 and once you retire at the age of 65 you need to save 8,700 and fifteen dollars a month so If I'm looking at my YouTube algorithm a lot of you guys fit in between the well, it's some 28 you got 20 year old so between the ages of 25 and 40 and if you're 25 Save and invest your 40 I know that number is a lot harder to do to save in a vest one thousand four hundred and twelve dollars a month But you could just do half that in order to Have a dividend yield where you're averaging fifty thousand dollars a month. That is still great You can live off of fifty thousand dollars a month in Texas Maybe not in New York, maybe not in California or in Miami But definitely in Texas and you can have a grand retirement Live laid up on the beach knowing that you're gonna have money coming in every single month But yeah guys, I just wanted to show you how to calculate your annual yield plus your dividend yield and how much money you need to save around every single month in order to Retire off your dividends account and the good thing about dividends account guys is that you're gonna be collecting the hundred thousand dollars But you could also reinvest that and if you reinvest that and pass that on to your children And then your children pass that on to your grandchildren by the time your grandchildren get your dividend portfolio There'll be they're gonna be filthy rich again kids are never gonna have to work a day in their life They don't want to and Bring again by the time your grandchildren bring this and your kids don't mess this up Your grandchildren could be bringing in five hundred thousand dollars a month off your dividends account that you started And that's a great way the that they can remember you and won't ever forget about you But yeah guys, I'm just showing you a quick and easy way on how to calculate this Go ahead down in the comments sections and let me know if you use Robin Hood and if you're and how much money Are you investing into your Robin Hood account? Right now and how old are you if you haven't signed up for Robin Hood yet? The link is down in the description go ahead and leave that thumbs up button and I'm trying to get out more videos every single week It's really tough. I'm really trying to challenge myself to get out three videos a week right now I'm around two videos a week. So I'm gonna What's today? I'm going to try to drop one in two days or so, but yeah other than that This is your boys eat the crypto man, and I'm out


Welcome everybody to my talk. Thanks for coming. Hope everyone's having a good conference. I know I am. Is everybody learning a lot? Excellent. I try to live a few minutes when I do talks because I learn so much in conferences. I want to talk about the stuff I'm learning and other people's talks more than what I came to talk about. So if I get on a side note about something that I heard the last talk, that was phenomenal. But anyway, I hope you guys get a lot out of my talk today. Before I say anything else, let me get this disclaimer out of the way. I work for the US Naval Research Laboratory. But my talk today is my opinions based on my professional experience and my personal experience. My opinions don't represent those of the US Navy, the US government, anything like that. As a matter of fact, if you do any research, you'll probably find that there's a lot of people in the government who disagree with me on a lot of things. Also, another disclaimer. I say we a lot when I talk because I have a really close-knit team, and it's an awesome team. And we argue about stuff we don't always agree. But when I say we, I'm not talking about Big Brother or all the developers I work with. I'm just kind of subconsciously referring to the fact that we try to make as many decisions as we can as a team. So I apologize in advance when I say we. So enough about that. A little bit about me. I consider myself a good programmer. Not a great programmer, but a good programmer. And I like to keep things simple. I study martial art called Akito. And in Akito, we have a lot of sayings. And one of the sayings we have is that advanced technique is just a simple technique done better. And I like to apply that not just in martial arts, but in all aspects of my life. And programming is no exception. So everything I do, everything I talk about, the underlying theme is keep things as simple as you possibly can. So just a little bit about this Naval Research Lab thing. It was started in 1923 by Congress by the recommendation of this guy, Thomas Edison, who said we needed a Naval Research Lab. And so we have one. And the group I work in, the systems group, has come up with some pretty cool technology you may have used. Most notably, the Onion Router Tour came out of NRL. And a lot of the foundational technologies and virtual private networkings were developed by Kathy Meadows and Rayn Adkinson, or two doctors at NRL. The Vanguard Space Satellite Program came out of NRL, which was America's first satellite program. Of course, Sputnik was first out of the Soviet Union. And there's a great paper from 1905 called The Reasoning About Security Models. It was written by Dr. John McClain, who's my boss's boss's boss's boss's boss's boss. But anyway, it's a great paper. It talks about system Z. And if you're into academics, it's a really cool theory about security. So all that said, my talk is not about anything military-related. It's not academia. It's not buzzword bingo. I had a really cool buzzword bingo slide, but I took it out because CC's was way better. So anyway, what am I going to be talking about? Well, I want to spend some time unpacking what I mean by security critical, like we just heard in the last talk. People throw phrases around. And it means different things to different people. So I want to unpack what I mean by it. Sorry about that. I also want to work through a use case. Now, this use case isn't an actual use case, but it's kind of a composite of experiences I've had. So it bothers from systems I've worked on and developed in, but it's not actually representative of any system we've ever built. But the main reason I'm here is this last point. Next steps. We've got a lot of initiatives we are interested in pursuing to improve our ability to use Ruby in security critical applications. And some of them we know how to do well. Others we have an idea how we do it, but we probably wouldn't do it well. And others we know we can't do. And so if anything you see on my next step slides rings a bell with you, please come talk to me after the talk because we're interested in getting help from people who want to do cool stuff with security in Ruby. So anyway, there's a great talk that I saw that influenced my thinking about this subject with Ruby. Back in 2012 I was at a conference called Software Craftsmanship North America. I really recommend you go sometime if you have, and it's a great conference. But Uncle Bob had gave this talk called Reasonable Expectations of a CTO. You probably haven't seen it. It's on Vimeo. If you haven't seen it, look it up. I'm not going to summarize it for you, but watch it. And as you watch it, just add security to the list of problems that systems have. It's very applicable to the security problem as well. And it rings even more true today than when he gave the talk in 2012. So when we talk about computer security, one of the things we talk about a lot is assurance. And assurance, usually as a verb, is something that I do to assure you that everything is going to be OK, that there's no problem. Well, when I talk about assurance, I'm not talking about telling you everything is going to be OK. Because what's the first thing you think when I tell you everything's going to be OK? Something's wrong. So I don't want to assure you of anything. What I want to do is talk about giving you assurances that allow you to make a decision of your own. And even if you don't like the assurances that you get when you do a security analysis on something, at least you know where you stand. And that's really useful. So when I talk about assurances, I'm not trying to tell you everything's going to be OK. I'm talking about evidence. We've all seen this chart before. And whether you're trying to make money or make the world a better place or solve a security problem, this chart is not avoidable to my knowledge. And when we go about solving a security problem, we bump into it too. And we look at it and go, well, we got a few choices. We can do something really clever that's going to outsmart the attackers. We could go buy a really cool library that's going to provide us all this super awesome security and solve all our problems. Or we could hire some outside consultant who's going to assure us that everything is going to be OK. Well, don't do any of that. Because attackers are really, really clever. They're more clever than me, they're more clever than you. And what's more is there's lots of them, and they have lots of time. You build a feature, it's onto the next feature.  But we're going to make mistakes in our code.  They're going to be bugs. They're going to be security bugs. So I'm going to talk about what we can do to defend ourselves. A key point I want to make today is that a security critical system should have the right security controls and the right places and with the right assurances. Say that again, a security critical system should have the right security controls and the right places and with the right assurances. Now, I like to do that with architecture. We construct architecture. And a lot of times when we're building code, the principles that make code awesome are the same principles that make code secure. We want to reduce complexity. We want to localize functionality. We want to improve test coverage, things like that. But also, we want to make sure we have the right controls and the right places. A firewall at the front door is going to keep bad guys out. Just like a guy with a gun in your server room isn't going to keep hackers out of your server. So you've got to not only consider architecture of your code and design and test coverage, but you also need to think about what controls you're using where and how, more specifically, we layer those controls in our system. So some of these acronyms, you may not recognize. I'll explain them later. But these are really the security control layers that you should consider at a minimum in your application. You have your operating system. You have your security framework. And then you have your application framework. And these are what we're going to layer in our assurances. But what are these assurances? Are they something squishy that we can't measure? Well, kind of. But we do have the ability to talk about them in a semi-structured way. And I like to talk about them in terms of this neat principle. And neat stands for non-bibpassable, evaluatable, always invoked, and tamper evident. And so your security controls, the more you can measure and answer these questions, nodding your head instead of shaking your head, the more security you're going to have in your controls. So I just want to go through these real quick. And non-bibpassable is pretty easy to describe. If you've got a circuit breaker, it keeps your electronics from getting fried because of too much electricity is going over the wire. It's going to trip the breaker and keep the electricity from flowing. But if there's a wire going around the circuit breaker, going directly from the power grid to your laptop, it's not going to do you any good, even if it does trip because you're going to get fried. So for a good security control to work, it has to be only way from point A to point B. Evaluatable is a little harder to talk about. There's a lot of things like symbolic execution engines and static analysis tools that we can use to measure and evaluate code security. But for most of you here, I think a great thing to do if you haven't done it is follow the instructions on the screen. And you can get a good idea of how readable, how evaluatable your code is if your score is, say, less than 20. The lower the better, but if it's code that needs to be really secured, you should definitely be below 20. So keeping things small, reducing branches, not using things like eval or call are good things to do. When you're in a piece of code, you consider security enforcing in your application. Always invoked. I think the HTML sanitizer and action view is a great example. When it first came out, it was something you could call if you wanted, but you could also forget to call really easily. At some point, they brought it into action view, I think, and made it default so you had to not call it. I haven't used Rails in a while. I'm one of those weird Ruby people that doesn't use Rails very much, but this is a C example, actually.  It's a learning experience for all of us, and we all get a good laugh out of it. But type this in and see what your compiler says to you. And then tamper evident. This is another one that's a little tricky to describe. But this guy here, he's a coal miner, and he's got a little canary with him. And back in the day, coal miners used to bring these canaries into the coal mine with them because when toxic gas leaked out of the rocks, it would kill the canary well before it would kill them. And while it's kind of gruesome to think about, it was a good way for this guy to get home to his family with the technology he had. We do something similar in binaries every day. We put these little cookies on the stack, and so if there's a buffer overrun in your application, the A's, the not slide, whatever it is, is going to crush that cookie if the attacker is not careful, and we can exit the program safely. It's a way over simplification, and it's not bulletproof, but if you're interested in more, I've got a little link on my slide here. And if you just type stack canaries or stack snap smashing protection, you can learn a lot more about ways we protect binaries. So I've got my checklist. I've got some controls I want to talk about today, and I've got some assurances I want to apply to those controls and see how we're doing. So we're going to use this checklist as we go through the rest of this brief. Like I said, the use cases I'm going through, it's one example in three parts, and it's not a system I've actually built. It's little pieces here and there from different projects I've worked on that I think represent good explanations of these security principles. So at the base of your system is your operating system controls. No matter how secure your code is, if your operating system is not configured properly, you're screwed. And the main security feature in your operating system is access control. Have the right security control. Does security geeky talk about mandatory access controls? And it can get complex, but they're actually pretty simple. It just means something that the administrator sets up at boot and it can't be changed. So the neat thing about mandatory access controls is they're nice and reliable. They don't change. They also have a really pretty static code base supporting them because they're not changing. They get set at boot and they don't change, so it's easy to make sure that code works well. So at the base of your application, of your system, it's good to use your operating system's access control mechanisms, preferably in a mandatory way as opposed to a discretionary way. It keeps your system simple. So a use case might be you've got multiple databases and you wanna be really sure that people on different networks can only read from the database that they're authorized for and you wanna be really, really careful about what gets into those databases. Maybe, I don't know, all sorts of examples of why we'd wanna do that. But rather than trusting our code that does the very best it can to make sure there's no SQL in our posts, we basically give our applications read-only access to some of these databases. And that way, no matter how bad our network application is, there's no way it's going to be able to read from the databases it's not allowed to see. And it's not gonna be able to write to any of the databases. And then we simply implement a piece of glue, a little router, and we can do that very securely. And all it does is make sure that the right requests go to the right places. And with this way, we can ensure that our information flows are set up in a very secure manner. Let's validate that. And so the fact that these databases have read-only and permissions, they're basically gonna have to own your box to get around that. So you have reasonable assurance that to write, it's gonna have to go through the dataflow pipeline I've created. Evaluatable, well the security critical piece of code here is just the simple little router that takes right requests into the database owners. So I can keep that pretty small, pretty evaluatable and I can use a type safe language like Rust or something like that. Always invoked. Every single file system call you make has to go through the kernel. That's pretty reliably always invoked. And then I try to come up with a good example for tamper evident. Making sure your operating system isn't being tampered with is kind of outside the scope of this talk. So if you're interested, let me know. But I skipped it because I didn't wanna bore you all to death with it. So, some takeaways. Use access control mechanisms in the operating system if you can and then wrap them directly into your application maybe say with FFI.  You don't wanna do that. So do your day to day development with a stub. We ended up in a situation where we had a third party that was gonna help us write our application and we needed to get their help and they didn't have our Mac infrastructure so we just gave them this stub. They wrote a really cool app that we couldn't write and then they sent us back the code and it was relatively easy for us to take the stub out and integrate the code in with their application. And then finally, it's only mandatory access control if the application doesn't have the ability to change the policy. So if you can avoid giving your application system privileges. If you look at stage fright and Android it's a really cool library. It does lots of awesome stuff. I could have never written it and I don't blame them the least for making a small little mistake. It's inevitable. But if they wouldn't have had system privileges on it and maybe they had to, I don't know, I haven't researched it that well. But it wouldn't have been as catastrophic as it was had it only had user privileges. So think, I'm not saying never give your software system privileges but think really hard about it because if you make a mistake it's no longer your box, it's their box. So some of the things we wanna do is make it easier to make test devils for our file system objects because we use the operating system so much in security. I've talked to some of the guys from test double and I don't know if it's such a good idea but it's something we've been playing with and if you wanna convince me it's a bad idea or you wanna help let me know. The other thing is is like I said we're looking at using Rust more for our type safe security critical code and or our performance critical code and everything I've learned about Rust Ruby integration I learned from this blog entry I have here. I'm not very good at it. So if there's more resources that any of you know of please let me know. Huh? Good to know. So moving on through the layers of the onion of our use case is what I'm calling our services security framework and I didn't have a really good name for this but basically if we're gonna separate our application into a bunch of processes we're gonna have to integrate them together in some way and those integration points are great places for attackers to break your system. Things like inter process communication or database access. These are great places where attackers are able to get in and do things like CSRF internationalization attacks, equal injection and it's a lot of time hard for us to get our paying customers to understand the sorts of things that can happen if we don't do a really good job with this and I don't know, have any of you guys ever read Ender Shadow? I know a lot of people have read Ender's game but Ender Shadow is a little less well read. There's a great scene in there where Bean's talking to his boss and he basically points out that as your attack surface grows defense becomes impossible and with these sorts of systems that we're building our attack surface is growing. Fortunately not as big as the scope of the aliens in Ender's game and Ender's Shadow but it's so it's not hopeless but it's bad and I don't have enough confidence in my ability and my team's ability even though we've been doing this for a long time to cover every nook and cranny such that our code can't be changed in 10 years to allow this stuff through. So we stick with this principle of separate, isolate and integrate and essentially what we're trying to do is every time a process component that's been separated ingests data, it uses some sort of domain specific language to enforce the security policies such that it's protected and then when it brings data, sends data out it also tries to protect the data and protect the next process. So that doesn't make much sense. I tried to come up with a better way to explain it but I think I'm just gonna have to use an example. So let's take a really, really oversimplified example and say that we wanna make sure that no semicolons make it into storage. Now there's a lot of web attacks that require semicolons and so I'm not saying you wanna do this or not but it might be a useful way to, it might be a useful policy to use in trying to protect a lot of web attacks. And the example I'm about to give does not take into account internationalization considerations so don't just use it internationalization is important for apps but it's also important for security so just wanted to throw that in there keep internationalization in mind when you're building your app especially with regard to how it impacts security. So let's look at some of this application layer pre and post processing we do. What's this code doing? Well it's not entirely clear it looks like it's doing some sort of escaping to turn the semicolons into something else because the semicolons might be natural and then it's doing some sort of resolution to make sure that the semicolon escape key doesn't show up in there and then it sends it off and then when it goes to render the data it goes to resolve it back to what it was and do I trust this code? Kind of but it's also kind of ugly and this is just one policy imagine an application with five or 600 policies that you have to apply this is gonna get kind of ugly. Let's look at the other side, the storage side I trust this code a lot more. It's job is very simple it looks for semicolons there's not supposed to be any semicolons in the data that's there and what's more is if you look at line nine it doesn't trust the caller to check the return code before it moves on if code is security critical you don't wanna make sure and trust that the caller is gonna check the return code because maybe you're checking it now but maybe someone's gonna introduce a problem in two years that's gonna block the check so if it's actually security critical don't rely on the caller to check your return code handle it right there. Die might seem a little extreme but like I said the application was supposed to have gotten rid of all the semicolons so if there's a semicolon there either there's a horrible problem or another application or somebody's taken it over so this is an example of how you can do tamper evidence without using fancy things like stack canaries or anything like that. Ruby's really awesome at monkey patching code into classes so there's all sorts of ways you can trigger these hooks so that they automatically get called we learned about how refinements could even be used to make sure that these things got called at the last talk which was really cool and again the point of the check was very small the normalization of the data preparation for storage may have been complex but it allowed for a very simple check at the time of storage and that brings up a point that I wanna get to in just a minute but I wanted to talk about some other cool technologies that are related I don't know if any of you guys have used antler or parcel it or anything like that parsers are cool but it's always hard to figure out what to do with the parser once you've got that AST tools like antler and treetop and parcel it and others make it really easy to hook in behaviors in your code when the parser hits certain things so if you need to do content validation or content parsing you should take a look at those projects another really cool tool is checksec.sh it's literally just a bash script and it does analysis of your binaries to look for what sorts of exploit mitigations have been compiled into it we use this all the time and not only that if you go to their website there's all sorts of links about all the security wonk stuff and if you're interested you can just learn a tremendous amount about binary exploitation just following the links on that side and then POC or GTFO has anyone read POC or GTFO? Think of it as why the lucky stiff but for security geeks it's really funny sometimes it's hard to follow because it gets pretty technical but it's really funny and then finally the spanner.co.uk it's a really neat blog where he talks about ways he breaks web applications I haven't found any better than that one so anyway a couple things I don't know if any of you guys have ever worked with SE Linux or XAML but really complex policy languages that can do everything they're very powerful and they're very good and people do great things with them but I have trouble keeping all the state in my head when I'm trying to write policies so I try to keep things simple and use DSLs that are kind of custom oriented towards the problem I'm trying to solve I think that's a very ruby way to look at it and it's a good way to look at it the other thing is to keep those checks as simple as you can at enforcement not just for the evaluatable thing but there's this other class of bugs called time of check, time of use bugs they're kind of obscure but basically it means you do a check you do some other stuff and then you write to the database and it can change in the meantime they're really really hard to detect really good hackers are great at finding them and causing them to occur your unit tests will almost never run into them and if they do you'll just assume it was a glitch and skip them so if you keep your check simple you'll avoid this whole really really ugly class of security bug and then a really good example I have a link here there's a guy named Matt Honan who works for Wired Magazine in 2012 there was this terrible hack or a great hack depending on your perspective but they did a bunch of little things and then chained all of these hacks together so if you ever hear the argument well they'd have to break this and then they'd have to break this and then they'd have to break this well that happened to this guy and so these things do happen and it's a really interesting story so next steps we, if I can get it to so there was a talk that Tom Stewart gave in Barcelona 2014 called refactoring Ruby with Monads and I like the idea of Monads right now more than I like to practice because I'm not particularly good at them but I do believe that we can use Monads to wrap our content that we ingest from untrusted sources and ensure that they're properly validated before we store it there was a good talk on Hamster we've been looking at immutability also provides security properties not just performance and code quality so there's a lot of things we can do to improve the mechanization in our code to enforce that it's properly validated the other thing is we spend a lot of time writing security rule sets and it gets rather mundane if you take something like the SMTP specification it takes a tremendous amount of time and it's very boring to go through and write those so we're looking to build out our tool set to automatically generate our rule sets from those things and yeah anyway, enough on that so now we're to the part that affects most of you most of the time which is writing applications and unfortunately there's a lot of security decisions that have to be made in the app they can't happen at the services and integration layer they can't happen in the OS they are in the app and a great use case is XML I try to avoid XML when I can but sometimes it's unavoidable and XML processing is very complicated so how do we build a high assurance secure XML processor? well we don't it's really complex if you've looked at all of the different XML libraries out there some of them are really great but they are complex we're not possibly going to be able to get them to meet that evaluatable construct at the very least so how do we do it? well we use the same strategy I've been talking about the whole time we break our goal into smaller pieces and we separate them and then we integrate them with well understood mechanisms that the OS can enforce another thing we're introducing here is what I call binary diversity there's a lot of different forms of binary diversity it's a great new research area but the simple act of using different libraries for different functions makes attackers job much harder so if you can do the separation and use different libraries it gives you some level of protection again it's not bulletproof but it's very good and like Justin Searle was talking about by breaking down your functionality into smaller units it's easier to test them and this brings up another good point which is you can have really secure code but you might be using some library like Psyche that is a good library but it has some obscure vulnerability in the underlying C-native code and you're screwed when it breaks so these things are going to happen we can do all the code analysis we want but your application is going to break so make sure that you've got fault isolation built into your system so how are we doing with let's see and it's not okay there we go how do we do well we've got that great non-bipassable pipeline the only way to the data storage is through or the next step in the application is through my pipeline so we've got non-bipassability evaluatable we've got a big code base there's really nothing we can do except for do our best to keep our flog scores low make sure our unit test coverage is good we've got good pen testers whatever we want to do there's only so much we can do to evaluate our applications you can do a lot with Ruby to make sure that your code is always invoked for example if you're using Rails you could instrument your checks into As XML so that they're automatically called and those little brick walls I had in the last slide they weren't just for decoration there's a really cool tool called Set Comp that we use a lot and so Set Comp think of it as like a firewall for your operating system every time you go to read a file your process calls down into the operating system which turns that into a bunch of op codes and things that very few of us understand very well and there's a few of those we really all need but there's a bunch of them you should never be using in production like high performance instrumentation to see how you're doing at the microsecond level or P-trace which is used for GDB these are the system calls that you probably don't even know are there but the attackers sure do and that's where most of the kernel vulnerabilities lie so you can use tools like Set Comp to protect your application so that if there is a security failure it can't be used to attack the operating system as a whole even more controversially is this GR Security tool it's a patch and you have to apply the patch to recompile the operating system but it provides security controls that protect against classes of bugs it's very controversial in the Linux community but there was a really good article in the Washington Post on November 5th that gave a reasonable explanation of Spender's perspective with GR Security versus Linus's perspective so if you look it up in the Washington Post from November 5th it's great also if you're interested in the internet of things there's a lot of tools open embedded, Yachto but we really like BuildRoot in my shop BuildRoot's a great tool for building your own Linux distributions and it makes it really easy to select the things you want Ruby is provided in BuildRoot so some of the things we wanna do moving forward is we wanna make it easier for other people to use Set Comp I wanna build a gem that makes it easy for people to block the system calls that they're not going to need in production this will greatly reduce the attack surface of any application that uses this gem or uses Linux obviously it's not gonna work on Windows but it does provide real protection but it needs to be easier to use than it is certainly in the instance that I use in my day job again the importance of even in your application separating things into separate processes isolating and then integrating with assured security controls and just being relentless in making sure every little piece of code that you have is well tested is well designed so like I said I wanna do a better job of making Set Comp available to users and another really cool technology that's come out recently is this Robusta I don't know too much about it I've read the paper but I haven't actually downloaded and tried to use it but basically Robusta is a container that lives inside the Java virtual machine and if there's a security failure in a native extension, a Java native extension Robusta actually isolates it so they can't break out and take over your whole JVM which is kinda cool and if you look at most of the vulnerabilities that happen in Ruby it's usually not in Ruby itself it's in some sort of native extension that we all use and love it's some gem, it's buried we don't even know we're using it so this could be a real winner for a lot of people in the Ruby community another thing is, we like M-Ruby and we're trying to learn more about it unfortunately there's birds of a feather talk going on on M-Ruby right now that I couldn't go to which is kind of a bummer but M-Ruby allows us to put better weaponized sorry I shouldn't use words like that I work for the Navy the more robust security controls into your binaries to make it much, much harder for attackers to break them and like I said, when you learn about GCC and Clang there's all these little compiler flags you can use that make your binaries stronger and they're really, really awesome so I could put a picture of my cat up but I always like it when I see Zach and Corey's briefs I don't know if you've ever sat through when a Corey's talks but he's a great presenter and so this is kind of homage to him my picture of Zach and I'm a little ahead of schedule so I want to take a non sequitur very briefly into security penetration testing like I said, I do that sometimes when called upon it's not my primary duty but it is a duty that I do and there's a lot of mystery around penetration testing for people who don't work in this I don't know if anyone recognizes this picture but this is the little great in Helms Deep from Lord of the Rings that the bad guys brought the bomb and blew the whole thing up and the obvious example is that you don't want to have this little hole in your outer wall but there's another example that a lot of people don't know about the way castles are designed that outer wall is just designed to make it kind of a pin in the butt for people to get through it's not really a defensive mechanism it's just a way to make attacking much harder so when they stationed all put all their eggs and guarding that outer perimeter and the bad guys blew it up because it had a water drain that was really the mistake they made they should have been guarding the keep which had a two by two entrance that no matter how strong the orcs were they would have been coming to it too and they could have fought them all off but anyway enough geeking about security and sorry about that so I don't want to talk to you about whether you should buy penetration testing or not often as money will spend sometimes it's not but if you're going to buy penetration testing services give information to them if you make them find the information they will find it and it's just going to take them longer and maybe annoy them and so if you give them information you're going to get more value for your money and along those lines build relationships with your pen testers because you're going to write these things called rules of engagement like what they can and can't do well there's always ambiguity in that and the better relationship you guys have the more you're going to be able to work with them to have a more granular understanding of what those rules of engagement are and don't just test from the outside we know in the Ruby community intuitively that we write unit tests for all of our classes no matter how deeply embedded in their application or to the outside in fact a lot of times those core libraries that we rely on the most we put a lot of work into testing those if we make our pen testers come in from outside the firewall really they're testing your firewall much more than your app so that's not a bad place to start but maybe give them script console access and see if they can test if they can get around your access control mechanisms in your application so like I had those controls at the different layers have your pen testers do testing from different layers obviously not on your production network but you know in a lab or something like that so with that I want to thank you for coming to my talk I hope it was modestly entertaining a little link I have here Kim Cameron Seven Laws of Identity who's read that? Wow this was written in 2005 and it was a treatise on what the identity management software community should do to protect the rights of consumers I really recommend it it's very relevant today so it just seems to be coming up a lot in the talks so it's a good read, it's timeless so with that thank you for coming to my talk I have 10 minutes for questions if anybody has any questions oh so the question is what's my opinion on getting third party penetration testers coming in versus just doing your own automated vulnerability scanning well it depends on what your goals are and that's a really lame answer and I'm sorry for giving it but I have to but I would recommend using an automated just like you have Travis or Team City we use Team City in my shop just like you do continuous integration you should have pretty regularly someone point an automated vulnerability scanner against your application both in production in the lab it's just it makes sense the cool thing about pen testers is they're humans they're not automated tools and if you get ones that know what they're doing they'll know what to look for that's not in that tool suite but a lot of times the usual suspects are the problem and you can get a lot of mileage just out of using automated tools yourself that answer the question well that's a really good point so the question if I got it right and jump up and down if I didn't is that now I'm using two libraries instead of one and the attack surface just got a lot bigger and a way of thinking absolutely it's true but if you look at the example that I gave all Rex and L was doing was checking for well formateness so it was doing a very specific purpose and we evaluated that Rex and L was going to do it well whereas no kagiri could assume up front that it was already well formed so mass assignment bugs would be a lot less likely to be applicable to it but it's going to do a lot more deep dive on the content and the math term for this is Floyd whore precondition post condition analysis but basically what you're doing is you're allowing when it comes into Rex and L your precondition is nothing and your post condition is that it's well formed and then with no kagiri you've got a precondition that it's well formed data and maybe that the comments have been sanitized or something like that but using Floyd whore it's easy to compose a secure system using preconditions and post conditions that probably wasn't a great answer but that's kind of our take on it. Any other questions? All right cool well thank you all for coming.