Cool. We are live and this is a meeting of the OpenJS Foundations Cross-Project Council Standards Working Group. We have a few of our friends. We're missing a few of our friends today because they are at standards meetings and there's always a standards meeting somewhere in the world on any given day at any given time. And that is where they are. So hope you're having fun, y'all. We start with announcements. Do we have some announcements we'd like to share today? Anybody? Got a couple. Always do. Joe, is there anything big in Node that may have happened today? And you're muted. Let me jog my memory. Oh, yes, of course. Version 16 went live today. Yay. If you go to NodeJS.org slash whatever slash releases, you can see the schedule, but yeah, 16 went live today and that's exciting. Congrats, Node. Congrats. I wore green in Node's honor today. Nice. No, I actually just thought about it. So in less exciting but still important and related news, the marketing committee meeting is just after this one, if you want to stick around and join us for the foundation marketing discussions where we talk about how we can get the word out about our projects, please do. And we also have a board meeting on Friday. And there's typically a public session after that so we welcome folks to come attend that as well. And oh, another just sort of like announcement type thing in just over a week from now. And there's Caseros from the W through C who is the new chairperson of that spec editors community group I mentioned at our last meeting and also in Slack. He lives in Australia. Okay, so, which means that's basically the moon as far as I'm concerned, it means I will be getting up at 8am to join a call for him at like midnight. And, but we're going to have a special meeting just to make that happen is going to talk a little bit about the, the community group, and we'll record that for our community. You know, we make it work. So I think that's it announcement wise. This the last thing this week will be publishing our schedule for speakers at open JS world we're just updating the website now. The location's already went out. So you should see that in the next day or two as soon as we have everything ready to go live so if you have not registered go to open JS world.com.  Great. Great call. That's a good. Of course that's happening that's like one of many things. So moving from the announcements then, unless there's others. We'll go into our agenda for today, and some of our items, one of our items in particular we're going to make listed items we're going to make a private session which is the discussion on our statement. So that's a surprise. The first item is dealing with the recurring CPC working session. I believe we settled this last week. I need to adjust the, I learned today that what I have to do is move the calendar invite, and then the node, like me make meeting tool will be fixed and Joe is offered to help. So I think that will resolve that periodic issue that we have popped up, but just to remind everyone on those days where we do have this or actually think maybe generally moving forward we're going to have this meeting at 1pm Eastern. So an hour earlier. And that that should fix this. So thanks for working on that. Next, unless there was any other comments I'll just roll on because I think that was, that was pretty. Do you want me to move that meeting now. Yes, 1pm Eastern time every freaking time, every time. Right now, continue on I will make the change 1pm. And that takes us to our next item, which is public for discussion the education and onboarding resources standards education onboarding resources that we've been kind of trying to compile on, and I think, especially with some attention that's being kind of turned toward how do we help people gain the skills that they might need or want to have. And then it comes to getting involved in standardization activities sort of like the context, you know what kinds of things would be good to read what kind of, you know, videos or things. We've got, we've got a nice little list that is compiling here, we brainstormed on several last week. I think this is obviously something we'll continue to add to it's not an exhausted list. I think our question is that we, we started to discuss but not make too much progress with is how, what we want to do with this information, like, do we want to put it on a website, and we could have it even be its own standalone website so anybody, you know, from any organization could say oh well here's you know, here's stuff that's, that's helpful for folks who are onboarding into blank org, you know, or here's the perspective. You may not see because you're in the web standards world but here's how the hardware people do it or whatever. The conversation kind of got cut off there and so I'd like to pick it back up for a few minutes if, if folks have the have any ideas or thoughts on the matter. But the simplest be to just have a repo that has maybe, maybe one or two documents in it, and therefore get help take care of the rendering and also the whole process of crowdsourcing it's further development. We could do I mean I like the idea of, I'll be honest, I like the idea of a website for a couple of reasons. And it could be a totally if we use pages. Can actually do all of that. Yeah, that I think I think that's where I'm like, I'm capitulating is to say, if it's a static site on GitHub, I think, but I think it's a like a web URL. It feels friendly. You know, I don't know. But I've, yeah, down with a curated destination and in our marketing committee meeting this afternoon we're talking about a way that we're templatizing websites for projects so we could do the same with this but we can have a little more fun with it we could give it a name it could be a standalone thing. So it just might, like, maybe be easier to find. We could give it a cool name. I'm super into cool names. Emily arrows, excellent education. I'm thinking trying to think of another E word. I was thinking that the branding would be more about the open JS foundation. I'm okay with this if you want to make it all about me. We can make it. You know, it's an open JS foundation program, much like JavaScript landia but it can be, it doesn't have to be open JS law branded. It's useful for the community if it's helpful for a neutrality to not even have open JS I'm actually I'm fine with that too. I guess it's a good point like you know do we think it will benefit from not being affiliated with specific group or you know would we because I mean at the end of the day we want to see these things just help people. We're the people that are sort of putting any of it to happen it's not going to escape anyone's notice who's behind it. So, there's no point in hiding the brand just on it. I love that too, obviously. I mean that counterpoint, although I am I do like, you know, I do also selfishly think it'd be great for it to have open JS all over it. You know I wouldn't want somebody to think about it, run into it and think oh well this is just this stuff just applies to open JS. For example, you know, and so we just would want to make it clear I think that like, this is a not specific to open JS, but it's been put together by the open JS and, you know, it's it's like SDO forum neutral, instead of vendor neutral it's because that's where it's neutral neutral squared neutral neutral squared neutral cubed. Okay. Yeah, so as Robin said, one of our projects q unit made like a dead simple like very nice. Jekyll template that's that I think is what we're going to use for the JS landing a program it seems like something that's very easy for us to kind of spin up. And not check. I forbid it. Well, first of all, we're the JS, the open JS foundation. I also hate using all that garbage. We're allowed to use tools if they're good tools, even if they're pretty good, you know, listen, in a different language. I do sympathize with that argument, Joe, it did take me four hours to upgrade system Ruby three weeks ago for some unknown reason, but it works. I for afford websites because we used you know, we had to use certain. I probably won't work on it just FYI, because I hate spending four hours updating my Ruby and my jams and all that stuff so. Do you have Joe do you have the bandwidth for providing an alternative solution. Honestly, 11 is what I would use. It would be made about like JavaScript. Okay, but you know what we're doing the thing, which is a symptom of it's like, okay, this is great. Let's make a blog. What's our stack, you know, like, that's the But okay. So I guess that the request here just to kind of close this out is to continue adding to that issue. This is issue number 130 with your recommendations like things you would encourage other people to read, or like, kind of dip into if they just sort of learn. And the second thing is, I guess more of an action on myself and I guess Brian from like a spinning up the like a template site for our for this. And we got a cool name. So that's another thing. Find it. Think of a cool name. The mongooses. That's a cool name. Right. All right. I'm moving to unless there's anything else, Mike or send ill. So way in on in terms of the resource piece, like what would be helpful. Okay, cool. Let's go talk about what's happening in in our different community right now. So obviously, there's a meeting happening today into or yesterday and no today and tomorrow, which is a TC 39 today meeting so we should be hearing from our teammates there what new things are up for discussion. And looking forward to getting that report next week is the W3C's advisory council meeting. And they've released some of their like pre videos and homework and stuff for us to review and be prepared with I haven't had a chance to read or and take a look at all of those yet. But some important things include some process changes specifically related to what they call the director free W3C. And kind of some changes in their legal entity. That's a big topic for the AC right now. And there's also a handful of charters, none of which at the moment are particularly pertinent to our group for example the automotive working group, not really sure. You know that we need to weigh in on that charter but those are some of the things that are that are on deck. And as things come in that look relevant to us I'll be sending that out on our standards email list for y'all to to weigh in on. And then last but not least that spec Ed meeting as I mentioned at the top of the call. Repo has been set up there's a handful of about, you know, 1520 issues of tutorials or educational things that Marcos and and team want to create. So if you're interested in that community group anybody can sign up, and anybody can go and weigh in and subscribe and start watching any of those issues so that is what I know. Currently about. And when then there's the advisory board elections which will be opening up as soon as the nomination period closes which is sometime this month. Yeah, that's what I know about W3C. Emily anything from from from Unicode. You want to share the Unicode message for my working group is considering right now we're meeting roughly every two weeks. The last meeting was actually yesterday. We still have been for four or five months now. Maybe more stuck on determining exactly the shape of the data model that we're going to that the whole spec is founded around, and the latest decision is effectively to do, rather than try and solve the issue. Specifically, just considering the data model is to in fact start doing parallel implementations based on these two different spec versions on on the various parts of the whole stack that forms the message format to standard. Well, one of the, I have strong opinions here because one of the two models being used is primarily written by ZB Bruniecki from Mozilla and myself. I'll, my part here is to effectively next time implementing the tooling. If we were to go ahead with this version of the data model, then have the whole parsing from source to to form a data model and then having a runtime on top of that. And we'll continue to be reviewing this. We're hopefully going to sort of simultaneously with this work soon be able to finally get to talking about the canonical syntax for this whole structure, which is probably the biggest open question for which we don't have anything. So the other sort of deliverables of the whole project we have a decent idea of what they're going to be or we have two different ideas on what they're going to be. There's of course many things still to do. It'll take at a minimum months for this work to conclude. I hope it's only months, but it's possible it'll take more than that. Months as fast in standards worlds though. We've spent already more than a month on getting to this point. Well, I guess congrats on getting to this point. Cool. Well, thank you for the updates and I think we'll kind of continue because you because you had an item for private session that might build on this. Let me ask if I'm missing Mike or Joe or Robin or Sarah group that we need to check in on Miles is our OSI affiliate. He's been super busy. So maybe worth pink hancing if there's anything from that. They are. Yeah, I chatted with him briefly about OSI I think they are rerunning the elections. Yeah, for the board. So I don't know if y'all were tracking that I think there was maybe a process error and so just to be thorough they're having an outside auditor take a look at it and they're rerunning the election. All right. Sounds not so fun. Um, all right, any other business for our public chat. If not, we'll, we'll close this early and go to talking about our statements and stuff. All right.


Going on everyone Sam here late in sports cards. We are ripping 22 23p in revolution Chinese new year eight box case break number two random team style there's a look again at your Random results as always you can find these on the website under the results tab as well as the link in chat Good luck guys KJ. We do Like if you want like a personal case like if so say we have say you're looking for I don't know for instance like We have 10 I'm just trying to think like case-wise like for break it down say yeah, so all right so say like for this for instance you wanted a personal case of Revolution Chinese new year you'd order eight boxes and you'd get a sealed case So like if we have if we have it available like on the website if we have like 16 boxes a playbook available and you order all 16 you'll get a sealed case of it You have to order it and like whatever whatever the case breakdown is You have to order that many to get a sealed case like if you ordered seven you get seven sealed boxes instead of eight You know what I mean So it's really dependent on on what we have available in stock to Jason Tatum Like sometimes like the earlier the product comes out We'll sell we'd be more it'd be easier to sell sealed cases Terry Rose here But as like as we do more breaks as people buy more personals as we sell more in the shop You know the the chances of that are less and less with the you know less product Jabari Smith read Again, should be able to make up a decent amount of time Sadiq Bay tie-tie Washington on these So we'll probably end up starting 10 bucks Tuesday a few minutes behind KP But with the PYT's of hobby we should be able to get through it pretty quickly. I would think Caleb Houston Christian Brown. So yeah, it's really dependent on on what the product is. Is there a product you're looking for like a case you're looking for Colin Sexton Harrison Barnes. Oh check Bajie rookie. They don't deserve a title run. Oh, no That is Tyrese Martin I think I got on 3-1 if they lose I'm not trying to like rub it in. I'm just it's a genuine question Jimmy Butler Chet rookie Curry 3-2 gotcha James Harden Yes, game 5 is a big one game 5 is always a big swing Walker Kessler nice one there Benedict Mathering. Yes, but you lose homes, right? Usually they don't would be my guess. Yeah, I don't think they do generally double getting wrecked. Oh boy That's I hate the hurricanes dude Box to Again guys, we've got I believe nine to go. Yeah, nine to go on 10 bucks Tuesday basketball Got to get that sold out get in there for sure appreciate you I'll just be in the face if you don't mind Snap face and into the chat it AJ Griffin Blake Wesley. Okay, uh, Christophe's for Zingas. There's Devon to sell Nice, Palo red. There you go. Congrats magic Hello, New Year There's a green of John in it Kominga to 88 there you go Vaughn with the Warriors second-year Kominga Kendall Brown base There's Russell Westbrook my book in space face. There's Kendall Brown Here with Dudley today guys. You got a new employee He just changed it to Sean. Yeah, James Arden Dudley McPherson the third Like I see it every time Every time we have like a work email or something. I see that it says Dudley Sylvia on it. Yeah Like today today As I say above we read There's J. Dubb nice one there. Yeah Like I saw today at email came in said Dudley Sylvia as requested time off There's Siddiq back We must have another Sylvia The Sultan of Vroom there's Siddiq Washington jaden ivy Christian Wood kawai And paul george on the back Uh demar de rosin red scotty pippin jr. Rookie Maybe that's actually Dudley christian brown could be Jason Tatum green uh to 88 new year parallel No, that's not that's shawn shawn taeva. There's uh staff carry No, uh, benedict matherin x benedict koma matchmatter. You do it after you already said it You don't make the rules. I make rules You don't make the shtick rules kevin hart the shtick sheriff over here. That's right Dylan brooks What's up pat? How you doing buddy? Hope you're doing well as well. Uh mark williams red rookie Pat Drew holliday Terry eason as well uh drone clarkson Your eyes is dry Our shawn boat champ, uh jaylon williams. That's j will I know I don't know what I don't know how that happened Why did you end up how did that even happen? I have no clue dude jaylon williams red It just happened turned around and boom. There it was Big old pile across these things Got uh nine to go again guys on some nc Uh, that is 10 box tuesday Prism treasure shade on sharp rookie got two years of prism 21 22 23 also 21 22 fastbreak Uh highlighted mainly biggest uh box in the entire break is going to be a box of 21 22 nt Basketball hobby patrick baldwin airs palo rookie Which jaylon sucks? I know this see we should we should yeah, uh Pat almost had to buy me a raise in shirts. We had a bet. There's carl anthony towns nickily ovish that uh if The bangles won the super bowl Vince williams pat's a huge bangles fan the pat the bangles won the super bowl I'd have to wear a bangles jersey on stream and if the rate if he he let me pick any other team Uh got spencer dimwitty 288 When there was like 18s left or something to win and if that team won he would buy me a raise in shirtsy And I picked the eagles of course Tyler hero. Yeah, we'll have to do something this season for sure pat Yeah, yeah, exactly airs dylan bruce Do That's why Uh drew holliday isaac mobley.  Jay Griffin In all caps fire red caps Please Brunson That's so funny Kyle who's my kennedy chandler scotty barns kevin durant red Troll and b that's true Kendall brown Jabari walker. I mean that's that's kind of what you get with julius randall though Like he just disappears in the playoffs Sean taking a spot. Sean j in 10 bucks Tuesday. We're down to eight guys eight spots to go Eight spots left In 10 bucks Tuesday the basketball breaking a little bit later on Now yet next one dean next one If you're in uh, I don't know if you're in 29 or 30, but we have two more eight boxers of revolution Blake wessley Both hobby after this Then we're into 10 bucks Lonzo packs are not easy to open. That's the one Slight to this Colin sexton johnny davis No sticky note today, maybe a little bit kennedy chandler Uh, now illegal comes in Harrison barns. Patrick baldlin. Here we go Let the smack top be jimmy butler March on boat champ What's up, brother? Buddy healed Jimmy buckets Hi, legal Chris paul Tye-tye washington It was flipped over though You know i'm saying like it as if it was a pizza and then it was Taco Yeah, huh, and they were like dipping it in some sauce Patrick baldlin jr. 288 for the warriors. Nice one again long Tray man, honestly Be down Only if I get one I just want a corner I want one a uh piece of crust a little chunk of crust crust nugget A quarter of a ronnie Is Happy that is josh, we're not One slice I'm not even hungry anymore Miles turn Here's 79 cents josh kitty. Jabari smith rookie You know my Venmo you're 79 cents, but Oh really? Tell you what you're not doing Terry you just lost Yeah He's got money on it. That's a good reason Gilbert Bring to say Nice Paolo 65 of 88 There we go magic on the new york new year green parallel Let's go baby Nice one there Get that mag for you congrats orlando Orlando magic Davion third This fire That's fire Do you have the magic in this Let's go zai Let's go Oh yeah dude Zach Levine you got a red one too in this break Uh like new year one Let's go dude Here's Jay Will Michael Porter Jr Jeremy Grant Scary Terry I'd be so pumped dude I'm buying season tickets I don't even care I don't care what they cost Just get me get me Inject Orlando baseball into my blood Yeah Patrick Baldwin You got something to do I'm over here singing the dance I know the Lord Jordan Pool John Wall Chet Vince Williams I just went to the one with Rick and Jake Oh that's right Cesar McCollum Yandere Aten Wendelmore Jr red Keegan Murray rookie Tyrese Maxie Yeah they should Boston fans booing their own team Kevin Porter Jr What Oh man Oh wow Johnny Davis I swear to God I better never hear about the Yankees Boo and Aaron Judge now That's it Celtics just ruined it John Morant Jeremy Sohan Celtics just ruined it for the entire city of Boston now for that And last pack of the break everybody Good luck Luca Deontay Murray That'll do it for the break guys Not really to recap I guess just the Paolo Green to 88 that'll do it for the break Thanks again Next up is P White


So we got to this approach of using a public key authority, but before we come back to this authority approach and look at the another one, let's just make sure everyone understands the problem. I mean just going back to our man in the middle attack. This was a scheme we used to distribute a secret and that's what we're trying to do. A wants to communicate with B to do so. They want to encrypt their communications and using a symmetric key algorithm. So they want to encrypt everything using some secret key and in this scheme is denoted KS. So KS is their secret, but they don't know it yet. So they haven't communicated in the past. So this scheme uses public key cryptography to exchange that secret where A sends its public key to B saying, I am A, I want to communicate with you, let's create a shared secret. So that's step one. We send our public key to A, sorry, we send our public key to B, B generates a secret. It creates KS, let's say it generates a 256 bit random value and that will be the secret that they use for AES to encrypt the data. So B creates KS and is going to send KS back to A, but of course we cannot send the secret in the clear. It must be encrypted because if we send it in the clear across our network then someone can intercept and find our secret. So what B does is encrypts the secret KS using the public key of A so that if someone intercepts this message, message number two, they need the private key of A to try and decrypt and get KS. Without the private key of A they will not be able to learn KS. And who has the private key of A? A does. That's our understanding of public key cryptography. Only A has the private key of A. So the idea is that B sends this encrypted message back, A receives it, decrypts using the private key of A and learns KS. And from then on they use KS to encrypt their data, KS and some symmetric key cypher. So this is a common technique where we use a public key and public key encryption to encrypt a shared secret key. And once that secret key is shared we use that secret key to encrypt using a symmetric key algorithm because symmetric key algorithms are much faster than public key algorithms. But we saw that there's a problem with this. We went through and I don't have the picture here but we went through and you went through and tried to work out well what could an attacker do and come up with this man in the middle attack. A sends the message to B but someone in the middle modifies that message, in particular uses a different public key. Just to remind us of what it is. The man in the middle attack involved A sending a message as per the original scheme, public key of A and the ID of A. But the man in the middle that is C intercepting and modifying such that they send, so this is C receives that, you've drawn this before, they change the public key to theirs. They don't change the identity, B receives that. So C is somewhere in the middle of the path for the network, they receive the message before it gets to B and modify the public key. B thinks it got a message from A, B chooses KS and sends that KS back to A encrypted with the received public key. B thinks the public key of A is this value but it's in fact the public key of C. So B encrypts KS using the public key of C, not knowing that, thinking it's the public key of A. As a result, when C intercepts the reply, it can decrypt and learns KS. C can decrypt because C has the private key of C. And then C sends back that same KS to A but encrypted with A's public key, which is of course known. And when A receives this reply, they decrypt with their private key and they learn KS. So we've gone through this attack of this man in the middle attack, just to remind you that someone in the middle intercepts the messages and changes the public key. So this is not good. So what we're dealing with now is ways to make sure that the public key we have when B receives a public key, B needs to know this is A's public key. They need to be sure whose public key it is, otherwise such attacks are possible. So what we're dealing with is ways to prevent these attacks. And so to prevent a man in the middle attack on the public key, we need some secure way to distribute public keys. And we went through this scheme first. The way to securely distribute public keys is to get someone else to confirm they are indeed someone's public key. So in this case we introduced this new entity called the public key authority, who everyone trusts. So it assumes that this authority is trusted and that includes that everyone knows the public key of the authority. If you know the public key of the authority, when the authority sends you a value and signs that, so in message 2 this public key of B was signed by the authority, A can verify that because when something is signed with a private key, we verify that with a corresponding public key. So this scheme is really a way so that A and B can exchange public keys and they're sure they are the correct public keys. It's not a man in the middle attack like in the previous approach. And the way they do that is that the public key of B is signed by the authority and the public key of A in message 5 is signed by the authority as well. And since they are signed by the authority, both A and B can verify them by decrypting with the public key of the authority. And that comes back to our assumption that A trusts the authority, which really means A has the public key of the authority and knows for sure it is the public key of the authority. It's not someone pretending to be the authority. So we have that assumption. Maybe what happened is that A physically went to the authority, confirmed their identity and got the public key then. So this is just one scheme for distributing public keys so that if someone tries to send a public key pretending to be someone else we can detect that. It involves if A wants to talk to B, A sending a request to the authority and getting the public key of B, contacting B saying I want to communicate with you, B does the same to learn the public key of A. And the last two steps are just to confirm that these messages are recent and not being replayed by someone else. And the end result is A knows B's public key and B knows A's public key. Easy. One of the problems with this approach is that every time A wants to communicate with a new entity we go through these steps of contact the authority, get the key and the receiver contacts the authority, gets the key. Imagine there are thousands of entities in the network, they all need to communicate with each other. There's many contacts to the authority and it becomes overloaded, it becomes a bottleneck. Many packets are sent to the authority which must respond quickly. If the authority cannot respond then A and B cannot communicate. So the next scheme is one way to improve that, mainly from a performance perspective, not from security, and it's called public key certificates. So we'll go through the general approach, again the same objective, A and B want to learn each other's public key. And they need to be sure that they're their public key, not someone else's. So in the general approach we have some third party to confirm who's key it is. And in the previous scheme it was called a public key authority, here the more common name is a certificate authority. What happens is that A and B are issued certificates. To note it in this diagram is C A and C B. A certificate will contain the public key of that entity signed by the authority. And this is a bit confusing when we compare this diagram to the previous one. These four messages sent between A and the authority and B and the authority, there's no numbers on them. They actually happen before the communications need to take place. So they happen manually. Whereas in the previous scheme we didn't draw the ones that happen manually. All seven messages happen automatically across the network in this case. Contact the authority, give a response. Because if we want to draw the equivalent to what we have here, A and B want to communicate using certificates. Let's draw it. The scheme is quite simple. A sends its certificate to B in the first message and then B responds with its certificate. So if we want to compare those schemes of using the public key authority versus using the certificate authority, compare this diagram with this one. When we use the public key authority, every time A wants to communicate with someone we go through these seven steps. Contact the authority, get a response. Contact B who contacts the authority gets a response. The problem was that there was many communications to the authority. When we use certificates, it's this approach. A wants to communicate with B quite simply. A sends its certificate to B and B responds with its own certificate. And we get the same security as in the previous scheme. So we need to go through what is a certificate and what does it mean and why this is secure. Now this diagram compared to this one, it's actually these two steps. Step one and step two, that's all. It's just that this picture, it's a bit confusing, it includes the prior steps that must happen manually in advance whereas the public key authority didn't include them. So note when we use certificates, every time A wants to communicate with someone it's very easy. A sends its certificate to the destination and that destination let's say C sends back its certificate and then they're done. What's a certificate? In the same way that the public key authority signed A's public key, a certificate is A's public key signed by an authority. When we say signed by someone, we mean encrypted using that signer's private key. Confirming it came from that particular entity. So the certificate of A includes the public key of A signed by someone else, signed by the authority in our scheme. And in our diagram, back to the lecture notes, it's captured in these steps here. These two. So what happens at the start is user A goes to the authority and say I want a certificate. Here's my public key. And the authority confirms that this is user A and this is user A's public key. So in a simple example, let's say I'm the authority and all of the users are the students in this class. So one student comes to me and say here's my public key and I look at your public key, I look at your ID card to confirm this is you, it's not someone pretending to be you. And I confirm yes, this is you and this is your public key. Therefore what I do is I issue a certificate. That's what the authority does. They create a certificate which contains the public key of that user, PUA in this case, the identity of that user, some timestamp. So T1 here is a timestamp saying that this certificate is valid from right now maybe until six months in the future. And I sign that information. So the authority encrypts that information using their private key so that anyone else who has the public key of the authority can verify. So think of a certificate as the public key of a user signed by some authority. And we'll see that a different format, this is the general concept, we'll see a more specific format in a moment. Similar, B does the same. B goes to the authority saying here's my public key and the authority creates a certificate for them. C, B in this case. Now note that these steps happen in advance. That is whenever A wants to communicate with someone, all it does is sends its certificate. So once A has CA, its own certificate, if it wants to communicate with B, it sends CA to B. It doesn't have to contact the authority. If it wants to send, communicate with C, some other entity, it just sends its certificate to C. So it doesn't matter the destination, we don't have to contact the authority except in the very first instance. And that really cuts down on the communications because it's only that first step of being issued a certificate that we have to contact the authority. What is the certificate? What information is included inside? Here's one representation which is on the slide or on the diagram before where we said it includes the public key of A, the identity of A, some time stamp because instead of having certificates which are valid forever, we have some time limitation on them and importantly encrypted using the private key of the authority. And that allows someone to verify it if they have the public key of the authority. So again this comes back to trust. To be able to verify a certificate, you must have the public key of the authority and you must know it is indeed the public key of the authority. It can't be someone else. So we must trust the authority. The certificates, this is the general concept but we'll go through a more detailed view and look at some specific examples of how to store that information. That's what we'll do today. When we sign something, what do we do? When you sign, if you're using public key cryptography, when you sign something, how do you sign a message? How do you sign a message? Encrypt with something. Okay, you get an F in the exam if you say that. Anyone else? Encrypt with a private key, still not enough, F for you, maybe a D plus because it gets closer. Encrypt with more specific. If you want to sign something, what do you do? Hash is good. You'll get an A if you say hash but even if you just want a B, you encrypt with the private key of who? You. That is if you want to sign something, you encrypt with your private key. So make sure you're clear because remember everyone has their own private key. Think of all users have their pair of keys. So to sign something, you encrypt with your private key. Now more specifically, we encrypt a hash of the message using your private key. The hash is there for performance reasons, not for security. So let's write that down. Here we haven't shown the hash function but in practice we usually use a hash function even for certificates. So one way we can write CA, we have the identity of A. That is something that identifies this user in the system. We have the public key of A. So the actual public key of the user. We usually include some timestamp. So denoted here T1 meaning some information about when this certificate was created and how long it's valid for. And all of that information is combined with the signature. And we create the signature by encrypting using the private key of the authority, I'm going to run out of space. The hash, the hash of what? I'm running out of space, you'll find more space. The hash of all of this. So this is our message. This is the information we want to sign. Think of this as our message M. We take the message and combine it with the signature. This part is, if we M is here, this part is the signature. The message is the information we want to communicate to someone, our identity, our public key, some timing information, a timestamp. We take that message and it's signed. We actually take the hash of the message and encrypt the hash value using the private key of the signer, the authority in this case. So someone else signs this message on A's behalf. So message signature, where the signature is the hash of the message encrypted with a private key. That's the same as we've seen all through the content on public key cryptography. So really a certificate is the public key and identity and some other information signed by an authority, signed by someone else usually. When B receives this certificate, so in the first message, these values are sent from A to B. When B receives it, what does B do? B receives the certificate, what does it do? Decrypt. Decrypt what? The signature. The general process we say we verify. So to verify, we decrypt the signature, S, we decrypt it using which key? The public key of the authority. So if it was encrypted with the private key of the authority, we decrypt with the public key of the authority, we get a hash value, and we compare the hash value with the hash of the message, so this verification step. So we say the verification, verify, what do we do? We decrypt using the public key of the authority, the signature component, S here, and we take a hash of the message component, and then we compare them. So that's the verification step. Decrypt the signature, we should get a hash value, take a hash of the message, and compare those values if they're the same, everything's OK if not, don't trust it. So this is the same as we've seen with all of our signatures. To do so, we need the public key of the authority. So for B to do this verification, it must know the public key of the authority, and that's when we say we must trust the authority, including we must know the public key of the authority, and we must be sure it's the authorities, it's not someone else's. Because remember, that's our problem. Our problem is if you get a public key of someone, how do you be sure it's theirs? So we're saying that we have some initial trust that we are sure that the public key of the authority is indeed theirs. If we can do that, we verify the signature, meaning we now know the public key of A, and because we trusted the authority, we know that it is indeed the public key of A because if it wasn't, the verification would fail. B, of course, does the same thing. It sends back its certificate, and A verifies that. So same steps. Any questions? How does an entity become a trusted authority? So in a generic system, say then an entity must be trusted by the users. How does it become trusted by the users? Well, it depends on what system. Let's say the system is we want to allow all students to communicate. Then one way to get a trusted authority is to choose someone that you all trust, maybe me, and I become the trusted authority. Of course, that assumes that you all trust me. If you don't, then that system won't work. So in practice, in the internet, how does someone become a trusted authority? How do you trust me? Why do you trust me? Yeah, do you? Why do you trust anyone? Well, based on past experiences, if your past experiences with them have been positive, then you build up trust. So in practice, certificate authorities in the internet usually are based upon organizations that people have dealt with in the past and have done things that have built up their trust. But there's no absolute way to become a trusted authority. You must trust someone. Otherwise, there's no way to bootstrap to start this off. Any other questions so far? This is important because when you open up your computer and you open a website, in particular, a website using HTTPS to create a secure connection to that website, that web server is sending you its certificate. And we'll see some examples of that. So secure web communications uses digital certificates, and therefore it's important to understand what they are, what the limitations of them are, and how they provide security. Let's try our man-in-the-middle attack. See what conditions a man-in-the-middle attack would be successful. Yes, our assumption is that when we say we trust the authority, it means we know the public key of the authority. And our man-in-the-middle, let's call them M. Because we may use M for the message. Let's call them something else, D. I've got to choose a letter that we won't use. C, we use for a certificate authority sometimes. F, just so we don't get confused with some of the other letters we use. Remember our man-in-the-middle? A sends data to B, but F intercepts. The malicious user intercepts and makes some changes. So A sends its certificate to B, but F intercepts. What can F do? Well, can F learn A's public key? Yes, the public key is included in the certificate. So F knows the public key of A. F wants to forward on a message to B, making B think it came from A. What can F do? Let's try some different things that F can try. Let's say F tries to create a new certificate containing its own public key. I'll call it CA prime. It's not CA, it's going to be modified. And how is it modified? Let's say CA prime contains the public key of F, the identity of A, a timestamp, just to note T, and the signature component. And again, I will not try and draw the rest, but the signature component is the entire message hashed and signed. So we've got some missing parts here. We'll come to them in a moment. So the certificate, remember, public key, identity, timestamp, and then take all of those values inside here, hash them, and encrypt with a private key. Whose private key? Whose private key do we encrypt with? Whose can we not encrypt with? Normally, we'd encrypt, well, the signature is using the private key of the authority. But the malicious user F doesn't know the private key of the authority. So CA, maybe we can draw CA so people are clear. The original certificate, CA, public key of A, identity of A, timestamp, and then encrypted using the private key of the authority, the hash of all of those three values. That's the original certificate. Public key, ID, timestamp, hash it all, encrypt with the authority's private key. But when F tries to send a fake certificate to B, they've modified the public key of A to be the public key of F, hoping that B will receive this and use this instead of the public key of A. They don't change the ID, the timestamp. They copy from the previous one. They take a hash of all those values and encrypt with the private key. Well, the important point is that they cannot use the private key of the authority because they don't know it. It should be private just to the certificate authority. So let's denote, they use some private key X, the private key of X, hoping to fool B into thinking this is the public key of A. B receives the certificate and verifies. So try the verification steps. Remember the verify, we take the hash of the received message, decrypt the signature, try to verify. Do we have a volunteer to come and do it on the board? What is X? Good question. F received the certificate, CA. They want to change the public key, seed between CA and CA prime. The thing that's changed is, instead of PUA, PUF. This is trying to do a man-in-the-middle attack. So they change that. But they want to also change the signature. Remember, the message must come with a signature. So what they've attempted to do, they take the hash of these values and they encrypt using someone's private key. They should use the private key of the authority, but they don't know it. So I'm saying that they use some private key of X. It may be F's private key, but it's a private key which is not that of the authority. So it's a private key. B receives this, B verifies. And the verification steps are the same as always. We decrypt the signature component and compare to the hash of the message component. Remember, message component, signature component. Try the verification. This is the message component and this part here is the signature component. So the verification by B decrypt the signature component which was the hash value encrypted with the private key of X. And we're going to compare that to the hash of the message component. When B verifies, which key do they use to decrypt? No. The public key of the authority. B receives a message, a certificate. This certificate should have been signed by the authority. Therefore to verify it, you use the public key of the authority to verify. So you decrypt the signature component with the public key of the authority. And again, our basic assumption is that every entity knows the public key of the authority. And it is indeed the public key of the authority. What happens in the first step when we decrypt and then compare to the hash of this value? Why, what happens? Are they the same? So once we decrypt here and compare to the hash, we need to check, are they the same? No, they will not be the same, why not? That a different key was used between the encrypt and decrypt. Here we use the private key of x to encrypt some hash value. The hash value was in fact the same as this, but we decrypt that ciphertext using the wrong public key, using the different public key and the pair that was used to encrypt. Therefore the resulting output will not be the same as the original input. It will not be the hash value. So they will not be the same. And when we compare them and find they're not the same, then there's an error. That is, the certificate fails the verification. We don't trust it. So when B received this CA prime, as a result of the verification steps, it finds I don't trust the certificate. Maybe report the error or at least don't use the public key in future communications. So again, this is using same concepts that we've looked at when we look generally at signatures. Any other ways to attack? What can F do? What can F do to try and full B into thinking this is the public key of A but it indeed is the public key of F? What we did was we changed the public key and then we tried to regenerate a signature but we didn't have the right private key to generate the correct signature. So that was a failure here. Another way would be to change the public key but we just reused the signature from the previous approach, the previous, the real certificate. But again, you'd find out that the hash of this would not match the hash of the original value and therefore it would be detected. So changing just the message but not the signature would also be detected. So it turns out by using this signature then B can verify changes of the message and therefore because we have the public key of the authority at B, when we receive a certificate, we can be certain that we have the correct user's public key if it verifies. And B can do the same in the opposite direction. How did B get the public key of the authority? I know many people are thinking of that. Any suggestions? How does B get the public key of the authority? Could they use certificates? Yeah, so how does B get the public key of the authority? Because that's an important part here. That is, to verify, we use the public key of the authority because we assumed the signature was created using the private key of the authority. So what if we, if the malicious user, F created this signature using the private key of X and then F got B to think that the public key of the authority was actually the public key of X? So that would be a successful tack in that case. So we need to be sure then when we have the public key of the authority, it is indeed theirs. If we use certificates, we could do that, but it means that we need another authority to confirm that this is the public key of the authority. Remember all the certificate is doing is confirming this is the public key of a particular user. And it's doing so by having another user, the authority confirming that by giving it signature. So to be sure that it's the public key of the authority, we could include the public key of the authority in a certificate and have it signed by someone else, by another authority. But for that to work, we must know the public key of that other authority and we have this infinite loop. So we must trust one public key of one authority, at least. But we can have a hierarchy. It can be such that the public key of the authority is in fact signed by a higher up authority. And that makes things more convenient in large networks. It turns out in practice, usually public keys of authorities are stored in certificates as well. So we could say the certificate of the authority is the public key of the authority, their identity, a timestamp, T. Some indicator of how long this certificate is valid for. And then a signature. Again, we take a hash of those first three values in the signature. I just never have the space to draw them. So this could be the certificate of the authority, including its public key, its identity, the timestamp, the hash of all of those values and encrypted using the private key of who? Of another authority or itself? All right, let's do another authority first and we'll see the hierarchy. Let's say it was encrypted using the private key of someone else. I'll say authority to. You can see that. Someone else, some other authority. Meaning this public key is signed by a higher up authority. But then we have this same issue that the public key of this higher up authority, what is that? Well, it could be a certificate. The certificate of this second authority, we don't have to be limited by a single one, is its public key, its identity, a timestamp. We haven't said too much about that. We'll come back to it later. Encrypted using someone's private key of the hash of all those values. Same structure. Public key, identity, timestamp, signature. Where the signature is those values, hashed and encrypted with a private key. Who's private key? Who's private key? Hmm? Another authority, authority three. Okay? And you see where we get this continuation that someone needs to sign the public key. So we could have the private key of authority three. And then we'd need the certificate of authority three. Signed by authority four. And we'd go forever. Well, at some point in this hierarchy, we need a root. And the root authority has a special case certificate where it signs its own certificate. Let's say authority two is the root authority. It's signed by itself. Check the public key and the private key. Same entity.  So this is how the root authority distributes its public key. It creates its public key identity timestamp and signs it itself. Saying, I confirm that this public key is my public key. And that's what we need to trust. That is the other users need to trust this one so that they can confirm the lower level certificates. So if we trust this certificate, then we can confirm the certificate of the first authority which in turn can be used to confirm the certificate of user A and other users that it's signed. So we can have this hierarchy of certificates. And at the top of the hierarchy is a root CA and that has a certificate which we call is self-signed. The private key used there is the corresponding key of the public key inside the certificate. Self-signed certificate. It's like saying, this piece of paper contains my public key and I sign it to confirm it's my public key and I give it to you. How do you confirm that it is my public key or you cannot with a self-signed certificate? It's me confirming that it's mine. But anyone can do that. Anyone can say, here's my public key and I confirm it's my public key by signing it themselves. So there's no security measure in that. It's not secure a self-signed certificate because anyone can create a self-signed certificate. But in the digital certificate system we need to be able to trust at least one self-signed certificate. So how would we trust it? Then let's say it's an organization or an entity that everyone else trusts in that system and they implicitly trust that it is their correct public key. We'll look at the X509 certificates. Just some notation just to summarize this hierarchy. In this picture we use some notation saying that a certificate of X is issued by some authority Y by denoting it as shown here. So let's use that in our example. Some shorthand notation that says we had the certificate of A was signed or issued by our authority. And the certificate of the authority, not good names, but our first authority was signed by authority two. And the certificate of authority two was self-signed just a shortened way to write down who signs particular certificates. To verify one certificate we must trust the certificate of at least one other entity. So to verify a certificate we must trust or we must have the public key of the authority. And to verify that we must have the public key of authority two and we must in this case trust the self-signed certificate of authority two. So we can build up a chain of trust amongst these certificates. So long as we have the root in the hierarchy we can verify the others. Open up your web browser. People always sit in my classes with their laptops. Open your browser, do something useful and access the Moodle website. Log in, if you're already logged in, log out and log in again. And I'll do it here for those that don't have their computers. So my browser, I access the Moodle website and I need to log in. Well, here's somewhere the log in button. Log in. Now note the URL. Note in the top of the address bar there, the URL. ICT.SIT.TUACTH.Moodle. What protocol was used to access that website? HTTP. So accessing a web server, HTTP. Now I log in. And maybe you can see I cannot zoom. When you hover over a link, usually your browser shows you the destination URL down the bottom. Note that the destination is HTTPS. What's going to happen when I click on the link? Those with the computers click on the link. This connection is untrusted. If you didn't get that then you've been hacked. Okay? Then your login to Moodle is insecure. So this is a warning message presented by my browser. And let's see what it says. You have asked that, so this connection is untrusted. You've asked your browser to securely connect to ICT.SIT.TUACTH. But we cannot confirm that the connection is secure. Normally when you try to connect securely, sites will present trusted identification to prove that you're going to the right place. This site's identity, however, cannot be verified. So this is a message from my browser saying I cannot confirm, I cannot verify that this is in fact ICT server. And HTTPS, which is what we're using here, uses digital certificates for servers to verify their identity to browsers. When you access a website, you would like to know it is that website that you're setting up a secure connection with. It's not a man-in-the-middle attack. And this message is saying, well, we cannot be sure. Maybe someone between my browser and the ICT server is performing a man-in-the-middle attack. Because what's happened, and we'll see in details later, that the server has sent its certificate to my browser. And my browser has tried to verify the certificate but reports this error saying it cannot be verified. So this is an example of receiving a certificate that is not trustworthy. So let's not trust that and let's not go to that website. Let's try a different one. I open up a different website, again using HTTPS. Let's hope my internet works slowly. It's coming. Using HTTPS, and HTTPS uses digital certificates and it's connected to this website, no warning. Which implies that the server, this fsf.org, has sent their certificate to my browser. And my browser automatically goes through the verification process. It tries to compare the signature with the public key and identity information and if they're verified, it allows me to access the website. If it doesn't verify, then it presents that warning. And since it didn't present the warning, it was successful. Here I can see this little lock up the top, the padlock and if I click on that I can see more information. And it gives me a summary. The lock here. It says you are connected to fsf.org, the domain, verified by Gandhi SAS. So this is giving me a summary about the authority that has verified the identity of this website and more information. And your browser will show you, if you look into the details, the certificate of the web server. So here I'll view the certificate and it gives me a summary of the certificate sent by the server to my browser. Remember, a certificate is a public key and identity of some entity in the network issued by someone else, signed by an authority. So it summarizes, it's issued to fsf.org and it's issued by some other organization. The common name is just the field which indicates the domain for this certificate. Also includes optionally organization, organizational unit and some serial number for this certificate. So in practice we don't just include the public key and one field for the ID, we can include other values. Issued by is the identity of the authority, some organization called Gandy Standard SSLCA, CA Short for Certificate Authority and some organization name. And the time stamp, here it's stored as, represented by two values, the date when this certificate was issued and when it expires. So certificates have a fixed lifetime or a finite lifetime. Let's look at the details. And then my browser represents and shows that this certificate is actually part of a hierarchy. So the certificate for fsf.org was signed by an organization, Gandy Standard SSL and that certificate was signed by some other authority and UTN used a first hardware. It's just the shortened name for those authorities. So in fact here we have a hierarchy, one certificate signed by another which is then signed by a third. Similar to our example where we had a certificate signed by the authority which was signed by authority too. So there are in fact three certificates here. The web servers certificate, the first authorities and most authorities, or the root authorities. The details of those certificates are included here. And the format is referred to as X509. There's a standard that says what's the contents of a certificate? And the name of that standard is X.509. So it's commonly used in certificates. There have been some different versions. And we'll look through some of the fields in there. It's on the slide here. It shows the different fields, but we'll use the example to see them. We have something, identify the version of the certificate. It's a standard used. X509, I think, version 3. We'll see a serial number that identifies this certificate. So each certificate gets a different serial number. Remember we signed the certificate. Generally, we encrypt the hash value. What algorithms do we use for the hash value and for the encryption? So it gives some values here. The issuer is the authority who signed this certificate. Validity is like our timestamp. Not valid before this date, not valid after some date. And the subject is whose certificate it is. And we'll have the subject public key information. Version 3, that's just the version of the format for this certificate. Some unique serial number. So another certificate would have a different value. The algorithms used in this certificate. The authority who issued the certificate. So some values to identify that organization. It's usually an organization. It can be a person. Not valid before some time and date. Not valid after some time and date. So after that date, whoever receives this certificate should treat it as untrustworthy. So they should be updated over time. The subject and the important part is the common name. Which identifies in web browser, in web server certificates the domain. So here, anything.fsf.org. So this certificate is for that domain. When you visit a website with that domain, this certificate applies. The others are just, I think, the common name, the organizational unit, are just optional values. Then the public key information. The algorithm used, RSA, and the actual public key. Remember RSA. We have a public key which is E and N. And the private key D and N. So in the public key, N is the modulus. So there's the value 2048 bits in hexadecimal. And E is the exponent. 65,537. So this is the actual public key, the RSA public key, for that subject. For the web server. There's some extension, some extra optional information that can be used to support by the certificate authority. We'll not look at them. The algorithm used for signing. SHA1 with RSA. That refers to... We find it. The hash algorithm, H, is SHA1. And the encryption algorithm is RSA. So the signature algorithm refers to the two algorithms used here. We may use different algorithms. Sorry. And finally, the actual signature. So this is the 2048 bit signature used, which is that S part when we draw it on the screen. That's the certificate of the web server, FSF.org. It was issued by an organization called Gandy Standard SSLCA. To verify this certificate, we need the issuer's public key, which is stored in the next certificate up in the hierarchy. The subject is Gandy Standard SSLCA. The issuer, in this case, is UTN User First Hardware. So another authority. To verify this certificate, we need this UTN User First Hardware certificate. And we see that up in the topmost of the hierarchy, subject, and the issuer. Anyone want to guess? Who's the issuer of this certificate? Who? Itself. At the top of the hierarchy, we will have a root certificate, and it's a self-signed certificate. So the subject is UTN User First Hardware. The issuer is the same. UTN User First Hardware. So this is a self-signed certificate. It's the same as this example, where we had, think of this as the server's certificate, issued by one authority. That authority certificate was issued by a second authority, but that second authority certificate is self-signed by itself. It doesn't have to be two levels all the time. It can be a single level or it can be multiple. Let's go back to our first example just to finish. When I connected to ICT, what happened? It gave me a warning saying my browser could not verify the received certificate. Let's try again. Untrusted connection. Technical details saying the certificate is not trusted because it is self-signed. So the browser says, I've received a certificate from a server, but it's signed by the person whose public key is included. And if we want to access this website, we must manually trust the certificate. So I understand the risks and we can add an exception. We can actually view the certificate. In fact, since I run the ICT server, I've created a self-signed certificate because I haven't gone to the effort of creating a real certificate. And you can see it's out of date as well. 2012. So this is the issuer and the subject are the same in this case. So be careful when you access such sites. If we confirm the exception and we manually trust it, we can get access to this site. I'm sure you've seen others like that. Next week we'll discuss some of the issues. Well, why do we have that? Why is there a self-signed certificate? And other issues of where did the... Why did the browser trust these other authorities? So whose certificates do we initially trust? Some of the practical issues to finish off on certificates. And that'll be next week. Any questions on certificates so far? We'll see a few more examples next week. You'll see some in your homework, which is yet to be released, but will be today or tomorrow. Any questions? You've followed the certificates on your laptop? So the informal homework, when access some websites and check the certificates from your browser, just so you can get some examples and see the general structure to start to understand what's happening. A formal homework will be assigned soon.


Protesting Kanu state as residents and NNPP supporters reject tribunal judgment which sacked Governor Yusuf Abba and Lagos election petition tribunal dismisses Jandor and Rhodes Viva's case confirms someone who's victory.  Some residents of Kanu state took to the streets to protest against the judgment of the election petition tribunal which sacked Governor Yusuf Abba as winner of the 2023 gubernatorial poll in the state. The Kanu state governorship election petitions tribunal sacked Abba and further withdrew the certificate of return presented to him by the independent National Electoral Commission and declared the all-progressive Congress APC candidate Nester Gowat-Gawuna winner of the March 18 governorship polls. As a result, some residents have gone to the streets protesting the verdict by the election petition tribunal. Joining us live in the studio to discuss this is Sanusi Bature. He's the Chief Press Secretary to the governor of Kanu state and also joining us is Ladikwa Johnson who is acting national spokesperson for the New Nigeria People's Party NNPP. Thank you so much gentlemen for joining us. Good evening. Let me start with you Mr. Bature. Let's look at the case and the judgment. Many people would say that they did not see this coming knowing what they know. Because of the Kwan Kwan Sia movement some people would say that they they thought that you know you had a sealed case but there are also people who say you should have seen it coming. Well the reality of the matter is that winning election is not a day job and there are some factors that contributes to winning election. Part of which in Kanu is the grassroot mobilization of the Kwan Kwan Sia movement under the platform of NNPP which brought its excellency Elijah Abakabiri Yusuf into power on the March 18th Gobernatorial elections. In the first place the party has been into the limelight after Senator Abhimusa Konkoso exited the PDP and they come to the NNPP in March 2022 and it has been an operation of one year and he made the party very very popular and particularly in Kanu we were able from zero to somewhere because we don't have a councillor we don't have a local government chairman but we were able to get 18 House of Representatives out of 24. We are also able to get two out of three senators in the first election and we're able to have the highest votes of the presidential election to conquer so in Kanu at that time close to a million votes leading both Tinibu and Atiku and for the second election in March 18 which is the Gobernatorial we have 40 set House of Assembly so NNPP got 26 out of the 40 while APC is having 14 PDP have none and for the Gobernation election we won with a white margin of over 126 votes and Abakabiri Yusuf is the only governor in Nigeria during the 2023 election to win election with over a million votes so he is the governor with the highest vote in Nigeria so therefore we have never expected that there will be a time because some people feel intimidated by the NNPP and some people have been intimidated by what he started within the first hundred days in office they feel like Kanu is too important to be left in the hands of the opposition so therefore what happened at the tribunal is an unfair judgment lopsided and we're going to challenge it at the appeal court we're very we're pretty sure that the appeal court and the supreme court will uptown this judgment because the yearnings of the people of Kanu said need to be represented and there have been clear evidences that there's no reason to cancel the 165 votes from the over a million votes that the NNPP got at the Gobernatorial election if you mention the issue the reason the court said first of all one of the grounds for for this petition is that APC is challenging the status of his Excellency Abakabiri Yusuf as a member of the NNPP and by law this is a pre-election matter and even at the pre-election matter APC as an opposition party does not have the ground to challenge us that can be challenged by only a member of NNPP who contested who probably contested election along with the priorities exactly but in our case his Excellency contested on a post because there was a consensus and he imagined victorious at the consensus and what we did was a permission we did a permission in June 2022 at San Abacha Youth Center and then he was affirmed by all the delegates including the parties stakeholders at the state level so therefore there's no contention about that but APC came to challenge that status and the court at the preliminary level said it doesn't have jurisdiction to take care of such issue but on the other way around they still say if they have the ground they will declare him not a member of the NNPP that's aside because it doesn't really affect the status of the judgment but the other issue that affected the status of the judgment is the issue of removing of 165,000 boat from our boat which is over 1 million boats so even at that APC claimed that there are some unstamped ballot papers there are those that are not signed by the presiding officers and those that are not dated so the electoral act as amended 2022 as amended clearly spelt out the reason for accepting an unstamped ballot paper because section 63 subsection 2 of the electoral act clearly said that as far as unstamped ballot paper or dated or undated or unsigned ballot paper is concerned as long as the presiding officer is able to justify that that ballot paper is from the ballots the ballots bunch supplied by INEC which is the electoral empire so therefore that shall be counted it shall be counted so where are the agents of the APC at that time that they couldn't challenge that unsigned ballot paper at the polling station and then APC said in their petition that they are going to provide thousands of witnesses to testify before the court on some of the evidences presented before it but they were able to present only 32 witnesses and even those 32 witnesses at the level of cross examination our lawyers were able to challenge them and were able to make them do now some of their deposition of our evidence is interesting Mr Johnson let me bring you in here still talking facts of the case he's told us most of it legally especially if you are defending a case such as this in making sure that you prove these votes and the cancellation the burden is on the APC I guess in this case to provide all the witnesses from all the polling units was this done no it wasn't the petition itself by the APC was a petition based on overvoting violence etc and of course the ballots that were presumably not stamped or what have you for you to prove the Niger the Nigerian law has established that each polling unit is independent you have to show what happened and that polling unit and it must be done by someone presumably an agent or someone that was there at the polling unit now you challenged over a thousand polling units and you only brought 32 people to court so automatically you know that they have there is no way they could have proven widespread violence or what have you but then the panel did what it did it decided in its own wisdom but another thing that is worrisome is the facts that people have said people of the tribunal legal practitioners of the tribunal have said that these ballots came in or the so-called unsigned ballots were attended from the bar not from a witness in the witness book box and so the NMPP had no opportunity to cross-examine meaning that they had no fair hearing regarding that aspect of it so normally they had normally your party parties attorney is supposed to see this particular evidence and it should not be tended by a lawyer it should be from a witness yes ordinarily such a thing would be tended by a witness most logically it ought to have come from the person in whose custody it was which was I neck that would be the natural thing I like was joined in this petition it was a dependent as well okay so you would have expected the I neck officer to tender we've had 165,000 so so so ballots that we haven't there wasn't stamped or whatever we would have been able to say okay based on section 83 and the 63 to would have then been able to ask them that okay you had them why did your presiding office account did it come out of the pad of ballot papers etc etc etc that way you'd have had a more holistic thing about those ballots can I ask I've covered elections so I probably have a fair knowledge of how these things work before those ballot papers are given out the I neck official shows them to the agents right and and these agents have to either agree or disagree before you know the process begins do you know if this was done it was done most likely it was done and even when it's been sorted the agents are there when you empty the box when you sort the ballots they're there they look at it then you start taking one and MPP one APC one PDP they're there they didn't object so all of a sudden you now come up with this point that is why a lot of people law professors different people if you read the opinion pages and newspapers all up in arms about this judgment it really makes no sense to a lot of us are you implying that this judge is where they swung this judgment in favor of the APC are you implying that the bench is biased well not necessarily I am saying that they have brought about a miscarriage of justice either by not avert in their minds to 63 to or by just negligence on the other hand many are implying not like the poor Johnson many are implying that with the surrounding facts the optics we have etc. that they are not comfortable with how they arrived at their decision you understand I will not say that they swung it's for the APC or for any side based on bias but one issue you will recall if you've read it that one of the judges went on to cast aspersions in source at members of the NMPP calling us bandits terrorists and calling us a cult now with that I can make both to say that oh that man was prejudiced interesting let's put a pin then let me come back to you mr. Bature let's talk about the government now many people are worried that with this you know happening it might be a distraction from governance it might not allow the governor to you know continue with what he's done in that same and breath I want to ask it's 100 plus days for your governor in office even though this verdict has been given what can the use of administration say they've done in a few days that it's been in office well the hundred days have been a very successful days of the administration of the engineer abacabir Yusuf why I say this is because of the laudable projects and achievement my son achievement he was able to record the judgment did not in any way distract him because even a day after the judgment he held the state weekly executive council meeting where he approves a lot of projects and he continued to do whatever necessary to ensure that cano is under a serious administration so within the hundred days let me give an example of what he achieved in education because education has been his priority number one number two and number three so you remember the issue and I have seen it in the news here in Lagos that there is a fear a lot of students will drop out from the university because of the hike in the tuition fees so in canoes the story is different because his excellency has directed that the ministry of higher education should pay for 100% tuition fee for 7,000 students of canoes indians studying at Bayer University which is the only federal university in the state and for over 10 state-owned tertiary institutions within the state which include two state-owned universities his excellency directed that instead of increasing like what other states are doing he said the current tuition fee before the first subsidy removal should also be reduced to 50% so some people that are studying NCE diploma you see them paying less than 10,000 naira per session and some in the university you see them paying just 10,000 plus per session so it's very easy in canoes and apart from that he also reintroduced the foreign scholarship program which was started by senator Abiyo Musa Konkosu by October 1001 first-class holders will defer to Nigeria to 14 different countries to study master's degree in different fields and also he has settled 1.6 billion naira which is the payment for the payment of senior secondary school examination NECA in particular for the previous and this year's candidates so he has settled that few few months ago and then he ordered the opening of the 26th Institute of for skill accusation because we're suffering from unemployment and for you to get us out of that unemployment thing you need to provide the youth with the skills so there were 26 institutions that are mainly designed to provide on the job training, fishery, animal feats, agribusiness mechanization, film industry, development journalism, entrepreneurship, a lot of pills so those institutes were closed by Ganduja administration and they have not operate in the last eight years. On assumption, it's excellency director that all of them should be reopened and admissions to start immediately so that people will be enrolled would be trained and startup capital will be given to them to be doing business in different areas. Part of those 26 institutions there's a reformatory institute which take care of the drug artists because you know if you look at the indices. I was going to ask about you know what the government is doing that regard because there's been not just in Kanu but then across look I think I've asked you that question before about the drug. You know the indices for drug abuse does not favor Kanu in any way the last 10 years I can see because a lot of youths, male and female have engaged themselves into the issue of drug abuse so it's excellency startup attacks post and the hero opened the reformatory institute so they would be reformed trained and they will be given a job depending on or some would be taken to school if they have the required qualification they would be taken to university or polytechnic or colleges of education and some of them will be given startup capital to start any business of their choice so that they can be proud of themselves and their families can be proud of them and then as a professional in the water industry Kanu especially the metropolitan area has suffered a lot in terms of the scarcity of portable water. So within the 100 days most of the metropolitan area are now being supplied with a portable water almost everywhere because he has repaired most of the water treatment plants and he appointed all the necessary MDAs under the Ministry of Water Resources and those are expert you know that is his own area is an expert in water resources and yes so it's an area that he has so much interest so we were able to achieve a lot in the issue and now he's going into the rehabilitation of dams so that we can have the available water for irrigation so that the state will be will maintain its status in having the all year round production of agriculture. Let me break come back to the politics of this whole case it was reported that one of your commission threatened the judge although we hear that your governor has you know let him go but then many would ask why what gave this commissioner the temerity to speak on behalf of your administration because I mean he may not have been speaking on behalf of the governor but then he's a representative. First of all I want people to understand that my governor my principal is a non-nonsense man and that commissioner does not represent the governor it's not commissioner for information and it's not spokesperson to the governor in any way it's a commissioner for land and physical planning. Somewhere somehow he got interviewed by some social media activists and he made that statement and the governor as a chief security of the state cannot in any way condone such unguided utterances so therefore he immediately fired the commissioner so that because we believe an official to that caliber should not be seen making such utterances because it relates to the security peace and security of the state so therefore the governor need to be appreciated for taking a proactive major immediately because few hours after the statement his excellency has issued a statement saying that he relieved the commissioner out of his appointment immediately. Finally Mr Johnson before we go because we're out of time how long before we see the NMPB back in court to you know challenge this decision and the verdict? I believe that the notice of appeal must have been filed by now so once that is done the appeal entered then briefs of appeal will be asked for we will file a written brief appellant's brief and the respondents will file the respondents brief and I believe that if there are no interim matters to be sorted out that the appeal will be heard. Okay well we'll look forward to that. Samusibature is the chief press secretary to the governor of Kainu state and Ladic for Johnson is the acting national spokesperson for the new Nigeria People's Party. Thank you so much gentlemen for being here. Thank you madam. All right we'll take a break when we come back we will be looking at the verdict from the Lagos state tribunal. Stay with us.


Hello, people of the internet. My name is Johnny. Welcome back to yet another FNAF news video. And this one is gonna be very exciting because we got a whole bunch of crazy details about the upcoming FNAF movie. I've been meaning to make this video for quite a while now. You may remember last month in December on Daco's charity stream. We got a whole bunch of cast announcements for the film. And actually yesterday, as I'm recording this, we also got another cast member revealed to us. So honestly, it seems like me waiting might have been the perfect opportunity. So in today's video, we're gonna be going over all the officially revealed cast members for the FNAF movie back in December and also the brand new one that came out yesterday. But before we do that, I'm gonna go back in time a little bit, talk about some earlier recap news with the film just to make sure we're all on the same page about what part of production the FNAF movie is currently in. So if you're excited for the film, please hit the like button, consider subscribing. If you're brand new, we talk about FNAF news all the gosh dang time and subscribing is the best way to guarantee you stay up to date with everything happening in FNAF. And now without further ado, let's jump all the way back to August of last year where Jason Blum, the head of Blumhouse Productions, the production company behind the FNAF film, tweeted this, it's great to be walking with Jim Henson's Creature Shop. Their experience and expertise with animatronics is absolutely killer. And in the attached image, you can see a kind hard walking fellow over here producing a costume of Freddie Fazbear. As you can see his head in the bottom left, you can also see his top hat on the table as well.  His ears and feet are also on the table. Now frankly, Jim Henson's Creature Workshop is an absolutely fantastic organization. They've made a lot of very amazing costumes in the past, most notably with Sesame Street, the Muppet Movie, the Dark Crystal. Now we don't know if these costumes are for actors to wear in costumes so they can act out the motion of the characters or if they're gonna be actual animatronics or maybe it's gonna be a mix of both. Either way, absolutely incredible to have Jim Henson's Creature Shop on the project. And then later that year in October, we also got news on the director and a couple of writers that are gonna be walking on the film. We got news that Emma Tammy is going to be the director of the FNAF movie. Russell Binder from Striker Entertainment is going to be an executive producer and the script is being written by Scott Cawthon, of course FNAF's creator, Emma Tammy, the director and Seth Cuddleback. So once again, a whole bunch of announcements happening that year that progress is finally going forward with the film. A whole bunch of names finally attached to the project and speaking of names, revealed a couple of days later exclusively by Geek Vibes Nation, was actually three names of characters that are gonna be showing up in the FNAF movie. They revealed the male lead of Mike, who's going to be in his mid-20s to early 30s. We have taken a look at these character descriptions in the past, so I'm not gonna spend too much time on them, but they will be on screen in case you do wanna take a look through them. Another lead this time of a 10 year old female named Abby, who is going to be Mike's younger sister. And lastly, for a supporting lead, we have the female in her 20s, Vanessa, which surprised everyone, because we do know of a Vanessa in the FNAF universe, of course the one from Security Breach. Is this going to be the same Vanessa we see in that game? Who knows? It seems like with the introduction of Abby, being Mike's younger sister, who usually Elizabeth takes that role at least in the FNAF games, it does seem like at least for the movie, this is going to start a brand new timeline or a brand new universe. And now let's finally move on to some of the official actors who got revealed for the film. On December 16th, coincidentally the anniversary of Security Breach, Deadline reported that Matthew Lillard and Josh Hutcherson are going to be joining the cast of the upcoming film. We're gonna come back to them in just a little bit, but first let's touch upon what happened the next day on December 17th, because our good pal, Lewis Docos Games Dawkins, did what he does best, hosted a phenomenal charity stream. And during that stream, none other than Scott Cawthon himself popped in saying, check your email. I sent you some donation incentives to use. And God dang bro, he wasn't lying, because he supplied Dawko with four new cast announcements for the film.  Now unfortunately, at least from my research, I couldn't find too many projects that I recognized that Mary's been in. I did recognize Law and Order Special Victims Unit as well as NCIS. Looks like she's also recently been a main role in four life. But what's interesting is that she's an unnamed villain. A lot of people are speculating could be Vanessa, but as we're gonna see later on in this video, that's not quite the case. Some other people thought maybe she's voicing Chica or another female animatronic that could be attacking the main character. I think that's unlikely just based on the other actors and roles we got announced during this set of announcements. I think it's more likely maybe she's gonna be like an angry manager at Freddy Fazbear's Pizza or maybe she's gonna be an accomplice of William Afton. Again, seems like this film's gonna be set in a different universe that utilizes some, you know, characters we know, but also of course, some brand new ones like this unnamed villain and Abby and bringing in Vanessa. So it could be a totally new character that we don't know anything about, but I'd love to know your theories. Who do you think Mary's gonna be playing? The second cast announcement on Dock O' Stream was that Piper Rubio has been cast as Mike's younger sister, Abby. Once again, unfortunately, I wasn't too familiar with some of Piper's projects, but I did see on her IMDb page some images of her in Holly and Ivy. And it looks like she actually played one of the main leads of Ivy. Once again, another mysterious character seems like it's gonna be a twist on Elizabeth, but I guess this film's version of Elizabeth, I'm not sure. Once again, I'd love to know what do you guys think about this new role of Abby, this brand new character of Abby? How do you feel about her possibly being this film's stand-in for Elizabeth and not actually having Elizabeth in the film? The third cast announcement is the one we've all been waiting for, Matthew Lillard cast as William Afton. There's been so many memes since this announcement. I'm sure I don't need to explain who Matthew Lillard is, but just in case you don't know, if you're worried about him playing a sick and twisted serial killer, well, don't worry because he had the incredible role of Stu Mocker in the original Scream, and he absolutely killed it. I swear, if you're worried about him being William Afton, just go look at some clips of him in that film. He absolutely nails the role. I am not worried in the slightest. I think this is probably, now that I'm thinking about it, probably the perfect cast they could have had for William. Though when Matthew is not going out and, you know, stabbing a whole bunch of teenagers, he's playing Shaggy in the live-action Scooby-Doo films in the early 2000s, and he's also voicing Shaggy to this day. And just like the other cast members, I'd love to know what do you think about Shaggy being William Afton. And the fourth and final cast announcement we got on Dockos Charity Stream back in December was Josh Hutcherson is gonna be playing Mike Schmidt. Josh has been in a whole bunch of stuff. You may recognize him as Peter in the Hunger Games. Most recently, it looks like Josh has starred in the film adaptation of Across the River and Into the Trees. And I'm just gonna keep saying it. Once again, another phenomenal casting. I can perfectly see him playing Michael in my eyes now. And now we come to today. The most recent cast announcement that got revealed yesterday, and that is who's gonna be playing Vanessa. And actually somehow coming full circle, the people that revealed this information was Geek Vibes Nation. And they have reported that Elizabeth Lail has been cast as Vanessa, who's gonna be a police officer in this film. And I spent so long looking at this picture and I was like, wait, why did I recognize her face? She's Quinn Harris in Countdown. So she's already had plenty of experience with horror films, which is pretty exciting. She also played Beck in You, which is a pretty recent TV series once upon a time as well. And once again, I'm sad over here thinking, oh my God, they've nailed another actor. Just look at Vanessa right next to Elizabeth. They look practically identical if Vanessa was in real life. So Blumhouse, huge congratulations on nailing some absolutely phenomenal actors for this film. And of course, right as I'm editing this video, Geek Vibes Nation has released yet another tweet this time claiming that they've heard rumors that Kat Connor Sterling has been cast as Max in the upcoming FNAF film. Seems like she's most well-known as her role as Presley in the Netflix 2021 teen, faith-based, romantic musical film a week away. And yes, I did just read that off her Netflix Wikipedia page.  Coincidentally, this lines up when the FNAF movie is filming. So I think it's pretty likely she's been cast in the film. Who this Max character is, seems like yet another brand new character being introduced for this film's universe. Seems like people's working theory right now is that she might be Mike's main love interest if he does have a love interest in the film. There's no evidence behind that. I think people are mostly just saying that because they don't want Vanessa to be Mike's love interest. I guess we're just gonna have to wait and see. But tell me what are your thoughts about this brand new Max character?  On Docko's charity stream, Scott Cawthon did donate $10,000 under the name Phone Guy. There are some people speculating that he used that name because he's going to make a Easter egg appearance as Phone Guy. But of course that's not confirmed. Don't take my word for it. I'm just gonna spitball here. I feel like that would just be perfect. So once again, not confirmed, but I thought it was interesting. A few people are speculating that. What do you guys think? Would you like to see Scott Cawthon make an appearance in the film as Phone Guy or maybe just as another character? Back in December it was also revealed when the film's gonna be filming actually. Under the production name Bad Cupcake, it's gonna begin filming on February 1st and wrap up filming on the 6th of April. It's gonna be shooting in New Orleans. We already knew about that. But once again, if you don't know this information, just figured out throw it in here. So hopefully maybe around the middle of this year we can see a few teasers, maybe even a trailer. A couple set photos would be awesome.  Who knows, maybe it'll actually release. That's gonna do it for this FNAF movie news update video. Thank you so much for watching and I'll see you all on the flip side. Goodbye.