QuickBooks Online, balance sheet vertical analysis. Get ready to start moving on up with QuickBooks Online. We're gonna be using the free QuickBooks Online test drives, searching in our online search engine for QuickBooks Online test drives, selecting the option that has Intuit.com in the URL, Intuit being the owner of QuickBooks, support accounting instruction by clicking the link below, giving you a free month membership to all of the content on our website, broken out by category, further broken out by course, each course then organized in a logical, reasonable fashion, making it much more easy to find what you need than can be done on a YouTube page. We also include added resources, such as Excel practice problems, PDF files, and more like QuickBooks backup files when applicable. So once again, click the link below for a free month membership to our website and all the content on it. We're gonna be using the United States version of the software and verify that we're not a robot. Scrolling in a bit by holding down control up on the scroll wheel currently at 125% on the zoom and noting that in the cog dropdown, we're currently in the accountant view as opposed to the business view. We'll try to toggle back and forth between the two views so we can see where things are located within each of them. Right-clicking on the tab up top to duplicate it as we do every time to put our reports in. Right-clicking on the tab up top to duplicate it again. And then I'm gonna go back to the tab to the left as the one to the right is thinking. Reports on the left-hand side open up the balance sheet report. Go to the tab to the right as the one to the left is thinking. Reports again, this time the profit lost, the P to the L, the income statement. Closing up the hamburger, otherwise known as the hamburger and range change. We're going from 01, 01, 2, 2, tab, 12, 31, 2, 2, tab. Run it to refresh it, tab to the left. Close up the hamburger, scrolling up top to range change. The ranges, they are changing. 01, 01, 2, 2, tab, 12, 31, 2, 2, tab. Not changing by much at this point because it was only a day off or day different, but run it to refresh it. There we have it. That's the set of process that we do every time. We're now focusing in on the balance sheet once again. Noting that the balance sheet and the income statement are the major two financial statement reports. We've been taking a look at variance on the balance sheet which can typically be applicable to other reports as well. Last time we looked at a horizontal type of analysis comparing multiple periods and then we can take a subtraction if we're comparing two periods and do a percentage increase or decrease column. So that's a horizontal analysis. Now we can think about a vertical analysis comparing each line item to some relevant total on the balance sheet that will typically be the total assets, total liabilities, and equity. Now note, this is another one that's common to be able to do with different reports but you wanna make sure that you know what kind of report you're dealing with to think about what the best type of vertical analysis would be. So in other words, on a balance sheet we will typically be comparing everything to total assets or total liabilities and equity which are the same number, assets equal liabilities and equity. If I go on over to the income statement then it gets a little bit more confusing in some ways because we're gonna be comparing to basically usually to income and we'll talk more about that later but the reason for that is because on the income statement, on the performance statement, income you'll recall is the goal of the business and therefore it makes sense to kind of compare everything in relation to income. On the balance sheet, you'll recall that if I bring this down to its bare bones we've got the assets equal liabilities plus equity. The assets represent what we have in the business in order to generate revenue. They're basically investments, right? We're investing in our business. Most of the assets possibly being put in property, plant and equipment because that's what's gonna be used in order to generate revenue in the future. So then the question would be well, how much money, how much kind of, because if I wasn't investing it in the business if it was just cash flow and the business wasn't earning me money then of course I would take it out and I would put it somewhere else where it can earn me money like other stocks and bonds or something like that. So the assets are kind of like our investment in the business to generate revenue. Well then the question is what's the percentage investments in basically my assets, right? And then we can do the same thing on the financing. How much financing or how am I financing the assets that I have with liabilities, third party, banks, loans or equity? That's kind of what a vertical analysis will do. So let's take a look at it. It's fairly simple to build a vertical analysis. We could just go to the drop, not that dropdown this dropdown and we want to do percentage of the columns percentage of the columns and boom and run it. And that's basically it. So now we've got a comparison column. So if I pull up the trustee calculator, trustee calculator and we check it out, then we can compare say the bank account. So bank accounts at 2001 divided by and we're comparing it all to the bottom line to the total assets. So we've got total assets right there divided by the 23436.29 that comes out if I move the decimal two places to the right 8.54%. So we do that all the way down. Why is that useful? Because it's kind of like, you can think of it kind of like a pie chart analysis if you're comparing investments and you're investing in stocks and bonds and you're trying to basically compare your investment strategy to other investment strategies to a benchmark investment strategy or to a professional investor like a Warren Buffett or something, you can't compare the dollar amounts because they have more money than you, you always go to the percentages. So whenever we're measuring performance that's often gonna be the case. And again, we can see that when we're measuring performance in job areas such as professional sports. We have to do the percentages in order to get meaningful data oftentimes. So similarly, if I'm in a business I might be trying to benchmark to the industry average. So I might try to say what's going on on average on the industry, I can't look at my dollar amounts when I do that so much, I have to look at the percentage. What percentage is the industry having their cash account? What percentage does the industry have in their fixed assets? And remember that if you're in a business that doesn't have a lot of fixed assets and there's probably not a lot of barriers to entry in it, like YouTube video creation, right? There's nothing, you buy a few things but there's not a whole lot of barrier to entry within it. And therefore you might not have a lot of fixed assets but the trade off to that is usually that there's a lot of competition in a business like that, right? And then the ones that do have a barrier to entry maybe you're gonna, you invented something or whatever you're gonna do, farming or something like that, well then you need or construction or something, then you need substantial equipment in order to do that. And that's, so now you're gonna be investing in the equipment in order to use the equipment to generate revenue in the future. That's basically the point of the investment in the equipment but you still wanna have enough cash so that you're able to pay off the current liabilities. So then oftentimes depending on your industry the layout of how much money is invested in or how much cash do you have on hand? How much accounts receivable do you have? Accounts receivable is important because you wanna think about how easily you're able to turn over the accounts receivable to get the cash presumably getting the cash if you're still growing so that you could put it back in the business possibly by buying the equipment, more equipment which maybe can make you more money in the future would be the general idea. If you're already large enough and you're not really in a growth stage then you wanna make money of course to take it out for personal use at that point. So then you can compare different industries and try to see how much percentage they have in fixed assets versus accounts receivable and so on and so forth and try to benchmark your production to that. On the liability side, we're comparing everything you could say to assets again but really we're comparing or to the bottom line of liabilities and equity. And so liabilities and equity because you're getting into kind of ratio analysis now because you can think about how you're financing your assets here, you're financing your assets either through third party loans, you took out a loan to get it or you have accounts payable liability or through your investment in the business, your value in the business which either got there from you investing money in the business and or the business accumulating revenue accumulating money, accumulating assets making revenue that you didn't take out in the form of a draw or dividend if it's a corporation and therefore your value that is yours is in the business. So that's how you, so the assets and the liabilities and equity are two sides of in essence, the same coin. So that's the general layout and then we can do so. Now also just note that if you're a bookkeeper and you're trying to give this information to a client then the question is we've got a whole lot of variance now because we saw the horizontal analysis where we can compare month to month, quarter to quarter this quarter versus the prior quarter and then we could do a vertical analysis here and I could try to compare multiple things on the vertical analysis. For example, if I have the date range for the full year I could then say I wanna see it by quarter by quarter with the vertical analysis and run that. So now I've got our quarter by quarter there's only data in the last couple quarters but you can see now we've got a combination of a quarter by quarter breakout and the vertical analysis. So this information actually gives you the same data as of year end. So there's a couple of ways that you can think of this if you're batching this together for a client you can try to have as little information I mean as much information on a single report and not have duplicate information if you wanna try to streamline stuff or you can think of it, hey I don't wanna overwhelm my client on the first couple pages so I'm gonna lead them into the more complex reports. So often times you might for example try to construct your report so that you have a simplified balance sheet and then maybe a standard balance sheet and then maybe some of the comparative balance sheets comparing two periods and then maybe some balance sheets that compare multiple periods like multiple quarters for example that's one way that you can basically think about it or you might say, hey look I'm just gonna have this balance sheet that compares multiple quarters and that's one of the only balance sheets that I'm gonna use and maybe have some other comparative balance sheet that show different information than this rather than have repeat information with a summary balance sheet and then a quarter by quarter comparative balance sheet which has the data at the end here for the quarters it depends on who your reader is for that information. If you're actually presenting to someone it's often best to start easy start simple and then dive into more detail as you kind of draw them into the discussion. So and also just realize that now we have a whole lot of different reports that we can be running we can be running the horizontal for two periods I mean, we can have multiple periods we can then run a vertical analysis for one period for multiple periods so you gotta be picking and choosing the reports that you want to be running and this is just the balance sheet report we're also gonna talk about the income statement or profit and loss which has a similar number of variants that we can then be running and then of course we have the other reports that we could run as well to supplement it as well although a lot of the other reports might be internal most of them in nature but some of them might be something that you would want to provide on a month in basis or quarter in basis as well. I'm gonna customize this as has been our normal custom I'm gonna put the without sense I'm gonna put the brackets around it and make it red I'm gonna call it not just a balance sheet but I'm gonna call it a vertical analysis balance sheet and then I'm gonna get rid on the footer of the date, time and report basis and run it so there it is and then I'm gonna bring us back to just the totals only and run that so now we've got the totals only so that looks good and there it is and if I was to preview it and in the print preview like right there the footers are gone so that looks good we'll talk later about how we might bundle these together in one PDF possibly to email it to someone or provide it to someone in some way with other reports and we'll combine like the Excel and the PDF printer to put it on one file so that'll be interesting you wanna be here for that now if you save this you could save the customize, save it so we're gonna save it here and that means that if I go into my reports on the left I'm gonna refresh this and go down to the reports then in the customize tab we've got our customized reports so we don't have to keep on formatting it every time you might wanna think about your external reports group them in a customized fashion in such a way that you can then easily generate them on a quarterly basis, a monthly basis, a yearly basis so just a quick look at the cog dropdown and the business view I don't think we've gone anywhere special here so we've just been in the business view we've been in the business overview and then in the reports so same place or just a different location in the business overview for the reports


Everybody forced here. We're bringing out sports card Almanac high-end a multi sport volume 13 case number five live hit draft style Two randoms coming up in just a moment here. The first one is to determine which case number we're gonna rip There are still six left So numbered back there near Pickle Rick beneath the Layton vinyl Then the other random is going to be for the draft order 10 people in the break. I want to turn will be the order after we randomize We've got just cards in this one. We're all ungraded. No memorabilia Two minutes per pick on the live hit draft if someone is not able to pick or they're just not here I'll pick for them to the best of my abilities Checking YouTube and Twitch chats latent sports cards at gmail.com is the email that I'm looking at occasionally if you need anything Yeah, I'll be typing in chat as well as well as Probably communicating of course, you know, that's about it only things I guys got to keep in mind no influencing the draft and no Discussing card values at least until after the break. Let's do it. Best of luck everybody. Let's do our randoms. Oh Way over there six in two We'll go eight times on our randoms first one is for the case one two three four five six seven and eight Case nine number nine and then the draft order now eight times again after eight the top One through ten that'll be the order one two three four five six seven and eight We've got Michael H up top first pick there. I'm gonna you refresh Move everything over so you guys can see the draft order Bigger in Boulder. There you go. Michael H with one Hilton has two Edward E with three David B4 John a 5 Daniel f6 Brian s7 Viviana 8 Ted T 9 and Brian s with 10 I'm gonna copy that. I'm just showing you Did I miss something? All right, let me say anything. All right. Did you get case? What did I say? Nine? Okay It's a mole. Well, what up? And guys get your spots for baseball breaks in the morning with Matt I also got released a yeah breaks hedgerow through Thursday now, right should probably get Friday up I think tomorrow just way to confirm that the releases Friday will ship and all that good stuff It is number nine right for give a lot of points Unknowns got a ton of points to day Sean how many points you got Two trillion man I don't even know I don't even know for no idea Good start here 2021 prism rookie signatures choice Jalen green PSA nine So the red choice is like the base This is not numbered short apprentice. It's just a choice exclusive, but it's cool color match Jalen green rookie out of PSA nine from prism Guys a bucket another PSA slab here That's pretty nice one there 2021 select almond Ross St. Brown rookie signature PSA 10 PSA 10 almond Ross 74 of 99 stud stud Flex your channel points non graded. What do we got here? Sir Charles Barkley enshrined signatures from flawless 10 out of 10 2020 2021 Chuck and shrine sigs Terrible No way lane Lions aren't winning nothing this year. I'm just kidding. I got no idea. That's the division. I really just I Really have no faith in any to any team, but I feel like they have to got a wow that is a tribute right Nolan Ryan 2015 and Nolan Ryan rightful recognition auto six out of ten sick. Oh, yeah, I guess it is tribute. It doesn't a sticker Tribute Nolan Ryan gorgeous cards super clean like shiny like how it fades into the So like it surrounds the auto almost all this picture to throw no hitter So Sean does it? 2015 tributes And no one Ryan express Vikings could I'm realistically any team has a shot there. I Don't think the bad dolphins won't win that division. They're not in that division I don't think the bears will but I think the others the other three have a chance Ellie De La Cruz 2022 Bowman Sapphire first Bowman PSA 10 Ellie De La Cruz No soccer so far. I Don't know if there's any soccer. I can't remember Ellie De La Cruz PSA 10 first Bowman Sapphire. We had a wrestling card. We had one hockey card so far. I Don't think there's been anything other than outside of that's been mostly baseball basketball football Do that is That's so clean 2021 dynasty dual patch auto David Wright Peter Lonzo the patches or something else right there five of five Holy crap shady. How do you have so many points? Dude's got 11 million David Wright Peter Lonzo three-color dual patch auto Clean sigs gorgeous dynasty card as well dynasty Simply the best simply the best So happy. Yeah, this is Almanac That's what we're doing Payton Manning not paid Eli Manning. Sorry ultimate inscriptions. I knew it was Eli. I just said Payton 9 of 15 Super Bowl 42 MVP gross As a Patriots fan gross 9 of 15 super cool Upper-deck ultimate collection auto the year is 2008 Number to 15 Eli ultimate inscriptions. It's pretty gross in a lot of ways gross makes me nauseous, but also Grosses, and it's a super nice card. That's try to try to launch out the MS. I want to pay him I'll say son of the Boston, but we have corner infielders already. Oh my god. Oh my god Triple on card auto from 2022 definitive baseball Juan Soto, Ronald Acuna, Jr. And Vladimir Guerrero, Jr. Oh Man, that's sick. Yeah, my stomach jumped up into my chest for a minute there 22 definitive triple on card auto Soto Acuna Vlad pretty fire pretty fire baseball heat. Yeah, Shane didn't say yee-haw He is from the south and this guy sure as uh, he was a great one. In fact, he's the great one Wayne Gretzky sign of the times Incredibly clean card 16 17 SP authentic sign of the times 9 5 10 Gretzky gem mint plus Surface 10 everything else in 9 5 gem mint plus on the card grade as well Good god, I feel like this case is super juiced Just gorgeous 9 5 10 SP authentic deathly am I opinion the best on-card hockey autographs that are out there? Love SP authentic the vets the rookies it all holds really good value in SP authentic Who it's Bo Jackson Barry Sanders Emmett Smith? Triple threads. Wow triple Jersey autograph Two of nine on the numbering that's outrageous right there. Bo Barry and Emmett Bo Barry sounds like a sounds like you're getting some cereal Wow, man, two of nine triple threads triple Jersey Jackson Sanders Smith, that's that's that's fire That's fire 2015 triple threads and that I think that might have been my favorite case I don't know if it was like If you're to sell all the cards, it'd be the best. I don't know but now is my favorite case so far So I haven't seen one Red Sox card We saw one Patriots card But the talk to Lane about that Maybe it's because those cards are too valuable to put in all the neck. I think that's what it is. Yeah All the All the Bobby all but the Bobby doll back out is that I have a way more. Yeah It's just just as facts. Oh, man Michael H Good luck. This is this is a toughie. This is a tough pick right here Two minutes on the clock starting now while it is your pick if you want to see a card up close Please let me know otherwise we're gonna hover This was this was definitely like like a Like a legend case for the most part Chuck and Ryan back there Gratsky the triple running back the triple young sluggers Eli Pete Man, oh man Yeah, that's ever were insane the three those three on card in a row or pretty nice actually four if you want to count the dual Mets And even though that's thicker triple threads me a triple threads bow Barry and Emmett What the heck Michael? It's just need a confirmation Just need a confirmation and that's it Good Going with the I mean dude that is awesome It is um Yeah, thank you ma'am. So back then that my game used pretty sure right so sick two of nine on that one Okay, moving on now Number two pick number two Hilton Hilton here yet. I Do not want to pick for Hilton right here. I Do not want to pick Come on Hilton I would say Hilton should have waited to buy in to see the times but it sold out so fast that there's no way It's impossible. Heck yeah, Michael. Happy for you, man.  Congrats, buddy Personally, I I think I know what I would take but I Don't know if that's what Hilton would take Also, I'm trying to think of like best available. You know what I mean? So tough thing is Hilton prefers basketball, but I I Don't know if I would take some of those basketball cards over some of those I don't know if I would I won't say for sure. I don't want to I don't want to influence the draft I don't I don't want to get I don't want to get banned for Myers near Sandoval Paul lives right right in the hurricane hurricanes path, man We all do man Right now it's his path. At least we're in the middle of the state We got some we got a little bit of go girl on each side All right, Hilton you got about 35 seconds. What are they watching on the TV out there? home run Digger Don't ban me. We're gonna ban Chris instead. We're trying to influence the breakers It's the B for boss. Yeah, it's for Boston and for boss B is from boss Got that right John. All right. That's two minutes for Hilton. I did not think about what I would have picked so Actually, I know I know what I would have picked I'm picking the I'm picking a gratsky for Hilton I'm picking a gratsky for Hilton. That's too good of a grade on a sign of the times It's too nice, man It's just too nice All right, Edward II Edward II pick number three again guys if it will all it's your pick if you want to see a card Up close, please let me know Nolan Ryan tribute back there. There's a legilla cruise sapphire PSA 10 first bowman Edward II pick three Yellow cards man Yeah, I'm done with the yellow card That can be Sam's playtime, you know scare me I'm gonna put him in the brig Richard's captain of the ship. I think I'm first mate. So put in Sam in the brig I say walks the plank. Yeah, I make him walk the plank You can jump in the shark and fester waters or Donnie and Jake and Mad Dylan all ridiculous man It's not says that I don't think it's too loud, but I'm just wondering what As long as we get work done, I don't Would assume I don't see Serena. I don't see Serena take a break. All right, 35 seconds Edward II Okay, Eli try not for the college team He's so noticeably older like there's no way to hunt that that's a fake hidden camera thing Those guys got to be pretending that they think he's younger. He looks so old in that It's a horrible disguise. It's funny though. It is funny All right, that is two minutes. I haven't seen it.  Hope you like it. All right, David B pick four Two minutes starting now vote on Vote no absolute no no no no no no not at all If it involves chat deciding something absolutely not all right David minute and 15 115 minute 15 Yeah, the fact that Shane and Danny are so excited about it makes me say no automatically David B is going with the Nolan Ryan Uh four eight three four one so yeah, oh good. Hey appreciate it David. Congrats on that such a pretty card On card tribute Nolan Ryan. I don't think I fit all these up here I'm gonna try I'm gonna do my best Okay, next is John a with picked five At least we got John in the top five this time No, that has not started yet that starts at 755 Eastern There's a break schedule for you. Oh, I don't think that Shane I definitely don't think that I just will not let you guys make decisions because I know it's gonna be like Oh, give them the stock of base cards in the back. Oh Yeah, of course hyper so it'll be after after this break I guess I could have just said it starts in 10 minutes I didn't realize 75 was 10 minutes away No, no, I wasn't saying that Danny He's not saying that all right about 45 seconds left For John Ellie Jalen green st. Brown Barkley Eli and the Mets John your new yorker is showing David right and pita lanzo five of five dynasty dual patch auto three colored patches on each is 2021 dynasty And then the Eli is ultimate upper deck ultimate inscriptions nine of 15 super bowl 50 or super bowl 42 MVP. Sorry no definite signs of wear on any card if it is it's very minor obviously uh dynasty you know comes in case already and then The ultimate just looks pretty good. All right looks like Looks like the time is up John. So whenever you're ready to make a pick Going with the Eli Appreciate it. John. Thank you. Thank you Thank you as always man. All right, Daniel left The new almanac remix ellie and the Mets Oh my god, man. It's too early. It's too late. It's too early. Whatever time of day you want it.  Yeah, both the new york teams are in last place Excuse you In the breaking studio Carl Going with the ellie Appreciate it julian. Thank you. Thank you PSA 10 sapphire first bowman and pick age viviana two minutes Got chuck jaylon green and almond ross st. Brown Got a ps a nine jaylon green irky choice signatures PSA 10 almond ross st. Brown to 99 select rookie auto and a 10 of 10 enshrined signature as trawlsbarkley encased flawless there 10 of 10 trawlsbarkley encased Or keeps waking me up Dude he's all he doesn't walk much anymore so he wants to walk. I'm like, yeah We're walking Plus I feel like when they get older they don't have as much control of like ladder and stuff like that. So I'm like, all right. Yeah Maybe not that but it's like hey like short notice. We gotta fill up here All right 50 seconds So I'll just wait on 50 seconds five zero Would it be kevin? Maybe for you it would be maybe for someone else it wouldn't be You know, sometimes I think about what I'd pick sometimes I don't think if I would think about every every single pick I would make I'd probably I'd probably have my head spinning What would I do here? What would you hear? What would I do here? Uh, so we do these the last one we did was what two weeks or three weeks ago Three weeks ago We're trying to do about one or two per month going forward Yeah, they did all sell out super fast the first five were listed Thursday daytime or wednesday. I forget which one of those days are in the day And the first five sold out within an hour and um Then uh We listed the other five later that evening and they took a little while longer to sell But yeah, they all sold out within like 12 hours or so All right, that is the two minutes there Viviana time to pick a few seconds here. I haven't seen Viviana so I'll give it a few seconds Really carl? That is That's insane This is authenticated. I often do you guys do these? Yeah, uh, it's the ultra Ultra high-end. I'm not sure if or when we'll do it again Joel, we don't have any plans on it right now This is about the price point we want to stick with Maybe a little higher or a little lower depending on what we're trying to do So hopefully we can do some Single sport almanacs those do take a lot longer to put together of course A little a lot more effort to get Same sport cards in the same value range that you want to pack out and everything so make it fair Make it similar to this Okay, I guess I'm gonna have to pick for Viviana. I don't see anything Let me check the chats So there's nothing in twitch And a buy-in was what 600 on this one. All right. Yeah, I don't see anything in chat. So I will pick the Charles Barkley For Viviana Charles Barkley 10 to 10 enshrine signatures fall us in case thought a 20 well a 2021 allow this Charles Uh and Ted Ted Hey appreciate that Joel, uh, Ted's going with the almond raw 70586 Cool. Thank you Ted. Congrats on your almond raw again. It's number to 99 Dude is a stud still slept on. He's he's definitely a top 10 receiver in the league in my opinion and then Brian s is going to get the jail in green rookie signatures choice psa 9 rookie auto All right, that does for almanac sign everybody moving on to some baseball breaks Thank you. Thank you


One of the things that John and I agreed on and have always agreed on is the need to have people's backs during tough times, and that's exactly what we've been focused on and exactly the work that we are doing. This afternoon, when I got to visit Abbotsford and see so many of the extraordinary community volunteers, members of the Canadian Armed Forces, emergency responders and just leaders on the ground who are devastated and heartbroken, but also stepping up to be there, not just for themselves, but for their community, for their neighbours, really does show the strength of British Columbians, the strength of Canadians, and that we're there for each other. We have each other's backs and that's what allows and enables your governments to do that as well. Our first priority is to be there for people, which is why we've deployed over 500 Canadian Armed Forces members with helicopters and planes, almost four and a half million dollars straight to First Nations communities immediately to help them through this moment, and over four million dollars for the Port of Vancouver. And as John just said, really pleased that the federal government and the provincial government are matching donations with the Red Cross. So one dollar donated by you results in three dollars of support for people on the ground who desperately needed. So as always, as Canadians are watching across this country and hearts are going out to folks who are working really, really hard to rebuild their lives and build a stronger future, send them your support, because this is what we do as Canadians. We're there for each other. Premier and I spoke about the support that's needed both right now and into the weeks and months and yes, years to come and we will be there, whether it's immediate support on saving livestock, supporting our farmers who have our backs year in and year out. We need to and will have theirs. We met today. Minister Blair and Minister Farnsworth and I met with frontline workers and responders and it's amazing to see the strength, the resilience, but also the pride of people who've been working long hours, backbreaking work as community volunteers, leaders, armed forces members, being there for each other. But it's not going to be enough for us to just be there now and in the coming weeks. We're going to need to be there for each other in the coming months and in the coming years. Here in BC, in Atlantic Canada, where storms are raging now, and everywhere across the country, where extreme weather events are going to become more frequent. The fight against climate change remains extraordinarily important, but the fight to build a better future, resilient infrastructure in ways that is going to require our governments, municipal, provincial, federal, indigenous to work together always tighter and better is going to be really important, which is why I'm so pleased that John and I have put forward a joint cabinet committee that will deal with disaster response and climate resilience to map out the way forward here in British Columbia and establish a model for how we're going to move forward as a country facing increasing challenges like this. We've got a lot of work to do. I can tell you one of the things that Canadians saw during this pandemic, particularly here in BC, which is when orders of government work together as friends, as partners, focused on the single-minded goal of having Canadians backs, we can do it. And that's what we will continue to do. We do need to address the long-term climate change problems. It can't be just about weather-proofing homes, although that's an important piece. We have to make sure we're investing in communities, investing in our country, getting our country to net zero, investing in support and indeed leadership by indigenous communities whose traditional knowledge and approaches to challenging climate situations are well established and need to be at the table, not just for themselves, but for all of us. These are the kinds of things that we need to do going forward. And this is why governments grounded in science, in reason, in being there for each other, in compassion, but also in strength while working together is what British Columbians deserve and what all Canadians deserve. So I'm so pleased to be able to be with you here tonight, John, to continue this work.  Great to be back in my second home in BC, even if times are tough. We're going to get through this together.


Thank you all for understanding. This is a complicated morning, more for Senator Makowski than us. I mean, she was on her way over here and got hit by a metro bus.  We're so grateful that you're here. This is, of course, you are the senator from the High North in America and have done more than anybody to shape America's thinking about this critical region. And of course, that's led you to become an internationalist because that by definition is what we have to do. And we're thinking about this region. So Senator Makowski has been a leader on both Arctic legislation and has been a leader in trying to get law of the sea finally moving. And I think it's it's emblematic someone that's out on the frontier has to also be out on the intellectual frontier. And she has been doing that. And we're so grateful that you're here. We apologize colleagues that we had to do it this way. And but Senator Makowski, why don't you come up and offer your your remarks. Finally, you're here. Thank you for coming. Well, good morning. And you know, today's going to be one of those days where they're going to be a lot of bus jokes. And I was thinking, as you mentioned, that at least I wasn't thrown under the bus or whatever. But I will tell you coming from Alaska in the land of the earthquakes, when when we got hit, I thought, Oh my gosh, there's an earthquake going on. So it tells you that I'm not a city kid yet. You're probably more used to the to the to the bus vehicular interface. But anyway, I I appreciate the opportunity to be back with you. And my apologies for for interruption of the panel. I know that that is intrusive. But I think you you got the the good excuse this morning, it's better than dog eating the homework. I want to thank CSIS and the Norwegian Institute for defense studies for sponsoring the conference that you have before us. You've got a great panel, a great panel of some of the top experts on the Arctic as as speakers and panelists. I really wish that I could could attend so much of what you have in front of you today. I'm going to have to rely on on my staff aren't here for some of that. But I I do think you've put together a great group. It is it is indeed a great opportunity for me to be here to talk about the Arctic and and john has noted my involvement. But it is one of those subject areas when I get talking is a lot of passion for the issue passion for what is happening up north and and for the opportunities that present themselves. There is as you know, a growing public interest in the region is primarily due to the impacts of climate change, the loss of the sea ice, the increased access to natural resources. Of course, the attention on the polar bear is also attracted a great deal of interest there in the high north. But the significance of the region, both from the Arctic and the non Arctic states is clearly gaining in appreciation. I believe that we're at a critical time in the Arctic and many of you have heard me say that there are two paths that we can go on with regards to international relations. One is a path of competition and conflict. The other is one of cooperation and diplomacy. And I think that the the decision on which path we ultimately take is going to require some dynamic leadership. And one of the first areas that we need to demonstrate that leadership is here in the United States and the Senate ratification of the Convention for the Law of the Sea Treaty. I think it's absolutely crucial, absolutely critical that the United States be a party to the treaty and and a player in the process rather than being an outsider hoping just hoping that our interests are not going to be damaged. Accession to the convention would give current and and future administrations both the enhanced credibility and the leverage and calling upon other nations to meet the convention responsibilities and given the support for the treaty by Arctic nations and the drive to develop natural resources, the treaty will also provide the environmental framework to develop these resources while minimizing the environmental impacts. As you know, the United States is is the only Arctic state that is not a party to the Law of the Sea Convention. The treaty was submitted to the U.S. Senate for approval back in 1994 and we're still waiting. Canada and Denmark joined the treaty in 2003 and 2004 respectively. But until the U.S. exceeds to the treaty, it cannot submit its data regarding the extent of its extended continental shelf to the commission on the limits of the the continental shelf that's established under the treaty. And without a commission recommendation regarding such data, the legal foundation for ECS limits is is much much less certain than if the U.S. were a party to the treaty. So again, I repeat that we must ratify the treaty, but we're really at somewhat of a stalemate right now insofar as as resolving that. The White House is looking to the Senate to lead and the Senate is waiting for a stronger showing of support from the administration. Now in part, the Senate calendar is is somewhat to blame in this. It's anticipated that if the majority leader would move the treaty to the Senate floor, it it's expected that it would consume at least a week of floor time. And as you know within our process, a week on the floor is is is considerable and considering that we've got a little less than 45 legislative days before we depart for the August recess and and really get into to the thick of the political season. It's it's highly uncertain that such time, you know, a full week of time will be carved out unless unless it becomes a a priority for the administration. And given the president's focus of late on advancing the start treaty, I see even less of an opportunity to schedule the Law of the Sea Treaty this year. And again, unfortunately, failure to ratify continues to keep the US at a disadvantage internationally and outside the process without a seat at the table. I wish I could give you more optimistic news from the from the Senate's perspective, but I'm just being pragmatic about what's going on with within the Senate calendar. Now I spoke of these two possible paths forward and I want to expand on that in a minute. Some have described a scenario where the Arctic is undergoing an arms race or a race for resources, but I'm not necessarily convinced that this is the case. I do believe that we've got some posturing going on, especially between Canada and Russia, but not much of that is is translating into action. The Canadian government's taken a number of steps and statements to assert their sovereignty in the region, including the release of a Northern strategy as well as planning of a military base in the Canadian Arctic, plans to build a build a fleet of ice strength and patrol boats renaming the Northwest Passage, the Canadian Northwest Passage. Russia also has evidence, some increasingly assertive behavior in regards to military and economic expansion in the in the Arctic. The Russian Security Council released details of how it will conduct its Arctic policy. The document is entitled The Fundamentals of Russian State Policy in the Arctic up to 2020 and beyond. Now that document touches upon sustainable development and environmental conservation and even emphasizes the need to preserve the Arctic as a zone of peace and cooperation. And while the new strategy does reaffirm the determination of the country to establish a new military unit designed to protect the country's Arctic territory, the policy is clearly much broader than that. Now here in the United States, we, as you know, have issued an updated policy for the Arctic. This was done in January of 2009, the National Security Presidential Directive on Arctic policy. I'm pleased to see that we're making some some good progress. It was a somewhat lengthy transition with the new administration, but the State Department is leading the effort to implement the policy, and various agencies are moving forward with the implementation, which is good. The U.S. Navy has a new roadmap for the Arctic. I've asked them to study the feasibility of a deep water port in the far north. The study will look to assess whether it's in the strategic best interests of the United States, as I believe it is, to build a port and then determine where that port might be located. A deep water port will clearly not only serve our military and our Coast Guard needs, but as we develop our offshore oil and gas reserves and see more shipping, more tourism, more vessel traffic within the Arctic, we recognize that a deep water port could provide valuable support for these activities as well. This study is anticipated to be complete by 2011. In addition to the Navy study, the U.S. Coast Guard has embarked on their own high-latitude study to determine what assets and infrastructure they need to be prepared for an ice-diminished Arctic. This assessment will also be done by 2011. And I think it's well recognized, and I appreciate the focus and the involvement, the commitment from the Coast Guard. We recognize that with increased maritime activity in the Arctic and such an incredible shortage of infrastructure that it really is vital that we determine what the needs are and then actively work to provide resources to protect the Arctic residents as well as the environment. Now, other nations without coast lines in the Arctic are also showing an increasing interest within the region. The Chinese have one icebreaker. They're planning to build more. They've got a very active polar research program. The South Korean shipyards are now leading the world in construction of icebreakers, mostly of finished design and ice-strengthened tankers and freighters. Both countries, along with Italy and the European Union, have applied for observer status at the Arctic Council. The EU, through the European Commission and the European Parliament, is gradually developing an Arctic policy to address EU interests in the region as well. Now, as we are all very keenly aware, well the Arctic is becoming more and more ice-free in the summer months. Arctic ice is not going to completely disappear. And one of the challenges that we will continue to face as a consequence is that we have an aging icebreaker fleet. As you know, the US has one operating heavy icebreaker, the Polar Sea, and we have one light icebreaker research vessel, the Healy. I was able to get an appropriation to refurbish the other heavy icebreaker, the Polar Star, last year and fund the US Coast Guard to do a study to determine whether or not we need to rebuild or to replace our polar class vessels. But really, no matter what the results of the study, we must make the commitment and gain the commitment of the administration and within Congress. The commitment that says that icebreakers are a national priority. And I'll continue to do all I can to advocate that position, extraordinarily important. Now, as you may have also observed, in the last few years, the governance of the Arctic has become even more complex. In 2008, the five coastal states bordering the Arctic Ocean, Canada, Denmark, Norway, the Russian Federation, and the US, perceiving growing interest in the region and perhaps somewhat preemptively, issued a declaration that reaffirmed their role as the primary stakeholders of the high north. Reinforced the law of the sea as the law of the land and mechanism for resolving potentially overlapping Arctic Ocean claims. But because they did not include the other permanent participants of the Arctic Council, there were a number of concerns raised. And this issue came up just recently in Quebec on March 29th of this year, Secretary of State Hillary Clinton, who I must say has been a real champion for the Arctic in this administration. She was up there for a one day Arctic summit. But only the Arctic coastal states were invited and participated. And Secretary Clinton criticized Canada for not inviting all those with legitimate interest in the polar region. Both the indigenous community and the Arctic nations of Sweden, Finland and Iceland had voiced concerns that they had been left out of that particular conference. Now, while conflict in the region may not be imminent, certainly there are competing interests and competing views within the region. And this really leads to some fundamental questions such as who are the major stakeholders on issues of Arctic governance? What are their interests? What are their roles? We recognize or I certainly recognize and I think those of you in the room recognize that there is great opportunity to work collaboratively and cooperatively. The Arctic is one area where the Obama administration can highlight this international cooperation in the implementation of US foreign policy. And this kind of follows the administration's intent to reset relations with Russia. And the Arctic, I think, is a great place to be starting that. There are many examples of this cooperation that we have seen amongst nations. We've got the Canada-US Arctic cooperation agreement on the Northwest Passage. This bilateral agreement allows for practical cooperation regarding matters relating to the Northwest Passage while affirming that the two countries agree to disagree about the status of the passage under applicable international law. But it demonstrates a capacity to collaborate in functional terms without resolving some of the legal differences. Now, I've mentioned the Arctic Council, but there are other effective forums for international dialogue on the Arctic, including the Standing Committee of Arctic Parliamentarians, of which I'm a member. We have the Nordic Council of Ministers, the Barron's Euro Arctic Council, the Northern Forum. We've also got to recognize the valuable contribution that organizations like the Inuit Circumpolar Council have played in representing the indigenous people's interests in the far north. There are many, many agreements that we can cite to between the Arctic states with regards to the fisheries alone. We've got agreements between Norway, Iceland, the Russian Federation in the Barents Sea, the United States and Russia on Pollock stocks in the Bering Sea and the EU and Norway in Svalbard. My former colleague, Senator Ted Stephens and I, we introduced a Senate resolution that became law back in 2008 that calls on the US to enter into international discussions, take necessary steps with other Arctic nations to agree on management of migratory transboundary and straddling fish stocks within the Arctic Ocean. And I'm pleased that the administration has been doing so at every opportunity, including when Secretary Clinton met with foreign ministers of other Arctic coastal nations in Canada last month. And in October of last year, Anchorage played host to the International Arctic Fisheries Symposium, which brought together scientists, fisheries managers, policymakers from around the Arctic region to consider those next steps. And I understand now that Norway is offering to host a follow-up meeting in the near future. But it again is an example of how we promote cooperative scientific research in the changing Arctic ecosystem as a step towards this management of the new fisheries that may occur there. Now, an area of perceived competition is the extended continental shelf claims of the Arctic states. And while there's been a dramatic increase in mapping activity in the Arctic, it's actually, I think, an area where we're seeing a fair amount of agreement. Canada and Greenland have agreed on delimitation of the continental shelf between them, as Norway has with Iceland and Greenland on Jan Mayen Island. The US and Canada have been working the last two summers on extended continental shelf data collection in the Arctic. They're scheduled to work again this summer. The US icebreaker Healy completed the second summer of joint mapping with the Canadian icebreaker, the Louis Saint Laurent. And though each ship has their own equipment in order to accomplish the mission, combining their efforts provides better data, they can cover more area together. We're also seeing Norway and Russia working together to jointly survey the Barents Sea area. And in the latest development of international cooperation, just yesterday, Russia and Norway announced that they have reached agreement on the resolution of their maritime boundary in the Arctic and on the management of fisheries and potential mineral development in the region. The next step is to develop a treaty between the two nations and regulations governing joint development of the resources. I think this agreement is a significant step towards eliminating the most significant boundary dispute among the Arctic states. I know there will be much for the discussion about the Arctic Marine Shipping Assessment that recommends the comprehensive multinational Arctic search and rescue instrument amongst the eight Arctic nations. But I'm pleased to report that the US State Department, the Russian Federation, are leading the negotiations with the goal of having an agreement ready to be signed by the Arctic ministers when the Arctic Council convenes in April of next year. And then, of course, the great collaboration and cooperation that took place with the International Polar Year, which lasted from 2007 to 2009, certainly a collaborative multinational effort that was really quite considerable. So really what does the future hold for the Arctic? I believe that the pace of change in the Arctic demands, demands that greater attention be focused on the region. The implications of the dynamic changing Arctic for the residents and the important security, economic, environmental, and political interest depend on it. But again, the question must be asked is whether or not this is going to be an area of multilateral cooperation or whether it will be an area of conflict. But I remain confident, hopeful certainly, that it will be one of cooperation. But it will take robust diplomacy and very likely recognition as Secretary Clinton has reminded us that the interest in the Arctic is not just limited to the five Arctic coastal states or even the eight countries who are the permanent members of the Arctic Council. It'll take a level of cooperation and collaboration to include the non-Arctic states as well. I am pleased that it seems like it's been a long time, ever so, ever so slowly, the United States is waking up to the fact that we are indeed an Arctic nation. And it has taken a lot of work by many of you in this room to have folks at a policy level not only accept indoors but to embrace the fact that we are an Arctic nation. And I'm confident that with the leadership of members of Congress, the administration from the Arctic community at large, we can continue to highlight the strategic importance of the Arctic for this country. With that, again, I thank you for all that you do on this very, very important issue in this incredible part of our globe. Thank you very much.


My name is Justin, I'm president of the online internet everywhere, it's talking to me. I'm going to be talking about rail security as indicated by the title of the talk. Quick announcement though, there's another security talk schedule, the same time slot. Everything is changed about that talk except the room. So the title changed, the reasons are changed, and the time changed. But it's in that same 204 each. So if you're like, oh man, I wish I were going to that other security talk, you can still go to that talk and go through this one too. So I just want to make sure you know about that. In case you're wondering what my credentials are to stand up here and talk about security, and if you came to this talk wanting to know how to hack, I got it right here for you, I figured it out late last year. Turn off the lights in your room, turn on the backlight on your keyboard, and start hacking. That's all there is to it. If you came to this talk to learn how to hack, you're done. Okay, I hate agenda slides, but I thought I would do one anyway. Because I want to make sure that you know what this talk is going to be about. This is not going to be a talk about the OAS top 10. It's not going to be an in-depth talk of how to hack Rails or anything of that nature. This is really kind of a very broad overview of what Rails gives you security-wise. What it doesn't give you, that's actually the bigger section, and it's really more like the complaining about what it doesn't give you. And then a very short section at the end about what to do about this situation. So first up, cross-site scripting, always have to start with cross-site scripting. Rails 2, who's using Rails 2? Yeah, see, never goes away. So back in Rails 2, kind of a bad situation. You had to make sure you manually escaped everything in your views. Rails 3, everyone rejoiced escaping was the default. Yes, I'm sure some people were upset that they had to go through and like remove all those h's from all their views, but this is like way better from security standpoint. Everything gets escaped by default. In case you're unaware, this is what it looks like to write views in Rails. If you don't do anything, it's escaped, views raw, it's not escaped. If you use .html save, it is not escaped. What happens when you don't escape things? You get cross-site scripting. My favorite one looks like this. This is a super neat attack, calling alert 1. That's my favorite one. A little bit more complicated. You may have seen this. Quite embarrassing. A little last year, a tweet deck had an excess problem. So it managed to fit this script into a tweet. Effectively called part tweet. And essentially what it did was it would click its own retweet button. So if you saw this tweet in a tweet deck, it would retweet itself. As you can see down there, about 84,000 retweets with this screenshot mistaken. Well, I don't know when this screenshot was taken. It was during the whole incident. And that part is not actually extraneous. It's the key to the whole thing. I can tell you about it later if you'd like. If you want to scare yourself and your friends, you can use WEEF, which stands for Router Exploitation Framework. It's not related to me in any way, but it's actually a rail, not a Rails app. It's Ruby and WEEF is built on Sinatra. And you can do horrible things if you find cross-site scripting on site. Check it out if you're interested. Rails gives you a lot of pretty safe helper methods, which you should use. It's kind of nice. You don't have to write a lot of HTML by hand. And HTML, no, that's not true, actually, you do. But you can use these tags. They're safe-ish. I can't vouch for their total safety. Certainly things like content tag or other sort of generic tags where you just drop in your own HTML. Probably not very safe. You should be careful. All right. Excesses. I love this example because this is an example everyone uses for cross-site request ordering. You have your website or your bank website open to one tab.  It makes your request to your bank. And you have this transfer of some money. Now, I want you to notice, though, that my bank account has so much money in it. I wouldn't even notice if 100,000 disappeared. So, you know. But other people, you know, they probably care about that and not money. Does anyone find, like, this pack kind of strange? Like, why did one website make your request to another one? And, like, it affects your login session? Is that weird to anyone? It's kind of weird to me. Does anyone know the answer to why that happens? And why does this even work? Yes, who said that? I like you a lot. The one weird answer is cookies. Yeah. So your cookies get sent along. So if you're logged in, the request will be as if you're logged in. You're probably all aware of this, but I just want to make sure that we're on the same page here. So Rails, out of the box, it's offered this way all the time. It's really nice. Gives you C-SERF protection. I'm going to say C-SERF because it's way shorter than cross-site request 4.3. The fancy term for this is synchronize your token pattern. You have a token in your session. You have a token in the form. When the form gets submitted, you validate that the token in the form is the same as the one in your session. It probably came from that user. You're all good to go. You probably all know this. Add some meta tags to your page so you can pull it out in JavaScript if you need to. Use the form helpers. It gives you this hidden input with an authenticity token. And it all just works. It's all great. Other frameworks would, I mean some other frameworks would love to have this kind of thing. Other frameworks have other frameworks. Mess assignment. It's awesome because everyone knows about it because of GitHub. And it's sad for GitHub. But it's good for the Rails community as a whole because people find out, hey, this is actually a problem, not just a cool feature. So this was the old way. So just drop your rounds in and save. And if you do that, someone can drop in like admin equals true. And it sets it up model. And now there you go. So now we've got to revisit some history. Okay, so Rails 2. You could wait for blacklist, the attributes that you can mess assign on models. Then in Rails 3.1, it became an option that you could pick to say all my models must have a waiters. Those are nice and true then. Rails 3.2.3. If you generate a new app, then that configuration was set to true by default. Also very nice. Rails 4, strong params came along. Now you have to waitlist on assignment. This is also pretty good. There's different philosophies. And if you still want to use the old way, waitlisting it on the model, there are gems that will allow you to do that. But all in all, this is good stuff. It's moving in the right direction, right? Towards the scene. That's the way we want to go. Looks like this. You probably don't know. If you require a parameter area, but anything else in that comes in, it's not going to work. Rails, by default, will use a cookie session store, which means all your session stuff goes into a cookie. Rails 2.3, that was assigned session cookie. It's nice. So use the secret value, sign it, and basically, yeah, you have this cookie sitting on your machine, you couldn't really change, right? Because that would be really bad if you could just arbitrarily set values in your session. That would be quite bad. Rails 4, they switch to encrypted session cookies, which is also like a good move, and they switch to using JSON, not marshaling and un-marshaling. It's also a good move. So again, we're moving in the right direction. These are all good things. I'm telling you all the good news up front. Right? Simple injection protection. Actually, just like saying, injection protection. Injection protection. All right. So Rails 2.3, you have your nice parameterized queries. That's the way to do it. Everyone knows parameterized your queries. Rails 4, introduced R-Roll, or R-Roll, or A-Roll. As far as I can tell, if you use that, it's safe. I could be wrong if you're here and you know that I'm wrong. Please let me know. So I stopped saying that. But it seems like it's pretty safe. I give you built-in queries to using that. It's basically safe from injection attacks. So, cool. Rails will give you all these nice, nifty security headers. So, X-Content type options set to no snip so that Internet Explorer doesn't try to guess what content type you're sending, which always ends badly. X-Train options set to same origin, so no one is hiring you, and for click-jacking attacks, XSS protection turned on, set to blocked, tell the browser, hey, if you happen to implement automatic XSS protection, use it. I'll give things. If you set force SSL to true, then you'll get a list of yes headers, which basically tell the browser, hey, never use a clean HTTP connection to connect to me. Always use SSL. Even if you click a link that isn't SSL, use SSL anyway. So that's nice. Oh, we got through that fast. Okay. So like I said, this is kind of, this is mostly me complaining, and hopefully you take some of this. I'm hoping that people here will take some of this and say, I'm going to commit fixes for this to Rails, and everyone will be happy. Back to cross-site scripting. I'll give you a moment to read this slide. Okay. If you think no one gets this wrong, you are wrong, I have talked to people, and they said, oh, it doesn't make it safe. So, I mean, you got to think about something coming in Rails, they've never used it before. They see this method. Looks like it makes it safe. It doesn't make it safe. Unsafe. This I just found out this week. I don't understand it. If you understand it, please let me know because I'd like to be wrong, but it looks like even in the latest Rails 3.2, it does not escape JSON when you call it to JSON. I don't understand, but if you do, please let me know. Rails 4, it's awesome. It encodes it with the like backslash U. It's totally safe. On the client side, it doesn't matter, it's interpreted the same, but it's safe from cross-sites scripting. You know what would be really nice, though? Is if we had contextual encoding. Because who knows what all these methods do? There's one called sanitize. Sanitize what? From what? To what? I don't know. I mean, I do know, but you can't tell from the name, right? And then you have like HTML escape, escape once, escape JavaScript, escape once, escape. Like cgi.escape. I don't know. I mean, I do know. Could you guess what it does? Probably not. You know what's nice though? Contextual encoding, which tells, it can tell where you are on a page, if you're inside a tag, if you're in JavaScript, if you're inside an attribute, and then it does the proper escaping. It's really cool. It would be nice if someone would implement it. Cicer protection is pretty awesome in Rails, but it's not as awesome as it could be, right? So you have to make sure that actually, you're using posts, or something like posts. So if you're using git, you know, you don't need protection. And you have to make sure that you don't even allow git, right? It's just because your web app is using posts, doesn't mean the endpoint will accept the git. If someone sends a git request, you don't get Cicer protection. Another thing that's kind of, you know, just a fact of light, is you've got to use the form helper if you want those automatic tokens inserted, otherwise you've got to do it yourself. Another thing to be aware of, Cicer tokens persist per session, so they kind of hang around for a while. It's not necessarily a bad thing, but you can kind of imagine that you might want that to be less long-lived than a session made. What happens when there's a failure when you get a token and it doesn't match what you expected? These, if these look like odd version numbers to you, they did to meet you. So Rails 2 through 3.0.3, it would raise an exception. You know, a price seen in it. Rails 3.0.4 through 3.2.1, which is the latest, 3.2, it calls a method called unverified request, and then it just resets the session. But the request still gets processed. It's just the session gets reset. Rails 4, the default, if you generate a new app, is to raise an exception. If you don't give protection for ordinary options, though, it goes back to this, oh, we'll just clear out the session. So what? Why am I talking about this? Imagine you had an awesome method like this, where all I'm doing is taking the parameters and transferring monies. I believe the transferring monies looks like this or something. I don't know. I'm not a big... So, the two links down at the bottom, the first one was from GitHub's bug bounty. They just published it this week. They paid out the bounty because of a bug where they were actually caching the session. So Rails would clear out the session, you know, like when you actually use the variable session. That was cleared out, but they'd cached those values somewhere else. So it did no good. The second one is a block from Invisium from last year in some client's code. The client had implemented the sessions in a totally different cookie. So it wasn't in the Rails session cookie, it was in some other cookie. So yeah, I cleared out the Rails session cookie, but not the one that they were actually using. So that's bad. I mean, ideally when you have this kind of failure, just stop the request. Why would you ever want to continue processing your request when it seems like someone's performing an attack? So, raise exceptions. Yeah. Speaking of sessions, this one still blows my mind. Server-side sessions are not the default. You may be saying, yeah, cookies are so fast but it's awesome, I don't have to have the database. But did you know that when you install Rails you have to install a database? So we're using the least safe default which is using sessions, sorry, cookies for sessions. When we could just be using a database because you have to install one anyways just to run Rails new. So what? Well, Rails session cookies are forever. If you get a session cookie, and we're talking about using the cookie store here, it lasts forever. It's valid forever unless you code something on the server side to deal with that. Otherwise, they're valid forever. The probably even bigger problem though is that you can't manage it on the server. You want to tell your user, hey, you have like five sessions and one is in China and you're in Atlanta.  By default, this is the default thing. Pre-Rail score when cookies are correct and encrypted they're super simple to decode. So if you came to this talk and you're like, I want to be a hacker. If the keyboard and the dark thing wasn't good enough for you, here's the second step. This is how easy it is to decode a session cookie from Rails. You just split it because the second thing after the dash dash is the signature. We don't care about that. Basically 64 decode it. Load it with Marshall. Boom, there's your session. That's the major problem with storing sessions in cookies is that you may accidentally put something sensitive in it. I don't believe that. Probably you're not actually putting this stuff in it, but you never know what someone's going to put in the session.  This one. Who here has a Rails app and it doesn't have a user model? It does not have a user model. I'm seeing like less than 10 hands. Okay. Rails doesn't have any like account management stuff built in except for it has secure password, which I, you know, okay. It's good to have. So, it's kind of crazy that that's not built in to me. It'd be nice if it was. No authorization framework. I guess you can, you know, build stuff with your before filters. This is an even bigger problem though. The Rails doesn't provide you any protection against directory traversal. So, it will happily render any file that you give it, no matter where it lives. And you can sit in any file, you know, if you have a code that looks like this. And remember that it's, when you render a file, it's actually executed pretty good. So, keep that in mind. This, though, depends a little on your server setup. Your web server itself may actually have this kind of protection. Hopefully you're limiting what your Rails app can actually access, or things, but out of the box it doesn't give you anything. Am I complaining enough? Alright. And again, this isn't because, like, I'm trying to disrail for anything. People say distil, disrails. Just make me feel really old. Okay. But because I'm hoping someone will fix it. And I'm hoping that someone's not me. Anyway, I double checked. Last night, all these methods are vulnerable to SQL injection on the latest Rails. You may be surprised because they look very innocuous. I made a website, Rails sqli.org. It lists a whole bunch of methods, active record methods with some example queries. And you can go look at it and see what to do. But what a lot of people don't realize is that you could clone that, like a Rails app. A very horrible Rails app where you can plug in whatever queries you want and play around with this. And it gives you sort of like, okay, this is the code that's going to execute. You can put in the parameter value for, you know, for this parameter and then you can run it and see what happens and check out the query and see the results and just kind of play around with it. I believe it updated for Rails 4. I went through, I think, with 4.0 and updated some things. What I would really love is someone else would go through and update it with, like, Rails 4.2 information because there may be new methods or there may be old ones that are gone or there may be old ones that have now come safe. It's possible. So just go there, download it, send me a pull request that would be possible. This is the most bagging I've ever done in a talk. But sometimes queries are so complex that you can't use the SQL methods that are provided by Rails. That's a joke about this query. Sorry.  So you might go look at the docs and be like, well, sanitization, that sounds good. And you know what else sounds really good? Sanitized SQL. That sounds exactly what I want. So you put it in your code because you don't actually read the docs. That's important. You just put it in your code.  Nothing? More than nothing. I added a method. What happens? You get this. A defined method. But let's say you did a little bit of digging. You're like, ah, it's on the class. So I'll just get the class and call sanitized SQL. What happens? Does anyone know? Private method. It's a protected method. We're Ruby is here. We don't believe in protected methods. So you're right. It's a protected method.  They don't give you an API. Just make your own. All right. So let's try this out. We're going to have classic SQL injection input here. We're going to pass it in to sanitize. That's on what happens? This is the most interactive part of the talk. No one knows. Because who knows what happens? Correct. Correct. Why? Because you didn't read the docs. It's actually expecting something like this. It works. It's not fun, so I'm not going to ask you. This is what escaping single quotes looks like in SQLite just kind of doubles them up. So, okay, we got that working. There's also this form which gives you a slightly different query. That's cool. Way harder than I think it probably needed to be. And probably some of you in here are like, yeah, but that's because you were in an instance method. If you were in a class method of your model, that would have worked just fine.  I just looked up the method and tried to use it. And it was really hard. That should be better. You got to do it yourself. Perfection, really awkward. You could like use URI parse and get the path, but actually you have to do something more like this because it will raise an exception if it's not a valid URI. So I wish there was just a safe redirect. That would be nice. Who in here is a Rails core committer? Does this look familiar slash dangerous to anyone? That home URL probably came from user input and therefore it's not safe and it's not escape. Yeah, it's not safe, but I'm sending it to link2, isn't that safe? Yeah, yeah, exactly. So I'm going to just put this in and assume as soon as someone clicks the link, there you go, success. My favorite one, which is a lurk one, post and a couple of talks. Apparently a couple of years ago I didn't realize it was so old. Rails insecure default. So there's a whole other list of things that Rails doesn't give you. Some of which have changed and some of which haven't. So you can check that out. You're all waiting, where's the cat picture? When's he going to shell this as cat? I know you were. Yeah, you can follow my cat on the internet and have him photo the cat. He's very lonely, he wants more followers so he asked me to throw him in here. Okay, to wrap this up I'm going to go through this kind of quickly because people probably have questions or corrections that they would like to shell at me. So what to do about it? First step. Learn about security. You've all taken the first step. Congratulations. Good job. Next step. Fix all the things that I just mentioned. That would be nice. That would be nice if someone did that. That would be really nice. You can use some libraries. This is not like a comprehensive list or even necessarily recommended libraries. But these are some libraries that exist that you might want to check out. Rack attack for rate limiting, secure headers or secure headers. But in particular, you want to add content security policy to your site, which you do. You can ask me later about it if you want. Access control. You're probably familiar with the libraries we've had. Everyone uses on the off and the bias, so you're familiar. That's a good idea. You might want to use some static analysis tools. There's one called Breakman. I don't know, it's kind of good. You might want to try it. Some guy wrote dependencies for known vulnerabilities. And it also would be kind of cool if more people sort of jumped on that and contributed to the I didn't look it up, so I forget the name of it, but the gate repo that it actually pulls the vulnerabilities from. I think that actually needs more people pushing the stuff to it. Nice thing about static analysis tools. I don't know if you've ever seen a graph like this. At least 50 of them on the internet. They all kind of look like this. The idea is on the left, you probably can't read it because they're also small. On the left, that's like when you start developing. You're doing your planning, your design, that kind of stuff. On the far right is you've already deployed. And the graph is the cost of fixing problems at any point along that graph. Problems could include security problems or other bugs. But we're in a security talk, so security problems. If you fix it way on the left, it's cheap. If you are typing code and then you back slap, back slap, back space, back space, and then type new code, that cost almost nothing. What about like you're in a design meeting and someone's like maybe you don't do it that way, you do it the same way. What did that cost? Almost nothing. That's awesome. That's what you want to do. At the other and you're at home, asleep on the weekend at 1am you get paged and you have to get out. You fix the security vulnerability. The cost is through the root. Not to mention if the users are affected and business is affected all of that stuff. So cost is very high. The point is you want to fix stuff early as possible. Nice thing about static analysis. I'm going to get unbiased, but the nice thing about static analysis is you can do it really early. This is a plan that came up with Twitter, which is where I work, which I didn't even mention, but sorry, forgot. This is the plan that we came up with. It's not a bad plan. The plan was use static analysis so that we can do stuff early. Look at all the code, before it ships. That's a good thing. My personal favorite don't fix vulnerabilities. Prevent them from ever. Get them out of the code. Don't ever ship them to production. That's the ideal. Options for doing that, you could use something like guard or guard breakman and run as soon as you change code and save file. It's pretty cool. You can get into your commit tools somehow. It's a good place. Continuous integration, maybe with the Jenkins plugin for breakman.  Whatever continuous integration you use, it's really easy to throw breakman in there. Lots of people are doing it. If you can get into your release process somewhere, maybe right before code ships you run breakman on it or run their audit or some other tool, that's also good. Just some options for you. If you're interested in more about that kind of thing, this is extremely self-promoting, but you can watch these two talks that I either gave or was involved in. The first one was at Netflix, and it's really short. It's a good, like, inst version of lessons learned with trying to get security into the software development lifecycle and stuff. And the one on the bottom is the one that people got really excited about a few years at conference. Myself and my co-workers talked about automation stuff. People really like it, and you might like it too. Be safe. I'm at president B, at breakman, and don't spread it around or anything, but we're working on a commercial version of breakman. If you're interested, don't talk to me. That's it.


Okay, we're live. Hi, everyone. Welcome to Greg and Allie on set. Yep. Look at that sexy man of mine. I'm right. Look at me. You are edible. Okay, look at you. I agree. Look at you. You look fan-fucking-tastic, hot, sexy, gorgeous. Wow. Well, you got me. This is it. This is it. Love. Hi, everyone. Hello, everyone. Goodbye, everyone. Hey, Bella. How are you? Hello. I love the way she says hi, kids. Hi, Tila Z. Thanks for joining. Hi. Welcome aboard. Hello. Yeah. We'll be going completely live and uncensored. This is just our pre-game show. I can't really talk about stuff, but just a heads up saying that at eight o'clock we're going to be live and uncensored, and there we can talk about everything. And we do. And we do. And we do. Yeah. Love it. How are you all? Yeah. They said from Roswell, Georgia. Uh-huh. Is that where the crash was? No, it's for us. No, no. Different Roswell. Hi to Dottie from Michigan. Hi, Dottie. Debbie, welcome. Thank you, Debbie. Yeah. It feels good to just sit back on my couch. Good. Yeah. Good. You can pronounce that one, my love. You can pronounce that one. Baha, girl. Okay. Hello. Okay, that's just right down the road. It's maybe from Sarasota. I don't know, 35 minutes away, maybe. 40, depending on where you're going. So kind of frazzled. What have you been doing? Should we ask what you've been doing? So, Shannon? Hello, Shannon. Hi, Shannon. Skyler joining us back again. Hello, Skyler. About two steps. All right, one more. Yeah, on the island. Dog days of summer. I've not heard that expression. No. No. Yeah, that's basically like August. When it gets really hot and your dog tired and you really don't have a lot of energy. Yeah. Hey. Yeah, that's new. It's a new one. Uh-huh. Well, cheers, my love. Not yours. Ah, I got some water over here. I'll cheers you with. Oh, what are you guys drinking at home? Are you drinking? What are you doing? So, I'm visiting my daughter who moved here in April. She has a lot of stuff. A lot of stuff, does she? Okay. Four-day heat wave in Pennsylvania. Okay. Yeah, we're going to Rumble at 8 p.m. You're on Facebook, so that link will be right above this video. If you're watching on YouTube, it'll be right below this video for our 8 o'clock Uncensored show. Yeah. Debbie's drinking water. What? What? I know you don't. So, I changed things around a little on my, I'm supposed to be drinking like 7, 16-ounce cups, bottles, glasses of water every day, but what I do is I've been starting out with V8 juice because I'm not big on vegetables. So, I'll do 16 ounces of V8 juice in the morning and then drink water throughout the day. And the reason I do that is because V8 juice, I have bought low sodium and the regular. I don't think it matters, but because of the salt that's in the V8 juice, all the water I drink throughout the days, throughout the day is absorbed through my cells because of the salt and the V8 juice. So, I'm getting my vegetables, the salt, I'm getting the water absorption because before when I was just drinking water all throughout the day and not doing the V8 in the morning, I would just piss so much and so often. But that's why I also, at the end of the day, I have one big 16-ounce glass of V8 juice and that way I'm not peeing all night, my body's absorbing the water and the liquids and I'm not peeing, getting up to pee five times a night. So, getting this down to a science. I admire you, my love. I'm just doing that 12-hour fasting thing. Uh-huh. How's that going? All right. It's quite easy. Yeah. Diet Lipton Green Tea? Lipton Green Tea. Now, that, that, I remember, Lipton Green Tea. I remember the Nest Tea commercials back, taking the Nest Tea plunge and they just lean back and they fall into a pool or a lake. Jim, you ever see that commercial? Nest Tea Plunge. You have different commercials to, to us, I think. I don't think ours the same at all. Yeah. Uh-huh. Debbie Emple said, coffee is my drink. Do you like iced coffee? I've never tried iced coffee or iced tea. Have you? You've never tried iced tea. It's not a thing much over here. I guess not. Yeah. That's, that's, it's really big here in the south, you know, the United States.  So it's either sweetened or unsweetened, you know, but, you know, people have their own preferences. I'm not big on iced tea, but if I were to drink it, I'd probably use green tea to make my iced tea because it's really healthy green tea. LG from Southern California. Hello. Oh, that's, I've never, not seen that. S-O-K-L, K-A-L. Southern California. That's different. Yeah. So Cal, Southern California. Okay. Yeah. You're learning. L-Z, Allie, I watch Big Jet Live out of Heathrow Airport in London. Are you familiar with that live YouTube? I've seen something similar. Yeah. Yeah. Obviously we are, we kind of look out for, like, American, you know, customs and, and Australian customs and things like that. London. Yeah. See, we always watch the other country, I suppose. Funny. Hi, Julia. Julia. It's a new name. Okay, Julia. I think so. Welcome. So Debbie says she chugs, chugs a huge bottle quickly. That's what, yeah. So coffee is my drink, says Debbie. We've got LG and L-Z here. Yes. Yes. So Sarasota is about 30 minutes away. I quit drinking two years ago because of being diagnosed with cirrhosis. I'm fine now. Table salt that. Yeah. I'm big on Himalayan sea salt. Huge. I don't own any Morton's iodized salt. Yeah. Yeah. I'm hoping you're okay. That's horrible. A friend of mine's mama had that and it wasn't through drinking.  The hot girl says my daughter loves the green tea. Yes, I saw that commercial. Debbie's, that's a cool commercial. Yeah. It was a great lunch. Shannon remembers that. You guys get excited. I remember a conversation that you guys all had about some other commercials that were cool. We don't really rave about any commercials now, do we? Super things get stuck in your mind. Like there used to be this Nestle's jingle back in the day. A lot of songs used to have jingles to them.  Back in the day, they had this Nestle's commercial where they would say, any STLES? Nestle's has the very best chocolate. Yeah. This is an eagle. And that's stuck in my mind. I can't get rid of it. I can't shake it. Hello, Linda. Lovely. Nice time. I just got home from a lovely farmer's market. Here. Nice. We've only just seen her as well, haven't we? I had my Patreon video tap where we all had readings, gave readings. So that was lovely. A lot of people do what's called sun tea, which makes sense, especially here in Florida. And what they'll do is they'll take a big glass jar, like a half gallon or a gallon, and they'll put their teabags in there and let it sit out in the sun. So you get the energy of the sun and all the flavor from whatever tea it is that you're using, sun tea. Yeah. You know how I drink my tea, though, don't you? Literally, it's three seconds in hot water in this out. Yeah. Literally, three seconds. I don't like the taste of tea much. I don't like the taste of coffee much, but it just flavored hot to me. Yeah. I've never made a pot of coffee, period. I couldn't tell you how to do it. I don't know how. Never made one. I'm going to keep those hurricanes away from Florida with Organite in other ways. Awesome. Thank you. We appreciate that. Yeah. Keep my baby safe. I have tea mixed with lemonade. Yeah. Yeah. It's called an Arnold Palmer. Yeah. Lemonade and tea. Yeah. No. This is all new to me. Yeah. Yeah. Learning some American customs. Hey Sarah. Oh, are you Sarah? Yeah. A lot of the commercials seem to be about pharmaceuticals. Man, they can spend a lot of money on that. Can't they? Yes. Whoops. You keep... Nestle's makes the very best. You got it. What's far fell, Dutty? I don't know. Don't know what far fell is. Far fells melt, slam shot. Yeah. What's that? Let us know. Yeah. Is everyone talking about being tired with all the energies coming in? We can heal. I've been drinking lion's main organic coffee. Yeah. You know, there are lots of energies coming in. That's for sure. Yeah. Did I read it right? That sound of freedom is now 100 million. Oh my gosh. That's crazy. Yep. 100 million. Has any film ever created that much money? This quickly? Sure. That's a good question. I don't know. My love. I bet you it's a record breaker. Wow. Hi, Julie. Welcome. Hello. Claudia. And did we miss Patty Simmons? We missed Rob. No sugar. Patty Simmons. Yeah, we did. Oh, there she is. Hello, Patty. Hi, Patty. Thank you. Basil. You say basil. We say basil. Yeah. To your tea. Isn't basil a name? Like a British name? Yeah. Basil Volte from Volte Towers. It was a comedian. It was on Austin Powers. One of the character's names was Basil, I believe. Really? Yeah. Like typical British names. Basil. Basil. Nigel. Nobody's name Nigel here in the United States. Is there not? No? No Nigel? No, no, no. There's no quarries either or there's no... I don't know what else names you've got over there. I don't have any of those. You probably don't have any Greggs over there. We do. You do? Yes. I've never heard of a British Gregg. Yeah. Oh, yeah. Hmm. Okay. Oh, it is. Was this part of a pop, plot, plot, fizz? Alka-Seltzer. Oh, whatever it is. I remember that. Yes. That was over here. Yeah. Or what was that one? That's a spicy meatball. Yeah. Yeah. I think that was for Alka-Seltzer. It could have been Rollets. It was some antacid. All I remember is that's a spicy meatball. Yeah. How is the heat in Florida? Here in Maryland it was 108. There?  Not here. Not here. Not here. Look. Oh. Not here. Goodness, no. Yeah. It's hotter in Maryland than it is here, but we've been in the low to mid 90s every day, basically the whole month, with lows in the upper or the mid to low 80s. So we haven't had a break. I've lost my tan. I haven't been out all month.  I have. Lost his tan. I'd show you my tan line. Get up close to me. Definitely. You haven't lost your tan. You don't even see a tan line. Woo-woo. No tan line. I have not. One day it will be back just like that. Yeah. Well, that's the thing. I can get it back in a week because the sun is so strong here. I go out for four or five hours for like three days in a week. It'll all come back. I was having this conversation in Patreon chat and I watched this farming channel and they're putting out these tea posts.  There's no sunburn. There's nothing that's still white. Wow. How is that possible? They must put on like zinc oxide all over them or, you know, 100 SPF sunblock. I don't know. I always put sunblock on my face when I go to the beach and it's usually 30 SPF, but you've seen my face sunburnt many times despite having, because I sweat it off when I'm bocce ball and I'm so far away from my sunblock that by the time I get back I started to get a sunburn. Yeah. Yeah. Okay. So this answers that question. Only daddy knew this though. Farfall was the dog in the Nestle's commercial. I had no idea. I don't remember that. No. No idea. It kind of sounds like that name of the dog that Jerry Seinfeld had to watch in the episode of where he was flying back to New York from doing a gig and there's an old man that was next to him and he had some dog that was traveling on the plane as well and the old man had some kind of heart condition and they had to send him to the hospital and then Seinfeld had to watch his dog and I think his name was Farfall. I think that was his name. So anyway, that was a long story. Sorry. Let's continue on. You love that program. You love it. Hi, Stephanie. I just found and subscribed to your channel yesterday and I'm having so much fun getting you guys in your community. Oh, that's awesome, Stephanie. Thank you. Thank you. Thanks for being part of our N5D family. Yeah, thank you. If anybody's got any questions they want to ask, the dice, just let me know. Have them here. It can be personal questions. Up to you. A drink I like to make is structured water, spearmint, grown on my balcony and lemon. Let it sit for a day or two. Very refreshing. Very good. What is the structured water? I'm not sure. I'm assuming that it's just putting it out there and letting the sun take care of all the sun and whatever it is that you're putting in there kind of charges it. Okay. I'm learning stuff today. Hi, Joyce. Hi, Joyce. Good to see you again. Hi, Jill. Aloha. Long time no see indeed. Good to see you as well. Thanks for joining us, Jill. Hello, Jill. We're missing loads of comments. I think we're jumping. Very few Nigels. I think, well, we have to because we're only got six minutes left and we're falling behind. Oh, I thought you. Okay. Gotcha. I gotcha. Hi to Claudia. No guy from England. My name is Jason. Anybody wants to join us over on Rumble. Hi, Claudia. Yeah, Jason's over here. My neighbor's called Jason. That's Moe's other owner. Yeah. So, Jill Nicholas. Is that a new name here? Is that new? Well, I'm a pale face now. Me too, says Julie. So, is it for the same reason, Julie? Because it's just too friggin' hot to go out. Yeah, the winters here are fantastic. Actually, you know, we have like four, maybe five months of really hot weather and then the rest of the year is amazing. Most of my dogs out in the heat is for ten minutes, five in the afternoon. That's when the turtle comes out from wherever you get a scraped bleeding leg. So, I put colloidal silver on it and got better. Awesome. Aw. Aw. Now, you put that on the dog or the turtle? Yeah. Actually, it could have been either the way she wrote that. Jill's got a question. Will I be moving back to Hawaii this fall? Okay. So, that's eleven, twelve, three celebration. Yes, it will be around a celebration time. So, it will be around a Christmas. One of the celebration times. But yes, you will. Yeah, fall. So, it will be Christmas. Yes. It's an amazing show. What's the deal with schedules? I would like to know schedules. I've not watched it. I think I've watched one, but it didn't grab me put it that way. It didn't grab me. Okay. So, it was the turtle that she helped. Okay. That's what I thought when I wasn't sure. All right. Here you go. I'm stretching water from the light cellar. They filter the water through copper pipe and several filters. It's free by donation. Very sweet. That's awesome, Linda. Okay. Yeah. Here's one question for you. I've been single for thirty years. Will I ever find someone? Okay. Well, I would change those yellow gloves and maybe do something about those ears on top instead of ... You've got a 13. No, you've got 12, which is three. So, three is celebration. So, yes, Dotty, but the thing is you're not manifesting it. And that could be because you're saying, I haven't got a partner. I haven't got a partner. I haven't got a partner. I haven't got a partner. And so, that brings you more manifesting that you haven't got a partner. So, you need to form the universe by saying, oh, thank you, universe. Well, bring me my perfect partner. They're perfect in every way for me. So, change the mantra. Yeah. And it will bring it quicker. Nice. Yes. Bella's saying that they've had thunderstorms and terrestrial rain nearly every day. The heat is brutal here with the humidity. I've seen it many times where it's been hotter in upstate New York than it is here in Florida. So, yeah, I know that heat that you guys can get. Whoa. Rob, recently acquired 11 puppies. You need to go ... How do you acquire 11 puppies? Unless ... Did you have a dog that was pregnant? No. Wouldn't make sense because you said acquired. So, how do you acquire 11 puppies? And what kind of puppies are there? Yeah. Are they? Yeah. Aw, a little tough. You've only got a minute left. Yeah. Have you got any pictures, Rob, that you can send? Yeah. She says she's been single for 30 years. Please, God, don't let me find anyone. That might all change, though. Well, me and Greg were saying this. We were saying we were happy on our own. Mm-hmm. And then wallop. Yeah. Yeah. Just be careful. Yeah, it doesn't make any difference if it's meant to be. It really doesn't. Aw, hello, Stephen. It's lovely. It's good to see you again. I saw you on Tuesday, too. Thank you for joining us. We're going to be going to Rumble here in a second. What do you remember from Guest Smart Show?  Yeah. That was, I enjoyed that show. All right. So we should probably get scooting over there. It's already 8 o'clock. If you're watching on Facebook, the link is right above for the Uncensored, completely free show on YouTube right here. We're going over there right now. Anything you want to wrap up on, my love? Um, no, no. I'm just in loads of pain. So I'm trying to gear myself up to do this. It'll be fine. Aw. It'll be fine. All righty. So we shall see you guys over there in about a minute. All right. Take care. Thank you for joining us. Mm-hmm.