This is the last talk of the day. Oh But it's okay because we have actual Tom Yes, I'm I am definitely sure that this is actually Tom Eastman Tom is a senior system software engineer. No got it wrong. No, what are you? What are you? Senior software systems engineer. I didn't even make it up. I like a gentleman programmer of leisure He has a real job now coordinates and he is going to be speaking today about the exquisite dangerous art of Safely handling user uploads. So let's make Tom feel welcome I'm sorry. I really like doing that. It's fun. Um, I guess I should start by explaining why I was inspired to give this talk So I'm not a hacker or or a penetration tester by trade. I'm a developer, right? Like like most of us here I build things and I like helping other people to build things. So my interest in computer security isn't born of wanting to be A hacker. It's kind of more born from a constant Crippling anxiety about screwing up and letting people down and so that's definitely not a healthiest healthy approach I think you'll agree, but it's it's kind of a motivating one at least right so So when it comes to web application development, I've always known that Handling user uploads is tricky But until recently I managed to kind of mitigate the risk by not bothering The most effective way possible basically avoid having to do it and or as many circumstances as possible More recently though I have been working on projects that do actually require, you know doing user uploaded files either because they have data ingest or They handle images of a certain type and I made a couple pretty unpleasant realizations kind of along the way so The first thing is getting it right is actually kind of harder than I expected most of my Web development experience is using Django actually All of it frankly all of it is Django Django's got a really good reputation when it comes to secure web application development You're well protected from the most common security pitfalls that you end up having to deal with It's object relational mapper makes it really difficult to write code that's susceptible to SQL injection It's template engine gives you really good strong auto escaping by default making it a lot harder to write code That's susceptible to cross-site scripting attacks not impossible because cross-site scripting is a really hard one to deal with but You're in pretty good shape by default and of course the built-in user authentication and session Management capabilities are really well designed in Django and they follow really good secure best practices So with Django the defaults keep you pretty safe right out of the gate You're shielded from the worst of the OWASP 10 the OWASP top 10 vulnerabilities So let me just do the thing that I often do which is Who in this room has heard of the OWASP top 10 and kind of knows their way around it as a web developer if you're not a web developer It's a little less Important, but it is interesting. So if you are a web developer and you're not familiar with the OWASP top 10 Google it as soon as you're done with this talk find the OWASP wiki read up on the top 10 OWASP top 10 if you don't if you're not aware of these security vulnerabilities Your reliability to your projects that you work on and this is fixable because you are educational people and you can learn How to protect your users? So and of course the top 10 isn't all you need to worry about but it's a good start and it'll make you a much better developer So anyway to my surprise when I was dealing with file uploads with Django I kind of discovered that Django's default settings can actually be problematic in some ways not necessarily insecure but geared towards Getting you up and running fast and not necessarily putting safety first So if you're a Django developer, this will look pretty familiar to you This is two lines from your settings file and a couple lines from a models file and in practice This is all you need to start doing file uploads in a Django web app The problem with this example is that behind the scenes the defaults expect you to be saving files directly to a location where they'll be hosted that media root URI for example is Expected to be hosted by the web server right away, and I'll be explaining in this talk why that's a terrible terrible idea So the other thing I realized was if you get it wrong the scope for damages eye-widening a Little bit of clever manipulation could see files saved to locations. You didn't expect Leading to exploitation of the server that is running on a misconfigured web server could be led to execute code included in user uploaded files A malicious file can cause programs parsing it or validating it on the server to crash or misbehave just straight up break the system and Finally and honestly most importantly a lack of care when handling user uploaded files could easily turn your own project into a platform for attacking Other sites and services and users It's fair to say that you have responsibility to make sure that your work can't be exploited to attack other people So I'm going to give you this afternoon a short list of concrete steps to help you solve a complex problem In order to explain why each step is a good idea I will need to give you some examples of just how badly it can go wrong and what you need to be protecting yourself from and I'm going to give you the last slide of my talk first because I'm a sucker for spoilers and I'm four seasons behind in Game of Thrones But I already know like everything that happens and this is not a mystery show so Here is my advice and you're welcome to you know, this is the last talk of the conference You're welcome to have a beer afterwards or you can stay and listen to why it's good advice Try not to play if you can avoid it Outsourcing this problem is fantastic Step one throw away the entire file name. The file name is not your friend Step two always store freshly uploaded files in some kind of quarantine zone That's not in the web route that is not being served up by the web server Step three always very carefully parse and verify the file once it's been uploaded to prove to yourself that it is what it needs to be and step four Don't keep that file copy the parts you care about into a new file that you'll then be hosting so I Gonna spend the rest of my time explaining why in order to explain steps one and two Getting rid of file names and storing them somewhere outside the web route I'm gonna explain something about web server software and about some of the assumptions that they've historically made about their threat model web servers are probably Think it's fair to say the most exposed pieces of software on the planet right now, right? They're hit by requests all day every day non-stop legitimate requests and maliciously crafted ones and Corrupt ones and ones from old software ones that aren't running HTTP to yet and older horrible HTTP 1.0 stuff By now web servers are very resilient to malicious input from outside Still scares me that this sort of key software is written in C, but But it's hardened C. They've been doing this for a long time. Here's the problem Web server software does expect you to be able to trust the files that it's serving They've been built with the assumption that any files that they're serving up to a web browser are probably there because you put them there and sometimes they're configured to Execute instructions in those files So this is like one of the first rules of computer security, right? And it's it's almost it's almost Latently obvious if an attacker can upload code and get your computer to run their code they win, right? It's over. You're done This is the key premise so What are some examples of code that lives inside the web route something that Apache or nginx or your web server would serve up that Is executed by the web server when it's served anybody? PHP right No, you haven't have you But this is the most obvious one. This is the obvious first call for Complaining about this sort of thing, but it's not the only one Apache server side includes it's like a built-in template language for the Apache web server CGI scripts the old-fashioned, you know web 1.0 way of doing dynamic web apps where a program is actually just run every time The page is requested and the output of the program is returned to the web browser Active server pages, which is like PHP if you're in the windows world it is a Programming language template templating language that sits inside the web route and is served up HT access and configuration directives HT access in Apache which actually changes the configuration of the web server depending on what's being served and Other web browser other web server software has similar kinds of configuration files sitting inside the web route and then you've got whatever editions you're actually using in your web Server like mod ruby mod pearl mod Python, etc So there's a lot of code that might actually happen If your web service can figure to treat any of these files as special and an attacker can successfully upload any of these files Then they might have a way into your system Now I'm gonna in this talk I'm gonna be using PHP as an example a reasonable amount, but this like I just pointed out is not a PHP only issue It's just that it's ubiquity combined with its execution model makes it a really common risk factor Especially in sort of shared hosting environments and well, you know all over the place. It's very pervasive So let's say you have PHP installed either intentionally or unintentionally, which I'll talk about in a moment Most default Apache configurations including on Debian and Ubuntu How many of us do use Debian and Ubuntu as their sort of publishing platform when they're doing web development? Yeah, I mean again, like most of what I'm talking about is common to a lot of stuff But these are the systems that I work with so Okay The default configuration in Debian and Ubuntu will execute any files requested with the PHP with the .php file extension As if they were part of your program so What do you do? You might assume that you need to block any files with the extension .php from being uploaded and saved to the web root Right, I'll spoil it. Yeah, you're right. You need to block those from being run Trouble is that same default configuration and this is the the locked-down configuration that comes by default on Debian and Ubuntu and Probably red hat, but I didn't actually ever get around to checking Also runs as PHP any files with these extensions PHP 3 PHP 4 PHP 5 PHP 6 PHP 7 PHP PHP s and PHP now and that's So make sure that your upload checker is blocking all those extensions That's the standard conservative configuration provided by distributions and as you might have heard the internet is full of bad advice and So depending on what PHP tutorial you or your administrator or your ops team kind of followed when they were learning about PHP and setting it up They might have used this snippet of configuration code when setting up their Apache Web server Who's seen this sort of thing before in Apache, right? This is really common add handler tell it It's a PHP script and look for that extension It looks really innocent, but it has this wonderful interesting bonus feature that it doesn't mind if there are multiple extensions on the file So Now these count as PHP as well File name dot PHP dot jpeg file name dot PHP dot gif file name dot PHP dot text dot jpeg dot gif File name dot PHP dot whatever I want to type here dot text Long story short if your application code is checking file extensions to decide if a file can be trusted you could be in a world of pain It's not gonna be enough What if you're not even using PHP? Like I said, it's not a PHP only problem But you'd actually be surprised how often PHP ends up being installed and configured on servers that aren't even using it Again, if you're in like the Debian Ubuntu world and you've installed your server and you've gone through the server installation And you've gone to the task cell screen and you've selected lamp stack or you know web application stack for your For your server install then it will install PHP with that default configuration ready to go and Certainly even in Python shops, they're often using some kind of PHP as well on their web servers They might be using it for monitoring for Nagios for And I guess is is CGI isn't it but you might you might have a wordpress site on the side or something Your servers may well have it on there without you realizing So these risk factors apply for any system where the web server is configured to execute code and files that are contained within the document route and As if that wasn't enough reason for you to never trust the file name or the extension of an uploaded file Here's seven more File names can do weird things with case like are you sure that your file name checker is Case insensitive or case sensitive enough to make sure that it catches those file names can do other funny things that fool The execution system of the web server this one in particular used to work on older versions of IIS So a file might be uploaded and your code would see dot jpeg and then when it got saved to disk It would be file dot ASP and ASP is just like PHP. It'll be executed on the way back out What if your file name has dot dot slash in it? Hey, you're fine. You're fine with Django in this case But this will trip things up and even if you're using Django, which does I think check for that on a reasonably strenuous basis What if it has a mixture of back slashes and forward slashes? Who knows all of the subtleties of Python's handling of forward slashes and back slashes mixed together in a windows environment Where I think it actually allows both to be sort of easily platform compatible You could find yourself doing fun things Right on windows you still have those historic old, you know tilled one file name things if the file doesn't match that 8.3 Syntax from the old pre windows 95 days You could upload a file like that and it might actually overwrite the file called web config dot con Which might actually know sorry web dot config is the one that that one comes from all these examples By the way are from the OWASP wiki. So again, please This talk is basically OWASP wiki as interpretive dance. So Read up that site. It's good stuff Files could have any mixture of single or double quotes in them that could be hilarious when you're shelling out to some other program And the poison null byte which is a hilarious one so if you're passing this to some sort of Backend function that might be exposed in Python that actually implemented in C Are you sure that that's gonna handle the null byte in the C code correctly this one traps This one used to catch out PHP stuff all the time. So PHP has a lot of file name strings that get passed to Back in C functions and where's that file gonna get saved in that case And finally You can't trust these file names in the first place because your users screw them up. Okay, most of the time all of us sort of understand the hidden semantic value of File name extensions, but but lay people don't right like it's it's a picture. It's it's a picture of my grandkids It's whatever. It's it's just what happens you you can't trust that they are what they say they are even under the best of times You've got no choice. You got to throw the file name away You can you can keep it like keep it in the database, but treat it like untrusted input and don't use it for a file name If you're saving the file to disk save it as an anonymous lump of data Maybe with a file name generated from a hash of the contents of the file You know just something that you can get you can find your way back to but you don't have to Rely on the file name as a file name if you're saving it to an object store like s3 do the same thing and Storing files on s3 is actually a really good idea.  It is not the other way around The things that can go wrong when you're parsing someone else's files are basically as myriad as the types of file that exist in the world so That would make this talk a little too long So here's a couple quick examples a file could straight up contain a virus right They could just upload a file with a virus in it a compressed file like an image file or a zip file or anything else Could be crafted to blow out your memory could be a You know a zip file which has five terabytes of zeros in them Which which I swear I never emailed my friends when when I was younger and I'm sure no one in here did No, everyone everyone sort of won't make eye contact suddenly if You're uploading XML and XML based file can have all kinds of really nasty things going on about it I think there was a talk by not Tommy Stamman about that on on on Friday and Actually, if you're handling zip files Then you have all of the above problems all over again, right? Because every single file that's in that zip file could have its own surprises waiting for you So it's it's it's not a fun game The advice I can give you here is kind of limited because what you need to do Depends a lot on your use case and what kind of files you're expecting you need to be aware of the fail modes of whatever parsers You're using to read uploads so with things like XML files You have the problem that that as was pointed out They're essentially programming languages and the parser is essentially an interpreter you need to turn off all the features of the parsers that are dangerous on untrusted input and in Python the short the short answer to that is use diffused XML if you're dealing with untrusted XML or XML that could have come from any surprising source We actually have a good solution for that here in the Python ecosystem. It's called diffused XML Google it. It's cool But other other file types are harder with images. It's really important to keep your systems up to date and patched because we have a Long long history of really terrible security bugs being found in image parsing libraries. So speaking of which Who who knows what image magic is who's unfamiliar with image magic? Just um cool Okay, so image magic is a ubiquitous suite of image manipulation tools It's a whole lot of command-line tools for annotating images rescaling images identifying image file types. It's a very useful suite It's very scriptable. So it's been in the Unix world for a really long time a couple months ago a large number of critical security issues were publicly disclosed and patched in the image magic library and These bugs were like worst nightmare scenario bugs anyone using image magic to handle an untrusted image was vulnerable to these and it was Trivially easy to x exploit. So here's an example That would trigger a shell execution on your server like you send this file to anyone using image magic and you get to own their computer from now on and this is the whole file and this is just a graphics format and It has a URI in it that URI got Used by I think it got shelled out to curl and it didn't have any kind of path checking on it So you can just start putting shell commands in right here That's all it took no buffer overflows no crazy see stack smashing or or Clever social engineering or anything. It's as anti-climatic as it is devastating like that's all it took Anyone who was behind on their security patching could end up being vulnerable to Something like this something embarrassingly destructive and Antivirus software has a really bad track record with this stuff too. Is anyone familiar with the name Tavis Ormandy? Tavis Ormandy is a researcher for Google. He works on Google's project zero And he has I guess what must be a dream job for someone like him where he Hacks non-Google software and open-source software and he calls up those companies and explains them how to fix it So Google is spending a lot of resources in making the internet safer for everybody by hiring some very dangerous people Fun fact fun fact excuse me Tavis found a bunch of severe security vulnerabilities and semantic antivirus a little while ago And he emailed them to warn them about it Unfortunately, Symantec uses Symantec to scan all attachments to to their in to their corporate email their entire email infrastructure crashed when he emailed them So look like antivirus is actually necessary. Sometimes sometimes it's a requirement Sometimes you have to be scanning if you're required to run antivirus software. My recommendation is run it somewhere else so an option might be Have a have your antivirus software on a computer where your file upload quarantine is mounted as a read-only As a read-only Network file system or something or if it's not confidential stuff. You're being uploaded There's actually a lot of third-party cloud scanning services that might be really appropriate assuming. It's not confidential information You don't mind where it goes But get it away from your application code and get it away from vulnerable things If that doesn't scare you about opening up and looking at random files that have been uploaded to I'm not sure what will But like I said if you're receiving files from the internet, this is your job, right? You you have no choice. You can't make your users do this. So remember step zero, right?  Let make them throw away anything that doesn't look right. I Go through this hold talk and I usually forget to mention that you know if someone's uploading a profile photo They could just upload a DVD image, right? What if they just upload five gigabytes of stuff at you? There's there's a lot of there's a lot of little things that you just want to make sure they just can't mess with you For bonus points again, I'm still sort of talking in debbie and in Ubuntu use app armor profiles Or if you're in the red hat world use se linux use some of these new security mechanisms that we actually have access to these days They might qualify as a bit of an extra credits assignment App armor is a Linux security technology that restricts the program's capabilities so it's functionally for example You would create an app armor profile that says this program is allowed to open, you know It's shared libraries its requirements and it's allowed to look at files in my upload quarantine But if it tries to open a network connection or start a sub shell kill it So going back to that image magic example that we had a moment ago a well-crafted app armor profile would have actually probably preemptively protected you from the worst that that could that that could do because You would set up a profile that says this is a program that looks at images It doesn't need to shell out and run LS. It doesn't need to run commands. So if it does do that Notify me and kill it. So the second image magic behaves in an unexpected way Process would be killed a warning would be generated in your log files, which maybe you'll even read one day It's cool stuff. I really like this stuff and it's worth learning about if you're a Paranoid systems geek like I'm hopefully hopefully turning you all into right now Okay, so where were we you're all very sleepy. Where are we? We are up to step four. Cool. I'm sorry. I'm like the last person keeping everyone from beer aren't I Sorry Okay The idea here is that you never serve the original uploaded file you built a new one yourself that isn't a straight copy of it The most simple example that demonstrates what I mean is image files again Once you validated that it is actually a jpeg that you've received Don't just put it in place for a re-hosting instead create a new jpeg with the same picture in it Either either by re-encoding the file or rescaling the image Which you know, you're probably gonna do anyway, right? Like if you're dealing with image files This is usually a no-brainer because you're probably gonna generate thumbnails and scaled versions of the file Or maybe you maybe convert the file to another format completely There's two goals that you kind of want to achieve when you're doing this You guarantee that you're the ones you're hosting files that you built You know that it has the data you need and That you want to present to your users and you're a lot safer with the assumption that it doesn't have any unpleasant surprises Sorry yep, and secondly you've successfully thrown away any data that you didn't need or didn't care about because your parser Didn't even notice it so jpeg files also provide a good example here by tampering with the image yourself You might break any last malicious content that might have been in there like You know image magic isn't the only thing that's been hit with security bugs and image libraries both Android and Apple have been hit with really bad ones within the last year and By tampering with the image yourself you might be protecting users on mobile devices or you might be protecting users who don't have their own Who haven't been as good with security patches as you have been So forget about exploits for a second. It's also just good data hygiene So I like imagine your user is uploading a picture and that picture contains an exif header And that header includes say like the GPS coordinates of the location the picture was taken That's pretty common. Most of our phones embed GPS coordinates in photos But it's a potential data leak that your user possibly neither expected nor desired, right? So if you don't care about that data if there's no compelling reason for the hosted image to have it It should be removed as a routine part of your upload processing This is a fun example this photo Was published on Google plus two months ago to demonstrate the new phone the new Huawei P9 smartphone Which I've seen billboards for all over the place. That is a beautiful photo from a from a smartphone Now Google plus Preserved all of the exif data it had it had all of the all of the exif tags on it so because of that It might not necessarily have been the Phone that took the photo if you can't read that at the back that says Canon eos 5d mark 3 Which is actually a really great camera So always be on the side of your users discretion don't don't be like Google plus So we're back where we started I Hope what I managed to do is give you some food for thought and some ideas on how to make both yourself And your users safer so Write beautiful code be careful out there and and and always be on the lookout for new ways you can disappoint bad people Cool. Thank you very much for your time We have time for one question. Oh one There's a short person up the back Thank you So in terms of patching software, I've taken particular delight in looking at specific CVE's and I do and finding they don't patch Get patched in vendor distributions because they're user space How do you look at those types of libraries and get them patched because package managers don't always pick up those security fixes when you say vendor libraries Are you sorry you're referring to The just not the distributions, but so for example a particular database driver within a language is Often a separate package within a distribution. Gotcha. And because those are separate packages, they're not necessarily Caught the distribution. So I found them sort of marketers Will not fix. Oh, yeah, so so just to give you just to give you an example of this Like Ubuntu has a very wide package selection in their main repository in in their repositories But their repositories are separated between main which they guarantee support for and universe which is called community supported and Community supported as I understand it means. Let's hope Debbie and patches it now You've got to maintain some vigilance on that. So I always recommend using you know supported Operating systems and supported LTS versions of things, but that's not a that's not always enough. You actually need to know if Your package is being supported by someone else, but assume it's not, you know, this is this is a process This is an ops process that is actually getting a lot worse in the world of Docker and Users and developers supplied things. There's a gap that needs to be bridged there And there are tools slowly filling that space Ubuntu has for example a tool, which I can't remember the name of but we'll tweet it out it is for Looking at the support lifetime of every Ubuntu package you have installed so at least in their metadata for their packages now They'll tell you this is an LTS one and it has secure support for like two years or this is a universe package I got caught out by this recently because WordPress is not in Maine Right, so if you're using WordPress and I always I always think it's a better idea to use Distribution-supported packages, but WordPress isn't one it's there. You can go apt-get install WordPress, but it's not in the main Distribution on Ubuntu, so you might not get timely security updates with it You need to Make sure you have some defined process for inventoring inventor inventorizing keeping track of the crap you're using And yeah, watch out for CVE's Someone has to have that job and all you need to do is go home to your company Go home to your project ask who has that job and if no one has that job you need to have a conversation about it Thank you, and that's all the time. We have let's thank Tom again


We've been open nine years here downtown Longmont. My wife and I have lived here 20 years and most people don't know this but there's over 70 parks in the Longmont area. So if you're looking for fun stuff to do in town outdoors like birding or biking or paddle boarding or tubing, Longmont's guided all and we're here to help you out. Follow us on Facebook and Instagram or come by the store and see our chalkboards. We change them out through the seasons.


What's up everybody welcome to SPM Buzz my name is Liz Jackson and today we are on location at Cinemax Hapa Sari Center and you can see this beautiful lady on this banner her name is Brigitte Blue and today we're going to be listening to her album it's called Colors. Colors is available on boomplay as you can see here but today we're here for the listening party. So remember Brigitte Blue is signed under Digit One Music Group but so this is SPM Buzz we're on location to give you exclusive updates of everything and then we're going to be spotting your favorite stars so keep it SPM Buzz


One in nine people do not have enough to eat and one-third of the food that is produced is either lost or wasted I'm Shalini for Uproxx here in Abuja Nigeria's capital to meet with a software developer This is something really personal to me Because in time past I've actually experienced a food deprivation and hunger and it's something that I can connect with I believe in the paradigm of internalization. So it simply says a Solution gravitates to where the problem is Cowberry is a social enterprise that seeks to provide affordable nutrition to Disadvantage the groups and demographics primarily using technology and cloud technology So show me how the app works if this retailer were to download it How exactly would they use it? They have access to a backend dashboard Okay, where they simply upload the categories of products that are closing expiration 90 days, okay And once they do that the app automatically Begins to help them track what within their shelf The novel thing is that as it gets closer to the end of shelf life the prices continually drops At 90 days the shapes of 10 percent automatically, okay 60 days It shaves off about 40 percent automatically down down down all the way to 15 days Where it shaves off 70 percent? We have a partner with the Shabery since August 2016 our advice every store or supermarket to get this app your cost You'll get your cost at least 25 percent of what you bought and you still give it back to the society So I think God will bless you for that The problems here are Stronger tougher problems and if a solution walks here it could walk anywhere in the world Oscar hopes to reach 100,000 households worldwide by 2020 For more information visit uprocks.com


Dyna yn ymdyn nhw'n dweud y potensiwch ar aion a ardyn ni i gael ei wneud yn creu newidol i gael i'r cyffredin ar gyfer y gwerth gweithio. Mae cyfnodd yn ymryd yn ymryd yn ymgyrch. Mae'n dweud ymweld ar y ddweud â'r cyffredin. Ac mae'n dweud o'ch ei ei ddwyf yn symud. Mae'n ddweud bod yn ymryd yn ymryd. Mae'n ddweud â'r cyffredin sy'n dweud â'r cyffredin sydd yn ymryd. My name is L.J. Rich. Everything I am going to do is live. Nothing has been pre-recorded. Okay, okay. Something strange just happened. I didn't tell you anything. You all knew what to do. How did you know to do that? Now you've got the idea. Let me try another song. Okay, so something. Something's going on. There are some rules. We use these rules to create moods. Like magic and mystery. We use those rules to create strength and certainty. Or just something to keep us calm while we're on hold. These are our unwritten rules. How we respond to music. How our body moves. How our thinking changes. These are rules that we know so well. And yet, they are really hard to teach a machine. How do we teach a machine musicality? So in my day job, I'm a TV presenter. I'm an inventor. I present on the BBC talking about music and technology trends. I'm also a composer and a sound designer. I build musical installations that make people feel good. These are paper mandalas by touching this. That lady is triggering sounds from NASA's Discovery Space Mission. On the left here, those are people touching flowers and triggering tropical forest sounds. And just there is the Science Museum, who hosted an idea I had about creating dance music based on how much people were moving. We picked up sensor data from their mobile phones, and my plan was to derive the wiggle index and therefore get the ultimate dance anthem out of data. I make devices that make people experience music differently. Some of my inventions have been, well, in the National Press. I've lectured at Harvard, DJed in Tokyo, and now I'm leading a project with NASA on creative approaches to data sonification. So just a few years ago, I found out that my brain is wired differently than yours. It's a neurological condition called synesthesia. My senses are completely mixed together. When I first tell people about this, many think it sounds a bit crazy. Some find it funny, but most are quite fascinated and would like to know more about it. Around three to four percent of the population have this. You might see colours and numbers together, or letters or days of the week. My version is particularly strong. For me, these sentences make complete sense. David Bowie, Life on Mars. It's like a beautiful dark blue colour with purple. Aber. That's actually, pleasingly, the same colour as the Swedish flag, blue and yellow. Sushi is this kind of beautifully clear acoustic D and A. It's that perfect fifths. And coffee. Oh, beautiful coffee. It's like a beautiful coffee. It's actually like Gershwin. That's why I don't drink bad coffee. Making unexpected connections is pretty much how everyone generates new ideas, going from one modality to another. And it's a practice easily seen in consumer electronics before the worldwide web, the smart revolution and the internet of things, phones did not come with cameras. Wow. Speakers didn't come with built-in AI assistants. Central heating didn't come with internet connectivity, but remixing technology is now commonplace. So it makes perfect sense to me that AI will change music just as it will every other aspect of our lives. So going back to teaching a machine musicality, first we need to think about what's useful to know about how music is built. Music is a repetitive phenomenon. It's made up of a set of repeatable notes. Everything is made up of the same small bass elements. Now western music has one set of notes. Other styles have different intervals, but in general all music is considered repeatable sounds. And notes are combined in different ways. They're used to create different feelings. Perhaps we can get music and machines to understand each other if we extract its essence, its DNA. A machine could recombine it, work out how to compose music to make us feel specific things. Maybe machine learning could create the tune that gives us that hairs on the back of our neck feeling. Well, we're halfway there. No, I can't do that, honestly. OK, so with a bit of service space, you can train an AI to create music based on your favourite band or artist, which is exactly what some people have done. Would you like to hear some music generated by machines? Yes, awesome. OK, here is Bach by David Cope. He's a composer. Bach wrote over 1100 organ works and he decided to just throw this all into the computer quite a while ago, actually. When it first started throwing music out, it was boring. He had to add a random element so that the machine would break the rules just like Bach did. It's pretty good. What about this? This is the Beatles. The Beatles, I should say. This is by Flow Machines. They got a band to play the song that was composed by an AI. This song is called Daddy's Car. The lyrics were generated by machines. The idea was generated, but it was played by humans, so it does sound more human. OK. What about black metal? Ready? It's a CJ Carrs project and he has a 24-hour black metal AI streaming channel on YouTube. It's gone viral. It's generated completely by an AI using a recurrent neural network. That's enough of that. OK. There are issues with AI musicians. I know this because I was jamming with an AI in Croatia as part of a consortium of music technologists. There's a sentence you don't see every day. An AI machine is terrible at listening and yet attempting to play along with it was quite inspiring. You have a conversation with another person. You find places to connect with them. You learn their character. How fast they talk. It's the same when you play music with another person, but in this case I was learning the personality of a machine. Machines don't understand when to break the rules. They don't understand social cues when you empty a band. There are lots of these unwritten rules that we follow together and the AI can do low-level work. What is the next note after the previous note? But it struggles with high-level concepts. Right now, I can't make AIs that cross genres. A bit like playing an easy listening version of a rock classic like Iron Maiden singing Two Minutes to Midnight in the style of Mozart Opera. It's currently something that no machine can do very convincingly, but luckily my synesthesia allows me to do this and I'm now at your service. So if you would like to have a go, please can you call out some artists? What was that? Motley Crue. Prince Daft Punk? OK. Can I have some genres, please? Pope Blue's Reggae? OK. So we've got Daft Punk and Reggae I picked out. OK. So what I do is I kind of take the elements of these things and I mix them together. So Reggae is interesting because it has the accent on the second and fourth beat of the bar. OK. And then you've got like a Daft Punk song which has a really driving beat. OK. So how do you mix those together? You do this. So that's the idea. Normally I would do one or two more because you're such a fabulous audience but I'm aware our time together is coming to an end. So maybe I'll do this later if there is a piano somewhere. So let me leave you with a few thoughts about why I think music and technology could give us all clues on what the future holds. Voice is music in motion and tonality. In motion recognition could be a very interesting and powerful development. If your bank, for example, detects stress in your voice it could know how much you really need to borrow that money and then adjust the interest rates accordingly. And mechanical devices, they make music. The sounds of an engine could be analysed and this could allow a system to work out the likely points of failure way before we hear that big bang there'll be micro sounds that you could learn to pick up. I believe all of us have the potential to think like someone with synesthesia in the same way you feel when something is right. Inspiration is everywhere but it's how we channel it that makes a difference. Those unexpected connections could be the key to you solving your specific problem creatively and elegantly. And I believe every one of you can access this more easily than you think. Inspiration is ours right now. Doesn't have to be elusive. It could be as simple as brushing your teeth with the other hand or ordering something different. So please start making your own unexpected connections and I hope that you have a truly inspirational evening and beyond. Thank you very much.


There's white collar business travel, there's leisure travel, but the workforce base is completely underserved and we spent two and a half years what we call an alpha test where we were gathering information, understanding these travel patterns and imagine being someone who is a journeyman lineman for example and you're traveling three to 25 times per year just to do your job and you have to work in blizzard conditions, you have to work in high heat conditions to restore power after a storm or maybe it's an expansion of a new community and again you're staying in an area that is just not decent or safe and that's the heart of the issue.


From the SiliconANGLE Media Office in Boston, Massachusetts, it's theCUBE. Now, here's your host, Dave Vellante. Hello everybody and welcome to this week's CUBE Insights powered by ETR. In this breaking analysis, well first I'm coming to you from the floor of Cisco Live Barcelona and I want to talk about storage. Storage continues to be soft but there are some bright spots. I've been reporting on this for a while now and I want to dig in and share with you some of the reasons why, maybe give you some forecasts as to what I think is going to happen in the coming months and of course I want to look into some of the ETR spending data and try to parse through that and understand who's winning, who's losing, who's got the momentum, where the tail wins and head wins. So the first thing I want to show you is let's get right into it. What this slide is showing here is a storage spending snapshot of NetScore. Now remember NetScore in the ETR parlance is an indicator of momentum or spending velocity. Essentially every quarter what ETR does is they go out to in this case 1100 respondents out of the 4,500 data set and they ask them are you spending more or are you spending less? And essentially they subtract the less from the more and that constitutes NetScore. It's not that simple but for this purpose that's what we're showing. Now you can see here on the left hand side we're showing all respondents out of 1161 and you see the January survey NetScore is you got Rubrik, Cohesity, Nutanix and Pure and VMware vSAN at the top five. So Rubrik and Cohesity very, very strong. Interesting Rubrik was very strong last quarter. Cohesity not as strong but really shooting up. It kind of surprised me last quarter Cohesity being a little low but they were early into the data set and now they're starting to show what I think is really happening in the marketplace. So that's a good indicator but you can see 75%, 72%. Nutanix still very strong at 56% driving that hyper-converged piece. You see Pure Storage at 44% down a little bit talk a little bit more about that in a moment VMware vSAN, Veeam, et cetera down the list. The thing about the left hand side and storage in general you can see the softness only about one third of the suppliers are in the green. And that's a problem if you compare this to security probably three quarters are in the green. It's a much, much hotter segment. Now look on the right hand side on the right hand side I'm showing what ETR calls GPP, giant public and private. You can see there's an N of 403. These are large, the largest, the very largest public and private companies private company being a company like Mars Candy. And they say that they're the best indicators of spending momentum in the data set. So really isolating on some of the large companies. Look what happens here. You can see Rubrik gets even stronger as does Cohesity. They're into the 80% range. I mean that's really rarefied air. So very, very strong. You can see Nutanix drops down. So it does better in the smaller companies it appears. They drop down to 41%. Pure gets stronger in the GPP at 68%. You can see vSAN VMware vSAN up tick to 45%. Nimble gets better. HPE's nimble to 54%. Dell drops down to 4.8%. HPE goes up to 33%. HPE was red in the left hand side. You can see Veeam drops. Not surprising. Veeam in the biggest companies is not going to be as prevalent. We talked about that in our breaking analysis segment after the acquisition of Veeam. And you can see NetApp bumps up a little bit. But it's still kind of in that red zone. I also want to call your attention to Actifio. They're way, way down the bottom in the left hand side, which kind of surprised me. And then I started digging into it because I know Actifio does better in the larger companies. And in the right hand side, they pop up to 33%. It's only an end of three. But what I'm seeing in the marketplace is Actifio solving some really hard problems in database and copy data management. So you're starting to see those results as well. But generally speaking, this picture is not great for storage with the exception of a few players like Rubrik, Cohesity, Pure, Nutanix. And I'm going to get into that a little bit and try to explain what's going on here. The market's bifurcated. Primary storage has been in the back burner for a while now. And I've been talking about that. You know, the one exception to that has really been Pure. Little bit for Dell EMC coming back, but really, we'll dig into that a little bit more, but Pure has been the standout. And they're even moderating lately. I'll talk about that some more. Secondary storage is where the market momentum is. And you can see that with Rubrik and Cohesity. And again, we'll talk about that some more. Let me dig into the primary side. Cloud, as I've talked about in many breaking analysis segments, is siphoning off demand from on-prem spend. The second big factor in storage has been there was such an injection of flash into the marketplace, it added headroom. Customers used to buy spindles to get performance. And they don't need to do that so much anymore because so much flash was pushed into the system. The third thing is you're still seeing in primary, the consolidation dynamics play out with hyperconverge. So hyperconverged is the software defined bringing together of storage, compute, and networking into a single, logical, managed unit. And that is taking share away from traditional primary storage. You're also seeing tactical NAND pricing be problematic for storage suppliers. You saw that with Pure again this past quarter. NAND pricing comes down, which you think would be a good thing for components standpoint, but it also lowers prices of the systems. So that hurt Pure's revenue. Their unit volume was pretty good, but you're seeing that sort of put pressure on prices so ASPs are down, average system prices. Let's turn our attention to the secondary market for a moment. Huge injection of venture capital, like a billion dollars for half a billion dollars over the last year. And then another five billion just spent on the acquisition of Veeam. So a lot of action going on there. You see big TAM expansions where companies like Rubrik and Cohesity who have garnered much of that VC spending are really expanding the notion of data protection from backup into data management, into analytics, into security, and things of that nature. So a much, much bigger emphasis on TAM expansion, of course, as I talked about the M&A. All right, so now let's dig into each of these segments. The chart that I'm showing now really digs into primary storage. And you can see here the big players, Pure, Dell EMC, HPE, NetApp, and IBM. And look it, there's only one company in the green, Pure. And you can see they're trending down just a little bit from previous quarters, but still far and away the company with most spending momentum. Again, here I'm showing net score, measure of spending velocity. Back to the January 18th survey. You can see Dell EMC sort of fell and it is slowly coming back up. NetApp hanging in there, kind of Dell EMC, HPE, and NetApp kind of converging. And you can see IBM. IBM announced last quarter about 3% growth. I talked about that actually in September. I predicted that IBM storage would have growth because they synchronized their DS8000 high-end mainframe announcement. To the Z15, so you saw a little bit of uptake in IBM. Pure, as I said, 15% growth. I mean, if you're flat in this market or growing at 3%, you're doing pretty well. You're probably a share-gainer. And we'll see what happens in February when Dell EMC, HPE, and NetApp announce earnings. We'll update you at that time. But so that's what you're seeing now. It's the same story. Pure outpacing the others, everybody else fighting for share. Let's turn our attention now to secondary storage. What I'm showing here is net score for the secondary storage players. I can't isolate on a drill down for secondary storage. Last slide I could do on storage overall. But what I can show is pure plays. So what we're showing here is rubric, Cohesity, Veeam, Commvault, and Veritas. You have five pure play, you can argue Veritas isn't a pure play, but I consider them a pure play data protection vendor. Look at rubric and Cohesity. Really shooting up to the right. 75% and 72% net scores respectively. You see Veeam hanging in there. And this is again all respondents, the full 1100 data set. Commvault announced last quarter it beat earnings, but it's not growing. So you can see some pressure there and you can see Veritas under some pressure as well. And you can see a net score really deep in the red. So that's cause for some concern. We'll keep watching that, maybe dig into some of the larger accounts to see how they're doing there. But you can see clear standouts with rubric and Cohesity. I wanna look at hyperconverge now. Again, I can't drill into hyperconverge, but what I can do is show some of the pure plays. So what this slide shows is the net score for some of the pure play hyperconverge vendors led by Nutanix. The relative newcomer here is Veeam with Veeamware. And you can see Dell, EMC, VxRail, and SimpliVity. I would say this. A lot of the marketing push that you hear from out of Dell and out of Veeamware says, Nutanix is in big trouble, they're dying and so forth. Our data definitely shows something different. The one caution is you can see Nutanix in larger accounts, not as strong. So, and you can see both VSAN and Dell EMC stronger in those larger accounts. So maybe that's kind of their bias in their observation space, but it's something that we've got to watch. But you can see the net scores here. Everybody's in the green because overall, this is a strong market. Everybody is winning, it's taking share, as I said, from primary. So we're watching that very closely. Nutanix continues to be strong, watching very carefully that competitive dynamic and the dynamics within those larger companies which are Bellwether. Now the big question that I want to ask here is can storage reverse the 10 year trend of the big cloud sucking sound that we have heard for the past decade? I've been reporting with data on how cloud generally has heard that storage spend on prem. So what I'm showing here in this slide is the net score for the cloud spenders, many hundreds of cloud spenders in the dataset. And what we're showing here is the net score, the spending velocity over the last 10 years for the leaders. And you can see Dell EMC, the number one net app right there in terms of market share, IBM as well. I didn't show HPE because the slide got too busy but they'd be up there as well. So these are the big spenders, big on-prem players and you can see, well, it's up and down, the highs are lower and the lows tend to be lower. You can see in the latest surveys, maybe there's some upticks here and some of the companies. But generally speaking, the trend has been down, that siphoning away of demand from the cloud guys. So can that be reversed? And that's something that we're going to watch. So keeping an eye on that, let me kind of summarize and I'll make some other comments here. One of the things we're going to watch here is Dell EMC net app and HPE earnings announcements in February, that's going to be a clear indicator. We'll look for what's happening with overall demand, what the growth trajectory looks like and very importantly, what NAND pricing looks like. As a corollary to that, we're going to be watching elasticity. I firmly believe as prices go down, that more storage is going to be bought. That's always been the case. Flash is still only about 20, 25, 30% of the market. About 30% of the spending, about 20% of the terabytes. But as prices come down, expect people to buy more. That's always been the case whether there's any elasticity to demand. It hasn't shown up in the earnings statements and that's a bit of a concern, but we'll keep an eye on that. We're also going to watch the cloud siphoning demand from on-prem spend. Can the big players and guys like Pure and others, new startups maybe reverse that trend? Multi-cloud is an opportunity for these guys. Multi-cloud management, TAM expansion into new areas, actually delivering services in the cloud. You saw Pure announce a block storage in the cloud. So that's kind of interesting that we'll watch. Other players may be getting it to the data protection space, but as it relates to the cloud, one of the things I'm watching very closely is the TAM expansion of the cloud players. What do I mean by that? Late last year, Amazon announced a broader set of products or services really in its portfolio. So let's watch for Amazon's moves and other big cloud players into the storage space.  Remember, much if not most of Amazon's AWS's revenue comes from compute. They really haven't awakened to the great storage opportunity that's out there. Why is that important? Look, you saw this play out on-prem. Servers became a really tough market. Intel made all the money. Amazon is a huge customer of Intel and Intel is getting a big piece of Amazon's EC2 business. That's why you see in part, Amazon getting into its own chip design. I mean, in the server business, you're talking about a low gross margin business. You know, if you're in the 20s or low 30s, you're thrilled. Storage, pure last quarter had 70 plus percent gross margins. It's been a 60 plus percent gross margin business consistently, so you're going to see the cloud guys wake up to that and try to grab even more share. It's going to be interesting to see how the traditional on-prem vendors respond to that. Coming into last decade, you saw tons of startups, but only two companies really reached escape velocity. Nutanix and Pure. At the beginning of the century, you saw Data Domain, Isilon, Compellant, 3PAR all went public. Equalogic and Left Hand got taken out.  Storage was really a great market. Coming into this decade, mid part of the decade, you had lots of VC opportunities here. You had Fusion and Violin and Tintry went public. They all flamed out. You had a big acquisition with Solid Fire, almost a billion dollars, but really Pure and Nutanix were the only ones to make it. So the question is, are you going to see anyone reach escape velocity in the next decade and where's that going to come from? The likely players today would be Cohesity and Rubrik. Those unicorns would be the opportunity. You could argue Veeam, I guess, reached it, but hard to tell because Veeam is a private company. So by escape velocity, we're talking large companies who go public, have a big exit in the public market and become transparent so we really know what's going on there. Will they come from a cloud or a cloud native play? We'll see. Are there others that might emerge? Like a Nebulon or a Clumio? You know, a company like Infinidat's doing well? Will they hit escape velocity and do an IPO and again become more transparent? That's again something that we're watching, but you're clearly seeing moves up the stack where there's a lot more emphasis than spending on cloud, cloud native. We clearly saw it with hyperconverged consolidation, but up the stack toward the apps, really driving digital transformations. People want to spend less on heavy lifting like storage. They're always going to need storage, but is it going to be the same type of market it has been for the last 30 or 40 years are great investment opportunities. We're starting to see that way, but we'll keep track of it. So thank you for watching this breaking analysis Cube Insights, powered by ETR. This is Dave Vellante. We'll see you next time.


I recently attended a three-day weekend Kempo seminar called The Zen of Kempo, hosted by good friend Master Sean Kelly. Now I wanted to cover this in today's episode because it isn't your typical Kempo seminar and in fact I feel that it is an important message not just for Kempoists but also one that applies to any martial artists, especially those of us who might not be in our prime or in our youth anymore. Today we're going to hear from some special guests and explore how you can get the most out of your martial arts at any age. For many years Master Kelly held massive annual seminars that attracted people worldwide and explored the dynamics of American Kempo. In recent years Mr. Kelly has scaled back to seminar to focus on deeper themes, themes that offered more than just the traditional busting and bruising practices Kempoists are known for. Kempo was represented by both the tiger and the dragon, the tiger for raw earthly strength and the dragon for higher wisdom and peace. So how does this seminar marry the two together? What is The Zen of Kempo? The Zen was to show the martial artist as a martial human to find out more about who they are and find now in their journey how to find balance, mind, body and spirit of all ages and regardless of where they come from but the majority of our group this particular weekend were above 50. Most of them are experts they're above black some are above even fit degree which means they're still willing to learn and so they have the injuries. Would it be through sports? Would it be just anything from a bruised knee to a knee surgery and shoulders? All the things that happen in almost any sport activity. We want them to learn how to use their martial arts as part of the therapy of better life and to go back to it and slow down a little bit. And my platform was to also give new instructors the ability to step outside of their normal comfort zone and give them a broader audience of working with black belts who are seasoned black belts. And so you get the grandmasters like the Bill Superfoot Wallace's. Here's a guy who is known worldwide who has a degree in kinesiology and physiology talking about the science of how to stretch. He talked about at 77 years old after four hip replacements and operation on his one knee. He's still doing it. Alex Perez had that this is his first time I invited him to start bringing out the forms and he did short three and his instructor is Master Ken Herman who's actually written books on the forms I believe up until short three long three. But I mean it's like an encyclopedia that he's brought to the table which means for those intellects who really like to go into the ingredient deep down and get into the DNA he put those in a manuscript where you can now outside though in your physical you can sit there and on your own and just start reading in between the pages some of the content that you may go man I didn't realize it was so in-depth. We brought in life coaches who are certified under the John Maxwell team coach Jocely Gonzalez and we have another one tomorrow Mr. Robert Sendin. We have a Tai Chi instructor Mr. Jim Kelly coming that shows the softer side of the art how to balance how to breathe how to transfer weight how to slow down and I get the physical this is fun let's see how many bruises and bumps we can get as our trophies but there comes a point in time most of us don't know in our audience what's going on with those people what sicknesses they may have dealt with or still are. My name is Jocely Gonzalez I am a neurobiologist I'm a life coach I've had a very interesting journey all throughout I love the martial arts train in my own capacity my age but I have learned to also adapt a lot of lifelong lessons into the martial arts not only training for myself but being a mentor to kids it's interesting because our brains think we're still 25 even the work maybe 60 65 70 and beyond our brains have that memory of who we were back in the young ages and so I love the fact that we are able to kind of work with where we are in a in our own capacity and at the same time allows to enjoy what we love. Zen is is a way of doing something not the same for everybody so it's what you get out of it is what you feel about it's the training the training the movement that the aspects of life itself you know I've been doing this since 1963 basically 57 if you count my wrestling background which is still a martial art my livelihood my life is still a blast I have an absolute blast doing this still fun kicking people too and we're all getting older but the knowledge and everything that you get from the Zenokempo as far as how to come how to become one with your spirit your mind your body and everything how to have a piece about yourself. One of the first things that Mr. Kelly and him talk about in the beginning is you know none of us are who we used to be we're not doing those jumping flipping kicks and spinning around and we can't do it but it doesn't mean it's not still in our minds and but what we can do is we can adjust what we know and make it work for us and do it with ease. When you're young or just beginning to train in the martial arts it could be an exciting time getting fit learning how to fight conditioning and taking your thumps it's easy to get caught up in the excitement of training but there are aspects of the arts that early practitioners tend to ignore or overlook. I think maybe a lot of martial artists might lose sight of just who they are inside you know they learn all this stuff and they learn all these techniques but you've got to also keep who you are in check as well. Intentional living in to really just sum it up if you can and just one global statement is just being aware each day of what you're doing not just for yourself but for others having intentionality and purpose to your life. I personally think that one of the challenges to finding this balance is our own perception aging isn't something that's felt overnight like a switch it's progressive and sometimes we have the tendency to not acknowledge the fact that we're getting older until we're forced to face scenarios where we hit limits so how can we better navigate this transition into getting older. I will encourage as the example I brought both myself Bill Wallace, Reiner Schulte who's in his 80s if we can do it you can do it and we have people coming from all ages I had a few come to this particular event I haven't seen in almost 30 years. One lady I taught her son when he was nine he's 40 now she's 71 and the phone calls that came to me was I can't do this I can't do that I have this going on and I said are you done now that you've told me what's wrong with you I would rather look and see what's right with you and let's validate your strengths. Retire doesn't mean stop especially with work it's really means to live live longer live graciously okay but now be more concerned about your health because you can't afford what it's going to cost you okay if you don't do that. It is very interesting to see that even when you are struggling with aches and pains arthritis maybe some gay issues you go into your 40s your aging processes kind of kick in as early as 35 although we start aging at 25 years old when we get to about 35 years old our process is kind of beginning to change and then at 40 more so you go into your 50s and it's like a switch all of those aging stages are beginning to be challenging for the body so when you start training when you're young you know the body is very agile and you can do this you can do that you can move in so many different directions go on the floor you know all kinds of different things and then as you're aging you can no longer do this many people think they can no longer continue to train in the capacity that they trained before and that's where that mindfulness set that mindful set change has to happen so that you can see that all right well yeah I may not be able to kick as high as I did perhaps if I go into something as simple as stretching can help me kick maybe better than I think I can and work from there so it's an adaptation it's really to adapt the thought of continuing to enjoy what you're enjoying what you're what you've been doing for many years and then from there learning that you're probably gonna have to make a few compromises but don't stop more than anything else it it it can be done at a ripe old age you can do it your entire life you don't have to do it hard you don't have to do it fast you don't have to do it strong just do it because it's it's an education it's a physical education it's a training session and it clears your mind to where you can have clear thoughts it's something you can do forever I've done it now for 60 years never too late it's never too late to start some people you know I've had 70-year-old people 12-year-old kids six-year-old kids the older the better because see the good thing about older people they don't have the strength to make it wrong so they have to do it right if they're still human that they're still human and are not invincible that's it it is even more critical to take good care of yourself to really monitor and watch your health and I know that when you're in the martial arts there's that's a lot of physical there's a lot of but that doesn't necessarily translate into health all the time so I think that becomes a critical component because without health you really don't have a whole lot this seminar and series of classes went on for three days with so many great guest instructors and lessons the amount of information can be overwhelming if you can attend the seminar and walk away with a good nugget or two of information something that you could really apply to your own life and training then it was worth it so with that question in mind what would be the key takeaways with the Zen of Kempo we want people to understand that nobody knows it all that's that's you know but we're first to hate criticize critique you see it all the time but people are putting things up they're doing reformed they're doing whatever and it's like oh but your toes weren't this and you're here wasn't that you don't know if that guy has had an operation you don't know if the guy has a disability okay it's just for him to show you a little bit what he knows when it comes to life and death and if it's a real street application nobody looks good it's a matter of survival learning how to love and embrace who you are and how to just move forward with with that learn to be a student it doesn't matter how old you are there's always something to learn always something to read always something to just gather from somebody else and just give it 100% give it your 100% with intention peace yeah peace there's your way of doing something not the way that's your way of doing something you won't do it the same way Sean Kelly does it he won't do it the same way they did Parker did it it's difference in your body you take into consideration your body your height your weight your different your distance your strength your weaknesses your power in February matter of fact next February we're going to open it up and have you know see Kimpo people are used to working with Kimpo people what happens when they're going to work with a shoulder cut person what happens if they're going to work with a deco on the person now now we have these different sessions these different systems come in so they can play with modify change something that they do that might help them in the realm of competition of training of different hate maybe this is easier for me than doing it my way if you walk away with one thing this weekend just one thing that you say wow I like that it was worth the entire weekend I personally got a lot of great information and perspective during that weekend everyone there had such a great attitude and no matter the rank an open willingness to learn I would like to extend a thank you to master Kelly for holding these events and for continuing efforts to not only perpetuate the art of Kimpo but to also provide a resource for those of us who want to integrate what we learn deeper into our lives Mr Kelly also runs the stop the bully program providing resources and training for the young victims of bullying we covered it in a previous episode if you'd like to learn more about that the link is in the description so hopefully you guys were able to get some value out of this perspective and I would love to hear about any influential seminars that you have attended and what you learned from them now I was lucky enough to be asked to teach a class for Mr Kelly's Zenith Kimpo seminar in 2020 and it was a fantastic experience the complete video of that class is available for our patreon and youtube black belt members so you can find that there in its entirety thank you so much for watching and we'll see you next week


In this presentation, we will take a look at multiple choice questions related to budgeting, going through those questions, and then practicing test taking skills with them. First question. First, a word from our sponsor. Yeah, actually, we're sponsoring ourselves on this one because apparently the merchandisers, they don't want to be seen with us. But that's okay, whatever.  Like our CPA six pack shirts, a must have for any pool or beach time, mixing money with muscle, always sure to attract attention. Even if you're not a CPA, you need this shirt so you can like pull in that iconic CPA six pack stomach muscle vibe, man.  As a CPA, I actually and unusually don't have tremendous abs. However, I was blessed with a whole lot of belly hair. Yeah, allowing me to sculpt the hair into a nice CPA six pack like shape, which is highly attractive. Yeah, maybe the shirt will help you generate some belly hair too. And if it does, make sure to let me know. Maybe I'll try wearing it on my head. And yes, I know six pack isn't spelled right. Three letters is more efficient than four. So I trimmed it down a bit, okay? It's an improvement. If you would like a commercial free experience, consider subscribing to our website at accountinginstruction.com or accountinginstruction.thinkific.com. A plan that lists operating expenses expected that are not including and the selling expenses budget, A overhead budget, B sales budget, C cash payments budget, D cash receipts budget and E general and administrative budget. Let's go through this again using the process of elimination, a plan that lists operating expenses expected that are not included in the selling and administrative expenses budget. Now that's a kind of a strange type of explanation here, but we can see we have operating expenses and operating expenses are usually if we think about like the income statement of a multi-step income statement, we typically think of selling and administrative type expenses as the operating expenses and then they eliminated the selling expenses. So I would, you know, it sounds kind of funny to think about it, but we're talking about operating expenses. So if we go through these, then A says overhead budget. Now we might think, maybe that's selling and admin, but that usually goes into that, to the cost of goods sold actually overhead, but and then B says the sales budget. And we're talking about operating expenses. So I don't think it's going to be B, the sales budget, C says cash payments budget. And we might think, you might have payments in there and D says cash receipts budget. This is expenses again. So we're probably not talking about money coming in that would be kind of income typically. And then E says general and administrative expense budget. So there's an expense, some type of expense budget, and it is an operating expense. So I'll keep that one for now. AC and E, let's go through it again. A plan that lists operating expenses expected that are not included in the selling expenses budget is that the overhead budget, we're talking about operating expenses. This is typically cost of goods sold. So I don't think it's that one. C says cash payments budget versus E saying general and administrative expense budget of the two, ease and expense. So again, note they kind of listed this directly what it is on a multi-step income statement. They're operating expenses, typically consisting of selling and administrative expenses. They then eliminated this selling expenses, which leaves us with the general and admin expenses final answer, a plan that lists operating expenses expected that are not included in the selling expenses budget E, general and administrative expense budget. Next question lists amounts to be received from disposing of plant assets and amounts to be spent on purchasing fixed assets. A, cash budget, B, capital expenses, expenditures budget, C, fixed assets budget, D, property plant and equipment budget and E, production budget. Let's go through this again using the process of elimination lists amounts to be received from disposing of plant assets and amounts to be spent on purchasing fixed assets. A, cash budget, it might deal with cash. So maybe we'll keep that B says capital expenditures budget. That sounds familiar. So I'll keep that now C says fixed assets budget and we have fixed assets up here. So I'll keep that for now. D says property plant and equipment budget, which is up here, plant assets, property plant and equipment. So I'll keep that E says the production budget. So I don't think it's going to be E. I can eliminate that. Now of these three, of these four, these three sound kind of like the same thing. You know, capital expenditures, when we capitalize something fixed assets or something or like a certain type of asset and it's also could be called property plants and equipment. So I'm going to eliminate A and say maybe it's, it sounds like one of these that they just didn't, one of them's got to be the proper wording of it. So let's read through it again. Amounts to be received from disposing of plant assets and amounts to be spent on purchasing fixed assets. So this is the amount that we're spending and receiving for fixed assets or property plant and equipment. You would think that C and D would be reasonable names for it, but that's not what we call it. We call it capital expenditures project, a budget. So it's a budget for capital expenditures. So when you hear capital expenditures in the terms of budgeting, and this term capital is confusing because when you, when you hear it in different contexts, it means different things kind of. So, or, you know, the way it's, the way it's applied could lead us to think that it means, you know, different things in any case. The capital expenditures in this case means that we have the expenditures for things like fixed assets or property plant and equipment. So we're either selling property plants and equipment, receiving money for the sale of those, not inventory, property plant and equipment, stuff that we're using to appreciable type of assets, or we're purchasing property plant and equipment, which is probably more likely to be occurring. We're going to purchase some kind of equipment throughout the time period. So final answer lists amounts to be received from disposing of plant assets and amounts to be spent on purchasing fixed assets be capital expenditures, budget.


I get it. Instagram and TikTok are hiding your content from people. This is how you're going to increase your engagement and get people to see you. You're going to post them on Pinterest, add the relevant title and description, then put the website that you want to promote, add the relevant tags, and watch people find you easily. Follow for more tips.


Welcome to Deal Breaker. So, you guys ready, man? We're about to unleash Deal Breakers on you, June 20th with my sales director, Dave Kobelman. We're gonna have a blast. Between now and then, I need you to think about something. What is that one thing? Cause I need help. What should our topic be for our first Deal Breaker show dropping June 20th on a Wednesday at 2 p.m. Central Standard Time? What's that one thing that is keeping you from making the sale, closing the sale? What's that one Deal Breaker that's holding you back from closing the sales that you know you should close? What's that one sale, that one story, that one appointment, that one call that keeps you up at night because you weren't able to close it, man. You weren't able to get the deal done. What has happened in the past to where you don't get sleep, man? Cause it bothers you. It eats you up inside. What's that one thing that's holding you back from closing the deal? We're gonna get into Deal Breakers and all the different Deal Breakers, everything insurance wise, sales wise, that keeps you from making sales.   Those things are holding you back. Dude, we're gonna address them. We're gonna come at them strong.  How about this set, man? I'm excited and jacked for June 20th. Wednesday, June 20th. Two weeks in two days, two couple weeks, two p.m. central, we're gonna drop it strong. We're gonna bring the heat. What's those things that are holding you back? Dude, we gotta remedy those. We gotta fix those. That's what Deal Breakers is all about.


Hello everyone. My name is Jayatma Vikramanayaka and I am the United Nations Secretary-General's envoy on youth. Welcome to the future caster Global Young Visionary Summit. Young people of today make up the largest generation that our world has seen and most importantly young people today are also the most interconnected generation. Youth are natural adopters of technology and they must be meaningfully engaged in shaping the world's direction towards innovation and growth of new technologies. Our world desperately needs technologies to solve the challenges that we are facing from the global climate crisis to sustaining peace and creating sustainable economies. This year we are all entering the decade of action which marks our 10 year countdown to achieving the sustainable development goals by 2030. Without technology and innovation this is going to be impossible. As the ones who will be inheriting and developing these technologies young people need to be involved in designing these solutions as well. The United Nations believes that young people should be engaged as equal partners in development. In 2018 the UN Secretary-General Antonio Guterres launched the Youth 2030 UN's first youth strategy to strengthen its commitment in working with and for young people. Through Youth 2030 the UN aims to be a pioneer in innovation by engaging with young people meaningfully. The growth of innovation and technology development have supported young people to create new solutions for global challenges. Provide digital spaces to advocate their future and drive employment and job opportunities. However there are more work that needs to be done to ensure that technologies can be safe, inclusive and empowering for all young people. That's why I am so excited to learn that starting from today you are a part of 700 students that are taking part in discussing how technology can change the world's future and impact the lives of everyone everywhere. The FutureCastor Summit is a remarkable opportunity for young students like you from all over the world to gather and discuss this year's theme for technology for development. I hope that you will share your unique perspectives, learn from each other's experiences and cultures and most importantly I hope that you will have a rich and dynamic discussion in this summit. Thank you very much and I wish you all the success with the summit.


Hello everyone this is Amit Dan of AmitDan.com. Today I'll have another episode of unboxing and review video and I'll be presenting the Moleskine Extra Small Volent Collection Notebook. Moleskine is an Italian company that makes quality notebooks at very affordable prices and I have the size you're looking at which is extra small and we'll open this up and we'll take a look at it. Before I do that let's go through some of the specs right here. So this comes in two in one set so you have you're looking at a set of two rule journals. We have 56 line pages two and a half by four and a quarter inch acid free paper and each paper is perforated or you can just take out you know or you can tear them. They come in two different colors with a darker and a lighter one of them is a pine green and the other one is a lemon yellow. Okay so this is a soft cover and they have rounded corner and the first thing I can tell you about that you know is that they're really small. If you see them on the video or you know on the website it's very hard to feel how small they are so I'll just compare with a crate card and a dollar Canadian dollar bill. So this is a credit card size card and if you take a look at it then you can see that you know how small is this. So if you just fold a Canadian $20 bill evenly and then you can have an idea of the size so this is really a very small size or if you make it flat then you can see that you know this is really small size which has an advantage of you know keep them in your pocket or in your bag all the time. So look at the paper so it looks like you know these are ivory paper. The paper are actually very fine paper not too thick not too thin. You can tear each paper they're perforated. So in here looks like there's a small information booklet and actually they even attached a sticker. So this is the side here and here we have some information about muller skin and it looks like they have in different languages. So I'll set this aside here as well. So two different types of pens here one is regular ballpoint pen and the one is color ink pen. So I'll just you know put some writing on here and just to you know see how they feel. So you can see that you know the paper is good quality the ink is not bleeding on paper. This is a good size to keep in your pocket or in your wallet if you have a like you know big wallet or you can put keep it in your sling bag or your waste bag but the small size may not be suitable for everyone but this is a very travel friendly and everyday carry notebook. You can so I'll be reviewing some other brands and sizes of notebooks. So this is the muller skin extra small volant collection journal and they come in two sets so each one has two different shades of color one is lighter and one is brighter. To you know take notes you can also do to-do list or take notes or shopping list or reminders or everything. So the product is a quality product reasonably priced and I cannot find anything to complain about if except if you know the size is not too small for some of you. These reviews are non-affiliated unbiased and honest all my reviews are non-affiliated and that's where you can get honest and real opinions. Thank you for watching forget about subscribing this channel forget about liking this video and I'll see you shortly.