The Saints are back for another round of incessant violence and cartoon-esque humor, but does Gadot of Hell feel like a standalone title, or merely retextured assets in the form of DLC? After the conclusion of Saints Row 4, the gang finds itself celebrating Kinsey's birthday. A mysterious witch board is brought out, and sure enough, they connect with the spirit world. Saints looking to marry off his daughter Jezbel and find someone to lead his armies, and the boss just so happens to fit the bill. Next into the underworld, Johnny and Kinsey rush to save their friend, an exact little revenge along the way. Anyone who's played Saints Row 4 will be familiar with most of the game's mechanics. You first dive into the game as a regular Joe, but upon receiving Satan's halo, gain the abilities to blaze across the streets, leap across buildings, and execute a variety of special attacks. What's different this time around is the addition of flight, and boy is it fantastic. Once in Hell, the Saints meet up with Dane Vogel, an old antagonist from the series. After his death, he began devising a way to take down Satan. Scattered around the map are various characters such as Blackbeard, Vlad the Impaler, and even William Shakespeare. By completing activities and helping them obtain a piece of the pie that is Hell, you begin to gain Satan's attention. Now unlike previous Saints Row games, the plot isn't driven forward by completing specific quests, rather each act ends when Satan's rage meter fills up. This makes things more interesting as players can choose quests based on various upgrades and weapons they'll receive, rather than merely completing missions because they are prerequisites to reaching the end. The problem is that these side characters aren't really well developed over the course of the story. You learn a bit about their backstory and you help them claim some territory, but their existence in the game's universe feels meaningless. Loyalty quests consist of just a bunch of activities bundled together rather than the unique missions we got in Saints Row 4 that helped characterize the crew. It leaves one to wonder if perhaps Volition had greater plans to expand their storylines, but were limited by time constraints. Unfortunately as a result, the final act of the game feels like a repetitious cycle of fluff used to stretch the game time. The controls are pretty straightforward, but like its predecessor, traversing the land only becomes fun once you've actually leveled up your abilities. It's unfortunate that the world seems to be designed this way, but thankfully you can upgrade your stats relatively quickly. Within the first about hour and a half of gameplay, you're able to max out the most important powers, and that's because of the new flight mechanic which is just so much darn fun. In Saints Row 4, you had to collect data clusters atop buildings and along walls, and doing so felt almost like a punishment as the process was slow and repetitive and distracting. However, in Get Out Of Hell, most of the soul clusters are suspended in the air, so you can easily grab like 20 or 30 of them without ever touching the ground. Major kudos for strategically placing these in areas that allow players to marvel at the exceptional world design. Diving in and out of buildings, ducking under bridges, gliding over lava, and speeding through tunnels is a thrill. And I think I actually spent more time collecting clusters than anything else in the game. I can honestly say that I have never had this much fun traversing a world. All the main activity types are back, from races to destruction to insurance fraud. Now, while a lot of it may feel like just retextured versions of the same, there's enough charm and personality in the design to make things feel fresh. Added to the fold are new games such as Salvation, where you must save souls before they die or are consumed.  Completing certain objectives unlocks special weapons representing the seven deadly sins, such as a lazy boy equipped with gatling guns and rockets for sloth. All the powers are essentially the same as in Saints Row 4, with some minor thematic tweaks. Inside of throwing ice, you can launch an attack that turns people to stone. Or as burned souls, and the ground stop is virtually unchanged. The only difference is that telekinesis has been replaced with the ability to spawn creatures. While rarely used, this is convenient for when hordes of enemies are being thrown at you. The weapons are interesting and colorful, but by default are virtually useless. Because of the importance of the new flight mechanic, any currency obtained from missions is often spent on increasing stamina and health. The average player will only have enough loose change to fully upgrade a single gun or two. It's so often taking down a single enemy means unloading a full clip or two into them.  Weapon stores have been reduced to vending machines, and there's no way to modify clothing or get sweet hellish tats. This feels like another missed opportunity as the only thing you can really do is swap between Johnny Gat and Kinsey, and change the color of your wings. Given the size of the game, this is acceptable, but customization has become something people have come to expect from the franchise. The world itself is beautifully designed. From downtown to the entertainment district, every section has its own unique feel, and while the game can't compare graphically to some of the stellar titles of the current generation, it would be wrong to ignore the incredible attention to detail. While the missions themselves don't do a great job of highlighting it at all, the various flight challenges allows for a nice means to observe the beautiful landscape. It's one key thing that seems to be missing and get out of hell, and that's the personality of past titles. Sancero 4 is dense with tons of pop culture references, parodying franchises such as The Matrix, Mass Effect, and Fallout. However, besides a particular spectacular cutscene worthy of a Disney movie, and a few pokes here and there, it feels rather dry. Now you get a bit from the mindless ghouls walking along the streets and casually crashing cars into buildings, comedically attempting to emulate the living, but overall the experience doesn't live up to its predecessors. Overall, there are many aspects of Gadot of Hell that franchise regulars will be disappointed about, from the lack of character development and customization to a story that feels like a chapter of a grander novel rather than a standalone narrative. That being said, at a $20 price point and clocking in at least five hours of gameplay, some of the shortcomings can be ignored. What really saves this game, though, is the flight mechanic, which makes this game one of the funnest open world titles I have ever played. And that's what it should all boil down to, despite its flaws every minute was still a blast. If you have some change to spare, it's well worth the money. Saints Row, Gadot of Hell, gets a 7.8 out of 10. One night with any lover, but you have to punch a panda. Do you do it? Ooh, good question. So your secrets, if you really look at yourself, you will be speechless. What happened to being doctors and teachers? What happened to being your brother's keeper? Nowadays, kids won't worry to bother me.


Hey what's up folks, in this project we're scanning statues to 3D print low-polygon miniatures. You can 3D scan statues from museums, art galleries, or historical sites to make custom keepsakes. With an 80-feet cutie pie and a neopixel stick, you can make them glow to make a custom lamp. To diffuse the LEDs, you can 3D print them with zero infill to make them hollow. Using photogrammetry, we can generate detailed 3D scans and use a low-polygon generator to make artistic renditions. Use the Polycam app and take about 50 photos of a statue at different angles.  After Polycam processes the photos, you can export an OPJ file to clean and modify. We imported the file into Blender and removed the unwanted geometry. We'll start by adding a box around the part that we'd like to remove. Next, we'll add a Boolean modifier and use the box to isolate the statue. Switch to Edit Mode to select any leftover faces and delete. Check out the guide on the 80-feet learning system for a full step-by-step tutorial. To generate a low-polygon model, we used Andrew Sink's low-polygon generator that you can find on lowpoly3d.xyz. Here you can easily decimate the model to get a cool-looking low-res statue. Next we'll export our model and then re-import it into Blender to fix any overlapping faces or overhangs. Inside Blender, we can delete extra faces and fill in any holes generated during the low-polygon process. Then, we'll use the fill face command to rebuild the geometry. To fix any extreme overhangs, we can pull faces by going into the Sculpt Mode. We used the elastic deform tool to help pull faces so they're at a 45-degree angle. This will help cut down on the amount of support material. Now we can export the model as an STL and slice for 3D printing. We had a lot of fun printing these and think it's a great way to experience works of art when you aren't physically able to travel. It's also great for archiving. Being able to touch and feel objects that are protected from the public is a great use of this technique. We hope this inspires you to try 3D scanning and make your own. Thanks for watching and be sure to subscribe for more projects from Adafruit.


All right, that's it for 2020. Actually, that's not true. It's not that's not it But I'm not gonna do anything for the channel on the 2014 and 25th to have other things planned and in 20 21 is going to be bananas. I have a thing I want to announce. It's not quite ready yet I got to test it but it's going to be cool. I hope so other than that I want to say thank you 2020 has been definitely quote-unquote interesting But I also gained a lot of subscribers a lot of people that watch my content So I'm really really thankful to all of you watching in and tuning in and commenting and liking and all that stuff So thank you so much. Thank you for everybody that watches my clips that that interacts with me and gives me Questions and tips and all that stuff. I really appreciate it. Thank you so much It's been a blast doing this and I'm gonna continue of course in 2021 I got many many topics to cover. I'm putting this it was my closet. It's this way actually kind of turn this oh In here in here hold on let me open this That's where the review stuff is being shot. So lots of reviews coming up. I have a lot of things including Among many many things so 2021 is gonna continue classic schedule a lot to cover but again I'm rambling as always towards the end. I don't do a quick video saying thank you tiny little Christmas break And then it's full force ahead. I can't wait to share the things I want to share. That's that. Thank you And I'll see you in my next clip


Hello, I'm Janeofina Genova from the BMC Information Design and Development team. In this video I will show you how to request services on behalf of other users in BPC Digital Workplace. This feature is useful any time you need to place a request for someone else. For example, you might place a request for team members that you support. Or you might place a request for a colleague who has network connectivity issues. Now, as I'm logged into BMC Digital Workplace as an end user, I will show you how to submit a service request for another end user. At first, select a service that you need to request for another user. For example, I will select the Assign Office Space service. Next to request for, click Edit. In the request for someone else window, you can search for people. Type a name of a person for whom you are requesting the service and select this person from the list. For example, I'll search for Bob Baxter. As you can see, Bob Baxter's name is added to the request for field. To complete submitting the service request on behalf of the selected user, click Request Now. And submit the request. The person for whom you have submitted the service request does not receive any notifications about your actions. However, both this person and you see the same submitted request on my activity page in BMC Digital Workplace. This was a quick guide about requesting services on behalf of other users in BMC Digital Workplace. Thank you for watching!


The study found that communities living near protected areas have higher subjective well-being levels, which is influenced by social impacts of part and geographical location. To increase well-being and public support for these areas, more effort should be invested in equal distribution of PA benefits. This article was authored by Nicoleta Jones, Crisso Volantis Melisios, Apostolos Cantazis, and others.


Thank you very much. Thanks for coming to DjangoCon. Wonderful speakers here. I hope I can move up to the podium. Now, I generally speak about security in the Django meetup in New York. And my first time I did this, I spoke for about three hours, and I realized that maybe I should tone down the slides a little bit. And these days, I largely speak about attacks, but when it came to posting content for DjangoCon, I figured let's not look at attacks, attacks change. Also, there's a video. I don't want someone learning the wrong things from this talk. So I've come up with a little bit of a unique approach to how we're going to go through security. So I'm employed by a wonderful company called Genesis. I used to be employed by a company called Manasano. How many of you have heard of Manasano? How many have done the crypto challenges? OK, good. So at least you have some people. I did web application penetration testing for about two years. Moved over to Genesis to do it more, to own security in-house. And I like to stay employed. So I'd like to mention that the contents of these slides are my own. Now, when it comes to speaking about security, it gets really tough. Everyone, you're always taught about security. They drag you into a big conference room in these large corporations if you work in one of those. Or in a small place, and you hear about it, you read about it on Hacker News and on Reddit, about different hacks. And it's a hard problem. It still exists. And one of the major reasons for that is that your app or your app ecosystem is only secured as its lowest common denominator. Take Google, for example. It's one cross-site scripting bug within one Google app. It affects every single Google app because they implicitly trust each other. Now, that's really tough because the surface gets really, really big. Also, security is constantly changing. What was good yesterday is not good today. And as a caveat, these slides work for today. They'll probably work a little bit more, but you should take these points down, research them further, because they may change. So let's look at what we can do to change that. Now, if you want to break down security vulnerabilities into two categories, they can be broken down rather simply. There's either a lack of or improperly designed and properly coded security controls. And these will cause you to be vulnerable to attacks like denial of service and where you don't have great limiting authentication bypass because your authentication mechanism isn't secure or is susceptible to bypass. And then the worst and most common is improperly implemented cryptographic primitives, which you're encrypting the data to data looks encrypted but can easily be decrypted or can be modified. And then there is mixing data up with code and these largely run around with the remote code execution vulnerabilities. Now, while there are obviously there applications that have remote code execution interfaces built into them, stuff like SQL injection and cross-site scripting in where an attacker can make their data execute as code on your server or at least within the context of cross-site scripting within the client's browser, largely involves the data and code being mixed up. So let's look at these things in a little bit of a different way, right? So as opposed to looking how to prevent the attacks, let's look to build our software to be more robust. Let's not look how we're being attacked. Let's look to build better software. Now, every language, every program has side effects, but there are side effects that we can prevent. And I feel that one of the first things in making a more secure program is building software that is incredibly assertive. You must, to the best of your ability, assert as much as possible what the user is giving you is what you intend it to be. Not what you think it's going to be, what you intended. And that's very important. And the Python Zen has this, where it says explicit is better than implicit. Don't just take the input from the user, assert it, make sure it's exactly what you want. Now, let's look at the easy one, which is mixing code and data. And when we talk about mitigating cross-site scripting and SQL injection, we talk about statements like output encoding or prepared statements to parameterize queries. And these statements sound very nice.  Let's look at what these things actually are. So when we get hit by this bug, for example, let's say SQL injection, we have a SQL query. We've got data from the user. Now, do you know what that data is? Well, let's say it's supposed to be a number. Let's say it's supposed to be text. Now, it should only be text and it should only be considered text by our SQL server. So if we explicitly put it into that category, at that point, we've mitigated it. And that's what prepared statements are. Prepared statements are parameterized queries. They're called both things. That's why I keep on using both of them because literally in each app ecosystem, they have another way of saying prepared statements are parameterized queries. But they mark, they explicitly tell the SQL parser, this is data, do not execute this. Insert this when you need the data required in this location. You explicitly mark that as data. When it comes to output encoding, when you're reflecting user data on the page, at that point, you have the ability to, you're marking that user data. You're marking that user text or user bytes as data. You're telling the HTML parser, you're telling the JavaScript engine within your browser not to execute that. Now, this should be a general rule. And this is one that I follow and that I feel that many of you should follow as well. Be assertive. If you don't know what it is, find out where it's going to be used. And whatever you do, you will not get heard if you mark it as data. Like marking it as code is a risky option. Try not to go in the risky side. Now, let's look at the security controls. So this is where it gets really tough because security controls, you have to understand attack surfaces. You have to understand threat modeling. You have to be able to build your security controls in a robust way. And that's tough because the current security controls that we all use every day have been a cumulative set of knowledge or research around the security controls. And we've only gotten to this point because of all the attacks that they've been hit by. We only have security controls because we need them. We don't have them because it was an initial thought. Security is always an afterthought. It's only after an attacker comes. If a bank didn't need a vault, they would not invest money in a vault, but they need one. And then as the vaults have been broken into, so too the vault technology has evolved. So what's really important to notice if you're going to ever build security controls, if you're going to ever implement them or use them, use popular ones. What I mean by popular is use ones that industry leaders use. You can find strength in numbers, right? Do not use one that one or two people use. There are many times I will go online on GitHub and see a new model that's great and has awesome functionality and contains an authentication bypass or contains a security bug that you've now opened that unsuspecting users actually gonna just jump straight into. And the way these holes are mitigated, the way that these holes are patched up to the more people using them, the more people reviewing the code and therefore building out and helping build a better security control. Now, Django helps us with authentication. It doesn't help us very much with authorization. So a lot of us find ourselves writing authorization code. It's really important that when you build this code, these authorization views or authorization decorators, that you build them, you write them in one, you put them in one place. They should not be scattered amongst your application. It's literally, you can take the Python Zen, read it 10 times before writing any security control. If finding, having them broken up into many different locations can lead to a vulnerability, especially when you intend to update or mitigate a specific attack. And now you have to do it in every single location. Now, again, as mentioned previously with our data and code example, it's really important to be explicit. But conservative, I'll explain why a little bit later. Now, if you find yourself in the case where you have to actually build, let's say a login system, at that point, you need to literally go by the book. You need to get a web application, a security book, a good one and a high recommendations later on, and you need to go down the list of all the attacks and find out how they're mitigated. You need to look at current secure, or at least secure as of today or now, or at least we hope so, login systems and design yours to be very similar, if not the same. You must understand the attacks and whatever you do, do not write your own crypto routines. I have so much pain on the internet when I see large organizations and you get how blinking to very insecure crypto routines. Now, it's also important to note that you have to understand what you're doing. So, you have to be very conservative in using cryptographic hash functions, and we'll get to this a little bit later. But most of all, what's really, really important is Django provides very good and very powerful security routines. It's important that you use them because this is what the strength in numbers mean. Django is popular, we're all here, we all represent that community. There are many of us, no, many in that community that are not here today. I think we probably feel more than this hotel, if no. So, Django is very popular, if Django implements it, you should be implementing it. Now, let's look at some security controls that Django provides, right? If you need to cryptographically sign something, use Django, use the signer that Django comes with. Django auto escapes, unless you market a safe Django auto escape user data, it'll explicitly mark it as safe after auto escaping it, but the auto escape only works for HTML markup. If you find yourself needing to render JavaScript code, user JavaScript code, you use JS and code. Now, when it comes also to validating URL structure, the regular expressions provide a very, very secure implementation of ensuring that the, or at least you should be using it to provide, to provide a stopgap measure that people that shouldn't be hitting certain endpoints with certain data shouldn't be there. However, it's not perfect. Now, as an example, the default hasher is PBKDF2, password-based key derivative function two. Makes it easier to remember the long list, the set of characters when you know what it stands for, but it's set at 10,000, if you should upgrade that to 100,000, and that's as of today. Learning to all future viewers watching the video or considering this, you may need to increase that at a later point. Now, if you want, if it slows down your system, right now, 2.7.8, the latest version of Python 2.7, has back ported from Python 3, the C hash function, and you really don't have to worry about it. Another issue that we have is that object permissions aren't present within the framework, and therefore most developers don't think about them. And it's really important to remember that you have to be assertive of which user owns which object. And on top of that, the CSERF implementation in Django implicitly trusts the framework. I've got some work that I'm working on that'll implicitly trust the cookie, I'm sorry, and it bases all the CSERF mitigation on the cookie. If you have access to writing a cookie for that domain, you have effectively broken CSERF. Now, that is hard, but it's possible, and I'm working on some enhancements to the CSERF implementation to mitigate that issue. But let's talk, let's jump back a little bit to building our security controls. We mentioned that they should be in one location and we should not repeat ourselves. And all the logic should be very straightforward. This means that when you're using the login required decorator, it does not belong in your views.py, it belongs in your URLs.py. How many people have a views.py that's bigger than a thousand lines? There we go, right? How hard is it gonna be to realize that you missed one view? It's in your URLs.py that rarely grows larger than a hundred lines and works quite well. Now, I'm not gonna get into the beta function-based views versus class-based views. Personally, I use class and you'll see why I like them more later on. But whatever works for you, it's a free framework. Now, within class-based views, you actually get the ability to create mixins by overriding the dispatch method. We have an example of that here. Here we have, I hope it's easy to see, I took a screenshot from my computer. Here we have a class-based view mixin that is a login required plus it's going to require that a specific object is owned by that user. And as you see in, let's say, line five, for example, we obtain the target user based on the object. We check that in line nine. In line nine is going to make use of the request.user interface. Now, this is obviously assuming that within your application, you request.you're not saving objects as anonymous users and therefore in line nine you're checking if the user is authenticated. But then you're also checking in line nine if that user owns that object. And this is one of the reasons I like class-based views. It allows very easy mixins. And then you can use these mixins to create views, like authenticated template view, which will just have this as a mixin on the left-most side and then have the regular template view that Django offers. And you have a very simple view and you don't have to worry about putting login required. It also allows you to put all your authentication and authorization code in one easy to find place. Now, that's views. Let's talk about forms. Now, just, Django forms are fairly secure. They're built fairly well. The thing that scares me the most is model forms. How many of you have Rails experience? How many of you know what mass assignment is? Oh yeah, that's good. Just about the same amount of people that have Rails experience. That's really good. So this is something we don't have in Django or at least we shouldn't, but mass assignment is a bug where fields within your model are accidentally exposed to the internet, allowing anyone to put any information they want in those fields. Now, I've written, the Django documentation taught me to always make use of fields and I very much trust it. I don't use exclude. When you use fields, you're whitelisting. You're saying we only want these fields. We only want to deal with these, we only want to populate these fields in our model and I think this is a very good example of a properly implemented control. It makes it hard for the developer to shoot themselves in the foot and at the same time, it's also very powerful. Now, well, we've knocked off quite a few things in our list. Let's talk about being conservative. So, C-Surf is one of the things that is a popular hole that's been exploited and it's pretty scary and one of the problems that I feel that Django has, especially with function-based views, is their lack of explicit HTTP verb handling. Now, as you see here in my class-based view, I have, I'm inheriting from the Django core view and I have the ability to respond to both a get and a post but if I don't have any of those methods, it'll get a method, the viewer return method not allowed whereas a function-based view will always return based on that method. There are C-Surf holes that I've found that exist because functions were expecting a post but when you gave them a get, they pulled the variables out of request.meta and the C-Surf middleware in Django saw a get, said we don't have to check for C-Surf here and the view was compromised. So, there are, there is the ability within Django function, within function-based views to use a decorator called allowed methods but I'm not that much of a, I'm not such a fan of decorators. I find sometimes they're left out and when it comes to writing your own, it can get a little bit hairy but that's just my own personal feeling and don't take it, judge it on a case by case basis but I like to be very conservative at least when it comes to my own personal development so I shy away from writing decorators, I'm using classes and I'm being conservative and explicit about what my view is supposed to handle. Okay, now that we know what being explicit is about, let's talk about crypto. Now, I was, the original section, the original slides here were examples of how to do crypto properly and I wrote an example of cryptographic implementation on my blog in Node.js and then someone asked a bunch of questions about it and started moving things around and then I pulled my slides out of this talk and I wanna, and I wanna shut down that page or at least remove it. Crypto is really hard, right? Even cryptographers have problems with it let alone simple humans like us. It is really important to note that if you don't implement crypto properly your users can be negatively affected and therefore you have to be very conservative with what you do. Using Qizar and I'm only giving Qizar as a recommendation, use Qizar. When it comes to crypto, use Qizar. Don't implement it yourself, please and please don't play with Qizar. You're modifying Qizar, modifying the behavior of Qizar, vulnerabilities. Now I have a friend named Jan. Jan and I used to work together at Matasano and after the work at Matasano Jan and I developed an application in Django and I proposed an idea to use a cryptographic hash to identify a user and Jan let me know about Jan's rule. Jan's hash rule is simple. Only use a cryptographic hash when you need to. Now, can anyone give me examples of what a use case for a cryptographic hash that you absolutely need a cryptographic hash? Storing passwords, incorrect because these days cryptographic hashes or they used to be good for storing passwords because they're supposedly one-way functions or they're great compression mechanisms. Cryptographic hashes can be calculated very fast. Passwords you don't wanna be able to brute force. So these days we use algorithms that are tunable. Someone mentioned Bitcoin or cryptographic currency. Again, the amount of processing power that the Bitcoin network has practically invalidates anyone that uses any of the Shaw family or even, I'm not even gonna talk about MD5, but the Shaw family of hashes to hash user passwords. The amount of hashes they're able to generate that second is mind boggling. So there are two examples of Jan's hash rule in where you don't use a hash unless you absolutely need to. The one use case I know is if you want to ensure the consistency of a specific file and for example, Git uses hashes to track files. Many open source programs use hashes so people should know if the file has been modified or not. But then again, we need hashes. We need at least unique identifiers that we need to tie back to users. So for that, we have UUID4. UUID4 reads 16 bytes out of the cryptographic random source of the operating system or at least it's supposed to. If you don't have access to it, it will just use Python's random. So you have to ensure that you actually have access to it. But that's when you need a UUID. When you need a regular just set of bytes that are completely random, just read out of U random. An example of code right there. That number is completely unique. At least I hope it is. Now you need something to be signed, use Django signer. If you're stuck, you're gonna have to use the Python's HMAC implementation. But then again, once you get to the HMAC implementation, which by the way needs a hash. That's another example of a primitive that needs a cryptographic hash algorithm. You can get nailed with a timing attack, a side channel timing attack. So really just stay on the safe side, use the Django primitives. Now, I deliberately shortened this talk a little bit. Now we got almost 15 minutes. So there can be a lot of questions, but I'll end off with a little bit of an appeal. Security is a great industry. It's really good. It's made me a better engineer, and I hope if you guys do research, you can do research into security, then you will become better engineers. It's important to note the limitations. The lowest common denominator will never disappear from security. Just like the chain is only secure is its weakest link. But it's really important to do research, look things up, and when building new parts of your application, try to understand the attack surface. Don't only look at what should happen, look at what may happen. And then once you look at what may happen, you realize it's a little bit tedious because so many things may happen. So let's just be assertive and ensure as much as we can what should happen. Now, I'd like to make an appeal to the larger community. There is a lot of knowledge that we have within Django about security. There's a checklist that we should be building to help our fellow developers build and write more secure code. I know as a developer, as a security person, one of the biggest fears we all have is that innocent people, people in general will get hurt because of our code. We don't intend that to happen, and unfortunately there are parasites, attackers in the world that pray on the week and unfortunately sometimes they're able to take advantage of our code. So we should create a very basic checklist of every part of the framework of when you're writing, when you're using this part of the framework, what do you have to be worried about? And it should be really easy to use and just appeal to the community to help. And if you'd like some reading material at Madisonia, we always recommend the WA, we call it, is a web application hackers handbook too. The second edition, the first one is good, but the second edition's better. Tangled Web, the art of a software security assessment, and Microsoft also has a great book called Writing Secure Code, and Microsoft's got some good books out there. And all these books will give you the mindset, the proper mindset to building more secure code. Now, that's good, whoa. Nice, I've got time for questions. Sure, I'm gonna put these slides on my website. So, well, yes, the question part. Thank you so much, Lady. I think it looks like you've left a full 19 minutes for questions if my arithmetic serves. So please, this is obviously an exciting opportunity to engage on security matters. Looks like we already have our first question ready. Let's have a question about, you mentioned taking advantage of safety in numbers. Do you believe that there's any sort of diminishing returns there in as much as, while you may get the benefit as a developer of the collective knowledge of the community so that they can help you secure against attacks, does that not also, though, open up doors for when there is a security exploit that the payload is larger, right? If every Django project is using the same code to secure themselves, once an exploit's discovered, you have a huge swath of projects that you can exploit. So it does, and think about it in the simple forms. Heartbleed affected billions. That's exactly what I was thinking, right? And OpenSSL is a very popular library, but at the same time, it's better than the alternative. This is part of the security, you gotta kind of pick your battles. It is better than the alternative. Writing your own is not gonna get, it will not be more secure. There are very few people in the world that are able to put out solid cryptographic libraries and for them to be initially secure by default. And I don't know them. There are people that do, but no one trusts them. And things that are built by the community have got a large set of eyes on them. Yes, if there is an exploit, many people will be affected. But at the same time, every time that there is a hole in them, you know that there's so much security review that has been done that they found a slight chink in the armor. And everyone knows about it, so everyone talks about patching it right away. It's not that everyone ignores it or it's known only to few people and then you don't know to patch it and then you get hit by it six months later. Thanks. You're welcome. Should I repeat the questions or they have them good on the video? Oh, okay, please. So I have a more specific question. I'm sure other people have run into this too. So what's the best way to encrypt a field in a Django model? So say I have a user and I wanna encrypt their first and last name. There doesn't seem to be a very clear way to do this. Is there anything you would recommend besides the instinct of just hashing that value? Well, hashing it won't help you because the hash is supposed to be a one-way function. You're not supposed to be able to pull data out of it. Using KeysR to encrypt it is really helpful. You can encrypt it and then pull it back and then decrypt it every time you pull it out. I believe Django Encrypted Fields, don't hold me to it, you have to check them out, but Django Encrypted Fields uses KeysR and Django Encrypted Fields has an example that has a text-based encrypted field. Oh, okay, great, thank you. It's not an endorsement to Django Encrypted Fields. I looked at them once, they may have changed, but check them out. Is that like an add-on or something like that? Yeah, it's a third-party application. Okay, thanks. You're welcome. I also have a Django-specific question. Can you comment on development versus production settings? Example that comes to mind is allowed hosts. Sure, so most important, debug mode must be turned off. Now, you may all laugh, right? And I did when I was a Django developer and then I joined the security world and I was like, okay, now I'm gonna count the amount of sites I've seen debug mode turned off. Almost every application that I've tested had debug mode enabled in some way and it's really, really important for that. Now, also in production, you're dealing with things like rate limiting and abuse that you're not used to and it's really important to look at your, every use case is different and just set some really basic rules and guidelines to how much of your service your user should be using. A quick question that might be a little too specific, but do you have time to elaborate a little bit on the sort of spoofing the post by using a get and bypassing the C-Serve and how safe is it to trust in if you're using a function-based view whether the request is a post or not? Which is probably good, I rely on that. Sure, sure. So I'm gonna talk in the abstract and I don't have any code to show, but I'll try to be as specific as possible. So every function-based view takes a request, right? It'll take any type of HTTP request, it doesn't matter. Now within the code of that function are specific directives to process based on that request. If request.post, so if this is a post request, process the form. If request.get, do the opposite, et cetera. Now the issue I was describing was an issue that has been found where a view existed and this view used request.meta. So it wasn't just looking for a get or a post, but the developer assumed the fact that it was in a form that it would be posted to, but it can easily have been requested by a get. And that was the issue. You mentioned during talk that it's important if you do venture down the security road and writing your own software for that, your own controls, that it's important to understand all of the attacks that you may encounter and anticipate. That book. Handbook. My question more pertains to, do you think it's valuable to be able to understand and execute some of these exploits yourself in that process? That depends largely on the way a person works and learns, but from my perspective, I learned software security by looking at the framework, we're looking at the Django framework and just seeing what does it do? How does it work? And then looking at other implementations and saying, why are they different? And then comparing the differences and understanding how it can be attacked. Some people find it really helpful to actually attack. And for that, there's a program called WebGoat that allows you to a really vulnerable web application that allows you to really test out the application, to test the application security. The web application hackers handbook would give you a lot of those attacks practically. They make use of a proxy tool, a web application proxy called the Burp Suite. And for me, that's my Swiss Army knife when it comes to pen testing. And I really rely on it heavily for everything that I do. And I think that going through specific components understand and just reading about the attack surfaces on those components will be really helpful. But whatever works, if it's easier for you to break into the actual application, there you have it. And if it's easier for you to just look at secure implementations, then if it's easier for you to do both and do both. Thank you. Hello, my question is about, do you have a guideline to know when it's appropriate to step back and ask? Well, not ask, but when doing security, it's holistic. How can you know whether the Django layer is the appropriate layer to address a certain security concern with a stack with other layers? So just to expand a little bit on what you just said, why should, so for example, when building a rate limiting control, you can build it, let's say you use Nginx, you can put that directive in Nginx, you can put that directive in Django, why should you do one over the other? Now, it really depends what you're looking for. Nginx knows how to proxy and serve files very well, right? So when you want to limit the amount of IPs that hit your site, you can do that in Nginx. When you want to limit the amount of IPs that hit a specific endpoint, you can do that with an Nginx. However, it doesn't know anything about your application. As in Django, you can build rate limiters that can rate limit specific actions so that shouldn't attacker decide to abuse that specific action, you can throttle that entire action across your application. It's not bound to URL as Nginx is going to expect, it's bound to a set of behaviors. So it's largely dependent on what you, what you want to, what type of control you want to build. Both are really important. In fact, I'll say everything that you can get out of Django as in put into Nginx for rate limiting should be done before that because why start to get into the request response cycle when you, you can just stop the attack from ever happening, yeah. Django has a lot of settings around cookies, like HP only, secure signed cookies. Do you have a recommendation of how you set up your settings or do you just use the defaults or what? So it really depends on the site that you plan on hosting. For example, if your site is not hosted under SSL, then sending the secure flag in your cookies is kind of going to break the whole HTTP sessions. So generally, when I set my, talking about cookie settings, I make sure that HTTP only is set on both the session cookie as well as a C-SERF cookie and then secure, I like to host a fully over SSL. So secure on both of those as well. Now, what's important that most people don't know is that the C-SERF failure view exists by default and it's one of the easiest ways to profile if the site is actually a Django site, send a post with either a missing C-SERF token or an invalid one and you'll get back the C-SERF error view. And it'll also tell you whether the site's in debug mode or not. Now, that's, that can be problematic. Most people don't change it. It's really simple too. So my question's more about Python 3 and tools like Qizar and encrypted fields. Is there anybody working on that or any kick starters? Are you seeing any new tools coming out that support Python 3 versus what you're talking about earlier? Yeah. So I'm gonna expand your question to also PyPy, right? Qizar makes use of, I think it's a Python PyCrypto. PyCrypto is a C extension to Python. PyPy doesn't work on PyPy, doesn't work on Python 3. And the reason I chose Qizar is because Qizar is a set of executables. It's also, it's written in, you can download the executables written in Java and run them. Now, what is important is that you don't run these executables and open yourself up to command injection. But largely you can make use of those executables. Use a tool, don't use it so much as a library. And that way you're abstracted away from the internals of it. And you're just simply using, like as if you would use Cowsay in shell, you're using just a shell command. You get, you put in data, you get back data. It's that simple. Any more? Please. Lavey, it seems like a lot of, yeah, I respect that you're sort of, instead of talking about attacks, you're talking about best practices against surfaces generally. But it seems like the surface you're talking about, by and large, is the request response cycle. For example, you say, let's put all authorization in one place. But what about for async? What about if you're dispatching a broadcast and you're not exactly, you need to understand who's on the other end? I find that that logic sometimes is wanting for a home. And it seems like probably it's not URLs to outpy. So what do you do with that stuff? So this is why I chose the request response cycle. Because I don't think 45 minutes or two hours would have helped with async security. When it comes to security, it's when it comes to protecting yourself from vulnerabilities, as I mentioned previously, you largely have to assert what is gonna happen. You have to be very specific. And you have to really push yourself to understand what's gonna happen. When it comes to asynchronous programming, things are largely being handed off to different, let's say using co-routines or now event-driven asynchronous programming. You can throw yourself down a rabbit hole really fast. How many people wanna think about race conditions in asynchronous programming? Well, every bank that exists today does not make use of asynchronous programming when it comes to transferring money for the fear of race conditions. And even within race conditions, they make sure that everything is within a transaction. When you mention asynchronous programming, from my perspective, I'll look at it from the Python way of not just API calls that are being sent out to the server, because those are also handled by Django's request response cycle, whereas with Django itself, asynchronously processing certain things. One important thing to note when dealing with it, and I'm not gonna dive really deep into it, is just because it's async doesn't mean it's lightweight. And just because it's lightweight in one place doesn't mean it's lightweight in the other. For example, if you manage to find a view that you could really increase the amount of processing power that is required by that view, saying they're based on, let's say one of the most recent holes within Django is submitting within a multi-part request a set of files that will cause Django to perform an ON operation. If you can find that with an async piece of code and they're using GEvent, that person's got real problems because GEvent is great when it comes to IO and it actually isn't so good when it comes to serious CPU handling and it's gonna stop responding to everything else. So what's really important is that you rate limit as much as possible. Don't think that you can upload 300 megabyte file and it will be really easy on your system. The second thing is to remove the asynchronous parts of your code from where it can get a little bit hairy. And what I mean by that is when you have code that is gonna run, say payment system. You wanna make sure that payment system, that payment happens once and only in one location and it can't be triggered multiple times within a specific set of time. So in the regular world, you'd use locks, right? You'd lock the start of that payment, you'd move through the code and you'd end the lock. However, Python's cooperative scheduler may, especially asynchronous programming, may break those locks or may get you to the point where you may be within multiple locks at the same time and do certain things. So it's important to know when to be synchronous. That said, it does mitigate a decent amount of, denial of service vulnerabilities so your mileage may vary. I'm an educator and teach people Python programming, Python web programming and so on and so forth. And one of the most difficult areas for me as an educator is that I tend to be a fairly trusting programmer, which makes me very bad at this kind of work. Do you have any advice for educators or for students who are learning this kind of thing about ways to make themselves constructively paranoid?  How many people have invited people over to their homes? Okay, the people that didn't answer are definitely, that's a little scary. How many of you guys have known that person before you invited them over to your house? Okay, how many of you have not known that person? Excluding Airbnb? Oh, one person, okay, good.  Now you don't expect that individual to be courteous and to know their boundaries, right? Not to put the silverware in their pocket, not to harass the other members at the table, et cetera, and largely they're very nice individuals, they will be like that, but when that person oversteps their boundaries, at that point you kindly show them the door, right? Now, when it comes to building software, we don't always have that luxury of being able to handle just one request and ensure that everything is working nicely around it. So we try to assert as much as possible, place all the rules around that one request, that guest in our house, and say these are the roped off areas. You can only go into the bedroom if you're a member of the family, you know? Okay, everyone can wash dishes, but you can only do certain things, you can only turn on the TV if you're trusted, you know, you're a staff member, you're a member of the family, you can only change the channel if you're old enough, if you're older than, let's say 18, right? Or 16. Now, that is kind of how you have to look at your users within your application. You're going to have, the majority of your users are going to be good, hardworking people, hardworking, sorry about that. They're going to be good, well-minded individuals, but you're going to have that 1% that's going to literally just probe you to find your weaknesses. And being assertive from the onset is really important. Now, the assertive part of security actually comes to me from a different part of my life as you may have realized, I'm a religious Jew, and you use them as a set of laws. Those laws are largely written in many places but are collected in a book called the Talmud. Now, I don't think many of you have learned the Talmud here, but the way every law in the Talmud works is that you take, they discuss the law. They say, we know this is supposed to happen or we know this is the law. Now, let's look at the limitations of it and they hypothesize everything. And from a very rough piece of stone, which will be the original law, they sculpt a masterpiece of every single facet when it should be done and why it should be this way. And this is, I've taken that part of my life and built it into writing software and writing secure software in a way where all the code that I put out I'm very explicit. What should happen and why should it happen? And I don't look at kind of the, okay, I hope it's all gonna work. I kind of, it's not that I'm not trusting of my users, but I'm just assertive and I say, you are only a user if you meet these requirements. The same way, if someone walks into your house, they're only an invited guest if they can accept common courtesy. No more questions? Nice. All right, Lady Gross, thank you so much.


Hey, everyone. I'm Molly Gingling, Adweek's Senior TV Reporter. I am so glad you could join us for another episode of Most Powerful Women in Sports, where the world's greatest marketers, media pros, and athletes come together to share the remarkable career journeys and how they achieved peak performance. So I want to remind everyone that we are live and taking questions. So please join the conversation in the chat and drop any questions you might have in the Q&A box. Today, I am so excited to speak with the amazing Carolyn Kendall Betts, the first female president and CEO of an MLS club, St. Louis City SC. So Carolyn led the majority female-owned ownership group through the bid process after the MLS expansion team was awarded in 2019. She oversees all operational and business aspects of the new team. And if that doesn't keep her busy enough, she's also president of the Enterprise Holdings Foundation, the charitable arm of Enterprise Holdings. She's also a board member of St. Louis Sports Commission and Gateway Art Park Foundation. I don't know how she has the time in the day to even think about soccer in addition to everything, but we have a ton to talk about. So Carolyn, welcome to the show. Hi, good afternoon. Thank you for having me. Thanks so much for being here. I am so excited for this conversation. Me too. So we do have a lot to talk about, but I want to kind of, before we even get into soccer, I want to go back to the beginning. And I know you're not from a soccer background or even a sports background, but you're president and CEO of a soccer team. So how did you grow up? What was your childhood like? So I'm St. Louis, born and bred, third generation Taylor. My grandfather Jack actually founded an enterprise renaissance at the time. And then in 2007, we acquired the National and Alamo brands and became enterprise holdings. But that aside, I have a younger sister who I love and adore.  I was actually a tennis player and a softball player. So you were correct. I never played soccer. And in fact, nobody in the Taylor family played soccer, but my family, especially my grandfather, was always very passionate about giving back to the communities, especially where our employees lived and worked because they rented from us, which allowed enterprise to grow, but he had a very soft spot in his heart for St. Louis. And it sort of has been passed down through the generations. And so really soccer came about because we were trying to figure out, you know, what, as a family, what, what's something we could do to continue to spur growth and revitalization in the St. Louis region. And somebody said, how about a soccer team? So fast forward four years later, here we are. So that's super, super interesting. So can you talk a little bit about the bidding process? And like, why was this important to you? Why was it so important for soccer? Well, I think first and foremost, soccer is an international sport. And as I've come to find out and view, and they've got very passionate fans, they're very loyal fans. And St. Louis is very much a sports town with very passionate, very loyal fans, but St. Louis also has a lot of really cool micro communities. And like I said, my family wanted to do something that could bring everybody out of their micro communities and support something together and really like bring the region together, unite the region, what better way to do it with sports, but also, you know, festivals, other things as well. So it was a crazy run. The region has been so supportive of us since the day we announced that we were gonna go for the bid in 18, 19, we were awarded the expansion team and then 20 hit. And of course, we all know what happened then. So we actually had our stadium start construction. We did our crest, our colors, team name. We did it all virtually. But you know what? Like I said, the region, every time we asked, they supported, it's been so exciting over the last two years to watch this group really help us build our brand of St. Louis City SC. And we're so excited for March of 2023. Yeah, even with 2020, you've still got all of this done and it's super impressive. And again, even with COVID, the league is still rapidly growing. So last year, the new expansion team in Austin debuted, Charlotte FC kicked off this year and just this past weekend, Nashville SC played its first match in its new stadium. So with all this rapid expansion happening and league growth, what have you seen and learned over the past couple of years that you can apply to St. Louis ahead of March? Sure, I mean, I think one of the things, just first of all, you know, just how great the other MLS donors have been for talking soccer specific. I mean, they welcomed us with open arms. We did, we toured facilities. We talked to all levels of management within the teams, talked to ownership. It was actually very helpful at a minimum to hear people say, you absolutely have to do this. You absolutely do not want to do that. I think also just learning about the sport of soccer. I mean, I literally bought soccer for dummies. I played like, you know, an eighth grade required physical education. But I think just learning about the fan base, you know, the age, the diversity, you know, how they consume the sport of soccer. But even, you know, the whole supporter concept and watching some of these EPL games and Bundesliga games. I mean, they're passionate and crazy, excited about things and to see that we could be and hopefully will be and lead the charge and some of that here in the St. Louis region. It's really exciting. But I mean, I've had to learn everything from stadium construction to building a team to building a brand. And it has been very exciting for sure. Yeah, I don't think there's anything quite like soccer fans. They have some of the most passionate bases I've ever seen. Yeah, I mean, just from learning about the TIFOs to the chance and the matches and the marches. I mean, it was literally a crash course, but like I said, it's just so exciting. And I love to hear about it and learn about it. But like in my mind, I'm like, how are we gonna be able to do this in St. Louis? And so I'm just so excited to see what, you know, what wonderful product we'll have in March. I'm so excited to see it too. But I wanna talk about the stadium. You touched on it a little bit earlier, but when the MLS started in 1996, I don't think there were any soccer specific stadiums in the U.S. But in just the past five years, they're 10 of open. And this year, there'll be 26 stadiums across the country built or rematched for soccer. But you guys didn't just build a stadium. You've built an entire complex downtown. Can you tell us about it? Absolutely. So we were very lucky that there was the large enough footprint for us to not only build a stadium, a training center, a headquarters, but also create an entire district that can be visited 365 days a year. Our hope is to make it more than just, you know, obviously soccer is the driving factor there, but to really find ways to engage with different communities. So is it festivals, certainly holding international friendlies, maybe NCAA tournaments, the list goes on and on and on. But we're one of the only few professional sports I think in the world that can be able to house that all within the same footprint, if you will. Our stadium's 22,500 seats, open air. I have to brag, it's beautiful. Our architects did a fantastic job. But even more, the people that putting up the, putting up the stadium have had to navigate COVID and everything else, they've certainly have taken care of themselves and each other and of their families so we couldn't be more grateful. But within the district, we're part of a greenway. Think a lot of biking, hiking, walking, and different ways to connect the city. But I think one of the critical pieces too is that our stadium sits on part of what used to be called Mill Creek Valley. It was a thriving African-American community and it was raised back in the 1950s. And because our stadium sits on what used to be Mill Creek Valley, we feel very strongly to pay homage and acknowledge the valley. So we worked with a local St. Louis artist to create a permanent art installation that will sit on the southwest corner to really, like I said, we have to remember the past but also hopefully have a way to create conversations about the future. That's gotta be special growing up and having your whole family from St. Louis and them seeing this impact you're having on the community. Yeah, you know it is. And I have to tell you, since nobody in my family has ever done this before, it's actually brought us closer together because now we sort of have, we've always had the company of course, but having this soccer team and everything else, conversations have definitely changed to get together. My aunt is super supportive. She's turning into a fan, my mom. But I think also being able to tell the story that we're a majority female ownership group with seven women and two men is sort of an interesting uniqueness about St. Louis. But no, I think my family has certainly been very supportive of me in every sense of the word. I appreciate everything they've done, but we truly are very excited about this opportunity. So I wanna talk about that, being the first female majority owned to name an MLS. What does that mean to you?  And it didn't really hit us until like three months into it when we finally had to list everybody's name. And we were like, wait a second, we're a majority female led ownership group because my uncle at an age I can't divulge is the youngest man in our family because my mom had two girls, my uncle had two girls, we had the fourth generation as all girls. So whenever we do anything together, it's always going to be majority female. But I think it also added to the uniqueness of why this ownership group was so perfect for St. Louis and it was the right time for us to go for this bid. But I think just having the opportunity to work with my family, being able to say that we're a majority female led ownership group, all the females very successful in their own right, it's been a great story to tell. You're making history and you didn't even realize while you were doing it. Literally, did not. I mean, when I say we were going down the list and I'm like, wow, there's like seven women and two men and you watched everybody go, say that again. And it was like, wow, we didn't even recognize it. But it's like I said, for our family, it's so normal to have tons of women. So we didn't really think anything about it quite frankly. That's awesome. So in terms of naming rights, in February, you announced the naming rights sponsor unveiled the name of the stadium. So what has that partnership been like and why does that make sense for city FC? Well, so let me start with the stadium. So Centine's been with us from the beginning, right away when we said we were gonna go make the run to get this team even when we were awarded the team. So Centine, we had been in contact with Centine. I think what we really needed to do was just make sure that we took our time to come up with a partnership that both parties felt was advantageous to both of them. So it was really exciting when we got to unveil that it was Centine stadium, the hardest part is knowing and not saying it out loud. As far as the kid's sponsor, I mean, Purina, who doesn't love puppies, right? We were so excited to have that partnership again, and congratulations to my chief revenue officer and our sponsorship team. Those are not easy deals, but interestingly enough, Purina has a female CEO at the time and now Centine has a female CEO as well. So we've got a lot of stories that are sort of coming out of it, but Purina has been a great partner. We're working on a lot of different activations to really promote, obviously, adoptions, but just to help pets can help with mental health. I'm noticing they love to chase balls too, so it kind of works with our players and our puppies. So we're able to sort of expand with both of our partners and really think outside the box when it comes to not only game day programming, but community programming as well. There's so many opportunities there with both of the brands. Yes, for sure. Okay, so we've got a team, we've got a kit, we've got a stadium and you need fans. So we touched on this a little bit earlier, but I know the club launched a record-breaking season ticket deposit campaign back in 2020, which something like 50,000 ticket deposits in the first 24 hours. So how have you built up this fan base in the city? How are you working with the community and how are you working to kind of cultivate this soccer culture in St. Louis? Well, I mean, St. Louis really has always been primarily a soccer town. We had a couple of players play on the 1950 World Cup team from St. Louis. And so I think we were blessed with the fact that soccer is a very familiar sport to everyone in our region. And so it was really just sort of tapping into them, having community groups, outreaches, obviously with a pandemic, trying to figure out ways to really talk to them, hear from them. So even going back to how we got our team name, we had over 5,000 submissions. And so we kind of the top 10 we took and then that's how we really ended up on city. But like I said, every time we're like, hey, can you share this on Twitter or share this on Facebook? Everybody in this region is more than happy to do it. So now that we're sort of coming out of the pandemic, we really need to sort of focus in on a couple of different groups. So we're really thinking about how we're going to reach into whether it's the Bosnian community, whether it's the Croatian community, females, college students, LBG, TQ, IA. So we saw the lot of work to do. But like I said, the fans in this region, whether they're soccer fans or not, have been so supportive and we couldn't have done this without them. That's fantastic to hear. Can you give us any update on ticket sales ahead of the first season? So we're completely sold out of our suites, our premium and our loge. We're getting ready to start our reserved and general admission tickets May 18th. It still cracks me up because people are like, I need to put down a ticket deposit. I'm like, okay, well, we're up to 60,000 ticket deposit. So I'm not sure what I can do for you, but I'm happy to do it. So it's just so exciting. People are sharing their timestamp on Facebook or they're sharing it on Twitter and we're actually going to do something which I think is pretty unique. We're scheduling appointments so season ticket holders can come down and tour the stadium and actually pick their seats. Because of the pandemic, we never really got to have a sales center. So we've got, I think, five to 10 days where we're going to host tours and let them pick their seats. So we're super, super excited. Actually, it's exciting we have seats in. So I guess I should start there. But yeah, no, it's coming along great. Again, excitement and where we are just really looking forward to March 2023. That's fantastic. And another good way to build community by bringing people into the stadium, getting them super excited. But 60,000 ticket deposits, that's very impressive. And the stadium seats, I think 22,000? 22,500. So we, I have to say that the ticketing team led by Edmund Elsie has been unbelievable. I mean, they really had to create a program from nothing. And the way they've handled it and the calls and the zooms. And I think he just, I mean, I'm biased but he has an amazing staff and I'm so proud of everything that they've done. That's great.  But what's that experience been like breaking into the business of sports and what advice would you give to other women that are trying to do the same?  But I think one of the things that I've learned about breaking into this business is it's okay to be wrong. I mean, it's a startup, it's something that you're not familiar with and you're gonna make mistakes. I think one of the other important things that is but don't be afraid to ask for help. And really at the end of the day, if you think about it, a lot of business is, I'm sorry, a lot of sports is business. And so I think sometimes people think that being in the business side of sports means you have to be into sports and I'm here to tell you that that's not true. I've also been told by some friends that it probably works better to run a team when you're not super passionate about a sport because it allows you to make decisions based on what's good for business and not necessarily what's good for your team or you yourself wanna be able to have this player. So I think it's really just important to remember that. You can do whatever you want.  That's great advice. And then kind of along the same vein, like as a business woman, how did you go about building the front office for the new team? Well, I really needed to kind of come down with three things that were very important to me. Number one was you have to be able to agree with what I think are our founding pillars. So we worked very hard to come up with, you know, five founding pillars like Tenacity and a few others and Swagger. And so I needed anybody that interviewed with me to believe in those as well because if they didn't, we were never gonna work. I think number two, I need you to be honest and transparent with me. I am that personality. I do not like surprises. I am much better with, hey, I don't think this went the way I wanted it to. What do we do? I love collaborating, strategizing. And like I said, I'm gonna be much happier if I know something from one of my employees before I find it out from somebody else. But third, and I say this, being a good person overall, and I don't really define good, but it's, you know, I'm very blessed to have a team that, you know, they're truly great people. They're kind, they're sweet. They have a lot of empathy. They're hard workers, you know, they'll jump in even if it's not their task and help out. But they're fun too. And I think those are very important to me when I'm building a team because it's long hours. It's sometimes like trying to walk in the forest, in the dark with no flashlight. And you just have to be willing, and I need people that are willing to high five. I also need people that'll look me in the face and say you're totally dead wrong. And I've been blessed enough to build that kind of team. Sounds like a great team you built and just the principles behind it. Today I'm blessed for sure. Thank you for acknowledging them too. So what have been some of the biggest challenges in launching a new club? And where do you see kind of further growth opportunities for the MLS?  And to be able, and to have to make that pivot quickly too, we don't know if we're ever gonna go back into an office. We don't know what it's gonna look like. You know, factor in building a stadium, you know, how much of our stadium design was gonna have to change because of what would come from COVID. And again, luckily we got through it. It was amazing, truly a once in a lifetime event. I think the other thing too, is just sometimes taking a break and looking at all the wonderful things that we've done. It's very hard to enjoy things in the moment because your mind is so busy racing towards, what do I need to do Thursday? What do I need to do next Thursday? And so I think my team does a very good job of like, we have to just enjoy this moment. It's the first time ever. We're probably never gonna have this moment again. And so I think just kind of taking that, you know, take a deep breath and just take it all in. And so, you know, as far as soccer as a whole, I think there's an entire untapped demographic out there. And I think that we all just need to really remember what it is that brings soccer fans to MLS. So is it physically great customer experience or a great fan experience, great stadium experience? Have to have an exciting team on the pitch, right?  But I also think the MLS already does a great job. But I think there's a lot of opportunity to make sure that players and coaches are visible in communities. And I brag on the St. Louis Blues quite a bit because they're always in the community. They're accessible. They could be at your kids' school. They could be at your local golf course. And I think that that's very important. So for Citi in particular, I want to make sure that we drive that culture because I remember the commissioner once telling me that you have a very successful team when the community feels like they own your team, not you own your team. That's fantastic. Well, Carolyn, unfortunately we are almost out of time, but before I let you go, you have some key takeaways to share with us. Okay. Yeah, I mean, kind of really first and foremost, sort of by mantra the last four years, I mean, in the business of sports, diverse perspectives and experiences bring value to every club. And I definitely took a little bit to learn this, but I'm getting there. You have to be confident in what your experience can bring to the table. And two, we really didn't talk about it, but you saw do my quick plug, you've got to find mentors. Consistently put yourself out there, through networking, look outside the box for ways to get involved with sports. But these mentors are really gonna be what got you through the great times of celebrating, the tough times that picked me up. And finally, do not fear adapting and innovating when you face setbacks using the whole, we had to completely pivot our whole plan in March of 2022, but stay true to the vision. We are building a legacy for our community and building something well takes effort and time. Great. Well, Carolyn, I think that is a great place to end it. Thank you again for being here. This was such a great conversation. And I personally am very excited for March 2023. Thanks, Molly. All right, thank you. And for everyone watching, please feel free to join us and please do join us for the next episode on May 25th.


Good afternoon. So shall we start right? OK, so hi, my name is Avitash. And this session is going to be typically on features of Java 9. So this will be probably covered by three persons, me. And after that, Manoj will cover the modules. And then it will be continued by Alabaksh. So let's start the session. OK, so we are talking about how Java 9 is a boon to enterprises and how enterprises can use Java 9 for their own benefits. So OK, so just a brief timeline view about the Java history. So Java beta was released in 1995. And over the years, it has grown to cater to different needs of the enterprises. Then we had first release in 1996. After that, then in September 2004, we had JDA 5, then JDK 8. And now we are on the path of getting the JDK 9. So basic good things which came into the timelines were generics, invoke, dynamic, Java 8 had lambda. And now Java 9 has project Jigsaw, REPL, and various other features. So what are the key features of Java 9? Java 9 major thing which everybody is talking about is project Jigsaw and modularity support. After that, HTTP 2.0 and WebSockets, then we have REPL or JShell. These topics will be covered in various different sessions and process API and JLink and other different multi-release jars and other features. So I would be talking about HTTP 2.0 or we should say HTTP 2.0 in this session. Just a quick check, how many of you are web developers over here or has done web development? Oh, cool. OK. So I would be covering brief about the history of HTTP as well as how Java is using now HTTP 2.0. So we started with HTTP 0.9. This was the first published recommendation of HTTP. So it came in 1991. It had only a get method available. So what client could do is just shoot a get request. It would get a response from the server and it will close the connection. So there was no concept of headers. There was nothing HTTP could do, nothing over there at that point of time. So it had only basic support of HTML, no media contents, nothing. So.


We now move on to music and lifestyle, so we want to have a taste of the fresh music in the industry as well as having a good conversation with some of the artists. Now we have our first guest with us, so we will be talking to Mr. Benson Munyao. So Benson Karibu, introduce yourselves, tell us what you do. Thank you, thank you, thank you very much indeed for inviting me in Y254. I'm very much impressed to be with you. Yes. Do you know what you are talking about? KBC, you know KBC operation in 1995 and I'm thinking where was I in 1995, you know. How many years? Several, several indeed. Yeah, so it feels good to be back. I am very, very, very happy to be here again. Looks different, how's the place? You know, decades later. A lot of changes, a lot of stations and we thank God because of you. Okay, we're glad to have you. So now tell us what you do. Who's Mr. Benson? Oh, Benson is me here. My real names are Benson Munyao. I'm born again, a vigilist. I come from Mkweni County and that is where I grew up. All those years, 50 years now, not very young. I thank God because of this grace. I worked along that period serving the Lord and I thank God because of this grace and masses and protection upon my life. So that is where I come from, that is where I grew. That is where my music journey began in Mitubu Village, Mkweni County. Mitubu Village, Mkweni County, that is where the story begins. That is where it began. Okay, so did you start music, take music from early age until now or did you do something in between? Oh, I began music while I was in primary school. I used, in weekends I go for kwaia practices. There were some pastors who used to teach us how to play guitar, how to compose songs. And I gained the interest of being a musician from there. Used to compose some songs which is the kwaia and we sing in the church that you are happy and you are also happy. It's not easy. When you compose a song and you find people are singing your song. Ah, it is amazing, true, true. So your music was born in church? True, it was born in church. So could we say that is why you went for gospel or it is more than that? Actually that is why I went for gospel because in those pastors who were mentoring us they taught us the ways of being and working for the Lord and that is where I grew and I gained the confidence in the Lord. In a church there I see African Island church actually. Me toobu. That is where I started. Okay. Yes. So would you say why is gospel important or people sing gospel music but what you make of it is all of it sung in the right way or are there people who are singing with different agendas? Music, one there is a friend of mine, Bishop Mondul, normally tell me music without anointing. Even in the gospel music is not music. Music that can touch the hearts of people. Music that can draw the attention of God. Music that you can worship. God, God our creator, our maker, who is in heaven. And you touch his heart that he can come and do miracle. That is the music that I am hearing. The music that can touch souls. The music that can evangelize to someone. That is the music that God wants us. The gospel. I am speaking on the gospel music. God wants us to minister songs that can touch souls. Because I think my sister you can see any church before it starts there is praise and worship. There are presentation of choir or interviewing to artist. In any celebration in Kenya you will find musicians there. Why? Because music has its value in congregation or in our lives. Day to day. You will find people grazing there they have small radius with USB. Music in playing. But they are grazing kato. The value of music. At the center of our lives we revolve around music or music revolves around us. I am not sure which one. So basically what you are saying is that if you sing gospel music it should be impactful. Something that will bring people closer to God and will touch the heart of God. So this is your motivation when you sing gospel music. What is your motive when you sing when you go and release a song? What do you aim that it achieves? First, like the current song release that I released with Anastasia Mukaba. It was after people had passed a lot of challenges during covid and after the last phase of last year is when I got this song God was speaking to me. Yes we have passed a lot of things but God has still asked good plans for us in Jeremiah 29.11. One my music normally get it from the verses in the Bible because it is a gospel music and when you listen to that song you will hear that it is purely from Jeremiah 29.11 after the children of Israel were in Jerusalem.  So that's how you get all of your songs through when you go, when you do your study and you read the Bible that's the only way you get your inspiration or you have other ways in which you get inspirations to do songs. Oh, sometimes also I listen to other artists. I hear how they are combosing songs that touch people. Sometimes I see, I can go in church, listen to messages from pastors and then I see oh, surely I need to combo such a song to reach people, to reach people through the music but also sometimes I'm inspired because when I release songs people call me and tell me wow we have seen your song in YouTube, we have seen your song like now in KBC, Y254 and we have been blessed oh, that gives me a mileage and to know that people are being interested in music so that motivates me and I still venture more to release good songs to touch people wow So what is that one is there any particular comment that just strikes out that you got from your audience someone who listened to your song and you just knew that this was from God Yeah, after I released this song and another song the fifth album that said one of the songs was Namayamungi Natosha in my fifth album that I released in 2019 and people clearly were saying oh clearly the grace of God is sufficient we are saved by the grace of God we live by the grace of God whenever we work in the morning we are under the grace of God and then people were saying really this song is touching because we are living by the grace of God not by might, not by our power not by what we do but by the grace of God so when people were commenting that I used to say kumbe God is blessing people it is not about me I don't brag kumbe God is blessing people I say glory to God and how do you do ensure that you do that you don't take the glory for yourself and you live it to God wow I normally control myself very much because once you start pride always discourages pride he says once you humble yourself he will lift you and those who lift themselves he shans them down so I normally tell God to give me a humble heart when people are saying oh we are blessed to say oh glory to God okay that is what I normally do alright one song that has really blessed you in your life that has spoken to you maybe after you have released it and you are going through something and your song came in hardy to encourage I am referring to my latest release the one I have just sung now because we were after a very difficult period and I remember when the schools were closed my son came in the house oh dad, if the world is ending let it end because I cannot wait to see all this suffering I told him no even in the early times when you read in the Bible there were spangu, there were sicknesses but God protected his people say truly yes told him just calm down God is in control so I watched many people people sitting in the houses just not going to church listening praying together some families came very close they used to pray together me we used to pray together with my family so after I said no I have to what about these after all these sufferings God has protected me I have never been admitted nor my family but now I have seen God take us through that period children are now back to school going back to church it was not a song about me alone but the entire country that God has good plans for us as a nation so that song I released after I had seen what we had gone through masks everywhere that protected us we thank God for the initiative of our government and also protection in the in the transport industry and people were wow where are we heading but now God gave me those words that he has good plans for me and you so that is amazing and now do you have I understand that you have a background in military has that played any role in inspiring your music or anything that you currently do now it has really because when I'm serving God speaks to me He speaks also through the servants of God some of the messages I get when our chaplains are preaching I get a message there and I go and compose songs I know it will break my fellow colleagues so some songs I get from reading the Bible others I get when our pastors are ministering so I can say I have also released several songs there I have also released some songs with some choirs there in our place and they were very blessed I can say they are very blessed and tell us as we come to a close about your music growth because you started music back in the days 1990s so how do you keep growing musically one thing I make sure that I read the Word of God two I normally interact with musicians you can they are saying that say buzz of the same feathers true so I normally make sure that I interact with musicians those who started producing songs earlier than me and those who are releasing those who have made hit songs I normally make sure I interact with them know why they are moving I normally visit studios that are mostly known I visit them and know what they are doing what they have current the programs they have for recording and also guitarists people play guitarists I normally interact them I think about music today I have not just kept silent and said I have just been interact with the people in the music industry and especially those who are singing the true gospel they are learning the music what would you say is the place of mentors in anyone's journey especially in the music career the place of mentors in the music career I can say I have been in Kasanga music shop I have been in his studio I have sat with him he has encouraged me he has taught me a lot I have also had an encounter with the Kamaanga studio and my latest release with Twigga studio and he has motivated me very much because he is a musician himself and he is a minister of the word of God and when you are with him you are in the same frequency he speaks every things he speaks musically and I tell you he is a good mentor so I have been interacting with the people in the music industry both in studios in shops and even we meet in other places and share we have cup of tea and also not forget you those in the media I also meet and share know how music is being marketed how in YouTube in such interviews like this one so it is all round you cannot grow without a mentor so they have a very important place so now you want to give your shout outs but first do we have anything we need to look out for any music coming up ya currently I am working on my sixth album by God Grace I believe in around August I will be releasing my sixth album that is why I have done a lot of songs prepared written but I have to check its impact into the lives of people okay amazing thank you for coming on board it was glad having you so you can give your shout outs on this camera to your people and tell our guys where they can get your music ya you can get my music in YouTube in Facebook Ben Mewes when you go to YouTube search evangelist Ben Son Mewes you will get my songs there in Facebook you will get my songs there and you will be blessed any shout outs you want to give outs I just say let us have faith in God let us trust in this God we might have been passing a lot of challenges in our lives but if our God visited the people of Jerusalem after 7 years and he gave them hope even you it is not late God can visit you and change your life if you believe and trust in Him our reference verse is Jeremiah 2911 God has good plans for us he has good thoughts he is ready to give us an expected hand let us trust upon this God and he is going to do great things into our lives let us not despair don't you despair don't you despair thank you again for coming on board we want to hear your song we will close with your song if you are feeling down you have been encouraged by this but it is good encouragement so let us hear from him your song take it away


In this image, a remote galaxy is greatly magnified and distorted by gravitational lensing. The galaxy's light has also been magnified by a factor of 20. Lensing effects also created multiple operations around the curved arc of the single background magnified galaxy. The object was nicknamed the Molten Ring because of its appearance. After its public release in 2021, astronomers used the picture to measure the galaxy's distance of 9.4 billion light years. At that time, there was an extremely high rate of star formation in the brightest and dustiest early galaxies. Stars were being formed at a rate a thousand times faster than occurs within our own galaxy today.


Hey guys, welcome to SSUNITEX, so till this side and today we are going to discuss about the delete activity So what is the delete activity and where we can use that? So here we can use the delete activity in Azure Data Factory to delete the files or folder From the on-prem storage or the cloud storage So if your data is available on your on-prem environment or on your cloud environment that is in Azure Blob Then we want to delete those files. So for that we can use the delete activity Next this activity is used to clean up or archive the file when they are no longer needed For example, if we have any file and we have Loaded the data from that file and that file is not needed anymore So we can archive that file or we can delete the file. So for that we have to use the delete activity Here we can see the data stores. So these are the supported format So first we can see the Azure Blob stories. Next, we can see the Azure Data Lake 1 and 2 Then here we can see the file system So this file system will be going to use for your on-prem and this Azure Blob is for deleting data from the Azure Blob. So go to on the browser and we'll try to see in the practical So first we want to delete the data from the Blob stories So here this is the Blob stories as we can see and under this container SSU testing we are having these three files. So we want to delete these three files from here So how we can do that? So for that we have to use the delete activity so let me try to add a new pipeline and Let me call this pipeline as delete activity. So this is delete activity and after that we can Go inside these activities and let me search for delete. So we can drag and drop this delete here First we are having this General option then we can see the source then logging setting and then user properties So in the general setting here, we can rename this task. So let me call this as delete files under Blob Storage now here we can see the timeout options. So that is Seven days next we can see the retry if this delete activity got failed Then how many type of we want to retry and what were the interval between retry? So these are options here go to on the source and under the source first We can see the data set. So we have to set this data set So let me click on new because we have not created any data set yet Now here we can see these are the sources by which we can delete So as we can see here file system FTP and other options So we can select for this as your blob storage because we want to delete it from here Let me click on continue Now here we can call this as delete underscore files From your blog stories. So this is your data set name here. We need to create the link service so let me go here and click on you and Let me call this link service as delete files under the blog stories Now here we can see the IR that is auto resolve integration runtime. That is okay Here we need to select the storage account. So as we have already seen the storage account is SSU Testing so we can select it from this drop down. So it will be going to connect under this Storage account now we can click on this create So it will be going to create a new link service and that link service will be pointing SSU testing blog stories now here we need to Set the path Directory and the file that we want to delete. So we want to delete under this input So this input container, whatever the files we are having we want to delete it So we can click on this browse and after that we can see this input. So let me go there if we can Select any one file then that will be deleting If we are deleting all the files, then we need to go under this input only and Click on okay So here we can see directory and file is empty Whatever the data and files are available under the input that will be deleting. So let me click on okay so here we have set up each and everything under the source and Let me go under the login setting. So what is the login setting? So this is very important So while we are going to delete the files from the blog stories, we want to keep the track So how we can do the tracking there by creating another file under the One more container that we have that is the login So here a new file should be generated and that will be keeping the information of the files that will be deleting So how we can create that so go to on the So here we can see the account link service. So we need to create a link service. So that link service will be Pointing that location that is the login location. So click on new and here this link service We are creating for login delete activity Here everything looks good. We can only select the storage account that is ssu testing It is loading the key And then we can create that So here we are using the same link service. So we have already created if you want then you can utilize the same Now here it is asking the folder path. So we can browse and here we have four folders So it is loading So that you can see input logging output and ssu. So we want to keep the Logging file under this logging folder. So we can click on okay So here we have done each and everything Now we can publish this And after publishing we will be going to execute this. So publish is completed as you can see now Let me try to debug it. So it will be going to execute this pipeline and Here we can go under this input And this will not have any file as of now we can see three files. So it is executing as we can see So once this will be completed So input folder will not have any files So it is executing So here we can see it goes succeed. So go to the input folder and let me refresh this So this should not have any files. So as we can see no blobs found. So it means everything is deleted Now go to the logging folder and under the logging folder. Here we have this folder And this is the file. Let me try to open this And here we can see the option for download if you want to download it But I don't want to download. I just want to See whatever the data that is there. So for that we can go in the edit And here we can see name category status and error if we'll be going to have any error for deleting the file So that error should be Here So as we can see the first file was captured second is the customer third is the sales So these three files has been deleted And the type that we can see the file And the status that is deleted from here. So From using that logging we can track like which file we have deleted from the blog storage So this is we have done go to on the PowerPoint and here Next is the best practices. So what is the best practice that we need to follow for deleting the file? So first we can see the backup your files before deleting them With the delete activity in case you need to restore them in the future So here it is deleting permanently. We cannot restore that in future So if you want to restore that in future, so we should Keep the backup of the files Next is the makes sure that the service has Right permission to the delete folder So if you do not have the right permission in the delete folder or the file Then you will not able to delete The files and folder under the Blog storage, so we should have the right permission there Next make sure you are not deleting the file that are being written at the same time So like it One place we are writing that and another place we are going to delete that so make sure you are not deleting those files And last one here we can see if you want to delete the files or folders from on-prem System so in this video we did not seen how we can delete the files under the on-prem system In the next video, we will also see how we can delete the files in on-prem system as well So while we are going to delete the file from on-prem system So make sure you are using the self hosted integration runtime with a Version greater than 3.14 so that is the prerequisite for deleting the file under the On-prem system so that we will see in the next video So thank you so much for watching this video if you really like this video Please subscribe our channel to get many more videos Don't forget to press the bell icon to get the notification of our newly uploaded videos. See you in the next video