Thanks for being here. Well, thank you, Alberto, for that warm introduction. And for your leadership of an organization that has done so much to support informed and engaged communities across this country. In this time of sustained pressure on the news industry, we are lucky to have the Knight Foundation searching for solutions. So those pressures are familiar to everyone in this room. Collapsing business models, eroding trust, surging polarization, metastasizing disinformation, growing attacks on journalists and news organizations. Each represents an existential threat, not just to individual news organizations, but to the collective strength of the free press and to the health of our democracy. Like all of you, we at the New York Times have spent years trying to chart a path forward through this difficult, fast-changing terrain. And while the road ahead remains treacherous, our recent progress has provided some welcome optimism that there is indeed a future for the type of deeply reported mission-driven journalism that many of us feared might be lost. But even as the times and a growing number of national news organizations appear to have stabilized, thousands of local news organizations, the beating heart of our journalistic ecosystem, continue to struggle. Now you've all felt the impact of those struggles. You've felt it inside newsrooms, as friends and colleagues have lost jobs they loved. You've felt it in your hands, in ever-thinning local papers. And you've felt it in your communities, which are growing steadily more disconnected and divided. And because many of you are leading the response to this local news crisis, I'd like to use my time today to share some lessons drawn from helping lead our digital transformation at the New York Times. In particular, I want to focus on two words today, one that I think our industry, myself very much included, has at times focused on too much and a second that I believe holds the key door to journalism's future. As the times has grown over the last few years, I'm often asked by other media executives for the secret to a successful subscription strategy. And they usually expect me to respond with some sort of insight on metering models or e-commerce systems or optimal marketing spend. And those things matter. And we have worked really hard to get better at all of them. But the thing that really drives a healthy subscription business is deceptively simple. It is offering something worth paying for. At the times, our entire business strategy can be summed up by that phrase, journalism worth paying for. Original expert on the ground journalism. That's independent, fair, and accurate. And that strategy, I believe, can serve news organizations across the journalistic ecosystem. Whether your revenue comes from readers paying through subscriptions, listeners paying through donations, platforms paying through licensing, or foundations paying through charitable support. In every case, you need to produce journalism worth paying for. And I'm sure that sounds obvious, but I worry that some in our industry are losing sight of the essential role of original, deeply reported journalism, not just as the highest purpose of the Fourth Estate, but as the path to sustainability for our industry. I worry that too many news organizations, both legacy newsrooms trying to find their digital footing and digitally native outlets adapting to the platforms shifting sands, are chasing innovation as an end, not a means. The times has had times fallen into this trap ourselves, as became abundantly clear to me every time we raced to meet our monthly quota of Facebook Live videos. Innovation is the word, I believe, our industry is focusing on too much. The reason so many journalists shook their heads at all the pivots of the last decade, the pivot to newsletters, the pivot to video, the pivot to podcasts, is that these one word strategies so plainly put the tool before the use and the form before the substance. The world already has enough slideshows and podcasts and videos and articles to last us through the apocalypse. Meanwhile, emerging technologies like AR, VR, blockchain, virtual assistants are still more popular with advertisers and funders than with actual news consumers. The world doesn't need more content. We need more journalism. And that requires us to step back and ask a different set of questions. Why should readers, listeners, viewers, and users make room for us in their lives? In an ever-expanding sea of content, what is the thing news organizations can offer that earns trust, loyalty, and a spot in people's daily routines? Or even more broadly, why is journalism worth fighting for? Why did our nation's founders view it as so essential that they enshrined its protections in the First Amendment? Why are so many journalists a collection of people not otherwise prone to hyperbole, warning that the pressures on the news industry present a real and growing threat to a free and informed society? Those are the questions to ask. And I believe the answer to all of them come back to a word that the industry is not saying enough, reporting. And some of you may be thinking, why is a guy best known in journalism circles for writing 100-page digital manifesto called the Innovation Report, Warning About Innovation? And hear me out. Back in 2014, the future of the New York Times, as Alberta mentioned, was being openly questioned. The company was in debt. Advertising revenue had plummeted. Our audience was stagnating. Talented journalists were taking buyouts or fleeing for more nimble digital rivals. Against this depressing backdrop, I was asked to lead a team that studied how our 168-year-old institution, both justifiably proud of its traditions and undeniably burdened by them, should adapt to the digital future. I was extremely bad casting for this role. Despite my relative youth, I have the background of an old school journalist. I got my start at a local newspaper reporter at Metro Dailies, first the Providence Journal, then the Oregonian. I've all but refused to engage with social media. I never joined Facebook. And the last time I tweeted, which was under duress and only under direct orders from Jennifer Preston right there, was a decade ago. And there is very little in life that brings me more joy than unfolding a print newspaper. And having no particular digital expertise to offer, I tacked the problems the only way I knew how. I reported. My team and I spent time with readers. We interviewed fellow journalists inside and outside the building, including some of the folks in this room. We mined for fresh ideas from designers, technologists, and product managers. We dug deep into our operations, studied digital startups, devoured reports and presentations and articles. And perhaps most importantly, in my view, my team and I took advantage of an increasingly endangered journalistic privilege, which is time to step back and think. What emerged from our reporting was a memo to newsroom leadership sounding the alarm that the Times was being left behind by a changing world and laying out a vision for how to reinvent the company for the century ahead. Though we called the memo the innovation report, we didn't expect the name to matter much because it was only meant to be read by a dozen people all inside the building. But then it was leaked and published in full on Buzzfeed and the name stuck. And I'll confess that I was not thrilled to see 100 pages of our hopes and fears and dirty laundry being dissected by journalists around the globe. But in short order, something very good came from the leak. Dozens of other news organizations from dozens of other countries started creating their own teams to produce the innovation reports of their own. But that word, innovation, continued to nag at me. And it's because innovation is necessary, but it is not sufficient. And at its worst, it can be a dangerous distraction. Innovation only works when it's in service of something more enduring. And to be clear, I maintain a convert zeal that journalism must continue to unshackle itself from the forms and traditions built for a different era. But I have another deeper conviction. And I believe that embracing change starts with knowing what will not change. And you can call that mission. You can call that value. You can call that purpose or anything else you'd like. And for us at the times, what wouldn't change was absolutely clear. For years, we had bet the farm on original reporting. We offloaded nearly every part of the company from our steak in the Red Sox, which was always weird for the New York Times, but it was probably the most profitable thing they had. Anyway, to about.com. And we offloaded these things to preserve the size and ambitions of our newsroom. We sold off our headquarters to pay off debt, even as we poured millions into bureaus in Iraq and Afghanistan at a time when other news organizations believed the cost wasn't worth it. Some people in the industry thought we were crazy, even financially reckless. But it eventually became clear that the investment in original on-the-ground reporting would save the times. But we also embraced innovation in service of that core mission. We changed how we work, becoming more collaborative and multidisciplinary. We changed how we communicate with our audience, becoming more transparent and responsive. We changed how we tell stories, creating a new form of multimedia investigations that, and I'm just going to use a recent example here, blend eyewitness video with plain spotter logs, radio recordings, and satellite maps to show how the Russian Air Force was secretly bombing hospitals in Syria. We even changed how we report stories. We now employ more journalists who can code than any other news organization. And that is not because coding is cool. It is because it allows us to do things like analyze massive troves of leaked location data to show how companies you've never heard of are following your every move. But all of these changes are in service of our enduring journalistic mission. And I believe the decision to align everything we do around original reporting and the imperative to make journalism worth paying for provides a near universal path forward for news in the 21st century. After a decade in which our own future looked perilous and the end times headline continues to haunt my dreams, I have been hardened to see not just the New York Times, but the Washington Post, the Wall Street Journal, CNN, NPR, The New Yorker, and the Atlantic all growing again. But these national news organizations will never be big enough to come close to filling the yawning void being left by the collapse of local news, which is the largest and most essential part of our journalistic ecosystem. Our country needs ambitious, creative, fearless, local journalists reporting in every small town, in every city agency, and in every state house. If we don't find a path forward for local news at something close to that historic scale, I believe that we'll continue to watch society grow more polarized, less empathetic, more easily manipulated by powerful interests, and more untethered from the truth. At the times, we are actively looking for ways to support original reporting at the local level. We've been partnering with local news organizations to tackle issues that matter to their communities, like our partnership with the Times-Picayune to explore the impact of rising sea levels, and our partnership with the El Paso Times investigating the detention of migrants. We're also trying to contribute in other ways from creating open source digital journalism tools to establishing early career training programs to help develop the next generation of reporters. We want to do more, and I'm very eager to hear your ideas. But our modest contributions pale in comparison to the daunting challenge facing local news, which is why I'm so encouraged when I see the examples of the model I've described today, journalism worth paying for built around original reporting, succeeding at the local level, often with the support of the Knight Foundation. The Texas Tribune built an entirely new nonprofit model to support accountability reporting. ProPublica has created an astoundingly impressive engine of investigative reporting. Report for America and the American Journalism Project are using ambitious new approaches to scale original reporting across the country. Established newsrooms like the Miami Herald are proving their mettle even in the face of financial pressure. As we reminded last year with the award winning reporting that led to Jeffrey Epstein finally being held accountable for his crimes. And I can't tell you how happy I was to hear today that that type of reporting is being supported by the Esserman family's new two and a half million fund for investigative journalism that was announced here on Monday. One bright spot that particularly warms my heart is the good work being done by my former colleague Les Zeitz. Les was the finest investigative reporter at the Oregonian, a two time Pulitzer finalist and a generous mentor to younger journalists myself very much included. As the Oregonian was decimated by cuts, Les retired and took up a seemingly quixotic cause, reviving the tiny weekly newspaper in Malier County in southeast corner of Oregon. Les was animated by the unshakable belief that people want high quality original reporting about their community. And in just a few years, he and his colleagues used that formula to transform a struggling paper into a profitable weekly that's winning awards and setting a high standard for deeply reported journalism. Circulation is way up, revenue has tripled, his formula is working. And to be very clear, I understand that success stories like this remain the exception at the local level, but it's a promising sign. Technologies come and go, but I believe that people will always want and democracies will always need great reporting. And I wanna end my comments today with a note of thanks and a personal request, especially to those of you with philanthropic budgets. First, I wanna thank all of you. Your presence in the room suggests a commitment to finding solutions to the big problems facing journalism. And that's true for those of you leading traditional news organizations searching for a sustainable path forward. For those of you leading digital newsrooms, filling the growing news and information voids in our communities. Those of you leading the efforts to support this journalistic ecosystem with money and tools and ideas. And those of you who simply subscribe to your local paper or speak up when you hear neighbor dismiss journalism as fake news or journalists as the enemy of the people. Thank you all. And, well, which brings me to my request. You thought you were getting off easy. The challenges we face are really significant. And even after the toughest two decades that our industry has ever had, the toughest two decades, I can imagine, I think it's pretty clear they're still mounting. And all of us need to keep pushing for solutions here. And as we do, here's my request, support original reporting. Innovate, but innovate in service of what matters. Help make the hard, expensive, essential work of gathering information and sharing it with the world possible. Because I truly believe in informed citizenry and a functioning democracy rely on it. Because the health of our news ecosystem depends on it. And because that's our mission, our core value and our highest purpose. Thanks.


That always happens.   That's what you get. That is what you get was even his father don't even came That's the only way was out.  Oh here we go.     I mean even I'm good at it. I mean even I am good at it That man I won up better across the mat. You're in the lead.   I mean like and he was running a different direction and he mellowed me Heavy ammo on the way heavy ammo on the way.   What a lag. It's just


Nonsteroidal anti-inflammatory drugs, NSAIDs, are used for chronic pain and inflammation in arthritic conditions, as well as acutely as analgesics by many patients. The therapeutic and adverse effects of NSAIDs are due to inhibition of the cyclooxygenase, cox, enzyme. NSAIDs can be classified as nonselective or cox, two selective inhibitors, coxibs, but both types have been linked to gastrointestinal, G.I., side effects, particularly on the lower G.I. tract. Rolfcoxib, a coxib that was withdrawn due to cardiovascular side effects, has previously unpublished data suggesting questionable G.I. sparing properties. The major side effects of NSAIDs are G.I. complications, renal disturbances, and C.V. events. While it is believed that all NSAIDs are associated with renal and C.V. side effects, lower doses of some NSAIDs may be cardioprotective. This review discusses the G.I. toxicity of NSAIDs and assesses their renal and C.V. adverse effects in detail. This article was authored by Sam Hariforush, Waheed Iskar, and Fakretin Jamali. We are article.tv, links in the description below.


One thing I didn't know, um, because Waco Tron came on here and he said that he was your cousin. Didn't he say that? That's crazy. Yo, Waco Tron in my face. That's crazy. I didn't even know that. Waco, man. I ain't, I heard, you know, I had Hot Boy West on here the other day. Like, y'all could, y'all could. Y'all relative for real? Yo, yo, yo. Yeah, we on Boss Talk 101. 101. Yeah, we gonna talk. You know what I'm saying? Son of a b***h, you're two-street or they don't wanna not, not be street. You know what I'm saying? I'm street, but I wanna not be street.  Eventually. Do you ever talk to, uh, Pusha still in the boys?  Neither one of them. I ain't talking to them. Nah, I don't know. Come on. I don't know. I ain't talking to them. They ain't hitting me. I ain't hitting them, but I see them. Now you ain't gonna reach out. I'm gonna reenact. I'll post them a** up and s*** though. You know what I'm saying? That's good. I'll post them a** up and s***. You know what I'm saying? Did y'all have a real relationship though? No, I got signed up. I was already in jail. That matters on it. Yo, here y'all that a** out of those. Yo, I don't be doing that a** to be clad chasing a**. I know what the a** is going through in that a**. And you know what I'm saying? When you're on top of the world and to go from being on top of the world to god damn a**.  Imprison me. Count time. That's a bad one. That's a bad one. You gotta stop.  I don't know how they do it up there. We don't know. Texas those a**. Texas is not right. But a** is happening. Yeah. A** goes to the Texas state. It's all. But one thing I didn't know because Waco Tron came on here and he said that he was your cousin. Didn't he say that? That is crazy. Waco Tron in my face. That is crazy. I didn't even know that. Waco man. I heard, you know, I had hot boy Wes on here the other day. Y'all mother could. Y'all mother could. Y'all relatives for real? Yo, yo, yo.  Yo. How the a** I didn't know that. We still running the family for real. Bro, that a** with that song. We a man and I want to say I was the first tech. He said I'm the first techs in the interview. He done done. You know what I mean? Waco Tron go to town in middle school. We used to play basketball. When he used to play basketball I was in the streets. He was in middle school. I didn't say like he was just one of them. I was in the streets. Yeah, but he was in sports. He played basketball. You know what I mean? He played basketball. I was in the streets. You know what I mean? When he told me that I flipped out then. I was like. That a** could have been something with that a** too though. Like that a** raw. He was. That a** raw. Is he still today? Yeah, he still going to play. He's still raw. He'll get out in the a** right now. He's smoking this a** now. Why y'all never done nothing together? Ho, me and Tron can see it. Really, she a** got there. That a** go so hard. I know.  Really, we just be trying. We just really trying to. You know what I'm saying? I don't know. You know what I'm saying? I really can't.   It ain't no type of. It ain't no type of tension. No a** like that. No, I know that. Y'all just busy. Yeah, you know what I'm saying? Like for real. How I feel when y'all rock out together? Because I know y'all did shows together. It feel good. You know what I'm saying? That's my baby from a long time ago. They be trying to make a scene. You know what I'm saying? I'm some weird a**. But at the same time, it's healthy competition though. Yeah. You know what I'm saying? If a n***a alpha male, you know what I'm saying? You can't help. It can't help but be animosity in the room. You know what I'm saying? Ain't nobody fault. It's nature fault. You know what I'm saying? We two young n*** coming up out of the city. So it's going to be something. You know what I'm saying?  I'm trying to go hard. Or go harder. Yeah. I'm a young n***a. Y'all both go so hard though. It ain't no. But it ain't no. I'm trying to go harder than him. You know what I'm saying? If it weren't for him, I probably wouldn't even be where I'm at right now. Real talk. Because I done been in some dark spaces where that n***a was going off.  Because he going off. Damn. You know what I'm saying? That's healthy competition though. Exactly. That's good. You know what I'm saying? Yeah. Like that. I don't want to see you perform or be in the studio. We gon' see it. We comin' in there. That n***a got, that n***a got, he started fuckin' with 808 when I had first got out of jail. You know, I ain't had no deal. You know what I'm saying? So they were like, damn, bitch, that n***a churn got a deal.  That was the streets we're seeing.  I'm still gon' get signed. You hear me? And you did.  Here. Yo, I did.


All right, let's get started. I've got too many slides and not enough time.  Try to talk quick and leave some room for questions. But thanks for joining. As you can see, my talk is on boot to cloud security considerations with IoT. It's a bit of a big topic, so we're not going to dive into super deep details. It's really more just to lay down some signposts. If this is a problem space you're interested in, point you in the right direction and try to give you some help to dig into some of the specific details, just because there's too much to cover. Just to get started, about me, the least interesting slide in the presentation. But my name is Kevin Townsend. I'm a tech lead at Lenaro. I've been there for about four and a half years now. My main focus is generally on ARM, more on the MCU side. A little bit Cortex-A, Cortex-R, but mostly the Cortex-M side of things. RTOS-IS and IoT security. I've been working for about 15 years, full-time, just in open source software. It's always been my bread and butter. It's a conscious choice. I just love being able to contribute to both the open source hardware and the open source community in general. Much more of a firmware person today than my early career was, really, more on the hardware side, which is good, in a sense. In the embedded space, you really need to have a little bit of a foot in both of those camps sometimes. I'm the Zephyr maintainer for ARCH32, the trusted firmware and integration, and just a small little hobby personal project. Zephyr Scientific Computing Library. I just really enjoy working with sensor data. And to me, embedded devices, it's all about taking data, doing fun things with it, and having interesting outcomes. So just a small library I put together to sort of do linear algebra and things like that. And if you're interested, you can see some of my work on MicroBuilder. And that's the GitHub username, obviously, for Zephyr if you need to reach out to me for something. So in terms of agenda, again, these are just sort of high-level things, but we're going to look a little bit at secure boots, at device provisioning, and specifically a bit of a sidetrack on key derivation, which is one of the more important parts, I think, of the provisioning process. How do you secure data in transit? How do you secure data at rest? And we'll distinguish the difference between the two of those. A quick example of tying these things together, what an end-to-end solution for boot-to-cloud security might look like, called Confidential AI, which is just an open source proof of concept we put together in my team in Leonardo. And then a quick checklist wrap up. So let's get started, just in the interest of time. So generally, if you're thinking about a secure IoT system, it's probably going to look at a very high level something like this. You're going to have a couple key components here. You're going to have secure boot, which is generally referred to as your root of trust. You're going to have some sort of firmware component. And that firmware component may or may not be separated into two different execution environments. If you're using something like Trusted Firmware M, for example, you're going to end up with two firmware images where you'll have a secure or a trusted processing environment and an untrusted processing environment. And your sort of firmware decision-making choice is whether you have a single monolithic firmware image or a secure non-score image is going to be based on a variety of factors that only you know. So you'll have that secure root of trust, your firmware image, then on the far right side, you're going to have to have some sort of provisioning infrastructure for your solution and generally some sort of cloud connectivity that doesn't necessarily have to be AWS, Amazon, Google, whoever. Maybe that's behind a company firewall, but generally you're going to want to get that data off somehow for analysis and potentially get information from the cloud infrastructure onto your devices for more updates, sending commands, et cetera. So generally these at a very high level, these are kind of the key silos that you're going to need to look into on a secure IoT system. So let's start with secure boot at sort of the front end of that pipeline. And that's a really important one because secure boot is the one thing that you absolutely want to get right and you don't want that to be an afterthought. If you do not have a secure trusted boot process, you don't have a secure anything because you don't know what you're running. You have no way to verify that this is a trusted image that it hasn't been tampered with, et cetera. So you do not want to leave this to be an afterthought. You absolutely want from the very beginning to be thinking about what does my secure boot process work like, what features does it give me, what do I require for that? Don't leave that to the end. So test that early and test that often. In the case of Zephyr, this is most often an open source boot loader called MCU Boot. It's not always the case, but it's a good place to start and it's well supported. And there's very good documentation around it. And that gives you a fairly solid foundation. Something to keep in mind with the secure boot process though, which may or may not make you feel comfortable, is that generally secure means immutable, particularly for the boot loader. So again, this is why it's important to get this on the table and plan for this from very early days, because that boot loader as your root of trust is generally something that you do not and cannot be changing in the field. It's important to get it right. You've got your verification keys, public keys burnt into that boot loader, probably, to verify the rest of the chain of trust. So get this right, because it's extremely difficult to change that boot loader in the field if you're taking security seriously, which hopefully you are. That secure boot loader should only run valid signed and ideally versioned images. And again, that's part of the immutable process because that signature verification, the metadata for that exists inside generally, the secure boot loader. And I say ideally versioned as well, because one of the things you need to take into consideration is that if and your firmware probably will have a lifecycle and you're putting out incremental releases adding new features, but also hopefully introducing security fixes, and you generally want to certainly consider the idea of enabling rollback protection, which means let's say firmware 1.0.3 has a known security vulnerability, so I put out 1.0.4 and we ship that. I want to make sure that people with malicious intent cannot intentionally roll back to a version with a known vulnerability to take advantage of that. So that's why not just signing, but versioning is also important to plan into your development cycle from the very beginning. So in the case of MCU boot, the K-config flag you want to look at is MCU downgrade protection. And there's a very variety of ways to implement that in hardware and software. Using a hardware counter, there's a lot of knobs to turn there, but something you want to think about and keep into your mind during your planning stages. Image content and signature with whatever your secure boot letter is needs to be verified every single reset. That comes with the cost. It's going to slow down your boot time a little bit, but it's essential to know that every time I boot up my device, the firmware image has not been tampered with, that the signature is still valid. So again, security often, there's a price to pay for that in the case of secure boot that will add some overhead to your startup time. It's nothing ridiculous, but there is a cost to it. Generally, it's worth it. Something you probably want to look for, that MCU boot does support, but if you're not looking for MCU boot, using MCU boot, is you probably want to look for something that also supports image encryption. People are probably always going to find a way to get your binary image off a chip if they're really determined, but a boot loader that at least out of the box supports image encryption at least raises the bar a little bit if you're publishing firmware update images just on an open TCP server or HTTP, et cetera. So just a detail you might want to look for as a criteria is that you can encrypt image as it's in transit from whatever your cloud infrastructure is to your IoT device. And MCU boot does have support for this out of the box. Again, because that secure boot loader is immutable, you're probably going to want to look at what are the hardware recovery options for that, because you can't change the boot loader, but what happens if you flash a faulty image, because generally you're going to be locking down your device in other ways. And this is a bit of a trade-off, whether you want this or don't want this, but it's a good feature to at least a tool to have in your toolbox. So in the case of MCU boot, how that works is you can optionally enable a serial recovery mode that only relies on the boot loader image itself. You can set a specific GPIO pin and then use the standard MCU boot tooling to flash a new valid application image in the field. And the signature, et cetera, will still be verified on that image. The reason that's nice that that's encapsulated purely inside the boot loader is that MCU boot generally has a requirement also on a valid application image. So if I'm using, say, BLE as my transport mechanism to send firmware over MCU boot, that BLE stack actually exists in the application image. So if you get a device that's totally bricked and something happens with that application image that it's corrupted, it is nice in the field to have a potential path over serial to update your firmware image relying only on that 32 kilobyte boot loader. Again, there's pros and cons to that, but it's a nice feature, a nice tool to have in your toolbox. And tooling is going to be a very important requirement when you're looking at secure boot as a problem. We'll go into that in a couple of slides, though. So just to sum up, secure boots, you absolutely want to get this right. You want to do your homework and your due diligence and plan from this early on, but there are some requirements beyond just picking a secure boot loader. For example, secure boot absolutely requires that you are protecting the boot loader flash region from overwrites that nobody else can come in and maliciously replace your boot loader. And that's something that we can't really do at an MCU boot level, because that's going to vary significantly from one SOC to another. Nordic is going to have certain options in place to protect flash memory, NXP, ST are going to have different options. So you really need to be doing your homework to understand how do I lock down that 32, 64, whatever kilobytes of memory so that it can't be rewritten once the device is deployed. And that's just digging into the data sheet. But again, be aware of it. If I can easily overwrite my boot loader, I no longer have any semblance of security on my device.  That also means disabling generally some SOC device recovery options. So for example, if you've used NXP parts, some of the LPC family, it's a fairly popular set of mass market MCUs, there's something called ISP recovery mode where I can set a candidate specific state when I reboot the device in hardware and it overrides any sort of user firmware and gives me access to the debug interface, et cetera. So it's great as a developer because whatever I do to my device, I can always recover it and hook my J-Tag or whatever, my J-Link up and reflash firmware. You absolutely don't want to be exposing that kind of possibility to someone with malicious intent. So you wanna be looking again at the data sheets. How do I lock down that feature? It's usually just setting some fuse on the chip but making sure that you've defined a process to lock down those hardware recovery options that you may or may not be aware of, but you wanna be digging around to lock those down. Similarly, the debug interface.  So plan early on for the sort of details of the risks to make sure that you have a reliable boot process. Again, we can't go into too much detail. I'm just trying to give some high-level pointers. These are the things, the most obvious areas to go wrong and if you wanna make a checklist, do this, this and this. And when you're evaluating your boot process and again, to reiterate, this is the one thing you absolutely wanna get right. So in terms of tooling, this is MCU boot specific but MCU boot actually comes with some really good tooling out of the box. So a boot loader is one thing but the ecosystem around it is also important. It's like a scheduler is kind of boring. Zephyr is a great system because it's an ecosystem. It's a bit similar. Your boot loader, you also want good tooling around that and there are some pretty good tools out of the box and there's some community efforts also to add more tooling. So in the case of MCU boot, you're today, there's a command line tool called MCU manager. I know there's some desire to introduce better tooling here. I think Nordic specifically, you guys were interested in replacing MCU manager with something a bit more flexible. It's still not a bad tool out of the box. So it's a CLI command line management tool and it works over a variety of transports. If yours isn't on this list, you can extend it. So it works out of the box with serial BLE and UDP meaning I can use my mobile phone to interact with my boot loader, send a firmware update, collect some data, et cetera, or UDP or something else. It is extensible and there's an extensible command set. It's not just restricted to firmware images so I can set the date time on the device. If there's an RTC, I can update the file system. I can get thread statistics, stack usage, et cetera and also device statistics. So if you have an iSquad C sensor from the command line I can see how many times was the iSquad C bus pulled, how many errors occurred in the sensor driver. That's extremely useful for debugging things in the field. So the MCU brings not just secure boot to the table. It actually brings you a lot of very useful field debugging analytics information and I find the statistics system in Zephyr it's not a subsystem people are aware of but it's extremely useful for field debugging. Things that are very difficult for a customer to give you insight to like how many bus faults have there been on the spy bus or whatever. And you can get that using MCU manager from the command line tool. You can reset the device. You can send shell commands, kind of scary. You might not want to enable that but it's there for development. You can, from my bash prompt, I can be sending shell commands and get the response back. Super useful, more on the development side though. Please don't enable that in your deployed devices. The option again, those optional commands are double-edged sort. So you want to be careful with that and you want to evaluate them. Some of them are good, some of them are bad and can be maliciously used. So evaluate that, but it's there. It's extensible and you can do some really interesting stuff out of the box. I think actually the tool that doesn't get a lot of love because it's written in go, I like Golang. I don't know what's wrong with all you Python people. Golang's a great language. Compiles to a binary. So I think that desires to move to Python but I don't know, I don't know. Anyway, opinions. Image tool is the other tool that you're gonna bump into with MCU Boot and this is, you might not need to use this directly. This is the tool that's used to sign your firmware images most of the time. But you can also use it to generate correctly formatted keys for the signing and that's problematic. When you're trying to generate your own private keys there's a lot of knobs to turn and there's a lot of things that can go wrong. So rather than just using open SSL or something like that it's nice to have a tool that just gives you a correctly formatted signing key. So you can do that out of the box with image tool that'll sign your images. You can also use it to verify firmware images, comparing it with the key to make sure this image is correctly signed and get very C-friendly public and private key snippets out of it. So it's a useful helper. You generally probably won't interact with it directly but it's there if you need to do something on your own. Always, always please for the love of all that is good in this world generate your own private keys from day one do not use default keys ever because someone will forget about them. Even in development generate your own signing key as soon as you start a new project and don't ever ship default keys. It takes you five minutes and just get in the habit of doing it. So in the case of Zephyr and MCU boot the KConfig flag you're gonna want is this boot signature key file that will point to a PEM file and then it will use that during the automatic signing process when you build your firmware images just get in the habit of generating your own keys. So provisioning, that's one of those other pillars on the going from secure boot all the way to the other side on provisioning but it's something that happens very early in the device life cycle. So you can see that one over here and whether that happens purely in a factory or the field depends on your use case. The problem is there is no one size fit all approach here. Provisioning is a hard problem. It's a domain specific problem. It's a company specific problem. It's really hard to prescribe what provisioning should, could, might, must look like for you. There's just so many variables. Can I use a public cloud provider? Is my company okay with pushing my data out to Google, AWS, Amazon, whoever? Does that data need to remain in the EU for legislative reasons? Where can I store that data? Does everything need to exist purely behind my company firewall on our own servers? What kind and how many keys and certificates are required on my device? How often will those certificates changed used for connecting to TLS servers, et cetera? What does the life cycle look like for that? Can those be provisioned purely in a factory once? Do they need to be regularly updated with three, nine, 12 month lifespans? There's a lot of knobs to turn there. What level of access control to the provisioning servers is required? Can that exist publicly? Can it just be some Amazon AWS server that anybody can talk to in the open? Does that need to exist behind layers of security so that things can only be provisioned by key people with access cards on a factory floor? Only you know that. So who can provision the devices when, where, et cetera? It's a complicated landscape and you're the only one who can really navigate what your requirements are there. But you want to, again, be thinking about that very early on because you don't want to be have to be integrating key management infrastructure late in the game into your firm. These are the kind of things you really want to get on the table from day one. So there are two common scenarios for provisioning devices, factory provisioning and this is generally the easier of the two. This is where devices are entirely provisioned in the factory during the hardware manufacturer maybe just before they go into packaging. You're burning your unique, some unique ID and some key access certificates to talk to your server and whatever that metadata might be to communicate with your data endpoints. That all happens in the factory. The user opens up the device and it just works. That's the easier solution. The other common scenario is something generally referred to as late binding. In this case, devices are provisioned in the field by the customers, generally using an intermediary tool. So this is where I get my wireless security camera or something, I plug it on the wall then I need to go through the application and I'm going to provision that device into a local network or some sort of cloud network. But that happens once the customer has the device in their hands. Late binding is definitely probably the more common scenario in shipping products. It's a harder one, but that's generally the one you're going to probably end up dealing in most non-industrial scenarios, I guess. So again, provisioning is just a hard problem. This is just kind of a signpost. If you're looking for some help and you're new to this provisioning space, here's at least one open standard. You can look at Fido device on board. It's relatively new. The adoption, I don't think hasn't been spectacular, but still it's a good standard to at least look at and see what can we learn from this. Maybe this works for you out of the box. Maybe it doesn't, but it'll at least give you some direction. These are the kinds of infrastructure problems you're going to have. These are the issues you need to be looking at. And so there aren't that many open standards out there. So just to sort of lay down a signpost, if this is a problem space that interests you, have a look at this. It's a good place to start. There are simpler solutions. This one's a bit complex in terms of infrastructure. There's a simpler solution we'll talk about a bit later. With a sample at the end. So there's a lot of ways to do this. One of the, just in terms of best practices, one of the key parts of provisioning though is key management. And usually one key is not enough. Generally you're going to, maybe I'll have a key for my TLS server and something for a cloud server and a key for encryption and a key maybe used for signing my sensitive data to ensure that the data traveling through my device to the cloud is intampered with. So that needs to be signed. And to verify that signature, I need the public key on the cloud endpoint to verify that my data, the data integrity and the provenance of the data. So that generally involves something called key derivation. And again, a multiple keys are often required on real world systems. The thing is key storage is a hard problem. And so the safest way to store a key is just never to store it, if you can get away with that. And so you can use something like a common standard key derivation function like HDDF in this case to generate something called a device-bound key, which you derive from the hardware unique key. Most MCUs today have a feature in them that they will ship with a hardware unique key or a unique identifier of some sort. Maybe it's just 16 bytes, but it's something that generally there's a unique number you can get out of a register that uniquely identifies that specific MCU. So when you use something like HDDF to derive a key based on that HUC, you get a very interesting feature called a device-bound key. What that means is that key is tied to a very specific instance of an MCU. And I'll go into a bit of details, but that gives you some interesting features. And there's also the benefit that because I'm deriving that as soon as the device comes out of reset, I never have to store that key anywhere. That solves a huge attack surface. Somebody can get access and dump the binary from my firmware and they're not gonna find that private key. Not having to store it solves an entire class of problems for you. The HUC then becomes the sensitive thing to protect. But so what happens in this process is if I'm using the HUC plus some sort of info label, so we take the HUC plus a string and those two together combine to give me a repeatable output that I can regenerate every time it boots. So what we do is every time the device boots, we regenerate these private keys. And those keys then are also another advantage is that they're persistent across firmware. I can unflash an entirely different firmware image. I don't have to worry about wiping out the user's private keys that were used to encrypt things because they were never stored. And it's based on hardware, not a software implementation. As long as you're using something standard like HKDF, the same inputs will always give you the same outputs. So it gives you key persistence as a potential benefit. It also ties encryption, authentication, et cetera to a specific MCU. You can imagine a PCB where I have a large external QSPI flash or an SPI device where I need to store device secrets. I want to encrypt that as it goes off my chip to that device.  If I'm using a device bound key for the encryption, replacing that with another malicious MCU will not give them access to things that were encrypted because the key that's used for that encryption is tied to that specific physical instance of an MCU. That may or may not be useful to you, but there are a lot of benefits of not just of not storing the key, but having it bound to a very specific instance of a piece of hardware. It makes it much harder for me to pretend to be a device that I'm not because without that hook, I can't generate the same signing, encryption, whatever, authentication keys. So this approach absolutely requires one thing though that you do need to know how to protect that hardware unique key and that's again one of those things that's going to vary vendor to vendor. So this is a great approach with the caveat, figure out how do we lock down access to the hook that that hook never leaves the key. So for example, if I'm in a situation, if I'm using something like trusted firmware M on the secure side and Zephyr on the non-secure side, that's a common topology where you have distinct secure and secure firmware. Something you need to take into account here is if I have that kind of layout on the secure side and maybe I can do key derivation with the same approach on both sides, you make sure on the secure side that you are always appending something extra into that info label on the secure side. And the reason for that is, let's say my non-secure side is telling the secure side of my firmware, I need a new key and use the hook and use this string and maybe I know that info label which is the additional information that gives me a unique key out. If I know that string that the secure side is saying, I can just give it the same string and then I will get the secure key from my... I will get the private key from the secure side. I can derive that on non-secure. So taking the simple step of your secure key derivation function for keys that exist on the secure side, always ensure that you accept maybe that extra info label, but it's prepended with something else that only the secure side can prepend and obviously do some simple checks. So like if the non-secure side tries to be a little bit spart and also knows the prepended value and appends something else that you reject that key request. But you do need to make sure that you are not leaking keys from the secure side to the non-secure side. And the way to do that is to make sure that you are always on the secure side during key derivation, appending extra information into that info field. You don't need to do that on the non-secure side, just as something you may or may not be aware of as a pitfall to avoid. It's low-hanging fruit, but deal with it from early on. Another benefit of this kind of Huck-based key derivation is you don't have to generate private keys. You can actually use this to drive a unique device UUID. If a UUID is a useful identifier for your tens, hundreds, thousands, whatever of devices in the field, this also gives you a device-bound unique UUID, and you can generate multiple versions of those if you want. So there's some other free features of this. So if you're not familiar with key derivation, have a look at HKDF. It's sort of a well-supported modern standard. The standard's not that inaccessible. Links are, you've got the RFC here. Sorry, just a quick time check. So securing data in transit. And this is where you've got your firmware image talking to some sort of cloud infrastructure, public, private, whatever, maybe behind a company firewall, but there's still some kind of communication going on there. The too long didn't read is just use TLS. If you can establish a connection with a server, just use TLS. You want to talk to your MQTT broker, just use TLS. It's tried, it's true, it's universally adopted, it's reliable, it's based on modern encryption standards. To keep it up to date, just use TLS. Problem solved. If you can connect to something, do everything you have to to use TLS for that. And the only maybe caveat here is make sure, in Zephyr for example, when you're establishing that connection, make sure you're enforcing a recent version of TLS, which is TLS 1.2 is sort of a good minimum starting point today. So don't accept TLS 1.1, et cetera, connections. Just you'll avoid a certain class of problems that way. So just, again, best practices. If this is new to you, you haven't played around with TLS on an embedded device, here's a good example to look at, the HTTP get socket sample. You can see how to get the certificate authority on the Zephyr device, which will enable you to verify that you're actually talking to a server that you should be talking to and it's not pretending to be someone else. So there's just a good pointer if you're interested and new to communicating over TLS with a server. Have a look at that one, it's a good starting point. So basic TLS authentication validates the server identity. In a sense, it gives me as a client device a degree of confidence in who I'm talking to because that server has a certificate that is signed by a certificate authority and I trust that certificate authority that they're doing their homework to actually validate the server as who he says he is. So the way that that generally works is you've got your client device with your Zephyr firmware here and it wants to talk to a server. So it will send a client hello message, part of the standard TLS handshake and the server will respond, hey, how's it going? Sends a server hello over and part of that server hello includes the server's X509 certificate which is signed by a CA. I get that certificate on the client side. I have the CA's public key and I can say, okay, you look like who you say you are but I wanna check anyway. So it can check the signature on that certificate and if it matches the CA I have, I have a reasonable degree of confidence that I'm talking to someone that I can share information with and the TLS handshake goes on with a key derivation process and you eventually end up with symmetric encryption of data using AES or something else and depending on what the server supports. It's a fairly well understood process. It brings up an interesting question though. How does the server know that it's talking to a trusted client device? So the server, he's flashing his credentials but how does that server know who I am? Am I pretending to be someone else? That's an interesting problem that maybe you don't think about as much with TLS and TLS out of the box actually includes something called client authentication and this is where the server also asks the client device to prove its identity and what's important here is that we're not inventing anything. This is a standard part of TLS. Every TLS stack out there is going to support this so you don't have to invent some weird process to prove who you are. You can use this with any HTTP server, whatever the TCP server that you're talking to. So there are some, if you're using a cloud provider to push out your data to MQTT or whatever, some of the cloud providers have better or worse support for this client authentication. Azure IoT, I don't want to play favorites but for example, I think Azure IoT Hub, this is something they've done well and maybe a bit better than some of their competition because they have very good support out of the box for you upload your CA certificate to Azure IoT Hub and it can use that to validate any incoming client requests to know that they have a certificate that's been signed by that CA and then they accept or reject the connection. So you can do this on your own as well but the support for this, the use of this extra feature isn't a given but some cloud providers are making more progress in there. Something to look at though to establish trust in both directions. So how that works in practice is you start with the same process, I've got my client device talking to my server, hey, how is it going? The server says, hey, haven't seen you in a while, here's my certificate again just in case, should prove who I am but part of that server hello also includes now an extra step where the server says, hey, you know what, haven't seen you in a while, I just want to make sure everything's above board. So why don't you send me back your certificate as well and you can see that here on the bottom this client certificate request and that's going to prompt the client device to take its X509 certificate which was signed by a specific CA via the certificate signing request. It's going to send that certificate over to the server device and then the server device can just verify the signature and make sure it's signed by the CA that I trust and maybe that's enough maybe it actually wants to talk to that CA infrastructure and say, okay, you're signed but has this device been block listed? Is this certificate still valid? Is it, so that you can take more or less steps on the server side than to verify that device maybe this device has a UUID that I know the device has been stolen or compromised I can then reject that connection based on that extra data so that out of the box using entirely open standards that are well supported in everything you can add device authentication to your Zephyr device so this is where you can introduce like basic client authentication because inside that X509 device certificate you don't just need a key and a public key oh already five minutes, okay quicker you can stick fun data in there so if you're interested in some examples here's one, you click this link or look at this QR code here's an example of generating a mutual TLS TCP server it's in go, I'm sorry, for the Python people and there's a script, a bash script in there for generating certificates for the server and the public keys et cetera just to give you some pointers if you wanna go in details here's a talk from last year's ZDS specifically on X509 client authentication so securing data at rest what do we do when TLS isn't available and some use cases are like I need to place secure information into external flash I need to use an intermediary app to send data to the cloud so maybe I use BLE to talk to my phone or lays it to a cloud server how do we deal with those situations securing data at rest is unfortunately less of a solve problem today there's a lot more work needed here and it's not as easy as TLS just use TLS, solve your problems for data at rest, we don't have that option to my knowledge, COSE is the only open embedded appropriate standard I'm personally aware of for protecting data at rest and COSE is something that's built on top of CBOAR concise binary object, something which is basically binary JSON it's very tightly coupled to JSON and it's a nice standard because you can very richly express complex data and relationships between nested data so COSE is something that builds on top of CBOAR it allows you for signing an encryption of data at rest using modern ciphers and I really believe this is something that should be actively promoted as a solution for securing data at rest unfortunately COSE encryption the E in the COSE is less common than the signing part today, the S so there's very poor encrypt and encrypt zero library support today particularly in C so there are some C libraries like T-COSA that are making an effort to improve this but it's still an active work in progress and there's no profiles in COSE so you kind of need to know a little bit what you're doing to glue things together if you're interested in this we put together a Rust proof of concept for what COSE looks like encrypting data at rest so you can follow that first link to see some examples of this is what COSE encryption might should could look like for an embedded device with efficient throughput there's also there was a talk a couple of months ago from my colleague in the back David Brown discussing what is efficient COSE encryption look like watch that talk if you're interested in this problem I think it's a good standard that you should keep your eyes on in terms of example everybody loves examples you want to see an example of what end to end boot to cloud security looks like how this all glues together a good example we've done in Linaro something called confidential AI what is that very quickly it's an attempt to demonstrate end to end security best practices based on modern Cortex-M hardware V8M, ARM trust zone using entirely open source standards and open source software with AIML workloads as a case so we're doing inference on the secure side and demonstrating how do I secure the data pipeline from the secure to the non secure to the cloud signing and encrypting data et cetera nothing special about the AI it's just a use case because I think having a good use case leads to better engineering results so we picked AIML as the use case how do I secure my models and my data this is what it looks like here's the links if you want more details there's a sample bootstrap server in there if you don't want to use some complex provisioning thing here's a good starting point for what provisioning might look like we put together a bootstrap server to take in device UUIDs generate certificate signing parse certificate signing requests register those certificates in a database and then the top link here is the parent repository for confidential AI which is based on Zephyr and trusted firmware M you can run it in QEMU no hardware required totally emulation friendly including the cloud connectivity over TLS quickly checklist integrate your bootloader early on understand your provisioning requirements replace your default keys please in day one even during dev plan for key storage just use TLS 1.2 don't use it use if you're using TLS think about it for client auth data at rest is still a work in progress but COSA is the standard to watch please get involved thank you I'm sorry that was like 39 minutes no questions I guess but if you've got any questions just chase me down over here I'm happy to talk about this so sorry I don't have time for questions so hope that was useful anyway


Hello and welcome to the session. In this session we will discuss a question which says that find the next three members of the sequence defined by a1 is equal to 1, a2 is equal to 0 and an plus 2 is equal to 3 an plus 1 minus an. Now let us start with the solution of the given question. Here first term of the sequence that is a1 is given as 1 and second term of the sequence that is a2 is given as 0. We have given a reference relation a n plus 2 is equal to 3 a n plus 1 minus an. Now we have to find next three members of the sequence that means we have to find a3 a4 and a5. Now n can take positive values only. Now let us name this relation as 1. Now as n can take positive values only. So let us put n is equal to 1, 2 and 3 to obtain the required terms. First of all let us put n is equal to 1 in the relation which is given by equation number 1. So this will be a now as n is 1 so it will be a1 plus 2 is equal to 3 a1 plus 1 minus a1 which implies a3 is equal to 3 a2 minus a1. Now we have a1 is equal to 1 and a2 is equal to 0. So putting these values here this implies a3 is equal to 3 into 0 minus 1 which implies a3 is equal to 0 minus 1 which is equal to minus 1. Therefore a3 is equal to minus 1. And now we will put n is equal to 2 in this relation. So putting n is equal to 2 in 1 we get plus 2 is equal to 3 plus 1 minus a2. This implies a4 is equal to 3 a3 minus a2. Now a3 is equal to minus 1 and a2 is equal to 0. Putting these values here this implies a4 is equal to 3 into minus 1 minus and this gives a4 is equal to minus 3 minus 0 which is equal to minus 3. Now to obtain next term we will put n is equal to 3 in equation 1 and we get a3 plus 2 is equal to 3 a3 plus 1 minus a3 which implies a5 is equal to 3 a4 minus a3 and a3 is equal to minus 1. So putting these values here this implies 3 into minus 3 minus of minus 1 which further implies now 3 into minus 3 is minus 9 and minus of minus 1 is plus 1 this implies a5 is equal to minus a minus 1 equal to minus 3 and a5 is equal to minus a in sequence minus 1. So this is the solution of the given question and that's all for this session. Hope you all have enjoyed the session.


Here's David Hawkins, what a season he's had for Tri-State. Pulls up. That one hits the back rim. Here's Corey Maggetty, probably the MVP of the league this year. Yeah. Knocks down that three. Well, to the winner goes to spoil. So if they end up winning, assistant and best player this regular season. Jermaine O'Neill. Yes, welcome back Jermaine O'Neill. He missed about three weeks with a shoulder injury, came back last week. He's looking. Here's Big Baby using his body, going up strong. Count the basket. See inside the patients, right up into them. And that time, the Jermaine O'Neill came over a little bit late, and he's still moving right there. So Big Baby, we're always talking about finishing through contact. David Hawkins, Amari Stadamire, Nate Robinson in for Tri-State. Here's Nate. He's going to pull up. Got it. Don't let him get hot. There you go. There you go. Well, especially if he can use the pick and roll. I mean, the thing is, with Nate, thought to it was an easy, soft stroke. Down. Here's Hawkins. Got it. The three. Speaking of stroke, one point lead. Your power to counteract that. Try to get a lot of pick and roll scenarios. Try to isolate the two of them with Megetti and also Katina. Here's the isolation with Megetti, and it works. Bucket and one. He'll go to the line. Amari, you just find the mismatch. Nate Robinson brings it in. He gets the pick from Amari Stadamire. He's going to pull for three. It's too strong. Stadamire, the finish. But that's Amare. Up two. Nate comes up with the loop. Take that separation and look up. Here's Jermaine O'Neill. Megetti, the three. That's what you call a body shot. You don't get back out. In that time, Amari got stuck on the ground. Corey Megetti was wide open for a three. Maybe open again. For three. Count it. Another body shot, huh? The winner of this game goes to the championship. That's weak in Brooklyn. How about the decision? It's a quick decision by Corey Megetti. Opportunity for power to get the rebound. Let's see if Trice can take advantage of it. Off to the double. But Trice stayed there. More so around this anchor area. Here's Katina Mobley. One point lead. Drive. State doesn't score.


We have a misunderstanding that I will clear up in this episode of the George show unedited Many of you thought when I announced a few days ago that we have a new CMS for gamers only that if you join it, you're going to leave your network powered by freedom No, the CMS is simply that a CMS if you join it with your channel You still stay with your network all the benefits you have with the network stay with you The only difference is that your channel is categorized organized into the new CMS for gamers only I hope this helps you understand that this is not an attempt to have everybody join one MgN network. It is just an attempt to organize all the gamer channels into one CMS Also, we have 3,000 people now who have signed up to the position music website If you haven't already just go to sync.positionmusic.com The link is down there in the description below. That's where you get professional quality music some of those albums cost $100,000 to produce and you get them for free a Link to the album one of them that cost $100,000 to produce is down there in the description below You can hear it and tell me do you think this album is worth a hundred K? Also hitbox is now over 3,000 partners that means over 3,000 of you freedom family have signed up for a live streaming partnership on www.hitbox.tv Where you can get all of your live streaming revenue partnered with freedom and you get all the benefits of freedom We will be rolling out more music So for example, you can stream all of your position music and fixed music on hitbox and monetize it and We will be rolling out a few more surprises Do you remember those five people that were coming in the next months to the Philippines? Well, two of them are coming in one week and they're coming from Quebec and The hint I gave you was that one of them had a three in his name a few of you guessed night blue three It's nerk mind Michael Doyle on aka nerk mind n3 Erk mind is his nickname He will be joining us along with one other person coming from Quebec on March 5th That's the day. He'll be flying in he will make a door-to-door video Which means you're gonna get to see his trip from the moment He leaves his door in Quebec to the moment he arrives at the door in the Philippines where we live Isn't that exciting? Isn't that cool? I think it's cool, and I'm really looking forward to his video So I hope you've enjoyed these updates on this special episode of the George show unedited who am I? I am George CEO and founder of freedom And you've been watching the George show unedited till next time guys be safe. Bye. See you


Hi everyone Joe for jazby's case breaks calm with another full case break of 2020 tops finest baseball eight box pick your team number Three from jazby's case breaks calm with a $200 giveaway right here top five forty bucks each That's not bad not bad at all big. Thanks all of these folks here in break number three Appreciate everybody getting in There you go Rookie of the year on in the background What if you saw this on to what if this game actually happened on TV?  I'm sorry to do anything What's going on Rocky's asking when is that top finest been breaking? Rocky Johnson, it's been breaking. This is break three already. All right box number one pick your team three You can see all the boxes on the top screen right there All right, good luck everybody here we go Anything spectacular. Yeah. Well, what's your definition of spectacular? I'd say yes. Glad junior autographs train whistles Dual autos all sorts of good stuff No, we haven't went is it even sold out I think we've been doing a finest all day Yeah, I can't do any prism hasn't sold out darksiders Let's fill you out. Let's sell out that prism. Maybe everyone's into finest today Maybe tomorrow be the prison today We got Luke's Geolito to 150 and there's your auto we got Ryan Not Ryan Reynolds Brian Reynolds Ryan Reynolds is someone else All right, that'll be for Michael Gallucci and the Pirates This dual auto would be pretty cool Trout o' Tony do a lot of and we've got Gavin Lux Finest first rookie autograph for Matt and the Dodgers Nice Break schedule not full. It's been busy steady, but not full We're gonna be going through some orders after this break. I Know there's a couple things on the website that are sold out. So we got we got things happening Is how I didn't know it pulling the cubs man are already down my throat EA. We haven't even finished our night yet It's a good movie and holds up nicely as a family-friendly movie for this family-friendly channel Yes, there will be Nick at night tonight. So keep filling it up ladies and gentlemen. He'll need things to do too couldn't catch up to that Kind of looks like John Cruck The the Mets villain in this movie Now make David auction ends in a couple hours From wherever you are in the world and we got a Jake Bowers Cleveland Indians autograph for Matt There's Lorenzo Cain to 250 and There's Albert alzale for EA and the Cubs There you go EA see it's a start. Maybe that'll that'll Cut me some slack with EA For at least a couple more packs Randy will the hockey blaster or mama blast out first. What's your best cast? I have no I haven't been paying attention to the site because I've been busy breaking so no idea You're welcome Eric. Yeah, we got we got more boxes. They'll probably be some Maybe we're warming up to some bigger cubs here Josh K. I'd be interested in filling that mosaic Listen, there'll be some Nick at night. So after I'm off air. What time is it right now? I'm off air in about three hours. That'll be my Maybe three three and a half hours around there. I'll be helping Nick a little bit too, but You know fill up some stuff fill up a mixer if I could help pack stack a mixer If we get one done by the by the end of the night or by the end of my night Maybe Nick kicks off with a mixer. I can help pack stack it. We'll fly through that mixer and we can end up Doing a lot more stuff tonight. So keep going folks. We've got plenty of prism baseball Prism baseball half case one is down to two teams Finest four is down to four finest five is down to seven I'll let we'll do four and five tonight. Maybe six and seven six is down to nine seven is down to ten One box NT is down to 18 mosaic is down to 10 Josh K If you if you grab the spot or two, maybe that that'll convince other people to buy a spot or two and got some mixer spots still available So keep an eye on the website and that spots left number Let me know when something sells out and all these have been the same team So I haven't had to do a left-right randomizer on that. There's Seth Brown for the A's Jeff Goldberg Finest first Seth Brown auto out of 250 you Darvish Cubs John means Orioles Robert Runkle Oh, this is the Bartman game for Steve Bartman. It's on ESPN if you want to walk. There's Audre Amorahon to 250 for the Padre Dean with that There's a Brock Burke, that's right Calvin shrawlty was also a former cub, I think There you go, Texas Rangers Matt Gomes Ryan Bryan to 99 and We've got a Mitch Keller 88 out of 99 for the Pirates That'll be Michael Glucci in Pittsburgh. I haven't seen any buchette autos yet Excuse me, Christopher. I'm not sure what your question is You're gonna start a hockey break? Halfway through finest picker team number three We'll go through orders after this and we'll see We'll see what else we can get into What did they do this documentary was this after the Cubs won the World Series or before a 2011 documentary so it was before What I'm pretty sure that Pretty sure that there was some sort of reconciliation with Steve Bartman after the After the Cubs won the World Series, right out of 250 Reese Hoskins Are there no autos for the twins I'm not sure you can ask Nick when he's on a little bit later. All right, and there's Abraham Toro To 150 Stroh's that'll be from Matt Johnston At each row is different. Yeah, there we go. That's out of 50 And that's finest careers 18 out of 50 Marlins edition going to Jeff And we got Zach Collins not basketball players at Collins, but Ketcher is at Collins White socks that'll be for Jared Jared nictor with that Buckner kind of handled this well though didn't need the ball going through his legs Oh, did they Steve Steven Michael Mustaine is saying that they gave Bartman a World Series ring after they won That's a good gesture That's a nice gesture good for them a few boxes to go here ladies and gentlemen My favorite 30 for 30 Mike tower Hmm. There's so many. There's a lot of good ones. I died. There's so many now At this point, what is everyone's favorite 30 for 30? 58 out of 99 that's Lourdes Gouriel. That'll be blue jays. I'll be from Matt to 250 There's a Masahiro Tanaka for Matt hedges and the Yankees there the From one of the early ones the two Escobar as I thought was a really good one There's a Logan Allen autograph for the tribe Matt goams with that There's two teams. I wasn't finest twins and Rockies You know what? I'll bet something to do with the break credit that we're giving And those are probably the cheapest teams then All cards shipped though there you could get a One of one of those teams too Was the Bo jacks enough to see I I don't I also mix up Derek Redding I also mix up which were 30 for 30s and which were which were like a ESPN E 60 specials and which ones were outside the lines reports and stuff like that. I Feel like we'd have to narrow the scope like what if we just said what what about the original 30 for 30? Which were the best of the original 30 for 30? I really like the what's the sneaker one with a Is it Jimmy Veccharo someone? Someone like that The shoe one was that a 30 for 30, but I remember about how like the basketball shoe money how that seeped into You know high school a you tournaments which then seep into college with then which then seep into You know so like the money that's all behind that industry now the shoe industry with You know young players Amateurs really That was one of the early ones right Jared the 30 for 30 broke details about athletes who? Yeah, who go broke after After making millions as pro basketball players or football players or whatever And there's a pedilanzo finest moments autograph for the Mets Armando in the Mets nice pedilanzo Out of 150 Victor Robles for the Nats TJ With that one. I didn't see any nationals autographs yet And we've got an orange shimmer Fernando Tetease jr. Autograph second-year auto 7 out of 25 good-looking auto though That is for Dean and the Padres Nice All right last box CC William says that Mets Boston game was nuts in the mid 80s the one they're talking on TV right now or on ESPN Was there for game six? Third baseline eight years old Almost That that's a that's a wild that's a historic game to be a that's wild Yeah, like I said Buckner really took this in stride there. You just had the I don't know how many people I mean he actually talks about it and I don't know maybe the Maybe the 80s were rough Buckner no longer with us Zach F. Was saying rip Bill Buckner last year 69 years old May 27th 2019 I didn't realize that Hmm Apparently Louis a body dementia, which is what it what is this an umbrella term that I some kind of Parkinson's were possibly really a minute. Wow. That's crazy. All right Jan saying the hockey mix are sold out nice Are you sure the make sure all those mini breaks sold out too? But if they did nice good news The Nolan aeronado 99 for the rocks that'll be for Armando, and we've got a Mike you're shrimp ski 10 out of 150 Carl's grandson right here going to Chris Walker and the Giants Ryan H. Yeah, you got a workshop that with the writers out of 150 Charlie Blackman and We've got Mauricio Dubon with the Giants That'll be for Chris Walker and that's it ladies and gentlemen Let's give away a little bit of money. Let's do a quick recap right here. Not a bad break at all He's evolved to tease junior Pete Alonzo finest first Gavin Luxe good-looking break Some nice stuff popping out of this finest. Let's go back to this list right here and Let's alphabetize by your first names and if you bought at least two teams You'll get an entry four teams gets you two entries so on and so forth Chris Walker with two that's an entry Fred Schultz with two that's an entry Jeff with two that's an entry Josh with two that's an entry Matt with two Matt G with four, so that's two entries Matt H with two that's one entry Matt s Michael with two. That's an entry and Robert with two. That's an entry All right, so let's see if we got everybody Armando. Yes, check Michael Robert, okay Great it's 11 spots there top five Get a little bit of money $40 of break credit each. That's not bad One One and a four four and a one five times top five after five two three four and Fifth and final time after five. We've got Jeff Robert Fred Matt J Matt G Congrats to you 40 bucks of break credit each going your way. Thanks for breaking. Thanks for watching And I'll see you next time on Jaspies case breaks.com. Bye. Bye


We will talk about the aviation history and how it has moved from decade to another decade. Airport operators as well as regulators, we will talk about certain compliance requirements or certain SOPs or standard operating procedures with regards to aviation. Well really I am excited to teach you friends on this particular module on introduction to aviation. Well if we have to define what aviation is, aviation is a huge space and it is so humongous there are so many things to learn about aviation and today in this particular module we will talk about how aviation was started and when it came into being. Well aircrafts have been around for more than a century but aviation has been around for more than 2000 years and that's not a small thing so it has been around for a long long period of time. Leonardo da Vinci made many model aircrafts but they didn't really fly, the reason being that he introduced lighter than air aircrafts. Well what happened after that let's see, well the first plane was brought in or rather was made by the right flyer brothers. There were two brothers who were the right brothers and they made the first aircraft to be launched. They were known as Wilbur and Orwell, they are the Wilbur brothers. The first successful heavier than air aircraft was made and it was known as the right flyer. The first flight was on December 17, 1903. After the right brothers first flight there was an aviation boom. The entire aviation sector really picked up after this particular time. One day aircrafts, giants are air buses as well as Boeing. Now these are used across the country, across the international airlines, they only use air buses as well as Boeing's. Well friends I'm going to teach you certain international airports codes which was given. Well Bangkok is known as BKK, Los Angeles is LAX, New York is known as JFK, Singapore is known as SIN and so on and so forth. Most of the countries all over the world have airport codes assigned to them. For the simple reason being that they need to know or rather the air traffic controller as well as passenger needs to know which airline or which destination they are going to be headed to. So they are these short forms given to them by AYATA. Looking at further, certain airlines also have AYATA codes assigned to them. The reason why codes are being assigned to airlines is for the simple reason that whenever a particular passenger is travelling by for example indigo airlines or jet airways or any other airline they need to have a short form or a code with which a passenger can identify his particular airline. So let's take a quick look, Singapore Airlines is known as SQ that is the code given to them. Malaysian Airlines is known as MH, Emirates which is a world famous Dubai aircraft is known as EK, Contas or British Airways is known as QF or BA. Well friends these are different kind of terminologies or codes given to airlines all over the world. Well friends let's look at what the aviation industry looks like. Describing as the building and flying of aircrafts and it has two sectors or two segments under aviation. One is military and one is civil. Well under military as the name suggests or shows this is used by the airlines for military purposes or the nations air force only and it is not used for commercial purpose. Well the civil is divided into two parts domestic airlines as well as international airlines these are to be used commercially from one place to another. Well domestic airlines are flights which operate within the same country therein they have to take off as well as land within that particular country for example take off and land within India, Malaysia, USA, Australia etc. Coming to international airlines these are flights which starts from one country and it ends into another country right from India to Australia, India to Hong Kong etc. So this my friends is a two segment of the aviation industry. Well friends we are going to talk next about the airlines regulatory bodies as you can see here on the slide we have Federal Aviation Administration which is FAA and we have IATA which is International Air Transport Association. Well these are two governing bodies which are the whole and soul of the aviation industry. Let's look at what their work involves so FAA revolves around controlling the operations of the aircraft, licensing the pilots, inspecting the aircrafts as well as maintaining the overseas whole and soul maintenance of the aircraft. Whereas IATA has a responsibility of association made up of most of the world's airline it sets the standards and records for civil aviation so these are two regulatory bodies of the airline industry. Looking at air services and certain routes well we have scheduled flights as well as chartered flights. Scheduled flights are those flights which have a certain time of departure and arrival which shows onto the board at the airport and these are specifically commercial aircrafts. Chartered flight are not having any kind of time of departure or arrival because these chartered flights are used by ministries, government officials, VIPs and VVIPs of certain industries hence they do not have a fixed schedule they depart and arrive according to their own convenience and timings. Looking at the different kind of flights or types of flights as well as the journeys we have direct flights as well as connection flights. Direct flights are flights from origin to destination with one or more intermediate stops. However the passenger does not come out of the aircraft because the same aircraft goes to the forward destination. Whereas in a connecting flight passengers have to change the aircraft at that particular stop so they need to come out of the aircraft and check in again into another aircraft. Well friends that brings us to a conclusion on introduction to aviation. We did speak about the history of aviation and how it started as well as certain you know ITA codes as well as airlines and how they are known. We hope you have enjoyed listening to this particular module. Keep watching more videos coming your way.


Welcome to George H. Smith's Excursions into Libertarian Thought, a production of Libertarianism.org and the Cato Institute. Ernst Kassir on Fascism and National Socialism The philosopher and historian Ernst Kassir was born in 1874 into a family of Polish Jews. After studying at various German universities, he went on to write numerous important works on science, philosophy, and history, including his magnum opus, the philosophy of symbolic forms in three volumes, and the philosophy of the Enlightenment, which remains one of the best overviews of Enlightenment thought ever written. After being introduced to the ideas of Immanuel Kant by the brilliant sociologist George Zimmel, Kassir went on to become a defender of the neocontianism of the Marburg School. When Hitler came to power in Germany in 1933, Kassir vacated his teaching position at the University of Hamburg and moved to Sweden. Later, fearing that Jews would be unsafe in that country, he moved to England and taught at Oxford for two years. Then beginning in 1941, Kassir taught at Yale and lastly at Columbia University, New York City, until his death in 1945. Kassir was a classic liberal in the German tradition of Kant, Goethe, and Wilhelm von Humboldt. In contrast to English liberalism and its stress on economic freedom and politics, German liberals focused more on the cultural aspects and benefits of a free society. Individuality, moral autonomy, and cultural diversity were dominant and reoccurring themes in German liberalism. Until his last work, The Myth of the State, Kassir wrote very little on political subjects. He began writing this book in 1944, after being commissioned by Fortune magazine to write an article on National Socialism or Nazism. Kassir expanded this article into a book, finishing it in 1945, just days before his death in April of that year. As Edward Skidelsky said of The Myth of the State, The origins of Nazism are sought not in the barracks and beer cellars of Munich and Vienna, but in the works of Machiavelli, Hegel, Carlisle, and Arthur de Gobineau. I shall not discuss the intellectual antecedents of National Socialism until my next essay. Here I shall focus on Kassir's application of his theory of mythological thinking to modern totalitarianism. Kassir had a keen interest in the natural and social role of myths. Indeed, the second volume of the philosophy of symbolic forms is titled, Mythical Thought. I shall quote liberally from the final chapter of The Myth of the State, The Technique of the Modern Political Myths, in this summary of Kassir's views. As we shall see, Kassir's ideas not only applied of fascism or to Nazism, but more broadly to totalitarian governments in general. According to Kassir, after World War I, Germany's whole social and economic system was threatened with a complete collapse. This was the natural soil upon which the political myths could grow up, and in which they found ample nourishment. Mythological thinking reaches its full force when man has to face an unusual and dangerous situation. This is as true in modern civilizations and advanced stages of man's political life, as it was in earlier, more primitive societies. In politics, we are always living on volcanic soil. We must be prepared for abrupt convulsions and eruptions. In all critical moments in man's social life, the rational forces that resist the rise of the old mythical conceptions are no longer sure of themselves. In these moments, the time for myth has come again, for myth has not been really vanquished and subjugated. It is always there, lurking in the dark and awaiting its hour and opportunity. The hour comes as soon as the other binding forces of man's social life, for one reason or another, lose their strength and are no longer able to combat the demonic mythical powers. Mythological thinking, according to Kassir, is the personification of collective wishes, and when this collective desire reaches a fever pitch, and when rational solutions appear hopeless, people typically look for a solution in the form of a strong political leader with mystical power and authority whose will is supreme law. But those civilized man shares the same violent passions as members of a savage tribe and is liable to yield to the same irrational impulses, civilized man cannot entirely forget the demand of rationality. In order to believe, he must find some reasons for his belief. He must form a theory, and this theory, at least, is not primitive. It is, on the contrary, highly sophisticated. In contrast to the myths generated spontaneously in primitive communities, modern political myths are made according to plan. The new political myths do not grow up freely. They are not wild fruits of an exuberant imagination. They are artificial things fabricated by very skillful and cunning artisans. It has been reserved for the 20th century, our own great technical age, to develop a new technique of myth. Henceforth, myths can be manufactured in the same sense and according to the same methods as any other modern weapon, as machine guns or airplanes. That is a new thing. And a thing of crucial importance. It has changed the whole form of our social life. It was in 1933 that the political world began to worry somewhat about Germany's rearmament and its possible international repercussions. As a matter of fact, this rearmament had begun many years before, but had passed almost unnoticed. The real rearmament began with the origin and rise of the political myths. The later military rearmament was only an accessory after the fact. The fact was an accomplished fact long before. The military rearmament was only the necessary consequence of the mental rearmament brought about by the political myths. The first step in the creation of modern political myths has been to change the function of language. Language may be used either to convey objective information, which is its semantic function, or it may be used to evoke strong emotions with the intention of controlling human behavior. The latter, which Kassir called the magical function of language, bears an eerie resemblance to what we now call politically correct language. Additionally, under totalitarian governments in which there is no private sphere independent of political life, the whole life of man is suddenly inundated by a high tide of new rituals. They are as regular, as rigorous, and inexorable as those rituals that we find in primitive societies. To neglect the performance of these rituals is far more than a sin of omission. It is a crime against the majesty of the leader and the totalitarian state.  Political rituals, argued Kassir, lull asleep all our active forces, our power of judgment and critical discernment, and take away our feeling of personality and individual responsibility. Moreover, when a society is inundated with rituals, we typically find collective responsibility in place of individual responsibility. Rousseau was wrong when he depicted man in a primitive state of nature as free and unconstrained. In fact, his behavior was severely constrained by rituals and his responsibility to his clan or other group. We might hope that modern man has transcended these constraints, but that is not the case. When exposed to the same forces, he can easily be thrown back to a state of complete acquiescence. He no longer questions his environment, he accepts it as a matter of course. Here are men in Germany, men of education and intelligence, honest and upright men, who suddenly give up the highest human privilege. They have ceased to be free and personal agents. Performing the same prescribed rites, they begin to feel, to think, and to speak in the same way. Their gestures are lively and violent, yet this is but an artificial, a sham life. In fact, they are moved by an external force. They act like marionettes in a puppet show, and they do not even know that the strings of this show and of a man's whole individual and social life are henceforward pulled by the political leaders. Unlike the attempts of traditional governments to compel or to prohibit certain types of actions, modern totalitarian governments attempted to control how men think by inculcating political myths. These political myths acted in the same way as a serpent that tried to paralyze its victims before attacking them. Men fell victims to them without any serious resistance. They were vanquished and subdued before they had realized what actually happened. Modern totalitarian states suppress and destroy the very sense of freedom, but at the same time, they relieve men from all personal responsibility. Kassir continued, Our modern politicians know very well that great masses are much more easily moved by the force of imagination than by sheer physical force, and they have made ample use of this knowledge. The politician becomes a sort of public fortune teller. Prophecy is an essential element in the new technique of rulership. The most improbable, or even impossible, promises are made. The millennium is predicted over and over again. As Kassir saw the matter, Nazi ideology was not a natural or inevitable outgrowth of German culture, which had a long and distinguished tradition of liberalism. This is not to say that Kassir was oblivious to the irrationalism and statism preached by various German philosophers, far from it, as he said about Hegel, But it was the tragic fate of Hegel that he unconsciously unchained the most irrational powers that have ever appeared in man's social and political life. No other philosophical system has done so much for the preparation of fascism and imperialism as Hegel's doctrine of the state. This divine idea as it exists on earth. In spite of this, however, Kassir maintained that Nazi ideology was a regression to a mythological or pre-rational way of thinking. Hegel and other status philosophers did not bring about Nazism directly. Rather, their ideas had a corrosive effect that prevented rational thinking about individual rights and politics from regaining the ground it had lost. This has been Excursions into Libertarian Thought, a production of Libertarianism.org and the Cato Institute. To learn more about Libertarian philosophy and history, visit www.libertarianism.org.