talk to you about hacking train tickets in the UK. They're a bit different from train tickets in the Netherlands. You have chip cart. We don't. We have magnetic stripe things that look like this. I have quite a lot. So that's what we're talking about here. Who am I? So I'm a site reliability engineer at Worth. We have a Dutch office and a Reading office. I do lots of hackathons and stuff. I still have come to MCH 2022 in here from the EMF slide deck. Obviously, we're all here at MCH 2022, so I should remove that. And I also like design systems. So the things that you see, particularly around NS, they have a really strong design system. We don't have that in the UK. It's a bit rubbish. Everything looks a bit weird on the railway network. So why are we talking about hacking train tickets? So back in 2016, it was a long time ago, I read this article about people that were forging rail tickets. And I thought that was kind of interesting. If you can make your own rail ticket, season tickets are expensive in the UK. It's maybe 5,000 pounds, 8,000 euro, for a yearly season ticket. That's not uncommon. So if you can make your own, that's quite interesting. And if you can write the mag stripe, that's even more interesting. But it turns out that's not what they're doing. They were just printing the thermal prints on the front. So they would take it, put it through a thermal printer, Photoshop, nice. It won't go through a barrier. And that's not so exciting. So how do we write the mag stripe? Well, we can FOI transport for London, who have lots of gate lines and are a public authority. So you can use the Freedom of Information Act and ask them what's on the mag stripe, what's the specification. But they didn't want to say, because they felt people might copy them, which, in fairness, is fairly reasonable. So we have to work it out ourselves. So the agenda for today. We will do a bit of history, just because I spent a long time in the National Archives working at how all this worked. We'll have a little look at the data layout and how you actually read one of these. It's not quite so simple. And what we're doing about digital ticketing in the UK, because we don't do chip cart, as I said. Sadly, we don't do chip cart. Maybe we will in the future. But how do we do that currently? And then we'll talk about some conclusions, I guess. So these are laws in the UK. If you're going to do this, please read them, because they are relevant. And you don't want to end up getting in prison. Things like writing your own mag stripe and putting it through a barrier is apparently not legal. So I don't know. I'm not a lawyer. This talk isn't comprehensive. It's my own opinion. Please don't see me. So the history. If you don't know about the UK railways, it's all a bit weird. We had private companies. Then we had public companies. Then we have privatization again. And now that's all gone wrong, so they're nationalizing it again. We're sort of looking in the periods between 1948 to 1994, which is when these tickets were sort of designed back in the 70s. That's where the magnetic stripe comes from, the 1970s. It hasn't changed. And that's really part of the problem. Before the 1960s, before British Rail, we had these.  But the station would just have like a massive rack of them and they would pick one off. There's no accounting. Accounting is done manually in a ledger. They write it down, which tickets they sold. It's not great. They were still using this in the 60s, even when there was some computerization. And it became a bit of a problem. So what they did do was they made it look different. They redesigned it. They didn't change anything else. So we went into the late 60s, early 70s, using tickets that were completely untraceable. The only method of security was they collected them back at the end. So if you kept your ticket, you could have another ride, which wasn't so great. And this actually continued well into the 80s, because as we'll see, the computerization was not quite so simple as they thought. But we did start to get some computerization in the 60s and 70s. So they started to look a bit like this. So these are printed by computers. They are mechanical computers, though. So they're printing very limited information, and they are doing some sort of tallying. So they collect some information about what ticket they sold, where it was sold, that kind of stuff. And then it still goes into manual ledger reporting, gets sent off to an office. They work out how much money they've made, all that kind of stuff. Still not great. And one of the real problems here was that everyone was using a different system. So you can see two types here. We have another two types here, all of them different. These all come from a ticketing manual, by the way. It's quite thick. They had to have an entire manual to tell people how to read the tickets, because there were so many of them. And we have even more here. So a huge number of tickets, huge number of systems that kind of dealt with them. And they were all going a bit wrong. By the time we got to the 80s, these machines, they were mechanical. Some of them were sort of electromechanical as well, but they were not doing so well. They were starting to fall apart. The manufacturers didn't want to support them. So the British Rail, as it was then, the train company, wanted to sort that out. So they came up with a list of all their printers they had. As you can see, quite a lot of different printing machines, quite a lot of different companies. Well, I guess four companies. And quite a lot of machines. They managed to introduce computers in other parts of the rail network, so managing the trains that ran around and all that kind of stuff. But they hadn't managed to do it for ticketing. Ticketing was still too much of a problem. So British Rail decided to do something about this. And they started an experiment. And it's called Intis, intermediate ticket issuing system. No one really knows a huge amount about this. There isn't very much about it in the archives. But some of the tickets do still exist. So they look like this. And these are fairly similar to the tickets that we have today, like this. And this is back in the 70s. It hasn't changed. The really interesting slash important thing is the code at the top right, 8355. That's called a national location code. This is a database of locations, obviously. It also includes other weird edge cases, but it is essentially a list of offices, so places that could issue tickets. And they all had a full digit code. And you can see this ticket is printed in 1984, apparently. It does have a manual here. So you can tell what everything is. Again, this comes from the ticketing manual. But this was just a piece of cart. It had no mag stripe on it. All it had was what was printed on the front. They did have a central audit functionality that they were trying out. They had a computer that was printing this, not a very advanced one, and it had a tape deck. The tape deck would get pulled out. It would get posted off, that kind of thing. It was apparently unreliable. They didn't like it. What they wanted to be able to do was have computers in all the offices. They would all talk to a central mainframe, because that was cool in the 70s and 80s. And they would not have to deal with posting tape cartridges all over the place. So they made a few hundred of these as an experiment. It was not a particularly mainstream thing. But they then decided, we have all these different ticket machines. We have all these different specifications. So surely what we need is, yeah, another one. So they made Aptis. So Aptis is the all-purpose ticket issuing system. It also has a portable version, because why not? We won't talk too much about that, because I don't actually think they made very many of them. They weren't very portable. Electronics in the 70s weren't portable. Yeah, that didn't go quite so well. So Aptis was supposed to do pretty much everything. So they would be able to take the ticket machine, put it in the ticket office. It would issue pretty much everything they sold, which was quite a lot. So you have to remember at the time, the railway company was like, they did a lot of transportation. Not just people, but also ships, also goods, also selling you food and drink, also selling you car parking tickets, all that kind of stuff.  So this was actually quite a big undertaking. And they were using their knowledge from the previous experiments to try and do this properly. Not have to go back to having 50 different machines across the regions that no one understood. No one could maintain and didn't work. They really wanted auditing as well. So this is the specimen ticket for an Aptis ticket. It looks pretty much like this because it is the same specification. And this dates from the, I think this document is 1986. So, oh, it does say 1986, nice. So it's the ticket that people in the UK will recognize today. If you go to a station, you buy a ticket, you'll get one that prints out a bit like this. It won't say British Rail because the government got rid of that, but it will have all of this information on it and it will have the double arrow at the bottom. There's a comparison for you. They are pretty much the same. They also printed them in different colors because why not? And these denote different things. So Network Southeast was like a particular division and this is what you would get things like a season ticket on. You can see on the back, it does have the mag stripe on this one. We'll talk a bit about that in a minute and also like the reference number. So 4599 is the BR reference. On the back of these, it will tell you it's RSP 9599, but they are the same ticket. The future requirements was the really interesting bit. So they developed this computer system called Aptis. They made a few of them, but they had some things they wanted to be able to do. So they wanted to be able to take credit cards. So they wanted the machine to phone up the credit card company like American Express and check, do they have enough money to buy the ticket? And they also wanted to do that for checks because back in the 80s, we used checks. The 7.1.3 is issuing London Underground tickets, UIC. So being able to take your ticket, go through the barrier on the London Underground and go out the other side of London. If you've ever been on the British Railways, you'll know that most things start and end in London.  And the top one, 7.1.1, was the ability to magnetically encode these tickets. And it's really interesting to think about why they actually wanted to do this because that's quite an expensive thing to do back in the 80s. You have to have the computer processing. You have to have the hardware. Mag stripe is not hugely common. It's on credit cards and stuff and on tape decks, but single-use tickets, that's quite expensive. And they saw it very much as a anti-fraud thing. Not in the sense that people wouldn't know what was written on it, but more in the sense that at that time, people were getting personal computers and personal computers come with printers. And printers can be used to print these sorts of tickets. They also thought that people might... They could use different colors on the tickets, like different color ribbons, because it wasn't thermally printed, apparently. It was a ribbon stamping through the ribbon onto the ticket. So they thought they could use different colors as well. But the main thing was just to check that it doesn't have a mag stripe on the back, because they figured people wouldn't be able to make those tickets, that they certainly wouldn't be able to write them, and that might go some way to reducing fraud. And they wanted to have these handheld verifiers as well, so you could... Someone on the train, they put it in, and it would verify the mag stripe. I don't believe that ever has existed. No one has ever bothered doing that, only at the gate line, when you get to the station. It wasn't the only reason, though. So they realized that... I know this is quite small, so you can not bother to read it. They realized that the London Underground thing was going to be a bit of a problem. So London Underground, at the time, were introducing big gate lines, and they wanted to make sure London Underground being a separate department, I guess, that people were using modern tickets. They would develop a mag stripe ticket, and it would go through the London Underground barriers. But that's all completely separate to the National Network. But the National Network still needs to use London Underground to get people across London from one terminal to another. Everything starts and ends in London. So they had to discuss with London Underground and come to some agreement. And they actually managed to get to London Underground to pay for the entire implementation of the mag stripe on these tickets. So all the software changes, they had to have a memory, they had to add the mag stripe encoder on the printer, all that kind of stuff. And they managed to get the other company to pay for it, which I think is kind of amazing that they did, but just so that people could use their tickets to cross London, I guess that's really quite important. So we come to the specification. So this is from National Archives, and this tells us actually really quite a lot of information that isn't necessarily known. I'm afraid it's imperial inches, because 1970s, 1980s. The really interesting thing about this is the data content that it tells us.  So there's some space for the cock to check that it's aligned with the data. And we have a forward direction and reverse direction and a check sum. So that's actually really, really interesting information when you're trying to actually understand what's on one of these. And the encoding density encoding standard is fairly standard, but the actual layout, how many people have a Magstripe writer that can read that, right? It's not on the edge, it's in the middle, London Underground Standard. As you can see, it has a 0.3 inch nominal track width, again, not massively standard. So very non-standard ticket, very interesting data content. So how do we read it? Well, first, we visualize the data layout. So we have a payload in the middle, the check sum I mentioned, and then the footer at the end. And some example data. So this is the interpretation of the document you just saw.  So you can put it in two ways. The machine can tell. Actually quite an important feature. So as I say, reading and writing, how do we do that? So you can't use one of these. Well, apparently you can. I'm told that people have made this work with some nasty hacks, but you can't just chop it off and stick it through a standard card reader. It just doesn't work. They're designed to read ISO standard cards, like your credit cards. They're not designed to read weird Magstripes from the 1970s. It just ain't going to work. There is this really interesting talk from, I think, about 2005, which talks about making your own with Magstripe reader with a microphone input. So you get a read head, you plug it in, you stick it through audacity or something, and out comes the data that you're looking for. You don't get a clock. In that sense, you don't get the bits that you see, so you get no clock. But this was used, I think, on the New York metro network to have a look at their Magstripe data, and it did work. But that was 2005, and I'm not sure I can be bothered with that. So I went and did some Googling. And this is the ND4020 ticket printer. It is made by Newbury Data, and it prints tickets. It also encodes them. And this is also available in eBay, quite readily, as it seems, for a hundred quid. So for a hundred quid, you can buy your own Magstripe reader, writer, it can read, it can write. It can even be extended with a massive hopper, so you can print lots of tickets. It's really quite a versatile piece of kit. And this is what it looks like. I have one of them here. This is the main board. It's a fairly standard, like, machine of its era. It's not particularly powerful. And unfortunately, the ROM is soldered, so you can't pull it off and have a look without breaking stuff, which I didn't want to do, because I wanted to use the transport mechanism that's inside it. It's a very well-made machine, by the way. So I took it along to the hackerspace, and we plugged it into the oscilloscope and put some voltages through it and tried to get it to talk on the serial, which was actually really quite difficult. There's no documentation for this thing. It's not designed to be sold to the public. You're not supposed to have it. As I say, it's readily available in eBay, but you're not supposed to have it, so there's no drivers. But you can eventually get it to talk serial. So at the bottom, you can see it's giving its version number, which is some kind of software version on the machine. So we have serial. So we can then talk to it. And it has this menu system in it. You can see the start dates around 2009. It's a Mark 2.1. And you can go through all of this. So it's got loads of cool stuff, like being able to set the clock, being able to read all of its registers. I'm sure really useful information. And the really interesting thing on this is being able to just write stuff into different registers. This is designed to be a printer. It's designed to interface with other software. So it's not designed for random people who don't have the drivers to just show up and tell it which bit of the memory you would like to write. But you could dump the entire memory location, which gives you all of the data that's in there, which is kind of interesting until I accidentally overwrote it, but I guess we can OCR it. But we don't know what any of this means. You can, I did try and have a look at what all the hexes, it doesn't seem to be anything particularly readable, unfortunately. So what we did try and do was put some random stuff through the execution. So you can execute a script on this. You can tell it, I want to execute a memory location. I want to print something. Unfortunately, that resulted in the entire thing crashing. It didn't like that because I guess we did not give it a valid function. We didn't write valid data. So I did some Googling, and the way this probably works with something called Pectab, it's a kind of markup language for airline tickets and stuff, they have some templates, they fill it with some data, they load it into the machine, and they execute it, as I say. I don't have any of that software, I don't know how any of it works. I did try and decompile some stuff, but again, it's not really very readily available. So the alternative approach is to make the machine think that you're just putting a ticket through and take the data raw off the Magstripe bus. So it's a 12-volt system, so you can just feed the motors here with 12 volts and stick a ticket in that end, and it will just run the transport mechanism when you have it turned on the right way. If you turn it on minus 12 volts, it will go the other way back. And that means that you can then get some data out because as you can see, we have some patch leads into the Magstripe reader output, and as long as it's connected to the main board, and you get the main board to the correct voltage, so it starts, it will do some magical stuff to initialize this daughter board in here, which has the reader, and you get data, which looks a bit like this. So that is looking kind of useful. We can see at the top we have the clock, at the bottom we have data, but again, how do we get that off in the oscilloscope? The oscilloscope is not very useful for 192 bits of Magstripe data. There is something called the screen capture for the Rigel scopes. It does work quite well, it gives you this, a massive CSV of voltages, but that's actually really quite difficult to interpret. What you're looking for is to align the rising edge of a clock with the rising edge of a data byte, and then the falling edge of a clock with the falling edge of a data byte. Actually quite difficult to do, and you end up with data that looks like this. It does not look like the data that we expect is not 192 bits, and it definitely doesn't really have any pattern to it. It's fairly random. This was also the point where I accidentally misread at the back of the machine, the ticket printer, and put 240 volts AC into the 24 volts DC. So it went bang quite loudly. Made a lot of magic smoke. But luckily as I say, these are readily available on eBay, so no, you can buy another one, which was the one I was holding up a minute ago. And do it again. So this one does actually have ROMs that you can take off. It's a slightly older one. It has bodge wires on the back, so I guess they're fairly low volume. And with a bit of faffing around with the microbyte at CircuitPython, literally all it does is it just checks for rising and falling edges. It's just much easier to do it on an embedded device than with a CSV of screen capture data from the scope. You can actually get data that looks about right. So this is ticket data from a random ticket that I put through. You can see that we have the coxsync bikes. We have a start forward indicator, 1001, and the reverse we have zeroes and four ones. Nice, looks good. So what I did is I put a load of travel cards through it. So a travel card is like a type of ticket in the UK. So I put them through, and you can see they kind of align, right? So we're obviously getting valid data now. You can see where stuff has gone wrong. That's, I know, the code on that is not particularly great. Sometimes it goes a bit too slow, bit too fast. Yeah, sometimes you get bad reads. But you can remove those. You can identify them fairly easily. And then you can start doing some comparisons. So here you can see, at the very bottom, we have two tickets from so Reading to Hook, they're like towns in the UK, and Hook to Readings. And you can see that one of those strings, those substrings, this is truncated obviously, is repeated in the data. It's not repeated anywhere else in that string. But that looks kind of like a start and an end. Like where I would start my journey, where I would end my journey. So presumably the Reading, that means Reading, and it's transposed there to say you're coming back. Because it's a return ticket. They're two separate tickets. And you can see here, again, we have, this is a different ticket here from Oxford. It's a return. And again, you can see in the return field that the Reading part is again set similarly. So it looks like we can actually read data. And it looks like it is actually valid data. Which is really good, because these are really difficult ticket stories, as I mentioned. And again, the inverse is true. So what do these bytes actually mean? So on the left, on the far right, you can see the national location codes for those stations. So three, one, four, nine, some zeros is Reading, et cetera. Those are the substrings extracted from some tickets. I don't quite know how they map. I think they map in some sort of proprietary way. But we will work that out at some point in the future. And when you look at this on a sort of bigger scale, looking across the whole data, you can definitely start to see patterns. I don't think this comes out very well, but the green block is all set to zeros, and the red block is some valid data for the type of ticket that they are. When you sort of start to look at this across tens, hundreds, thousands of tickets, it's actually really easy to start seeing the patterns here. And it is probably possible to reverse an engineering quite a lot of exactly what this data does. So what did I learn by doing this? This is not encrypted. It is raw data, which isn't surprising from the era. They didn't really do encryption, and there wasn't really a huge need for it. But there is this checksum. So as I mentioned at the end, there is a checksum for data validity purposes. We don't know how to calculate that. It's not public. I guess if you get enough tickets, you can work out how to do that. But it's not something that currently is public, or particularly public knowledge. As I say, pattern matching is really, really doable when you start getting a huge number of these tickets. And you could start to actually, as I say, probably reverse engineer what is going on. The ticket printers should not be on eBay. I think that they are fairly controlled items. I don't quite know how they're ending up on eBay. But when you have one of these, it is possible to just use it to write these really obscure tickets. You can just get one, read it, and write the data to another. And if you know, say, something like a season ticket, which is valid for a year, you could duplicate that on one of these. Fairly easily. It's not difficult. You don't need to know what the data is to duplicate one of those. So I don't think these should be ending up so easily on eBay, because it would make duplicating tickets really quite not difficult at all. Of course, you can't change the data without knowing how to recalculate the checksum. But that's not always a requirement. And yes, 24 volts DCN does not mean mains voltage. That causes bad things. So what can you do next with this? So if you get loads of data, you could do a better job of reverse engineering it. I did this in a couple of weeks before EMF. And then after EMF, I did planning for MCH. So I haven't really done anything else with this. The thing like the data clock alignment is a bit of a problem. It's a bit sketchy. It sits in random bytes every so often, because it's not really very advanced. Things like blast and faster, they're used for bioinformatics. They can definitely be used to align some of these strings, and particularly substrings. So when you're searching 2,000 rows of data, you should be able to use those tools if you can work out how to load the data into it in the first place, pretending it's like DNA. You should be able to use those to speed this up a bit. Dumping the ROMs is something that's on my list to do. It'll be really interesting to see the software that's on this and how exactly it's supposed to work. Again, there's no documentation for it. And writing these tickets. As I say, you can use these to write the tickets. I haven't done it yet, but it should be pretty easy. It has the hardware there. You just need to reverse the process of reading it. I have like five seconds left. So things like ISO, Itso, and eTicket are the supposed replacement for these. Itso has its own problems. eTicket, again, has several other issues with it. We currently don't have a replacement. The government has not decided on anything to do about this. They are still issuing orange tickets, orange credit card, Magstripe tickets. And they will continue to do so for the foreseeable future. As we can see, they are not particularly secure. And it's really quite easy to read and potentially write them now. The specification for these, I am told, floats around on the internet. So it is kind of public knowledge now. Yeah, I think this is probably a bad thing. I think someone should probably do something about it. Because these are common in circulation in the UK. You use an orange ticket for pretty much every journey. And they are now really, really quite easy and out of date. And yeah, I think that's pretty much it. Thank you. Unfortunately, there's no time left for a Q&A, a public Q&A here. If you have questions about this amazing talk by Hugh, you can look him up outside of the tent after this talk. Once again, give it up for Hugh. Thank you.


So, here number seven is coming up here then, Yarnis Karoje is off the inside gate, Artem Laguta going off gate number two, a winner first time out, then it's Charles Wright two points in his opening ride off the outside is Niels Christian Everson, right of course the wild card Yeah, real fairytale story for Charles. Yeah, and a good start, you know two points from his first ride he kept his composure, he'll be really relieved about that and there's no question that he'll be looking forward to his next ride Gate three is not ideal Right, here we go, wow! Wow, it's not from Laguta, he's magnificent and Wright's just snuck through into second spot right now it's a nice ride from Charles Wright can he block the challenge here and Niels Christian Everson Everson comes around the outside nice ride and Everson has got a lot to speed, it has to be said here can he make it camp, which way will he try he tries the inside run now, he looks a little bit quicker than Laguta he looks good, he's over now he looks good Nigel Laguta, he's sharp away from gate two it's a super start from here Everson coming on strong in second place got the better of Charles Wright Cologne J's woes continue he's tailed up at the back, but Artem Laguta desperate for points looking good out in front Everson working overtime, running wide right from the inside the British champion comes charging in the second place and Everson responds really good opportunity to move there from Charles Wright Yeah, well it was clever coming out of the second turn there as well because he held his line into win for Artem Laguta but Charles Wright's in great Britain he's on four points from two rides Brilliant, brilliant he can make the semi scale he can indeed, Charles Wright look at him punching the air come out Charles, that's better he's having the time of his life he was in the right place at the right time though we're seeing Laguta, but here Charles Wright is raising the roof for the lap of honour we're not seeing it, but believe you me there he goes Charles Wright, the hero of his second outing Everson running too wide, getting himself in a bit of a pickle and Wright pounced and got up the inside came through and picked up another two points he's well and truly in this Grand Prix


Towards Building Inclusive Digital Communities. ITU's Self-Assessment and Toolkit for ICT Accessibility Implementation. Digital accessibility is the key to achieve inclusive communities in which everyone can equally benefit from the facilities provided by the information and communication technologies, ICTs. To support member states and stakeholders' understanding of ICT digital accessibility requirements, ITU developed Towards Building Inclusive Digital Communities, a toolkit and self-assessment for ICT accessibility implementation and monitoring. Upon completion of the self-assessment questionnaire, which will take approximately 15 minutes, respondents will obtain an immediate overview of the level of ICT accessibility implementation in their country or organization. Tailored guidelines to support the development of appropriate policies and strategies to advance digital accessibility implementation. Monitoring and evaluation of digital accessibility implementation by enabling repetition of self-assessment after each progress to track results. The toolkit comprises a PDF file and an interactive document that enables to complete the self-assessment questionnaire, which includes seven sections with multiple choice in the following topics. Law and regulation, political buy-in, standards as references, public procurement, training, monitoring, e-government. Each topic has a scale of one to five, where one will indicate the absence of a plan or action for each item or question and five will indicate that the action has already been fully implemented. One, no. Two, starting, about to start. Three, implementation in progress, up to 50%. Four, about to be completed, above 50%. Five, yes. After completing the questionnaires based on the answers, respondents will receive immediate expert advice and tailor-made recommendations, including guidelines and best practices for consideration. Respondents will also be able to print the entire question index and print the results roadmap. In the score section, the respondents can revise the degree of compliance in each one of the sections according to the five phases of implementation. By clicking on the print button, the respondent can get a printed version of these indicators. We invite all member states to complete yearly this assessment and share their results within the ITU to jointly follow the global monitoring of ICT accessibility implementation. We are confident that the ITU toolkit and interactive self-assessment will support all member states and stakeholders to transform the dream of building inclusive digital communities into a reality. Together, through collaboration, cooperation, coordination, and commitment, we can make it happen. For more information on the ITU toolkit and interactive self-assessment, as well as other useful resources, please visit our ITU accessibility resource website. www.itu.int.


What's going on everybody, my name is John Hammond and welcome back to some more MITRE CTF. The competition is about to end. I spent the last like five hours just recording these videos so that's why I've been like swagging out in the bathrobe, hoping that's cool. I'm gonna tackle Web 150, which I believe is the last thing I can cover here that I have solved. I don't know if the game will remain open or if the challenges will remain accessible but I wanted to share what I could and I'm really looking forward to these write-ups for stuff that I didn't solve because the forensics one is fascinating, the QVR code is really cool, I want to look at the binary stuff, etc, etc. So this challenge is called My First Blog. The description is I wish Canonical would release a blog platform to make everything so easy to use and just works. So this is my blog. So it's just a spot for me to talk about how much I love Canonical. I love Canonical. As someone who's getting started with Linux, I love Canonical. They build the easiest to use Linux distribution I can find, they build so many useful tools. I've tried out Juju, Bizarre, Ubuntu, Launchpad, and learning PHP. I recently learned about PHP and I can't stop switching everything over to it. In fact, the blog is now powered completely by PHP, I think. I changed the file extension at least and added a little PHP coding below here that should pretty much do it. I have the PHP code commented out though since I can't seem to get it to work. So we could try, and I had done this for a while, just try to go to index.php or php2 or php3, etc. It looks like it's just not going to respond because there's nothing there, that makes sense. So I tried robots.txt, you know, you're low-hanging fruit for regular web challenge. I tried, if that will ever turn me down, cool, I tried .git, etc. And I didn't get anything with that, but it got me thinking about this and this is after lots and lots of testing of brute forcing, different file extensions of running derbuster, running gobuster, running derb, of anything I could get my hands on it. It felt like I didn't have a foothold here, so I just kept staring at it, kept staring at the challenge prompts, and I kept seeing canonical.  And why did I have these references to Bizarre, Ubuntu, Launchpad, and stuff? So I tried to Google some of these. I tried to say, like, is it juju? What is that? OK, that's not what I wanted. What is Bizarre? I know it's a version control system. They're yelling at GitHub, so what? Why? Does normally it's there's a web challenge where there's a publicly accessible .git directory, and that way you could you could download and work with it. So I was like, what the heck is why is Launchpad in there? Why is canonical in there? Why is Bizarre in there? So I tried to Google a little bit more about Bizarre and. OK, Bizarre, how about Launchpad? Yeah, that gives me a little bit more information. OK, great. That's probably why I was talking all the stuff about canonical, because if I actually Google Bizarre canonical. You'll be pointed in the right direction. It's a version control system. And if you go to check it out, you can find that it is very, very similar to. Here's the user guide. OK, cool. I want to get the documentation. I want to learn all about it because maybe maybe this is what I should be looking for. Are there files that are being left as artifacts on on the website that I could just be able to read and work with? So I actually tried it to work with with Bizarre. I went up, went ahead and installed it. It was BZR. So you can pseudo, let me go open up. Sorry, pseudo apt install BZR. And then that would let you work with it. I'm on Ubuntu, whatever distro or package manager that you need. But I went into my temp directory and I created something with BZR. I had, I don't know if it's still there. Probably in a reboot killed it. Yeah. I created Bizarre a directory and then I went into it and I try to use BZR init. So for the longest time, I was like, what else is in this? What does it do? Does it have anything like it does? And it does. It has a dot BZR. So I said, let's take a look at what that is. Is that in there? Is that accessible? Is that a thing? Really anti-climactic with the lag. But yeah, OK, forbidden. That's totally a file. We're just not allowed to access it. So for the longest time, for like four or five probably, OK, not four or five hours, but maybe one or two hours. I was like, what do I do? What else can I find in here? Can I check? Can I check the read be? What are what are these files that I can access? And that would load. I'd be able to work with it. I could check out the branch form out. I could check out repository. I started to read through a lot of these things. So grep, tach, or anything just to see what kind of information and files might be accessible. Like Durstate looks like something that I could read and that would be able to like grab things out of if you wanted to check out in Durstate, etc. Because what I wanted to do in all in all ultimatum, what I wanted to do was to use something like Git tools, internet wages, Git tools, because that has a script and I've used it many times before. You've probably seen me cover it. It has a Git dumper. So given a URL that has a publicly accessible .git directory, it could just download and work through all those files. It just pulled them down. And I thought, well, I don't know if there's a thing like that for bizarre. I kept googling for it. I kept trying to find it. I couldn't track it down. So I thought, well, do I just have to figure out how these pack files and objects merge together? How does that work? So I would try to in my bizarre file. And this is this is all tangential. This is not the way to get the fly right now is super easy. But I just wanted to explain to you my mindset because a lot of people tell me they like hearing about that for some reason or like, how did you solve that problem? What made you what brought you to that conclusion? Whatever. So let's just touch a file. Let's say file and let's go ahead and get at it. I'm sorry, BZR at it. Wow. BZR, that file. Cool. And then we could BZR commit. Cool. And that's fine. Anything as our like message and then we can BZR log and we can see it there. We have a revno and I'm assuming that is a revision number. A lot like kind of a shaw one hash or the commit ID messages that get would have. So peculiar, right? I thought now let's take a look at the internals. Now let's move into the dot BZR file and see what else is here that I didn't have before. Now I have some packed files that I would have been able to work with or find. So I'm curious where would I be able to determine these things? I wanted to see is this pack name available literally anywhere? So I would try and like run find and then while read line to determine all the files that I could look at. I would try and run strings on that line and I would do done and then I would try and grep for that string to be able just to determine it. But it didn't seem to be anywhere. Even what looked to be the dur state when I downloaded this earlier. This hash looks similar but it's not the same. So I couldn't track down where that pack file was. Me as a human being, like me as a person I could not do it. And then my roommate Caleb, well it's a tiger best dude in the world.  Why are we trying to correlate how this can be pieced and puzzled together when bizarre obviously knows how to do it? Is there a way to like get clone and bizarre? And then we got to that notion where yes, it absolutely is possible. You can run bzr branch given a location and if we just gave it the URL here or this actual address, it will try and look at it as if it were repository because it is because the dot bzr file is there and it just needs a directory to put it all in. So let's just say files. So now it downloads it, moves into files and there is our index.php. If you wanted to you could busy our log, see what we're looking with and these are all things you could have found in the internals if had you just like requested that file in the web browser but because we're able to use this with bizarre we can download the file, work with it as if it's a real repository because it is. So now let's cat index.php and there is the flag. So cool, right? I don't have time to cover at least I don't know if I'll have time to cover to solve or even continue to work on web 200 but from what I understand if you pull that one down actually I can't I don't know I'm not gonna I'm not gonna bleed that topic and concept that challenge into this video I don't want to do that but this is the flag for this challenge you could submit that and for the second one it's the exact same thing where you have the blogging platform with a little bit more repository information. There are a lot more revision numbers and stuff to look through and it goes into some bitcoin addresses and I have yet to solve it don't know if I'll be able to I don't know if the challenges are going to remain up and available but I thought that was very cool because I'd never worked with bizarre before I had no idea what I was doing and I was just trying to put the puzzle pieces together and it took some cool insight and epiphany to be like why can't I just download it why can't I why can't bizarre do what I am trying to do and it can I just need to learn how so hope you guys enjoyed this one hope it was fun there's that flag you can go ahead and jot it down submit it save this knowledge for later tuck it away in your brain and thanks for watching hope you enjoy these if you did like this video please do like comment and subscribe I'd love to see you in the discord server there's a link in the description it's a cool party place full of CTF players programmers and hackers you can hang out with me and some other cool people that are super duper smart we'll we'll tackle some capture the flag competitions in the voice chat and it's just a party it's the party place to be so come on and jam it's the space jam I'd love to see you on Patreon I'd love to see you on PayPal I am so grateful for all of your support and what you do to help keep this afloat keep me going keep this channel going so thank you love love you guys I love you I love you I love you I love you gonna end the video now it's getting weird


How's it going everyone Caleb here with late and sports cards next night? We have 2022 select baseball Six box break number 18 pick your team stuff or excuse me random team style. Thanks again for joining and good luck The results are linked in the chat. Let's get it going Honestly no Lane I'm working late tonight sleeping in late tomorrow and There's a couple of customers that are expecting me to be at the shop at like two o'clock So I'm gonna be coming in pretty early tomorrow So I will be busy in the morning Sorry Lane It's gonna be Starting out here to 99 on the patch try color read Debmer's silver aeronado Nice. Good luck finding it Shane. Yeah, that's the cool part about the national. It's just taking in the experience honestly Silver Jake McCarthy Diamond level lime green Louisa Ria's to 99 Just taking it all in Red Devin Williams there to 199 if I wasn't doing anything. Yes, but I'll be here early Silver Jake Myers It's gonna be number 299 on the auto Lopez rookie patch auto. Nice Jake Myers to 199 spark signatures Astros the Jake Myers It's a wonder there on the phenomenon Well, good luck finding the chain Cracked ice to 25 a Jalexie to 25 Try color Austin Hayes with Merrifield by the numbers You're absolutely rolling in the fab hits Joshua. It's gonna be a zebra Justin Verlander Awesome card. There you go. Astros Nice one silver Joey Vado You go on the zebra very cool SSP not numbered case. It's Roanzee contraris on the patch to 250 Try color Pablo Lopez in flago one soda. Here we go. He might get 20 wins this season. Yeah To 299 on the Mario Feliciano patch autograph brewers sparks Carrera Ray excuse me to 99 and the ebonyas 99 Try color Josiah Gray selvi Perez John Haseley not numbered patch and a silver in Fuego Vladigrero, Jr. Nice silver in Fuego Go Silver Tyrone Taylor red to 199 Jair Doran nice one Red Sox Jair Doran Silver Sonny Gray number 299 Reed Detmer's silver rookie patch auto solid Fuego Soto Spencer Strider on the patch Braves and another wander Striders having a good year Try color Ken Griffey, Jr. with Merrifield by the numbers. I'm green to 99 Xander Silver Verlander Fox number three of the break. Here we go red to 199 Ryan McMahon Red silver Shane Bieber Brandon Mars to 250 on the rookie silver patch Nice guys were down to four left on the prism basketball tiered random team style full case for to go Link in the chat there try color Yastremsky White Miguel Rojas to 50 white Luis Gonzalez patch autograph to 25 There you go Giants nice Marrera Ryan Valade to 99 rookie patch auto try color you go Piazza Say blue Mike trout nice one there to 149 concourse level you Darvish try color Nick Gordon silver patch to 250 Silver Acuna Junior select stars Silver Jesse Winker diamond level Silver Willie Stargill the Phillies are just destroying the Marlins. I think I jinxed them earlier Sean. Yeah, I think I did Here we go. Good luck. They're just getting pounded right now 90 never a good feeling in baseball tough to come back from that. He's your Sanchez try color Marlins speaking of Resnare on the patch not numbered Padres silver Brian Reynolds Phenomenons red Pina Lanzo to 199 Polar Bear Silver diamond level Yati Molina Nice one max three to 250 on the silver patch Braves Adam Wayne right try color go fax. What's up Mike? Good to see you man Got a white 90 Matthews to 50.  How you doing as They hit another home run. Oh Man, yeah, he's been crushing it to 99 moonshots autograph Raffae Devers nice one Rafael Devers. There you go Red Sox Nice one on the auto to 99 Moonshots auto Brian De La Cruz Marlin silver patch auto to 199 nice rookie patch auto Solid box here couple to go Silver Luis Castillo And judge there to 149 Very solid box. We'll take that one Excellent up here. So are the Marlins still the team that you root for as you wear a Red Sox shirt, but yeah Gotcha Your mon Burkett's there to 199 red. Oh, that's gonna be a lightning strike silver. You're not over as Very cool on the lightning strike. There you go. Nice one Houston crush the break silver. Gary Sanchez. You got the Verlander and you got the yard on both case hits there Selvy Perez to 149 grass astro is there you go Nice one for you James G. Try color Joe Adele Carrera spike or Korea spikes Eli Morgan this time guardians patch Silver by the numbers of Nolan Ryan number to 99 Josiah Gray rookie patch auto nationals Lou Bob Redemption, come on one Soto signatures. Hello.  That is sick. I Did he turn down some huge dollars today or recently silver rookie patch entree Jackson at 250 I did crazy amount of money Almost a half a billion dollars He said nope Connor Siebold Shry color wander in Fuego. Nope and not stoke Larry Walker this time tie-dye two of 20 Did though toke I did It's crazy Silver Ichiro Silver kind of wall nuts man. What do you think about that toke? What do you think he's gonna go? Feels like one of those Yankee type situations where you know 448 million or something Something foolish on literally almost half a billion Yeah, why do you pass to 199 on the sparks auto? I think he wants to win. Yeah Think you're right like something just absolutely foolish It's like 40 million a year India to 99 lime green Yeah, I hear you try color sunny gray punch I Gave you're saying so it's just crazy 15 years as well. Yeah, I gave you're saying silver Yelich.  I mean, that's true though the length is kind of wacky 15 years is a lot and you've been intending to 199 surprise they offered him such a Long contract to 250 Brian De La Cruz silver patch. It's true Mike. That's true Mike bombing to 99 try color patch. I'll say a break you silver moon shots. Yeah, that's kind of what I was getting that lean It's kind of what I was getting at as well.  I hope and pray he doesn't like it injured in the home run derby man I would that would just be oh my goodness silver Luke Williams Something just like freak like that, you know Mm-hmm to 299 Patrick Mazzica rookie patch auto and an infliggo O'Neill cruise that'll do it guys. I'm sewer recap here The hits. Thanks again so much for joining Appreciate All right, so we had that Patrick Mazzica One you pass your side gray Brian to the cruise Raphael Devers nice one the late Louis Gonzalez to 25 Giants read debt mers Mario Mario Feliciano Jake Myers and Otto Lopez and the redemption wants so Congrats Nats. There you go. Thanks everyone. Astros also did very well had a couple of SSPs including a Zebra Justin Verlander appreciate it. We'll be on to the next one shortly


We'll talk about it. So I assume that you're using something like ES6 or something like that, right? You use transpilers. How many of you just write JavaScript without transpilers? And you still enjoy it? It's hard to enjoy JavaScript. No, I tried it, seriously, but no, that doesn't work. So my name is Wagmi, I am heading a small consulting company called Tharka Labs. We do web and mobile development. So I have, I mean, I write a lot of JavaScript and I've been using ESX a lot these days. Before that I did a little bit of coffee script and anything that would not let me write JavaScript but still write JavaScript, I would take that actually. So my journey into functional programming languages came through Lisp, actually. So I started off with Scheme very early on and then I did Common Lisp and then I discovered Closure and so on and so forth and finally I discovered that, you know what, even if you have to write JavaScript, you don't have to write JavaScript, actually. So thanks to transpilers and so on and so forth. So my journey with functional programming properly started with, I would say Closure and Closure script, actually. Now the thing that I liked really about Closure and Closure script is that it was on the JVM. I mean, I was a Java programmer so all the libraries were just interop away or they had excellent wrappers over everything and they also had Closure script after a while and the best thing that ever happened to Closure script was David Nolan, actually. So he created OM and I think this, Bodil had given a talk called developing for the browser in the post FRP world as if there was some sort of an apocalyptic thing. But that is very true because after OM came in, it kind of gave this perspective of how you could use functional programming and immutable data structures and still have very, I mean, very well-reasoned user interface very well. And from that point on, I started discovering more languages like that. I actually had a brief sojourn with Elm as well and then Elm is very nice. But at the same time, Elm is, what do you say, I mean, it's still evolving and it's very opinionated on the kind of things that you can do with its type system and so on and so forth. It is pretty nice. And then I discovered PureScript, which is far more stricter, far more, what do you say, elegant form of functional, strongly type functional programming language targeting the browser. So usually as programmers, the first thing you do when you do that is you write Hello World or Hello PureScript. Now the trouble with writing Hello World in languages like Haskell is that there is this thing called the IOMONAD or this has a side effect. So just to clarify, how many of you actually, I mean, have done functional programming or understand it well, a few?  Like for example, you can't say, I mean, in JavaScript, you can say var a equals five, and then you can change your mind and say var a equals six, or you can really change your mind and say var a equals hello, right? I mean, you could not only change the value, but completely change the type and the representation of the whole variable. In functional programming languages in general, that is generally frowned upon, right? So you do not, although closure supports it, you can actually rebind vars and so on and so forth. In Haskell and other languages, it is not possible actually to do that. So the same is with pure script and languages like that. The idea is that you don't want to have side effects in your code. So whenever you execute a piece of code, you want to be, I mean, it needs to have a defined input, and as long as it has a defined input, it should always have a defined output, right? Now, but I mean, given the state of where the world is, it is not always possible, right? Because you want to be able to print things to the screen or go out and fetch, you know, stuff from the internet, from a web service, or actually make changes to the world around you. And that's the whole point of writing these programs. So if you're only doing purely functional programming languages without any side effects, all you would see is the box getting hot, as Simon Peter just says. There won't be any other thing. And that would be the only side effect of it. So the idea of functional programming languages like Haskell and pure script and MLSS, to separate the purely functional bits from the bits where you are mutating things or where you are changing things, or where it has side effects. Now, that's why you have a module here, and you have this main function, and the main function just says log, hello pure script, right? And it just writes it to the log, but you have to see the do block in there. So do block basically says that, hey, this main function is going to have a side effect. And the kind of side effect that it's going to have is something that prints to the console, actually. So I just put it out there, we will see what side effects are, we will see what pure functions are and so on and so forth. But I just wanted to say that that is in essence the difference between imperative programming languages and functional programming languages, is the insistence on purity. Just a little bit about pure script, it was created by this guy called Phil Freeman. It was very hard to find a photo of this guy actually. So yeah, I just stole it from his Twitter thing, he's a class that you want on Twitter and GitHub. So the thing is that I think given all the other Haskell-ish compile to JavaScript things out there like Faye, like GHC.js and all this, I think pure script is much better and much cleaner implementation of such programming languages than anything else. And I mean, like I said, I already mentioned I do a lot of JavaScript, I also do mobile. So in my day-to-day thing, I don't use pure script, I would like to use Haskell, but I don't use Haskell. So whatever I say, please take it with a grain of salt and other things. So I don't have like the production, you know, war marks in my chest or whatever, right? So that Tanmay is going to speak next, he's going to talk from 34 graphs. So he's going to say what happens when you put Haskell in production. But yeah, that's about all the slides I had actually. So we'll jump to code, I think. So let me know if you're able to see this. Most of it pink and all that, but anyway, so let me do one thing. Let me just change it to a white background. Maybe it'll look a little better than. It's okay, it's workable, so let's not worry too much about it. So when you start off a pure script project, there is this thing called pulp. That's what you want to start with, actually. So it's a npm thing, you can just install npm install hyphen gpulp and you'll get it. So all that is there in the documentation, I would just want to skip to that. So let me create a new directory. So you create a pure script project just like that. It's going to get a whole bunch of things and put it in there. Now, the way pure script is organized is that it uses bower. That's one of the other things I like about the pure script community is that it doesn't like to reinvent its tool. Like for example, Elm has its own Elm package manager. I mean, every single language has its own package manager. But these guys start, you know, you have a perfectly good package manager called bower that's just sitting around. Let me just use that, actually. So they're also very pragmatic, so let me just. So this is the main file that we saw.  So this is even worse. I think it is better, right, slightly and the wrong directory. So is this better? Lightly, I suppose. So let's start doing run this. So the way you run this is you say pulp run and it's going to run this, right? And it's going to say hello, sailor. And let's look at the output it produces. So by default, it is going to output it in a common JS format. So you can actually have this built and check it into NPM if you want, actually. That's pretty cool. So you can see that it is there. So let's try adding a few functions onto this and let's see what happens. And it also comes with a raffle, actually. So you can run that with pulse PSCI. PSC is the compiler, PSCI is the, it's like just PSC and GSI from Haskell. So here you can ask for various things. You can say one plus two, it gives you the, it doesn't automatically import Prelude, after you have imported Prelude, then it'll, Prelude is the one which has all the standard functions that it comes, right? So the whole thing about Pioscript is it's types. So usually it has a few primitive types. Integer is one, it has one for floats. It's just number. You can do strings, and you can also do arrays. So it says that it's an array of integers. So usually JavaScript will allow you to do this. But here it'll say that you cannot unify, I'm sorry. Of course, it says that you can't unify int and a string. That's because it expects all the values in an array to be homogeneous, actually. It also has a record types. So you could do that person equals. So then, so these are just records. So it also supports the standard JavaScript way of building these. But then they automatically get strongly typed or associated with that. And then you can define functions the same way. So you can say square x equals x star x.  Let me write it here. So let me declare the function here and use it there. What's wrong? It takes two ints and returns another int. Maybe it was not able to recognize that it's an int. I'm sorry. So two of them are, sorry. So you can say square of five and one second. I think I messed up my Apple pretty well. So yeah, so I mean, so here actually has a particular type, which takes a int and then it returns an int, actually. So if you see the implementation of this, so let me also do code output. So I didn't build it. Let me put this here. Yeah, something weird is happening. I'm pretty sure it worked before the, so okay. So the one thing that I wanted to show you is when you did a built, it actually built in the rest of the functions. When you optimize it, it'll only look for the functions that you need. Say for example, you only got the logs, actually. And we had the square function that was there. So it basically exports it and then it exports the particular values from the module, actually. So as you, even if you have other dependencies on your project, like for example, if you add a lens library or some other library, it'll make sure that it'll only get the libraries that you're interested in, actually. So let's start dealing with records a little bit. Yes, it did, actually. So it has a watcher as well. So you can say, this will keep watching the directory and then it'll keep running it. So ideally speaking, it should, I'm not sure why it's looking for patterns, src, star, star, star.js. It should be looking for your script files. So, PULP build should automatically find out that it is looking for the main module and it should build it, actually. But it is not. But however, if I give hyphen o, it finds out the mail module and then it's compiling it. For some reason, I think it's a small bug that we've run into for some reason, actually. So let's start writing a small listing here. So we're going to do a bunch of records. So we already saw how we do this. So we could say type person is actually, so we'll keep it simple here. Let's go include it in PSCI. So when I have this person, right? So I could do things like, and I could say this is a person, m.person, okay? But the thing is that, and I would also be able to say a.firstname and a.lastname, but I would not be able to just say, because it'll say that there is no instance found for prelude show main person. That means that there are type classes in PureScript. So think of type classes as interfaces in Java or protocols in Closure, where it says that you need to satisfy certain methods before it can do this. Now in the console, when you're doing this, I mean in the grapple, when you're doing this, to display a value, it expects it to have the show class implemented. So let's go ahead and implement the class. The thing is that now this is called a synonym type, in the sense that, say for example, this type is the same as a record. So PureScript does not allow you to have, I mean to do show classes or implement classes on synonym types, right? Because that will create ambiguity. So instead what it does, you have to do is you have to say this is a new type and give it a type constructor. Then what you can do is you can then say you can implement an instance of it. And when you are getting it, you just can't have the person object directly. But you have to understand that this is a, I mean we have a constructor on this. So you have to say a person of P and then you can then say, so now we should be able to show the person. So let me do this again. So here now I can, so doing this, I can do this, m dot person. Like I said, I already have a, so it won't let me do that. So now it actually displays the name, otherwise it wouldn't react. So if we have to update a particular name, then again we will have to set the change name. So you can take an object and you can then say, you can take an object and say new person and hence you could say, so the type of this method would be change name, colon, colon. So here this is the way in which you change the value in your record. So you take the record and then you change whatever value that you have to do and then do this. So what this does is it creates a new record from that and since we are using the type constructor, I mean, which is person, it will create a new person class and then return it from this. So let's see if that works.  So you have a and then say, so this changes. So this is the only way you can do changes in a record, right? I mean, so every time you have to make a change, so you always have to make sure that you make this change in place and then you have to do this. Now imagine if it's a deeply nested data structure. So let's do a couple of more iterations on this. Then things will become a little interesting. So I'm also going to have a new type called address and I'm gonna have a simple city and let me also add a bunch of phone numbers. So this guy would also have, so he also has an address in place with this. And so, for example, now let's also do one more thing. So you would have come across enums, actually. So in pure script and Haskell, the way you do enums is called the abstract data type, actually. So here you could do, say for example, you could have home, mobile, right? So this is sort of, I mean, it's not a simple enum where it's just these type constructors, so it could also be specialized on value, home of A or home of B or so on and so forth, actually. So we're gonna use this as well. So he's going to have a bunch of phone numbers as well, something like that. So let's see how we construct such an object. I'm gonna say a person who has addresses, I'm from Chennai, so state team, it's not yet there, so. And then we'll have some phone type is going to be used. So we'll fix the show appropriately. So as we know here, we only have, when we show the person, we are only showing the person in the last name. We want to show the other things as well. So we'll have to have the instance classes for those. We'll do the same thing for the phone as well. So I'm just going to see if the show method is working on this. If not, we may have to set up a show class for this as well. So now we can say, we definitely have a better way of doing this. But I'm just doing this for the sake of simplicity here. 13, Mr. Kama, I have a comma here. It says between home and here it should. Phone type needs show method on that. So one of the neat things about this thing is that you can do pattern matching. So you can simply say, what do we call it? M dot a person. So this basically shows that he's the first and last and lives here and so on and so forth. So the thing that we have to notice here is that when we implemented the show method here, we actually directly did a pattern matching on the constructor itself. So we can do pattern matching on the value, actually. So that is one really cool thing about languages like this is that you can actually do both partial and full pattern matching on this. So the famous example that's shown is like, yes. It will be an in exhaustive match and so it should complain, actually. No, it doesn't, actually. But it will bomb, actually. So let's do that. So I think instead of commenting this out, let's comment the home thing out. I know Haskell gives an error, but it doesn't check for, it bombs at runtime. Should definitely be a bug, should definitely be a bug. I mean, whenever you have these pattern matching things, it should be exhaustive. Especially on an ADT, it's actually quite trivial to find out what the data types are going to be on this one. That's a good guess. So now imagine if you have to change. So we did this change name, right? Now imagine if I have to write a function which is actually going to change the number that's there, right? Now that is going to be a pretty hard change function to write, if you have to write it like this, actually. So before this, let me, I actually wanted to show you this thing. So you could do, I need to get pure script list. Since it uses Bower, it takes it from the cached things, interesting. So it should have a, it has a constructor with an array, please don't do it. One of the things that I wanted to show is that here, it actually returns a maybe type even for a head, actually. So some things they've gotten, right? Like for example, head on Haskell would actually return the thing. And if you give an empty list for a head in Haskell, it would just bomb at runtime, actually. So, but some of those things here have been fixed. So it actually returns a maybe even on a head of a list, actually. So some of the things, but usually, you don't want to use list because list is very slow. Array actually maps onto the direct JavaScript array. And so it's usually faster, actually. Well, get to the constructor. It should, the cons should just work, actually. Yeah, so this would be, sorry, I think there is an empty list, there's an empty list. But yeah, I'll get to this later. The empty list is supposed to be, I mean, you could just cons on it and just get an empty list, but yeah, there's something wrong. I'm sorry about that. So anyway, coming back to this. Now, if you have to change this, it's going to get really difficult really quickly. So one of the ways in which you do these things is Lenset in your script, where you can actually go into a particular data structure and then replace it and then return back the original value. So I have a, I knew that I would get it wrong when I do it on there. So I spent the last half an hour writing one. So let me probably skip to the repo that I have for this. Now, this is a very similar sort of structure where you have the person and the address and so on and so forth. The way this works is that the PureScript Lens Library allows you to define accessors for a particular structure in your code. Like, for example, here, I've done this for the first name, right? The first is to destructure on the person data type and actually have a lens which reaches out to the actual function and take it. It's very similar to the Lens package in Haskell. Have you, has anybody done Lens packages in Haskell? Edward, you've done that. Okay, so it's very similar to that. But again, there are a few minor changes in that in a sense that the standard SDAB type signature still applies. But you have to be very explicit about defining a lens for a here, this thing here. Even though you say this person actually takes this record as of this thing, even you declare your lens, you have to specify it again for the type system to understand it. But your standard lens operators still apply. So let me keep it quick. So I have a bargaining with my thing here, just like how I had earlier. So in order to apply a lens, so this is a person and you can get the first name. So this should, right? So this will basically reach into it and get the first name. The advantage with this approach is that you could also do changes. So you can lift over this value and I think the operator is. I think I need to get the setter actually. I keep forgetting the, I'm not sure why they could just call it set. That would have been easier than these symbols actually. So you could also set in this. The advantage with this thing is however nested your data structure is, right? I mean, you can actually construct these lenses to that particular area. And then you can either set or get objects and it will return the whole person object as such actually. So that's pretty cool, I mean, it's, I mean, a lot of people come to Haskell and say, okay, they have these records and all these kind of things. And whenever you have to do mutability, it becomes a, or when you want to simulate mutability, it becomes a problem. So with this sort of thing, the simulating mutability is not that big of an issue actually. So going back, so let me give you some of the other things that are nice in the language. So you would have all done, right? I mean, JavaScript, Ajax calls, right? And you want to serialize Ajax calls one after the other. So the way you do it in JavaScript is you do promises. So you say this, and then you do a then, and then you give that, and so on and so forth, right? In a language like pure script, you don't have to do that. Or in a sense, there's a lot of syntax sugar that lets you go beyond that. Say for example, there's this thing called the effect monad, and you have a way of lifting the effects one after the other, so that you can actually do something like this. So before we do this, so let me start the server. Let me show you how this works.  So here what we are doing is we have a simple call to do localhost 3000 slash help, and after we get the result, we actually want to log its response, which actually would give back a result. So this, in fact, this would give back a result, which will then be passed to the long function, which will then have an effect where we will actually lift the effect. So lifting the effect is as good as committing that operation, it will wait for the effect to complete, and then it would do the next effect, actually. So it basically serializes these two values. In fact, you could do something with REST one again. So even though it looks like we are actually doing this, so lift F, so I can print that response out again. So for people who have done the bind operator, so what do does is that it actually is a syntactic sugar over multiple nested callbacks. So the REST one basically gets this, the result of it then gets passed to this, the result of it gets passed to this, and so on and so forth, actually. But because of that, it forms this bunch of closures where the variable REST one is still available here. Although it looks like a linear flow, like an imperative program, you just say, a equals b, or a equals one, b equals two, yeah, big deal, a will still be available after you have set b to two. But if you understand how the monadic bind works and how the syntactic sugar works, it is actually pretty cool that the effects that you have on top are still available when you have, when you have committed the other effects and they are still available in scope for you to do interesting things. So let me just, so it gets this help, and then it gets the list, and then it actually prints out the help response again, actually. The response value is still available after the call gets done. So let me talk a little bit about the server. It's an ExpressJS server that is being run, and it also has static middleware. So if you go to localhost 3000, I have a public facing site. I mean, React app, we'll get to the React app shortly. But if you go to, so this is what is getting displayed, actually. So let's quickly find out how this can be done. So Pioscript is not just an academic language. It can actually be used to do both client-side and server-side. So my earlier idea was to live code this, but then after I coded this, I decided that's not going to be possible, actually, to do it. So but let's start from the main function. It's usually easier from there, actually. So you can do multiple levels of foreign function interface in Pioscript, actually. Now the default way of doing FFI is that you do a, so you write a standard JS file, actually. And then this should be in common JS modules spec. And you should name the module the same as the module that you're going to do that. You need to, this commit is sort of important, actually, for the Pioscript compiler. And then you have to stick whatever functions you want into the exports of that. After which, you write a Pioscript wrapper for it. And then you do a foreign import. And if you see here, it is not a standard function, right? I mean, it's not like a Pioscript function where you could carry these values and so on and so forth. This is a function which actually, in fact, a special type called fn3, because it takes in three parameters. All the middlewares take three parameters where you have the request response on the next in this thing. So you take these three parameters. And that's how you do it. So if you want to turn this function again into a carryable sort of function, then you have a data.function package where you can do a run fm3. And then you can turn it into a carryable value, where it actually wraps this particular function into three different functions, where it passes the first value. And then it turns the lambda out, and then passes the second value, and so on and so forth. So that's how it works. Now the other way to do, I mean, that obviously sucks, right? I mean, when I started doing it, I actually wanted to do a React Native PureScript demo. And I just got lost in writing FFIs, and I gave it up, actually. So it uses too much FFIs that you have to write to do those things, actually. Instead, what I'm using here is something called as an easy FFI. It's a library on this. It's kind of cheating. Like, for example, so think of it this way. So I have an array of to-dos, actually. So this is our database. And then I create a, say for example, if I have to add something to it, I know that PureScript's array is actually JavaScript array, actually. So what I do is, the add function basically takes in to-dos, to-do, and an empty value. And I just do a to-dos.push to-do, and then it gives the index, and I just do a minus one and show it. So this is actually JavaScript code that runs for the to-do function. So if you notice here, it is actually all, but all these foreign functions have an effect on it, actually. So there is nothing which is pure, because it actually mutates the value of a variable in there. So in the similar sense, we have an unsafe foreign function, which actually gets the value from process.env.port or 3000. And the result of it is going to be an effect, which is going to be a string that's going to get lifted, and that's going to be in the port now, actually. And then we then set up the app on the port, actually. Now the app setup is pretty much the same thing that you would be familiar with in this thing. So all you have to do is you use certain middlewares, you map routes to handlers, and then on error, you do some error handling. So let's look at a couple of them. So the easiest thing is, of course, the help handler that we saw. It has a particular structure like this, and it just displays them into JSON, actually. So now we are going to actually turn a pure script record into JSON, and then give it up. So the way this works, so let's go to help handler. So the help object is a very simple record.  So it looks like a JavaScript object, but it's actually a pure script record. And then you have the sendJSON. So sendJSON method is a part of this thing, Node Express app, so that knows how to do sendJSON, which is essentially JSON of that particular value. It just stringifies the thing and sends it. And that's pretty much what you have to do to actually write a sort of web service in your script, actually. Get the object. It could be the result of a computation, and you can lift it from a monad as well, and then send the value out, actually. So that is how the slash help method works. So let's go to the list method, which is an empty object at the moment. So here, in help, we didn't have to lift an effect. So whatever was the variable, we just did a sendJSON on that, actually. But in this thing, so the handler can also be a monad of this type. So what this does is it actually does get to do with indices.  And it's just a FFI again. So this is like, I mean, of course, your type guarantees with pure script are lost. But say if you're on a deadline like me, and you have to prepare for a talk and show that and still work, you could do something like this and get away with it. So of course, you could do the same thing with actual pure script records and do it properly. But here, what I did was I basically did a to-do-start map on it, and then this returns. But the fun part about it is it is an effect, actually. Since it is an effect, you can lift the effect into an actual object, which will turn it into the default value, so which is actually array of index to-do, actually. So index to-do is the type that we have declared on top, which basically says ID, description is done on whatever. So it turns it into an array of index to-do. And then it does a send handler. And then it does a send j on it, actually. And that's what you see as an empty array. So I have an included body parser here. So that's why I said get query param. But it is quite simple to include body parser. And then you can do get body param instead of get query param. So you can either deal with it as JSON or as URL encoded form data. So here, this would be slash ph. So this says that it's created. It's ID is 0. So if you go to list again, then it should have value. So let's look at what happens there. Again, we have an add to-do function, which basically has a to-dos. And then it has a record onto it. Again, as you would have expected by now, I showed the add to-dos function, which is a completely unsafe function. I mean, you're not supposed to write your script functions like this. Anyway. So you add to that, you push it. And then when you push it, you get the count of how many items are there in an array. So you just do minus 1 and 2. So that's pretty much what the delete set done, pretty much all of them are very similar sounding things. So that's all it is to create a web app with this thing. I will show you a couple of interesting things that happen here. One thing is when I go to the actual URL, it actually renders index HTML, which comes through the public middleware of that, actually. And also, if you see here, I'm also logging these things here. So whatever URL is visited, I'm logging them, actually. So let's look at how the middleware is done. So in fact, in the setup app, we say useLogger, and you do these things. So let's go to the logger function. So logger is just a handler. So it gets the original URL. This is the standard, this thing from Express App, the PureScript Express Library. And then it actually lifts an effect where it actually renders the URL, and it calls the next. So both the get your original URL and next are from the PureScript Express Library.  So that's pretty much it. You can write your own. And I also, like I said, I use the static middleware. So this is a middleware that's entirely defined in PureScript itself. The other one is to, if you want to use middleware that exists in JavaScript or standard Express middlewares, you can just export it as a function, get it in via an FFI here. And then instead of saying use, you just say use external. And then point it to the FFI function, actually, middleware that you have. So I think it is quite usable now. I mean, you can actually start using PureScript to build server-side apps pretty easily. And hopefully, you would have time to do a much better job than to just do an unsafe foreign function and do everything that way, actually. So that's, I mean, I meant it as a whirlwind tour of different things. So I wanted to show one more thing, actually. I wanted to show that you can also do pretty decent UI with it. How many of you have worked with ClosureScript and GNOME here? Good. I mean, ClosureScript and GNOME, and Elm, anybody? Nobody in Elm, actually. So Elm had this idea called StartApp. StartApp basically said that any purely functional UI is going to have these three things. It's going to have a state. It's going to have action or a bunch of actions which take it from state to state. And then it's going to have a render function. And that's it. Those are the three things. So Elm also works the same way.  And then it keeps rendering it as you move the state. Although the action is not very explicit there. It's just an atom which keeps changing over time, actually. So in the same way, in PureScript, you have the lower level React where you can actually create class and do things and so on and so forth. But usually when you are writing or when you would like to write React applications in PureScript, you might want to use a library called Thermite, actually. So Thermite does pretty much the same thing. It has this concept of initial state. And then it has a way in which you perform an action or make the state go from or have a way to mutate the state in a managed way. And then you can then have the render method, which actually takes the state and renders it as such into the DOM. So let me start with the main method here, which is usually the thing here. So the main method actually creates a spec. I mean, takes the spec from here. And it creates a component out of that. Now this is the way when you use React, you would have to do a, even if you do this, I think you would have to do a factory of that particular class and then create a factory and pass it to it. Otherwise, if you're using JSX, if you just use the angle brackets, it gets turned into a factory, actually. And then you just render it to the body. Now body here is a method for me, right?  But we are in the managed PureScript world. Window may be available, document may be available, and you may have a body on it, right? So you can't just do that. So the way we do it is you actually go to DOM, ask for window, maybe it'll have a window. If you have a window, then you ask for the document on it. Maybe it'll have a document, and so on and so forth. Now actually this returns either object. So either is like saying whether it is successful or failure. So left is usually failure and right is successful. So you convert it to a maybe, and then you do unsafe just on it. I mean, so maybe type has these two options. It says maybe it has a value, or it has nothing, actually. So here, again, I am living on the edge, so I should actually do a pattern match and do it, or you can actually bind to it and still get that. Otherwise, you'll get nothing. But instead, what I'm doing here is I'm doing a fromjust, which will actually, I mean, I'm always expecting it to have some value. If not, it'll bomb on the client side, actually. From there, I just, I mean, this is just a help of function because the render method expects element and not a HTML element. So you have to turn HTML element to element. So it's just two libraries in the DOM thing which actually changes. So it's just a type help of that.  So the r.render method is the reacts render method, which actually gets called. Now, our render method is very simple. So you get the context, actually. This is the same as the context that you get in Ohm's context. So you have a global coordinator of sorts that actually says, OK, where these components are, and what the tree is, and all that. So that is the context here. And then you have the state that's here. So state is something that we define, actually. So it's a type that we have. And it has just one thing right now. It just has a counter of an integer. I have three actions, increment, decrement, and reset. And I have an initial state where I set it to 0, actually. And then I also have one function which takes a particular action, takes an existing state, and returns a new state, actually. Just like how we did with earlier functions and lenses. But this just uses the standard function, because I only have one thing. I could have used lenses, and it would be easier here. So this basically takes a state. And if it's incremented, incremented, decremented, decremented, with reset, I just return the initial state as such and render it. Now the render method actually has, so if you notice for some of these, I have used underscores. The reason you use underscores is sometimes you don't care about what the particular types are. Like for example, one could be props, and another one is the context of the sender here. If you aren't sure about it, or if you don't care about it, you can actually put underscores. And your switch compiler will figure it out and bring it on its own. So here you have these things where this is just like OM, where you have a node, its attributes, and the children, actually. They're all in an array. But it also has these special prime values, where it directly takes children, and it doesn't expect attributes on it, actually. So that's the only difference. So here you construct the DOM, as you would construct it in OM or a similar library. And then you set up properties on it, where you say when it's on click, then you basically have a lambda where you apply the action to the context, actually. So here it's increment, decrement, or reset. I mean, you could have other values, like for example, if it has on click, the on click would actually give you an event object here. So if you want to do something special with the event object, then you can actually lift its effects from there, and then also do things from there. So those things would also work. So let me quickly show you how it works, like standard things. So I actually wanted to build a full to-do MVC, both the server side and the client side bits. But as I said, I got stuck with a lot of the FFI issues, so I kind of left it in between. And so I have a React app. I have a small demo, which does the HTTP calls and all that. I also have the HTTP calls, so theoretically it's still possible to integrate, but yeah, when I find the time. So in fact, this is kind of a whirlwind tour of what Pure Script is capable of. I knew I kind of went a little fast. But if you have any questions or other things, we can take it up now, and then we can kind of discuss if you want to hack on something else on this thing. We can also do that. Any questions? Most of the cases, yes. There are Pure Script D3 libraries available. But it's still pretty new. Like for example, the new FFI. I mean, earlier the way you did FFI before 0.7, so 0.7 got released recently. In 0.6 till 0.6, the way you did FFIs were you used to write these JavaScript functions as strings within code, actually.  And then you would say colon, colon, and then have the type on it, actually, which is very weird and very difficult to do it. Now that it has been separated out, I think there'll be a lot more FFI libraries coming up. It's a fairly new language, but definitely it's worth giving an eye on, because this brings a kind of rigor to JavaScript that usually does not, the JavaScript is not known for. And also, I think this is the best shot at having a strongly-tight language both on the server and the client, actually. I know GHS, JS, and FAI and other things are there. But I think Pure Script may be the, I mean, I would say there's enough community support behind it. I think Pure Script would be a clear winner in that space. So exactly, precisely the point. You can only use monads when the types are lined up, actually. And that's exactly what it does. So where did it go? So let's look at the type of this function, right? So as long as the first type, I mean, as long as the type is the effect, it will be the same, actually. So let's inspect the type on this, and it will be slightly clearer. I won't say a whole lot clearer, but so this type could be a little hard to read. So the thing is that it is of type exception Ajax, right? So as long as it's of type F, it's OK, actually. And you don't have to line it up. So as you put the stuff in, I mean, so we have lifted the effects of logs. So you're not seeing that, actually. But if you had done that, it will actually say effect this exception Ajax console log, actually, all the three of them. So for example, so here it will say the effect does not line up. So the effect is console log here, but the other one is the control monad act effect, actually. So which is a different monad, so the types don't line up when you just say log on it. That's the reason why we are lifting the effect on it, so that the type's line up properly. Any other questions? If not, I'm around. I'm easy to find. Thanks, guys.


How many Koreans do you make in Islam? Actually, I didn't make a lot of men. How many? Okay, I'll do it again. Assalamu alaikum. Hello, I'm Dauduki. As you know, Korea is not very friendly to Muslims. But there is still Islam and there are people who want to spread this beautiful message of this religion. And of course, our religious leader, Imam, is one of them. Then what does Imam living in Korea do? What's their job? I was curious about this, so I came to hear Ansan musted to know about this. Then, shall we go together? Let's go. Is this not your bike? Assalamu alaikum. Assalamu alaikum. Nice bike. Yes, yes. Motorcycle? Yes, it looks like motorcycle. I have one and another one. We are going to Lestran now. Pakistan Lestran? Yeah. Suddenly, some people came to us and asked me about why did you become a Muslim? So, we replied them. Daud already made his Korean brothers and sisters. Nice to meet you. Do you believe in Muhammad? Yes. No, Muhammad is a prophet. As an angel. Assalamu alaikum. Assalamu alaikum. Is Ansan okay? No. Wait. This is your office? Yes. Hello. Yes, I'm here. Where is the camera? Camera? Yes. So many Korean, Korean and... Oh, he is studying Korean culture. Maybe he wants to be a Korean. I studied this. Oh, I know him. He is a Korean Muslim who lived in Malaysia. I know. You want to recommend me some books to study? Yes. Some books to study. Okay. So, you are Imam in Ansan Masjid, right? Yes. When did you come to Ansan? I came to Ansan in February 2014. Wow, this is a long time ago. What are you doing here? What's your job? Actually, I'm an Imam. Yes. And Khatib. Khatib? Yes. Also, Islamic missionary. What's it called in Arabic? Da'i. How many Koreans you made to Islam? Actually, I didn't make Allah. Allah made... Okay, I'll again. Shahada actually maybe over 250. Wow. That's really a lot. Your daily routine is focused on worship. At first? At first, leading the worship. And second is Dawah activity. Because I'm always waiting for the non-Muslim Korean. So, I'm waiting every day here. So, you can ask how Koreans come to you. Social activities. Facebook, Twitter, Snapchat. Yes, I saw your fights too. You're very famous, right? Yes. They come to us and they visit. They have many questions. As my possibility has a nice way. Nice. So, I never anger them. I never challenge them. Of course. So, he's waiting for Koreans who want to enter Islam every day. And like this, he helps over 250 people to embrace Islam. Mashallah. Time. Okay. Also, apply. No problem. I can do it. You can apply here. Take time. No problem. He always waits for people in here. He waits for Muslims who want to pray. And he waits for Koreans who are interested in Islam. Mashallah. It is really great work. And he spent a lot of time for Allah's around to Allah. I can't see much of the city. So, I think if you climb this mountain road, then I think I can watch the masjid where. Looks so beautiful road. Let's go. So, if we go upstairs, we can see the masjid where. This place is for eat. They pray in here. Yes. Very big place. Over 2500 people. I think I should come here. Why not? Because from far and many long time people come here. Lord, I'm calling. I need your help. In Russia, I took help. Otherwise, 1, 2, 3, 4, 5 languages. So, you write yourself? Yes. You speak two languages? Yes, yes. Nobody help. Not Google. You should be genius in Korea. To become Imam in Korea, you should be genius. This is the need of the masjid, you know? Yes, that's true. Is this your home? Yes. Why do you have this? For my baby. Oh, you have baby? Where are your baby? Massa? Hello. I'm sorry. What should I do? Hello. Hello. Oh, I miss you so much. Wow, you look same. How are you? Hello. Assalamualaikum. Are you baby? Why you cry? You have two son. Oh. You success. Already success in your life. Are you hungry? No. Your wife made mango dash put. That's Pallangatangla dash biryani? Yes. This is Pulao. Pulao? Not biryani. Biryani is mixed with rice. Ah, okay. Okay, let's eat. Very baby delicious. Really because you are hungry. My baby. Where your wife is good cook? Yeah, really good cook. Mmm, it's really good. Really? I think your wife have to make restaurant. Really? Better than restaurant. We are together. It's so delicious. You are telling this for your visitor? Are really delicious? No, no, no. If it's not delicious then... Oh, it's good. What? Really delicious. Because you are actor. Actor. What do you want to be like when you grow up? Imam? Really? You want to be Imam? No. Bad, bad papa. Bad papa. Oh, okay. I'm so sad for you. So, how was today? Oh, it was great day. And we are handsome people. We are so happy for Daoud came. And we want to see you again. We want you every week in our mosque. Of course, I will come every week. Oh, thank you. Thank you. So, do you have any last sentence to audience? For two audience just I want to say. But I want to say from this thousand Muslims that we love you, Daoud. And we will love you. And our love to you will be continued even after date in Jannah. Oh, yes, in Jannah. Yes. Okay, so the video is over. And I checked what Imam living in Korea do. And it was so impressed. He's helping Muslims to pray every day five times. And made a lot of efforts to Dawah in Korea. And it was so helpful to Koreans. I'm so proud and happy for him. And may Allah bless him a lot. And made him Jannah and give a lot of favors. Okay, then thank you for watching my video. Take care and be safe. Alhamdulillah. Maasalama. Thank you. Bye.