and thank you everybody today for joining us. I know many of you joined us on short notice. We had provided a little bit of an email announcement yesterday about some program changes. And I know that there are many questions that people probably have. So before we get started, I just wanted to talk a little bit about what we're planning on doing today so that we can make sure that most of today's session is really gonna be focused on answering your questions. I will start and kick off by providing a few updates and a few background information about the Microsoft program offerings that are available at TechSoup and those offers that are available to nonprofits. I will also talk a little bit about some upcoming program changes that we had sent an email and posted a blog post about yesterday following an announcement from Microsoft. And then I will share a few of the frequently asked questions that we have received so far from many nonprofits around the US and world. And then we'll open it up for questions. And as Aretha said in the Q&A function, so if you look on your right hand panel, there's a chat function where we've been sharing where each other's from. I'm from Montclair, New Jersey. So it's pretty gray and rainy here today. But I'm excited to talk to everyone from all over the world it seems today here.  And if you use that Q&A tab to input your questions, we will definitely try to make sure that we can get to as many questions as possible today. We have many people who've joined us. So we are really, really excited to get and dig into this. If there are any questions that remain unanswered, you will see on every slide, we have put our email address. Please feel free to reach out to us if there's a specific question that you have. Our main goal here today is for you to walk away knowing what the changes are, feeling a little bit more comfortable about the program offerings themselves. And the biggest action that we have is just making sure you know how to get help. That's what we're here for and that's what we're trying to do today. And we are continuing to be available to be able to help you. So feel free to reach out to us via email. We'll share some other resources as well at the end of the presentation. So with that, I will kick off and hopefully everybody can see my screen. I know that everybody here is aware a little bit of who TechSoup is, but just to kind of remind everybody, TechSoup is a global nonprofit ourselves. We are here, our mission is to make sure that the ecosystem of nonprofits around the world has access to the same technology and solutions that can help all of us achieve our missions at a more scalable and efficient way. So we're here to help you connect to products and solutions, hardware, courses, IT consultants, anything we can do to help support your technology adoption. We have over 400, we work with over 400 corporations, foundations around the world to be able to bring the offers that you need available to you and those are all available on our marketplace. And our marketplace has really tries to provide offers that help meet you where you are in your stage of technical capacity or where you are and where you wanna move to. So we have installed software, we have hardware solutions, there's cloud software, and we have many technologies support services as well to make sure that we can help you on that migration path. What we're planning on covering today is a little bit more on the Microsoft offers. That is particularly related to some of the changes we announced, there are several other offers and if there are questions on that, please do let us know and we can try to answer those as well. But today we're gonna focus and spend a little bit of time just talking a little bit about all of the Microsoft solutions that are available for nonprofits. Before we jumped into that, I wanted to spend a little bit of time on an area that I think is confusing and I know it can be confusing for many people as well, which is just the terms and the licensing structures that Microsoft makes available and some of the ways that we speak about some of the products as well. So there's two distinctions here. One are the on-premises solutions and the second are the cloud solutions. The first one I wanna talk a little bit about is the on-premises solutions. So on-premises solutions are those products or offerings like Office Standard that you pay for one time. You download them and you install them on your laptop or desktop. And many of you may know that you have to go to the Volume Licensing Center at Microsoft right now, the VLSC to download those keys and licenses and install those on your computers. There are free patches and updates available between these version releases, but usually your team has to actually go and deploy those. And typically we see full version releases every 18 to 24 months, though those have slowed down as things have been moving into the cloud. Under the on-premises kind of offering, there are two different ways that Microsoft makes nonprofit on-premise offers available. One is through donation. So Microsoft fully donates those products which are available to the nonprofit community for a small TechSoup administrative fee, which helps us run programs like this and manage the program in general. Some of the other distinctions of this program offering is that there's a quantity restriction. So you can only request up to 50 licenses per product. And within the donation category, there are also only standard level products. So office standard versus an office professional. And right now all of the donation offerings also include software assurance. So those offers come with a two-year software assurance benefit that allows you free upgrades during that period. Microsoft also makes available discounted products that are on-premises solutions. These are provided by Microsoft at usually a 60 to 75% off discount. There are no license restrictions in terms of how many you can request. So we often see people requesting these licenses when they need over 50 licenses for something. The one thing here that I'll mention is that there is a minimum. So this is really meant for people who are buying larger quantities. So there is a minimum of five licenses that is required in order to actually use the discount program. And there's a little bit more flexibility and choice here. So those standard products are available. There are also professional and premium products available at a discount. And there's an opportunity to purchase the product with a license only or with software assurance. And if you choose not to get software assurance, the price can come down a little as well. So those are all of the on-premises offers. And those are kind of the installed products that we've talked about. The second product group offering are the cloud solutions. And the cloud solutions are a subscription-based service that you're signing up for. Some of them are available, completely donated, but you still have an ongoing subscription, even though they're at $0 charges. And some of them are available in donated or discounted ways, I'm sorry. The cloud subscriptions are regularly updated. So you don't have to kind of install or get security upgrades. That is always happening in a cloud solution.  If there's features that are added, that's gonna be provided directly within that subscription. And it makes it so you don't have to keep upgrading your devices, that's automatically done in your subscription itself. The one thing about cloud licenses is it does require some stable internet connection in order to get those patches, those syncs, and for you to be able to work online and in the cloud. That being said, and I'll talk a little bit more about this, it is not required for you to have consistent internet access to use some of the features that are available in the solution. But if you want the updates, if you wanna actually work in the cloud, that is when internet connectivity is required. Like I mentioned, the cloud solutions are available as both a donation and a discount. So there are opportunities for subscriptions that are purely $0 and zero, you know, there's, sorry, they're completely free to nonprofits. Some of those have different quantity restrictions on it and I can go through those cloud offerings a little bit more in detail. But one of the things I would also just highlight here is that you can mix and match those licenses. You don't have to get all of the same license. You might say I need two donated license and five licenses that look like this and that's totally fine. The other part of the cloud licenses is that that subscription or that contract that you're entering will be valid for a 12 month period, which means even if there's any price changes, you're still locked in for 12 months and then each year you would renew that. One of the other areas is that cost can be lower on a cloud solution if you move to a solution that allows you to have less server usage that doesn't require as much maintenance because all of those things are being managed and directly input into the cloud. That being said, there's always positives and negatives to every solution. So we wanted to highlight a couple of those that we know are realities that many of us face in the nonprofit sector and across the world, I would say. First on on-premises, some of the advantages are it's a one-time expense. So you have funding that you're able to use to be able to leverage and get that product. You don't have ongoing costs that you have to think about funding and the software assurance allows you to get the upgrades for a two-year period in case something comes up. Some of the disadvantages is, again, that it's a one-time expense, which might mean it's a larger expense at one time. You do need to upgrade every three to five years as new products become available and there are other security benefits and features that are being prioritized. And the biggest thing is you're responsible for making sure your systems are staying up to date, attached, and secure. And so it does often involve more server usage, more IT support necessary to be able to manage the solutions. On the cloud side, some of the advantages are that the costs can be spread out over time, that you don't have to regularly update. You're getting every new feature update that's being built and designed for the solutions that you're using. And you can turn on the licenses and off the late sentences as you want. So if you have a huge event that you're throwing where you're gonna have lots of volunteers, you can ramp up your licenses, get them on, only have them up for two months, and then deprovision them and there's no problem there. You can really kind of be a lot more flexible about what you need and when you need it. The other part here is that there are just more robust security features in the cloud solution. You're getting kind of the power of the same security solutions that's used by government, by commercial. Everybody's kind of leveraging that same infrastructure, which can be really helpful and scalable for many of us who might not have that ability to do in-house. And then I think some of the disadvantages are what we've talked about, the same thing on cost. Spreading it out over time might be harder. Some of us have funding where it's not as secure to understand are we going to get funding next year for this and thinking about costs in a different way when you're thinking about a subscription product. And there might be some new training opportunities, retraining, there's a cost of change in general. We all know that. And so that needs to be factored in as well. And because there is some dependency on internet connectivity to be able to download and to be able to sync on the updates, that is definitely a consideration as well. Now, we talked a lot about in the email and in our blog post yesterday about some of the changes that were happening. So what I wanted to do today was just focus on everything that I've just mentioned of the offers. Well, what's changing on April 4th, 2022, which is right now about six months away. So everything I talked about here, the on-premises and cloud offers really stays the same. The biggest difference is what you'll see is that really the donation offers for the on-premises products are really moving to just a discount model. So where we previously had the ability to have donation discount on both on-premises and cloud, what we'll see now is that we just have discounted licenses under on-premises and that both donation and cloud will still remain on the cloud solutions. So a little bit more about the detail of what will be available and what would not be available. So most on-premises products are going to be leaving that kind of donation catalog in on April 4th. There will be a few things that remain that are highlighted in these three boxes. The first one will be eligible nonprofits will still have access to a Windows Pro license as a donation and those are operating system upgrades, as well as full operating systems that you would be able to get. Many of those licenses and the operating system we know are critical for being able to use some of the cloud software. So that's really important to maintain in the donation. There are also a few countries that we operate in that Microsoft operates in and TechSoup also does where Azure is not available. So in those markets, Windows Server and SQL Server will be made available as a donation. And there are also organizations that have really needs for device-based licensing. So those organizations that have public access computers, training labs, education centers where we have multiple people coming in to use a device, we will have a small and separate program that will have a donation catalog available to them so that they can get those licenses for their devices. We're still building out that program. We're hoping that will be able to be launched on April 4th and that will come with a little bit more information and we'll have more to share on that as we iron out those details about exactly who would be eligible for that program and what products would be available under that donation as well. Like I mentioned, all of the cloud licenses are still available. There are cloud donation offerings available, there are cloud discount offerings available and many of those cloud offers include all of the features and benefits that exist already in some of the on-premises solutions. So I wanted to talk a little bit more about that because we did get many questions regarding it and I think it's important to note that particularly there are a few cloud licenses that can really help in terms of those features that you might be looking for coming after April 4th. So here's an example of the key products that are requested from nonprofits over time and definitely in the last year. We have Windows, we have Office Standard and we have the Windows Server Standard product and these are three on-premises examples. They're still available today. They will be available until April 4th. They're available as a donation with an administrative fee for 50 licenses which comes with software assurance. If you need more than the 50 licenses they're also available as a discounted offer and you can get those with or without software assurance. But Microsoft also makes available a cloud license called Microsoft 365 Business Premium. It is a license that is available for free for up to 10 users and then every additional user after 10 is at $5 per user per month. And this product actually has many of the features that Office Standard and Windows Server have inherently in it. So it includes all of the Office application. It includes access. It includes teams for collaboration. It includes SharePoint, Exchange, Publisher, Azure Active Directory, which is oftentimes where Windows Server is being used right now as well as Intune for Device Management. All of these are available under this license for free and I will also just stress that the Office applications that are available are also available for a full download. So you can, once you get the product you can actually choose to download them as desktop applications. And at that point you would not need or require a stable internet connection for you to leverage and use the Office suites. When you do have internet connectivity you can use all of the other robust features and you're able to then sync into the cloud but it is not required on a day to day basis for you to be able to have an internet connection to be able to use those applications with this license. And so what changes on April 4th from these product offerings is similarly that you will still be able to get them as on-premises but the donation offers themselves will really move to just a discount offer for the Office standard and for the Windows Server standard and for some of the other products that we have. And as I mentioned a lot of those products can be fulfilled in the cloud donation offers that are available but we understand that that is not always an option that people can make and so we wanna make sure that you understand that they're still here but there are implications and changes in terms of pricing, budgeting and planning that your organization would want to make and that's why we're trying to be as clear as possible and hold as many events as possible so that we can answer your questions and help prepare for that. So I'm gonna move into the Q and A pretty quickly because I really wanna get to everybody else's questions and we did get from nonprofits as I mentioned lots of great questions already so I thought I would take the top four questions that we have gotten so far and just start with those and as you have more questions please feel free to put those in the Q and A I already see that starting to build up so I'm excited to go through it. The first one is what does this mean for my existing licenses? You will still be able to use your on-premises products that you have today. These are perpetual licenses, the change are only gonna impact the new licenses that you request in April 4th and it'll only impact those that are actually going to be on-premises. In terms of how does this change your current cloud licenses? Again, this does not and will not change any of your cloud licenses. You can still use your cloud subscriptions right now with no issue. And then what if I don't have dependable internet connectivity? This is a question we've definitely heard and understood. Like I tried to explain before, on-premises solutions will still be available but unfortunately they'll be available at a higher charity discount rate. And some of the cloud subscriptions including some of the donated offers do include fully downloadable applications that can be used when offline. And the last question I wanted to spend a second on answering a little bit more is how are libraries impacted? We proudly and work for many years collectively with libraries to provide the Tech Super Libraries Program and we know that the on-premises donations for public access computers has been critical to that. Right now we know that libraries will continue to be able to request those on-premises public access donations until the end of this calendar year, December 31st and we are actively working with Microsoft right now to make sure that that will continue after that point as well. I'll note that on libraries, though we've been able to serve public access computers under nonprofits, libraries have also been eligible for education offers from Microsoft for some of the cloud licensing. So we're working right now in partnering with the education group at Microsoft to see how we can extend these offers, how we can make sure that the library sector remains whole in terms of the offers that they have and we are hoping to have more information on that in the next few weeks. We will plan to send an email to anybody who is registered as a library with us or if you have specific questions on it, please let us know and we'll make sure to send any updates out that way as well. Shruti, there was one also question about purchase orders for libraries and just to say that we have an existing process for any organization that's eligible and requires a purchase order process, use the contact us at the bottom of techsoup.org to reach out to our general customer service. They're very familiar with purchase orders.  Thanks, Gary. Okay, so I'm gonna go through the questions in our Q&A. I'm gonna start with Wayne's question. How do I convert our current non-tech suit, Microsoft 365 subscription to a TechSoup subscription? Great question, Wayne. There are a few resources that I will kind of point to here. I have a lot of things just in case. Here where there is consultation, there's a link here and maybe somebody can put this in chat as well of a forum and we can work with you to get your licenses directly through TechSoup and help you on your cloud licenses. So happy to do that. The next question I have here is from Evan Perkins. Are the license restrictions for donated on-premises restricted to fiscal year or lifetime? So the license restrictions for Microsoft, great question. Evan are actually under a two-year period. So every two years, those quantity restrictions can get refreshed. Next question, the email I sent said on-premises options were going away in 2022, but you're staying there still there. Yeah, that's a great question, Rebecca. And I apologize if that was a little confusing. So the on-premises options will still remain in April 2022, but they will not be available as a donation offer. So the cost will increase because they will only be under a discounted model. And so let me go back to this example. I think it's a little clearer as right now where we have Office Standard and Windows Server available for $52 for the administrative fee associated with them. That will be not available after April 4th and it will only be available as a discounted offer. Okay, I see the next question from Victor Enriquez. Is there a rep support staff that we can contact directly to public libraries for purchasing? Again, you can definitely feel free to reach out to us on the email address here, reach us at techsoup.org and we are happy to help understand how we can support you. In the past, a lot of the, this is from Cody, sorry. In the past, a lot of cloud donations did not apply to public libraries, non 501c3. Has this changed? So the eligibility has not changed at this point. So right now, non public 501c3 libraries, I believe can get education licensing, but don't necessarily qualify for nonprofit licensing. We are working with the Microsoft team to one, understand if we can help and support libraries by offering some of those education licensing and two, to see if we can maintain and continue the program for public access computers through the TechSoup program as well. The next question that I have is from Linda Wagner, will we receive a notice about renewals from TechSoup or from Microsoft? So in terms of your renewals for your subscription, you will get those on a systematic basis from Microsoft directly, if you have your licenses directly from them and if you have your licenses with TechSoup, you will get those from TechSoup to indicate to you when your subscription might be ending and when you might be need to do another renewal. And Gary, sorry, would you mind meeting because there's some background noise until unless you have to. I was just gonna say there's several questions around how do I determine what product we already have? So if you go to your techsoup.org account, log in and there is two tabs there. One is your request history. It can be filtered to show only the Microsoft requests and there's also a tab for your fulfillment emails which are what you receive after you've made the donation request or discounted request and that has details including the license keys for Microsoft.  You also have access to a Cloud Manager account which will show you your existing or previous subscriptions and licenses through TechSoup. Yeah, and I would just offer there as well is that if you are on your desktop or using it, you should be able to use the little windows icon on the bottom left-hand corner to kind of look at the applications and look at what version you might have installed on your computer right now which can give you a bit of understanding on what license version you have as well as what product you might be using as well. I'm gonna go to William Brannon's question. I was told by a Microsoft partner that I need to use 85% of my active office licenses. However, some of my licenses email acts as a device account such as scanneritecompany.org. Nobody logs into that account but it is this needed. Is this okay?  I'm gonna go to a slide that we have here a little bit about the utilization requirement for Microsoft grants. So Microsoft for any of the donated cloud licenses. So this is very specifically talking about the offers of Office 365 E1, Office 365 E2 which is an older license, Microsoft 365 Business Basic and Microsoft 365 Business Premium. On those licenses, those are available to nonprofits at a $0 as a full donation and Microsoft refers to those as grants to the nonprofits. They require that if you are leveraging and using those licenses that they need to have a utilization rate of about 85%. And so that 85% is really calculated based off of the licenses that are assigned. So if a license being assigned means when an organization comes in you might request 10 licenses. You might have those 10 licenses not be using that but when you would take that license and say, okay, Shruti Ramaswamy at TechSoup.org this license is now for you, you're now assigning that license. And as soon as that license is assigned to me I have to make sure that I'm using that license at least once every 90 days in terms of a Microsoft 365 cloud service. Those include Exchange Online, Microsoft Teams, any of the Microsoft 365 apps. It doesn't necessarily register usage when you're completely offline. So we do recommend looking at that and making sure that you have some activity. And if you don't have any activity you can always unassign that license until you are ready to have activity on those licenses again. And that still, you can still keep the 10 licenses you just don't have to assign it to a user. I think your specific questions were, what about email accounts that are not necessarily touched their aliases? It's a little hard to know exactly what's being tracked and not. But what I will share in the chat or after is that there is a way that you can go into your Microsoft 365 administrative center. There are reports that you can pull to see active usage by user and you can make sure that you are meeting that threshold. This is something that I think most of us will meet if you're using email or if you're logging on every now and then or if you're saving anything to the cloud. But it is important to note that this is a requirement that Microsoft has. Okay. There's a question here. Is there a Power Automate Cloud donated or subscription that includes robotic process automation? This is from John Sabola. I'm gonna answer. There's a few questions in here as well. So I'm gonna answer that one first. There is Power Apps that are available as a donation. I believe it's 10 licenses that are available as a donation for Power Apps per app. I don't know if that includes robotic process automation but I can look that up and get back to you on that. And then for the license right now, is it Windows 10 or Windows 11 as an on-premise license? The way that the donation program works is that it will be the most latest up-to-date version of the Windows operating system that's available. So as soon as Windows 11 is available in enterprise reach under the volume licensing center, that will be what we will have available. And under all of our product usage, if you need to for any reason, there is always an option to downgrade to one version as well. And then is Windows Server, CALS an on-premise license? Yes, Windows Servers, CALS are on-premises licenses. Those will still be available today and after April 4th but those are only available as discounts. Okay, I'm going to the next question which is Brian Robinson. Is Active Directory a viable replacement? Azure Active Directory is Azure Active Directory a viable replacement for on-premises servers? So I think Brian, there's a lot in that question and it's probably specific based off of what you're using it for if it's just for Active Directory. It also depends on what you are managing the access to other programs. So I would say if you want to send us an email we'll be happy to talk a little bit more about that. One thing I'll note is that under Active Directory, Azure Active Directory that's inherent in the Microsoft 365 solution, the goal here is really to limit how much you need to have a Windows Server on-premises solution because the administrative center in Microsoft 365 is pretty robust. You can manage all of the user activity. There's in-tune device management so you can manage devices to the Active Directory and you can control all of the licensing directly from that admin portal. So the goal there is to remove as much necessary for you to have to have a separate Windows Server instance but that's always really based off of how you're specifically using it. Okay, the next question is from John Romano. Is Microsoft Exchange only integrated with Microsoft 365? Is Microsoft Exchange only offered through cloud solutions? Does Microsoft Exchange allow for custom domain features by what I mean assigning user their own custom domain and having a small email server to do and carry email promotional activities? So I'll just really quickly flash up a few of the other cloud licensing that's available. You will see that there are several cloud licenses that include Microsoft Exchange which includes Microsoft 365 Business Basic, Business Standard and Business Premium. So it is offered through multiple cloud solutions. There are some ability to kind of be flexible here but in terms of the actual domain features I would probably wanna make sure that I understood exactly what you're looking for John. So if you wouldn't mind dropping us an email I'm happy to answer that a little bit more in detail based off of how you guys are using it. Alyssa McLeary asked, how do we determine our current products? So that's a great question Alyssa and thanks for asking that. So what we try to do is advocate as TechSoup with all of the technology providers that we have to make available any of the solutions that they have that we think would be the most valuable for nonprofits available to the sector for as low as a cost as possible. But ultimately what products are available are determined by the companies themselves and what they can make available as their nonprofit offer. So these changes are not necessarily changes that we are making the decision based off of the products. Our goal here is really to communicate the changes and the impacts and really help make sure that we can provide you good alternate suggestions and make sure that you're well prepared and planning for this change. The next question is from Rebecca Webb. So if I have an on-premise for free now, will I have to change to a cloud version to keep a free copy? So another really great question, Rebecca, I just want to note that if you have an on-premises solutions right now, nothing is going to change out of that solution. You can still keep it, you can still use it. That won't change after April 4th. That's something that you currently have. If you need to get a new license, that's where you would have different options available to you. Again, you can still get an on-premises license, but it would be available as a discounted license versus a donated one. How do we get the on-premise Windows license and how do we determine if we have that already? Or what we have already? And I think Gary answered that a little where you can go into your TechSoup account to understand what you have. Again, you can look on your desktop itself to be able to determine that. But in terms of how you get that, we can post a link in here in the chat on the product donation site. And you can go there and we have Windows upgrade options available and you can make a request for those licenses. Gary, did you have a question that I should answer? No, nothing to add. Oh, okay. Leah Truman asked, if we already have the license for an on-premises product, will they still be usable? Absolutely. There's nothing that will change in terms of the functionality for products that you are already have and that you are already using. Can I say clearly what Windows Server OS and SQL SQ will be available for discount after April 4th? Sure. So, or I'll try, I should say. Jeff, so what we'll have after April 4th will be, we will have a Windows Server operating system and a SQL Server operating system that will be available for nonprofits as a discount. The Windows Server, I'm trying to get to that slide, sorry, the Windows Server standard product will be available at around $79 a license. Again, on the discount program, you have to have at least five products that you're purchasing, that could include user cals or server cals. SQL will also be available as a discount. I can come back to you about what that pricing will look like. Those will be available as a discounted offer starting on April 4th. They're already available in the discount program today and are available as a donation as well. Will cloud donations, this is from Chris Jelly, allow eligibility for SSFSLogix? I'm not sure I totally understand that question, Chris, so I apologize, but if you wouldn't mind sending us an email, I'm happy to explain or try to answer that a little bit better if I have a little bit more background. Okay, Tony, will all existing cloud tiers still be available at nonprofit discount? So right now, Microsoft makes several of their cloud licenses available at a nonprofit discount that includes most of their Microsoft 365 business solutions as well as their Office 365 enterprise solutions. There are a few products that still don't have a nonprofit discounts, but most of them do. So if there's a particular product that you're looking for or seeking that are not part of those suites, please do let us know and we can probably answer that more directly. Does this affect our donated Windows 365 E1 and E3 licenses? This is from Dave Basham. Again, no, it will not impact any of your current cloud licenses. So you are free to move forward. There's no changes to the cloud licenses. Doug Warren asked, I signed up for cloud. Microsoft sent notice that I have been accepted and told me to wait for TechSoup to call back. It's been 18 months. Called Microsoft repeatedly and they were given 10 users. So looks here that you are having some problems, Doug, and I apologize for that. So if you wouldn't mind sending us an email and if not, we can find you, I'm sure, based off your registration. We will definitely come back to you, reach out to you and see what we can do to help to make sure that you can get access to the licenses that you're looking for. And I apologize for that. Brian Scott asked, we have Office 365 E3 only used by a small group, but a larger group using Office 365 E2 licenses. We pay for the E3, but not the E2. If we switch to the business premium for our core group, can we keep the E2 for the rest of our users that only need the exchange mailboxes? So you can use the E2 licenses right now. I think they are still available. You're not able to purchase new E2 licenses because it's a retired SKU, but you can keep the E2, you can migrate it to the business premium if you want. The business premium licenses though are only restricted to 10 users that would be available for free. And I think for legacy E2, for older E2 licenses, you probably have more allotment. So that might be a question that we might wanna work on together to see what's the best way for you to have the licensing you need at the lowest possible cost. Pam Schultz asked, if I need more than 10 licenses, do the first 10 licenses come for free or are all licenses needed for a fee? No, the first 10 licenses come for free and then you pay for each additional license. So you can always get the first 10 for free. And I will also say if you don't need all of those features that are in the business premium, there are also some options that are cheaper like the business standard, which are $3 per license per month. That includes a lot of the same functionality. It just doesn't include some of the more sophisticated kind of security and active directory features that are available in business premium. Okay, Jennifer asks, we're a small nonprofit with extremely strict confidentiality requirements by law, stricter than HIPAA. What are some of the encryption standards for the Office 365 to ensure we maintain that confidentiality? Also, we have devices that have our clients use and we need to maintain confidentiality between computers and clients. How would this work and is there a way not to kill our budget? That's a great question, Jennifer. And I think there are definitely licenses that might be best suited for you where you need just a higher level of security, data privacy, and there are a few add-on functions that I would say are able to. So I think maybe if we can reach out to you, Jennifer, we can have a little consultation about what would be the best solutions for you. There are Office 365 E3 licenses that we particularly recommend for organizations who do have to think about HIPAA or even stronger than HIPAA. There are some add-ons as well and we can work with you in your budget to see what might be the best solution. Joan Golland-Boy asks, are there cloud storage limits for Microsoft applications? There are some cloud storage in there. I think they're pretty high. I don't know them off the top of my head. I don't know, Gary, if you do. In general, one gigabyte of OneDrive data storage is available and there's certainly add-ons for additional data. Great, thanks, Gary. Licenses such as on-premises SQL, will they be on discount? Yes, Armando, they will be available as a discount product after April 4th. Again, I'll just remind everybody that those are still available today as a donation, but after April 4th, they will still be available as a discount. So software assurance for Windows Server Standard, will that upgrade our current server OS to the current version? So if you have an existing software assurance that is still within its two-year period, you can absolutely use that to upgrade to the next version so you can look in your VLSC and if you have an existing and not expired software assurance, you can leverage that to get the upgraded version of the product. Pam France asks, what's the difference between the on-premises Office products and the downloaded Cloud Office products? So in terms of the actual capabilities, there are a few differences, but there will be a new release of the 2021 Office, which I think will align them for a period of time where the features will probably be similar. I will say some of the downloaded Cloud Office products because they are able to get more of the feature updates. You will see anything that's new, that's developed and all of the development efforts that Microsoft makes, they go directly to the Cloud first. They're not going to the on-premises solutions first. So that includes features on how to share functionality, how to collaborate more effectively, tools for that. Sometimes there are some interesting features that I always find great, like design suggestions, collaboration tools that might be useful, but there are a whole suite of features and you can find those online and post that link for you, Pam, but there's, I think the core functionality itself, if you're using just a word Excel, the core functionality is really similar. It's just a lot of the feature-rich and collaboration tools that are probably more available in the Cloud solutions. Okay. Chris Holm asked, the last time I checked donated or discounted Windows Upgrade wasn't available for Windows 10 Home Edition, is that still the case? Yes, Home Edition licenses are tricky. So Windows Upgrade doesn't necessarily work on the Home Edition, that is true, but we do have a license called Get Genuine, which is a full operating system, and that can be used to upgrade from a home device to a Windows Professional or Windows Pro license. So we would recommend using the Get Genuine. The one thing with the Get Genuine license is you can only request Get Genuine once in your lifetime. So it still has a 50 quantity restriction, so it's just meant for a full operating system. Again, after April 4th, we should be able to have more SKUs that develop and provide a full operating system, but right now the best license would be a Get Genuine license. Okay. Joan asked, if we have 50 on-premise licenses but are not currently installed, will we still be able to install that on future computers? Yes, if you have already requested those licenses and you already have them in your volume licensing centers, you will be able to go ahead and download those so you can still use those licenses. Dean asked, the best place to ask questions about which organizations qualify for the Microsoft program. On our site, we do have the eligibility requirements for each of the programs listed. If you have questions, you can feel free to reach out to us. There's a Contact Us page on our site or you can feel free to reach out to the email address that's on the slide, reach us at techsuit.org. Andre says, helpful presentation. Will we get the PowerPoint slides? Yes, we will be sending out this entire recording and the PowerPoint slides within a few days via email as soon as everything's kind of ready and prepared. We'll have that ready to send out to you no later than Friday. David Reed asked, if your organization purchased licenses before you were with the organization, how can we determine what active licenses we have? This is a great question. For this, I would definitely recommend that you use the Contact Us page on a TechSoup so that we can look up your account specifically and understand where that might be and what licenses you might have. We know that staff can turn over at nonprofits, so it might not always be clear what licenses you might have access to. So feel free to reach out to us and we can try to help you with that, David. Dave Basham asked, will we be able to request donations of on-premises licenses until April 3rd, 2022? Yes, that is the goal, that we will still have them available for you to request until April 4th. So yes, you will still be able to access and request licenses up till that point. Jean Olson asked, what's your NGOs who don't have ongoing access to internet do under this new plan? We have an on-premises machine software in Ethiopia because the internet connection is often non-existent. We totally understand Jean and I think that's a great question. I think there are a few options. One is that if you don't have ongoing access to the internet, you can request an on-premises discount license if that's something that you need. In terms of other solutions, like I mentioned, the business premium license and the business standard. And then there's also another license that's not mentioned here called the Microsoft 365 Enterprise Apps. Those are all available and include completely downloadable versions of the application and you can use those applications and the downloaded desktop applications without internet access. So you can still have the functionality of the office applications. If there are other devices or other kind of on-premises solutions that you're looking for that are not office-based, please let me know and we can work together. There are many opportunities and many different offerings and solutions we have at TechSoup. And so we'd love to kind of make sure that we're finding the right solution for you even if that might not be a Microsoft solution. Robert asks, if these changes don't affect until April 22, why are libraries only able to purchase until December 31st? That's a great question, Robert. And I probably should have explained that a little bit better. So there are a few changes that are happening in the Microsoft world. One of them is a back-end fulfillment change that's happening at the end of this year which is right now the way that everybody gets their products is through the Volume Licensing Center. Microsoft is going to start retiring that open licensing program that we currently use to deliver those licenses. That really should have very little impact on most organizations because we'll just be moving to a different back-end fulfillment channel. You might have a different way of downloading those licenses through your Office 365 administrative portal instead of the VLSC which on a very wide scale we hope is a really good change for everybody and a much more modern solution for everybody to be able to use to download. But particularly for libraries we're trying to make sure that we can continue that program in the back-end fulfillment channel that we're going to have and it's just something we haven't done yet and so we're still working with Microsoft to figure out how to do that. So the timing of that change is a little bit different which is why it impacts libraries a little differently. So I'm really hopeful we'll get more information on libraries and have a lot more clarity about that program and hopefully it will be all under the same umbrella of time periods and there won't be any impact but until we know that for sure I don't want to necessarily say that that's true. There's been several questions around basically can I mix and match licenses? You can definitely mix and match licenses particularly in the cloud world it's pretty easy to do that. So if some of your organizations just need email or just need online applications you can use the business basic application that's mentioned here that are just the cloud services. If you have some of your team who really need desktop applications who need the advanced security who are playing different roles you can get the business premium applications here as well. So for sure you can definitely mix and match. Another question around Azure and the Azure credits. So Azure under Microsoft is a whole series of different products, services and capabilities under the Azure brand. It includes Azure Active Directory which is the identity management component of nearly all the office and Microsoft 365 plans. However, some of you are aware that Microsoft does make a $3,500 annual grant available known as Azure credits but those can only be applied to Azure services not to pay for Office or Microsoft 365 or any related products unfortunately. Thanks, Carrie. So there's a few questions here also about understanding the E2 and whether or not that's retiring. The E2 license is actually no longer available for any new subscriptions. If you have an existing E2 you can still maintain and use that license but there is not a product available for anybody to get a new E2 license. So I'm not sure exactly how that will be retiring over time but I know that you can still use TechSoup. We use E2 licenses here as well because we have those before so we definitely still can use those licenses but they are not available for any new purchase at this time. There's a question here from Lisa. When will the 2021 Office version be released? Should be today or soon. So we're not sure when that will hit the VLSC but as soon as we do we promise we'll send an announcement on that. So we will make sure that that gets passed on but it should be very, very soon. There's a clarification here about one terabyte for storage not gigabyte. That's a great clarification, Jonathan that we had talked a little bit about in terms of the storage that's provided here. The new Microsoft 365 pricing will that take effect on April 2022 or is just that for on-premise removal? It's a great question, Steven because there has been a lot of press and a lot of news articles about price increases in Office 365 and Microsoft 365. At this time that is actually a price increase that is only affecting commercial products. So education and non-profit products prices are not supposed to change. So at this point there should be no pricing changes that we know of for non-profit or education. What we know is that the pricing will increase for commercial products at this point. There's a question from Todd here about does the Microsoft 365 business premium include a Windows 11 upgrade? The Microsoft 365 business premium right now includes a Windows upgrade but it includes a Windows upgrade based off of the pro version. So if you have Windows 7 or Windows 8 you can leverage that license to upgrade to the higher level license that's available. It will not work if you have a home license or a different license type. I have a question here from Jack. Tried to purchase Microsoft 365 business standard but was told that I had to download the Microsoft Authenticator. I did that and could not get it to do anything and we don't have an IT department so we just gave up. Jack, we've been there. We understand your struggle. Many of us had to go through that process as well. I would just say if you can send us an email, Jack we would love to help you through that process and provide some support to help you get using those business standard licenses. It is a little tricky and sometimes can be a little confusing so we'd love to help and support you through that. So if you can just send us an email we'd be happy to get you in touch with the right people. Rebecca asked how do I change from an E1 subscription to a subscription that includes downloadable office products? Rebecca again, please definitely email us. One of the resources that we have here is this free consultation. We're here to help and so we can definitely help you switch from an E1 license to a Microsoft 365 business premium license or a business standard license that includes those downloads. Victor says we currently have an A1 license. Do we move over to business? So Victor, if you have an A1 license you can either get education or nonprofit based off of what you're doing. You can't usually have education and on profit so maybe we can work together to figure out the right licensing for you and probably as a library. It might make sense to keep the education licenses for cloud but we can definitely work with you on that. We got another question from Richard about Mac users and I wanted to answer this because we've gotten this question a few times as well through email. Mac users, all the on-premises products are available for Mac users both donated and discounted and all of the cloud licensing can be installed on a Mac computer as well. So there's no particular difference for Mac users in this change. I know we're running close to time here. I would just ask if anybody can see if I haven't answered something that is really upvoted or something that a lot of people have, please let me know and I'm happy to answer that question. I also wanted to just make sure that everybody saw some of these additional resources that we have available. The first one is a consultation so we can meet actually with Gary here or anybody on his team to help provide a little bit more understanding about what cloud solution might be right for your organization and help you get set up with that. We also have Digital Skill Center which is actually full courses that are available to organizations, staff, volunteers to be able to learn how to better use Excel, Teams, PowerPoint, Word, SharePoint, lots of other applications. I'll say there's so many really robust features that I wasn't even aware of until I took some of these courses so I would definitely recommend them. We also have a digital assessment tool that's available to organizations right now so you can go online, it's a completely free assessment tool and analyze the current state of your organization's technology and we can help you build out recommended product solutions to help you better serve your mission. And then there are many blogs, catalog offerings that we have here that can help support you and provide more information. I know this was a very long webinar probably a little not as interactive as probably a session we would wanna have but with 300 people we did our best to try to make this as much as possible as helpful for you to answer all your questions. I'm sure we probably didn't get to everything but like I said, our email address is here. You will have access to the slides and recording within a few days and I very much hope that this was useful to you and helped clarify some of the confusion or questions that you may have had.


Come on, this has got to be it, surely, surely!  Crumpets, save the pride, bro. I can't feel my hands. Stop inviting me. Come on, please!


Everybody forced here ripping 2022 top Star Wars chrome black hobby 12 box case number six random pack or auto style So what we're gonna do is do the random up front here I'll show you you're gonna get a sign an auto or a pack with a number next to it one through 12 on both of those So boxes one through six will be left side top down and then seven to twelve right side top down I'll take him out just as they sit in the box right now And then with box one that's auto one and pack one box two is auto two and packed to so on and so forth So good luck. Let's do the random now, and then we will uh Rip the case. Thanks for joining everybody. Here we go Two and six eight times eight times on the names eight times on packs and autos will put them side by side to see who's got what one two three four five six Six seven and eight on the names now Jonathan Q down to Joe C and then eight more times on autos and packs one two three four five six seven and eight Pack nine down to auto 12 There you go Jonathan Q pack nine William N pack for Joe C pack 11 Matt P pack eight Joe C auto six Brandon M auto nine William N auto seven Jonathan Q auto eight Jarek with pack three Joe C auto one William N pack seven Joe C pack six Joseph D auto three Joe C with auto two pack ten William N pack two Stefan as pack 12 Joe C pack one auto five Jamon L pack five William S auto four John H auto 11 Joe C with auto 10 and auto 12 Those results are getting posted right now. I'm gonna drop a link in chat so you can look it over again If you need to again always available on the website Good luck John Always available on the website last spot last pack mojo. Nice So that's one through five hang on sixes at the bottom still sixes at the bottom All right, so box one has auto one and pack one pack one has the grand inquisitor Wedge got a blue refractor of quill five out of 75 and auto number one Is grief cargo Carl weathers is grief cargo nice hit Auto number one box number two pack two maxrebo A refractor parallel of mace That's nice 90 of 199 And a green refractor parallel of ember palpatine Number 90 of 99 Request a blue anakin. All right, I'll consider the request Stefan. I'll consider it And auto number two is a green record d. Bradley Baker 22 of 99 box three three has cob vamp grief cargo Refractor of director crannick 75 out of 199 auto number three Is caldron ali pal casey is caldron ali box four I've got anakin base for a pack four Luke base and a green refractor of palimoto 31 of 99 And auto number four is asu Christopher shon is asu box five I'll see a big parallel or big auto in the last uh, you know Several boxes here pack five Galen are so nice color for pack five coming up. Good luck Enfus nest And axe woes four out of ten. I think that's magenta or fuchsia Nice axe woes to ten pack five And auto number five is admiral akbar tim rose Auto five You have to put a request written in triplicate. What what is that ken? What is that? Number six box six salacious b. Crumb dooku refractor 13 of 199 And gold refractor of bb8 49 to 50 At auto number six is a gold. It looks like yeah, it's gold It's palimoto. Amy sideris 17 out of 50 on the gold That was a good box Right number seven now pack seven bodhi rook k2so green refractor bokeh tan kreeze 26 at the 99 And auto number seven is refractor auto as a bridger taylor graze as a bridger robot mon mothma refractor like her character in andor 117 of 199 And gold darth mall three out of 50 sweet gold mall And auto number eight is refractor auto magistrate morgan elspeth diannelly anisanto Yeah, vader on the box. Yeah tough fool for sure Number nine now I'll force you to fill out three times. Gotcha. Yeah, sounds about right ken. That's what I would have to do If it were up to me aura sing Lando calrissian and a green refractor sabine wren 44 40 or 44 of 99 Auto number nine is runs our malk mark boon jr. Is runs our malk number 10 now so pack 10 grand amroth ron kira wrecker refractor wrecker fractor 192 of 199 Andor is amazing Got a refractor auto of nambi gima kirin shah's nambi gima I've only seen like half of it so far and it's so good It's like legitimate tv drama number 11 Cannot wait to watch the next few episodes That finally be caught up Don't know when that'll be though Number 11 now pack 11 commander kody refractor of isoketano 98 of 199 and a blue refractor of saugr era 30 of 75 Auto number 11 is a dark side auto of valon hess richard break valon hess and last up number 12 There's We there's zero chance. I'll probably watch even another episode before wednesday. There's like zero chance I just don't have I don't have time to do much of anything recently You got fennec finally watched like the fourth or fifth episode like the fifth episode last night I got fennec shahns general grievous green refractor captain phasma 48 of 99 and auto number 12 Is a commander daisy a mandalorensis commander daisy? Well decent case not the best case But thanks again everybody. We've got uh football coming up now


Looks like we got time, so I'll go ahead and get started. My name's Chris Wigman. I'm a senior web engineer for TenUp. And before I did this gig, I built security plugins. So I've reviewed a lot of code over the years and had to look out for a lot of what I'm going to talk about today. And what we are going to talk about today, then, is some of the bigger vulnerabilities that we see in WordPress. This is a fairly advanced talk. I'm going to go through some codes. So if you're not comfortable for that, this is probably not the talk for you, to be honest. We're going to be talking about what the vulnerabilities are from a code level and how you kind of avoid them, what to look for as you're programming plug-ins or themes or things like that. In order to talk about this, one of the big questions we have to ask is, who identifies these vulnerabilities? These aren't something that I just picked out of a hat. There's actually something called the Open Web Application Security Project. It doesn't just cover WordPress. It covers vulnerabilities web-wide. This might be ASP.net. This might be Java. This might be any language that's typically used on a website. This organization, what they do is every three years, they come up with the top 10 application security risks. The current one out is from 2013. So it'll be updated this year. And it applies these things across a wide vulnerability. Now, fortunately, with WordPress taking up 25% of the entire internet at this point, most of them or pretty much all of them in one fashion or another are applicable to WordPress. With the nice benefit of WordPress Core, if we do this right, I'll eliminate a lot of the risks in our own code for us. When we talk about these vulnerabilities and then they deal with a couple things, they are dealing with code, but there's also some of the biggest problems we're gonna see with WordPress are configuration and just general vulnerabilities outside of our code. Even as developers, there are numerous things we can do. Sometimes it's simply to make our lives easier or to give access to that one person who needed it to sign off on your project that was due yesterday. But these are the types of security and various configurations, server configurations and general vulnerabilities that we're gonna talk about that really affect us here. And they're gonna target various different applications or different parts of WordPress as well. So we're not always just targeting WordPress, the four meg zip that you download from WordPress.org. In some cases, we're talking about vulnerabilities that target the server or could potentially damage things underneath. So in other words, if you have 100 sites on your one server, you're hosting with Linode or even if you have Bluehost and you have 60 different sites in your unlimited account, it could very well be that just because one is hacked, it doesn't mean it's gonna stay in that one site. It can target pieces underneath and spread. So we're talking about things that can target the server itself. We can target things, they're talking about things that are targeting the application. And the application, of course, is WordPress. And we're also talking about things here that target the user. So these don't always, they're not always trying to get to your server itself.  Either it's to get data from somebody who's at your site, they're trying to break the trust relationship. Because in the end, all this comes down to, it's not so bad.  You probably have 17 backups. Maybe some people, you do your writing in Word, whatever it might be. It's not your data. It's the trust relationship between you and your clients that you're trying to protect here. It's that ability for your user to say, well, last time I went to that site, I got malware. I'm not going back to read his stuff, no matter our first stuff, no matter what it is. So any things that target the user are often overlooked when we talk about WordPress security. But the truth of the matter is, this is really what we're trying to protect. All the data in the world, if we lose a few blog posts even, it's not the end of the world. If you lose the trust of your readers and more importantly, your customers, depending on what you're trying to sell, that might be the end of your world. So that's something that's a very big distinction that you have to remember when we're talking about this type of security. So the OWASP project, I've gone through and I've picked, and I haven't necessarily picked these in order, but they do have a number of vulnerabilities in the 2013 list that specifically target WordPress, and this is an overview of them. We're gonna talk about sensitive data exposure, security misconfiguration, injection, cross-site scripting, insecure direct object references, missing function level access control, and CRSF or cross-site request forgeries. Most of these are very developer centric, but again, you don't have to be a developer to create a vulnerability, to take advantage of a vulnerability to create it by somebody else in some cases. And this top one is simply the most common one that we're gonna see in WordPress. This is really where it's gonna break that trust with your users. Sensitive data exposure. This might be, how many people in the room use WPCLI? It is a great feature of database export. WPDB export, and it creates a SQL dump of your database, everything in it. And it does it right in the web route if you don't do anything else of your application. So right in the exposed WordPress server route that's available to the web. So you do your database export and you leave it there. Anybody who wants to download that list of your users, any user meta, maybe addresses or something else that you have in there, that file is just sitting out there ready to be downloaded. That's a sensitive data exposure. It might be as simple as you left an extra admin in there. Your developer came by six months ago, did some work for you. He left his account with just the username password, but it has access to absolutely everything. Their credit card information, whatever else that you have. That's sensitive data exposure. There's a whole lot of ways that we can expose data without even trying in many cases. And without realizing that very simple tasks that we need to perform our job can leave this data in places at which it can be compromised very easily. Now of course the primary target of this is the application in the server. And it's a very severe risk. This is where you break the trust of your user. If they start getting spammed from 150 different pharmacy ads and it can somehow be traced back to they got your email address because you left it exposed to them, you've now broken the trust of that user. This is the worst case scenario and that's why I listed first. I believe this is actually number seven or eight on the OWASP list of the top 10 vulnerabilities. But it's by far the most damaging, particularly to a small site owner or a small business owner who relies on either repeat customers or some sort of reoccurring income from people that you need to have trust you. Difficulty to exploit, this says it's difficult and that's coming from OWASP. Many times it is, if you do a database dump, my initial example, if you do that WPCLIDB dump and you leave it there, what did you name the file? Well, they may have to guess or they may need some other way to just stumble upon that file. But the only thing preventing them there is what they call security by obscurity. Which is anybody who works in security who's played with security before tells you it's not really any security at all. That's just simply renaming something and hoping that they don't stumble upon it. Not quite the way you want your user data to be protected. And of course, the outcomes of this is sensitive data exposures we've discussed. Many of these are gonna come out from a security misconfiguration. And this is simply a misconfiguration anywhere that can lead to a compromise. It's usually, again, in the application of the server. It's moderate risk. Sometimes it might mean nothing. Maybe it just means that Google is indexing your staging site and you don't want it. Maybe you got mad at the staging site and your test data and there is some colorful language and all of a sudden Google's indexing that for your client instead of their main site. That is a security misconfiguration. That is getting out data on your client that shouldn't be out there. These are really easy to exploit. If you go into the reading settings, maybe it's something as simple as checking the little box that says don't allow crawlers on the site. Maybe it's something as simple if you have a membership plugin of checking the right box that says the site's a private site or leaving the wrong user with the wrong access credentials. These are very simple and they're all throughout. From a developer point of view, maybe this is leaving the untrusted SSL certificate on because you were testing and you didn't want to pay and you haven't figured out let's encrypt yet. There are numerous ways in which this can be exploited very quickly. So watching out and dotting your eyes, crossing your T's become very important. This is the biggest one. And developers are probably more guilty of this than most. We focus on code. We think, hey, I have sanitized all my data. There's absolutely nothing that anybody's gonna put in there.  It happens all the time. And it's a very simple way to create a very big problem for yourself and for your users. Now, of course, that's the simple way to do things. And some of these others are a little bit more difficult, at least if you're not a developer, you're probably not gonna implement them yourselves. And the first one is injection. Injection is simply a vulnerability which lets your server run code that it's not supposed to run. This could be your PHP. This could be MySQL. There's a famous cartoon out by XKCD in which they named the student, the kid's name is Drop Tables with a semicolon. So it goes to the database and it says Drop Tables, which anybody who's used MySQL knows that deletes the database. That's injection on a database. PHP, it's just as easy to run. It also is gonna attack the server and this application. Typically when this is a vulnerability, it can take over, this is the type of thing that can take over your whole server if done wrong. This is the type of thing where they start leaving PHP code in various places that can do things like set up new users for you. Change users for you.  It's very easy to exploit if it's available. These are the types of things that with even the big security plugins, the other plugins you see out there, typically when you see a vulnerability come by and they say everybody needs to update this right away. Many times it's because something can be executed remotely and something as simple that we've used in WordPress all the time. If you've used any of the XML feeds and XMLRPC and stuff like that that uses serialized data, just running unserialized on a piece of data runs code. Now we all have JSON. JSON is a transport mechanism for transporting data from one server to another. It uses JavaScript, but there's nothing executable in it and it replaces in many cases serialization.  It'll run the constructor if you build a class, it'll run the wake function. So you can pass data back to a WordPress site and if that function is there, it's just gonna run whatever code it's told to run. You've now made quite a large hole for your server. And there's ways to make serialization a bit safer but for the most part and most uses I've seen of it particularly in plugins and themes, it can be a very big hole. All it takes is the right post content with something like Postman if you use Chrome or something simpler to exploit a site and take it over if done correctly. And the next one of course is cross-site scripting. First, the first time around we tried to execute code in the server. We wanna execute PHP code in my SQL code. When we talk about cross-site scripting, it's user supply data sent to the browser without validation. It can be executed data, it can be things like executing JavaScript. This can be the types of things where you see people put something in a URL with the alert one or they put a form in the, you know, gravity forms, you can't do this with gravity form so I wanna use them as an example only because we all know the name but if gravity forms had this or any other form plug-in had this you would put alert one in a box, you submit your form and all of a sudden alert one pops up. Alert one being a JavaScript. It's usually a quick test a lot of people do. It puts a little JavaScript pop-up with something on it. Maybe you say hello world or whatever. That's cross-site scripting. It's typically targeting the user. It is of moderate risk. There are ways you can steal user credentials doing this. It's not the easiest thing to exploit. You usually have to go around hunting for it. These are the types of things that once it's found it's why it's so important to upgrade your plug-in.  But it's not something that people typically stumble upon right away. Outcomes here, hijack browser, deface website, redirect user. These are the classics. Bank login forms and things like that. Ways to redirect a user so that you can get their credentials off things like that. Taking their cookie, their login cookie. If it's an admin user, you can use JavaScript to grab the cookies. Sending that back to another server. These are the types of things that hackers are trying to do with cross-site scripting. And they're very simple to do. A little bit of code example. The first one is if is set, get my secret key. This was, the way this would work is you put something in your browser URL with a question mark, my secret key equals whatever. And then you just echo it back to the screen. So you could put my secret key equals JavaScript and spell it out and it'll run that JavaScript for you. Document.cookie. You can start getting ahold of cookies that way. You don't see quite that blatant too often in WordPress anymore. Most of the, especially in big plugins that's one of the nice things about the maturity level of WordPress at this point is at least some big developers are avoiding these types of mistakes. You do see it a lot sometimes in newer developers' plugins or themes that are very custom and maybe the developer isn't quite as experienced. And the second one goes back to, John Block just did an excellent presentation on translatable functions. The second one is actually could be a cross-site scripting example of a problem with translatable functions, namely just underscore underscore my text to translate. The catch is who writes your .pot file? Who writes the translation file? You can put absolutely anything you want. All that does is echo the function. WordPress.org has tools to find it.  If it's a private company that keeps track of its translations, especially a smaller company where maybe they have 30 translations and there's six people in the company, they don't speak those languages. They're not going through every single translation. Almost, I've yet to see anybody do a security review on a translation file. Anything can be put in there. So where John was talking about the escape HTML underscore and underscore, all of his extracredit functions, that's the type of thing you need to sanitize these just as much as you need to sanitize anything else. Like again, you don't see it as much because WordPress.org covers a lot. But on the private side of things, this can get you in trouble pretty quickly. Another one that works, you used to see this a little bit more, especially with really complex plugins and themes is insecure direct object references. The use of a key or name to request an object whereas the target object does not verify the requesters access permission. In other words, I put something in the URL that says user equals and put a username. And I get all the data on my user. Well, what if I just change that username? There's no control over what user I get. So if I wanted somebody in the front row, I'm supposed to see my own profile, but if I wanted anybody else out here and I could just change that username variable, that's an insecure direct object reference. It's allowing me to access data that I'm not supposed to, simply by changing just a little bit. Here's a very simple example. If you had some sort of object that was retrieving users, my WP user and then you have a get user key. Maybe there's 15 users in there you're only supposed to have your own just by changing that user key. You could go ahead and get back the other 14. If you're using WordPress APIs, you're probably safe with this, but this is just like John was talking about with translations. You wanna make sure that you're using your API functions.  Again, WordPress in its earlier days, before these APIs were quite as robust, you'd see a lot of things like this because people were reinventing the wheel themselves. They were having to build this functionality in. If you're up on WordPress and up on what you're developing, you shouldn't have this problem anymore. Here's another similar one. Missing function level access control, which is failure to verify access rights upon access to a specific function. Targeting the same types of things with a moderate risk but very easy to exploit and it can result in data corruption, sensitive data. This is changing the URL. We've all seen login pages where if you go to, we've gone to a website where, well, how do we log into this?  Custom systems are really good at this. There's not so much banks anymore. I've seen universities, I think, is where I've seen this happen the most.  So you start guessing at what the URL is and all of a sudden now you have access to what you needed to do. That is missing function level access control. If they didn't provide it to you as a direct, like they wanted you to access it and it's still available to you. They have no control over that function. There's no control over that access and that's a problem. Here's a simple example that you might see in an older WordPress plugin, something along the lines of my plug-in slash user if they had a user screen. And without checking, you can switch over to my plug-in dash admin and you can edit settings. The particular, the last two are actually an old example I have from an actual plugin whose name I'm not gonna list, but it does happen. It doesn't happen as much anymore but it's simply creating the same access for everybody and just relying on the URL to decide who's supposed to be where. Of course then there's cross-site request forgery. Another big one, this is forcing a login victim's browser to send a forged request to a vulnerable web application. Things like this is how people steal your cookies. This is how people steal session information, login information and things like that in order to use it against you from the front end of a website. You're targeting the user and it can be a fairly moderate risk. It might be something as simple as if it's a simple blog, they deface your website, they get a hold of a cookie passwords they can't use. But it can be, once it's out there it's also very easy to exploit and it can result in all kinds of problems. And it can look very simple. In this case it's just an image. Somebody puts an image in your comments or some other little bit of code in your comments with a get my password string. Maybe that's a little bit of JavaScript or something that runs. Maybe that's something some other type of code. Maybe it's something as simple as you don't really want your competition tracking you and just like at the bottom of every, if you use Jetpack, one of the big issues with Jetpack has always been that little smiley face that everybody hates at the bottom and that's used to track users. Maybe you don't want your users tracked. In which case, that's a perfect example. Jetpack is not a CRSF for whoever's listening live. It is not an exploit. That is an intentional, that is something you're agreeing to when you install Jetpack. But these are the types of things that attackers would do. Maybe if they want your data, browser data, demographical data, a simple image logging all that, the same information Google Analytics could launch could be a problem for your users, especially if you're in a European country or something with very strict privacy laws and you now have a third party breaking privacy laws on you. And of course it can get much more advanced if JavaScript was run, maybe it could steal cookies or something like that, but typically it winds up being just more of a demographics target, at least in my experience in the code I review, but it's still something that you often need to look out for. Those are the basic ones there. It's kind of a fast run-through of what you're looking for. Unfortunately with 25 minutes, I'd love to give a whole lot of code examples, but I do actually have this presentation online as well on my personal site, I will tweet out. And I have an extension to this because I used to get this as a one-hour talk on various different PHP functions you could look out for these specifics, things like eval, things like filter var, things like unserialize with a little bit more of an example on why these can be a bit of more of a problem and how these can be exploited here, and then a little bit more alternatives on how to use them. This is what I have for today. Does anybody have any questions with this? Why is it called cross-site? I always, it implies to me there's like a second site which would really be a different thing. Why is it called cross-site scripting? Oftentimes for instance, the question is why is it called cross-site scripting? Oftentimes if you take my example of if we wanted to track my competition's demographic data, so we put an image on that other site, well that image goes out to a second site to download data, right? So it's sending your data to somebody else. It's sending your data off to a third-party server and it's actually running that exploit, let's say it's just a simple Google Analytics tag, Google's a third-party, it's another site that's running it. Does that make sense? Okay, that's one thing, they'll just like put something into a form field and then boom, you'll get that alert box of something and it's really just enclosed on that one site. That's more XSS. I'm sorry, I'm thinking cross-site request forager. I'm still at the end of my presentation there. Same thing with cross-site scripting there. A lot of times, if you just did an alert, one is in demonstration, you're fine, you know it's vulnerable, but what if I put in document.cookie or href equals or window.location equals and started taking you to other sites that looked similar. Or what if I took your cookie and sent it off via a post-request or something along those lines. You can steal all kinds of data, you can get access to sites, you can do all kinds of things with cross-site scripting, mostly by sending data to other third parties and then using that data back against you in a lot of cases. I can't even sleep anymore again. Glad I could help. You mentioned about damages to small businesses or websites, one of the things Malware does is tell the SEO because Google penalized them. They may not know about it, so they don't have that massive tool. They may have a totally useless website because they're the index out of Google because the malware may be in the nobody. My comment is, I deal with this a lot. I'm always looking at logs. And I see in my access logs, www.com slash, and they put junk in the back of my URL.  Do you have an idea of what they're doing there?  It basically has a database of like a dictionary of all the exploits found. They can go back to my old plugin, which is better, WP Security. And when we had a problem, they say, oh, well, if somebody hasn't updated, this is the string that we need at the end of a URL or the right form field that we need to hit, whatever it might be. And it can run through thousands of these different ones that it knows about and just keep running and trying at those. And that's what you're seeing there. Yes, oftentimes you're gonna get hit pretty good. And that's where some of the firewall plugins are really good at filtering those out. Securities are an excellent resource for filtering those out. And there's others as well that are gonna, they're looking for that type of behavior. If they're looking for these bots that are attacking and looking for these exploits, and then they just stop. And then they just stop them from coming to your site. It's hard to be a, to move around with a fixed mic. We have a match, right? So do you think it could be related or, and how can we handle something in this case that, you know, it's keeping, you know, coming back and we don't know exactly where it came from and how will the investigators find out, you know, the problem is everything's up to the agent. Sure, the question was, in the beginning of the month, security released details of a major attack it was seeing across a large swath of WordPress and other use, potentially other users. I can't remember the details. And, but they don't know the cause. That there was no root cause identified. How can we protect against that? The truth of the matter is a firewall like security and something that's gonna protect for you, somebody who's identified that the patterns, it uses what they call heuristics. They're building rules based on what they've seen. So those types of firewalls, cloudflare, security in particular, are gonna be able to see that and keep it from your server because unless you know what you're protecting against on your server, you're in trouble. The question was also, could this be part of the G-Lib C? G-Lib C being a very common library used on Linux servers, could this be related? It's possible. I can't really speculate if it is or not. But if you can prevent it from getting your server in the first place, well, either A, update if you can, and B, if you can prevent it from getting that far, that's really your only recourse in a situation. In some cases, that's really your only option is to monitor and look at your logs, watch what's going on and be proactive. You know your site better than anybody. I could go, any given site in here, if something's weird, I get five hits a day, say, normally on my site. Now, all of a sudden I stuck it in 25,000 hits a day. I'm the one who's gonna notice that even before some of these scanners, it's up to me then to respond and then look at logs and see what's happening. Maybe block IP addresses, whatever it might take in order to react to that situation. In the back there? The question was with secure and some of these, is it better to use a third party type authenticator to log into WordPress? In my experience, no, the accounts usually are still there.  So the type of, unless you completely disable that login form, they're still gonna try constant, the better thing is making sure you have something like fail to ban installed. That's gonna look at the attempts at login, regardless of where it's coming from, and block it there. Does that make sense? Okay. What security, what security plugins or other options do I recommend? If you're looking for best practices, you're a new blogger, you're a new site owner, iThemes Security does a very good job of enforcing best practices. iThemes Security, it is not a firewall. It is not claiming to be a firewall. It's gonna tell you things like make sure all your users passwords are strong, change users, all the best practices that you can do to prevent security misconfigurations and things like that. For true protection, on a plugin level, I strongly recommend Security. They provide a firewall, it is a paid service, but their firewall and their service behind WordPress, its goal is, it doesn't even get to your server, everything goes through theirs, so they can filter out all kinds of things before it gets to your site, and that's really the best way to protect something at that level. Sure. The question is, what would I recommend for IP address filtering that's not necessarily WordPress specific? There's all kinds of, country level gets really weird, because it changes, it's easy to mask. There's all kinds of databases you can buy, and I can't think of the name of the major company off the top of my head. There's a company that sells these databases, and they do them. They subscribe to one of these services for that, but that's very WordPress specific. They get around them so easily now. Exactly. What I recommend is Fail2Ban. If you have a Linux-based server, Fail2Ban, it's a Linux service that you can build in any rules you want, three bad logins. It can replace login lockdown, it can replace jet packs at the server level, and it can watch for anything at all you want. Some guy just hit my contact form 25 times in a row, that's probably weird. So you set a rule up, and you can ban that IP address that way. It's basically sending your own heuristics. It can take some configuration, but for a local something that you can install that is not WordPress specific, that's probably your best bet. And of course, Security has solutions for non-WordPress sites as well. Man, excellent question. The question is, what resources do I recommend for developers to prevent these? The whole idea here is developers preventing XSS, and these are the things you're looking for. 10-UPS engineering best practices, which are public and are all available on GitHub and the 10-UPS website, probably one of the best out there. The WordPress Codex. Using things like standard WordPress APIs. If you wanna build it, if you want the feature, if you want access to a piece of WordPress, there is documentation either in the Codex or someplace close by that's gonna help you do it. WordPress coding standards. If you use PHP Storm, Sublime Text, Adam, you can actually download all of WordPress's coding standards and you can set them to the VIP level. It gives you a few false positives, but what it's gonna do is it's gonna flag all kinds of things through your code that says, oh hey, you're directly accessing a Git variable here. Check this. It's gonna say, you're using JSON and code, instead of WP JSON and code. Check this. It's gonna go right up and down the line and it's gonna, well it's gonna annoy the heck out of you if you're using another project you've been building for a while the first couple of times, but it's an excellent tool, it's free, it's on GitHub, it works with PHP Code Sniffer, very easy to install, and it'll watch all that code for you. It's not gonna fix it for you, but it's gonna give you tons of warnings that you just simply didn't know were happening before. That's WordPress's coding standards. I'll tweet links out for this after as well, and it's combined with PHP Code Sniffer. It's a linter for PHP that does a very good job. It's not built in, PHP Storm can support it, you still have to have Code Sniffer installed, and you can install it as a composer package if you use composer, and then the WordPress coding standards, it's literally a link, it gives you one command to set that part of it up. I think we've got time for one more question. How they do it. So I'm looking like I have the encoded stuff that you talked about, I'm searching for that. Do you know a place where I can find signatures, or what I can use? All my own examples I've built over years of reviewing code and cleaning people's sites. I've never seen anybody for very legitimate reasons, not even business protection. That's probably data that they don't want available. You can use open vulnerable or CVE database and things like that for general. Sometimes they have exploit codes, sometimes they don't, it depends on who's releasing it. But more often than not, I'll look to see if it's a legitimate vulnerability, but if I'm cleaning somebody's site, I always save the code snippets and log snippets and that's really where I've found to be far more reliable than a lot of the databases out there to be honest. Or there was the first talk this morning was also a product that does code scanning, automated code scanning. So maybe that's something that would also be worth looking into. Unfortunately I missed half his talk. I can't say too much on there. But that was very specifically what they did as well is they actually have a product that you could purchase to scan it. Anyway, it looks like I'm out of time, so thank you all very much. If you have any questions, I'll be happy to take them outside of here.


What is going on guys welcome back to the channel and I appreciate you being here today I bring you another destiny 2 video and today I bring you this quick little guide on how you can obtain yourself the new exotic fusion rifle or the fusion blaster The Jotun but before we go any further guys if you do enjoy the video and would like to show you support You can by hitting that like button and if you are new around here and enjoy daily destiny 2 videos be sure to subscribe Okay, so the Jotun exotic fusion is another exotic with the black arm with DLC Surrounded by mystery we until this point have not known where this exotic drops But in actual fact this exotic is obtained quite easily Well, I say easily it still includes the RNG, but it isn't tied behind any crazy quest That's for sure so this weapon which has already dropped much like the laminar exotic bow It drops alongside the completion of a powerful weapon frame Purchase from Aida one using a ballistic slug These you can acquire to per week from completing her weekly bounties once obtained Grab a gold powerful weapon frame from Aida one now at the moment The Jotun has only dropped in the latest bergusia forge, but there were reports of people getting the laminar Exotic bow from other forges other than the is an army which it was released into the loophole alongside So don't quote me on stating the Jotun is tied to the Bergusia forge But at the moment it's the only place it has dropped So if I were you and you want to chase this exotic do your powerful weapon frames here until it's confirmed whether or not It drops elsewhere So yeah guys It seems that all the Jotun is unlocked the same way the laminar bow was and it's been time-gated to drop with or maybe alongside the bergusia forge upon completing a Powerful weapon frame and on that note guys. We have come to the end of video I told you it was quick I told you it was shot if you guys enjoyed it leaving a like really helps out and if you're new around here and enjoy daily Destined videos like guides top fives gameplays reviews just about everything make sure you subscribe And if you never want to miss a video I upload turn notifications on by hitting that bell button But again, thanks as always for stopping by and hopefully I will see you on that next one


It is looks good.  He needs Corbin. I I don't have a donkey and you false that it's good I'm a Twitter Patron official Twitter account when develop your notifications ward bang Well when you did that the Sun shined on you like a glorious condensation of glory But today a new trailer dropped, I believe yesterday night our time So we're just getting into it today because we like sleep But it's a Netflix trailer for a new film coming out May 1st. It's called Mrs. Serial Killer It's with Jacqueline Fernandez, which doesn't sound like a Indian name and then Manjul say his last name Rick Think it's Minaj Yeah, yep Bajpayee we've seen him in multiple things He's the he's in Gangs of wasp her He's a he's in the family man that that show the family man. He's in that one with the professor Alagara Alagara with the with the gay professor and the reporter Moms in the family man. Oh my god Anyways, we've seen him. So this is his new trailer. So you ready? I actually That picture I posted on Instagram of me was set a rare photo of me with Corbin's mom. Uh-huh Somebody commented that's not nice It's true. There's more juicy content on our Instagrams and Twitter's folks. All right. You ready three two one go Who you talking to you freak Defendant will remain in custody without being Joy innocent I Hello, police station Hello But remember Interesting it looked a lot like a Cinematographers like real Yeah, did he say like there was like every single shot was hyper Stylized and beautiful Well, it's obviously that's the style of the going for it's prettier than reality Which is a style that you can go for as long as you stay consistent to it right the writing seemed a little Cheesy at times to me. Did it seem like that to you? No, nothing specifically stuck out to me either with it being cheesy or being anything particularly riveting per se Yeah, I'm I'm I'm interested in that. I can't figure out Mrs I mean obviously there's something going on with this woman and yeah, and it's very rare You see a woman in the role of a potential or yeah playing a crazy cycle and there were several instances with a woman or women in Situations were like the one shot of her coming down the hall and she's doing kind of a weird dance So it's very I'm I'm interested primarily to see the potentiality of an actress playing a psychopath like this It's not like I love that. I like Minaj or however you say his name Yeah, he's really good Yeah, I know his clout in India T's everybody says he's one of the best in India that we just haven't explored enough yet But the the stuff that was weird to me was the Almost the dialogue sometimes was seemed a little cheesy like stuff. I've heard before like hello. Are you there? Hello Like that stuff that I've heard a thousand times that I'm hoping it's not just a rehashing of right every other Psychological thing. I'm hoping that you know, you'll throw something new in here and Netflix usually would because they can do whatever the hell they want Right So it's not like they have to stick to a formula Family-friendly you could be as gory as you want. You could be as sexual as you want You could be as bloody as you want because your Netflix You don't have to I would subscribe to a television network or a sense of This is one that I would totally be dependent upon stupid babies saying Jump if they're jumping up and down then I'm I'd watch it if they're saying avoid it. I'll avoid it. Yeah I don't know who Jack Jacqueline for me that just does not sound like an Indian name. Hold on No, Jacqueline Fernandez. It doesn't in any way shape or form I mean she could be Indian and maybe she's married and she's married to a Fernandez and her last name was saying, you know Maybe because yeah, that sounds Mexican or Hispanic. It's what that's yeah, I do Yeah, that's an Hispanic last name Jacqueline Fernandez. Let's see. Hold on TV episode TV episode white interview Did you say did you say white interview? Oh, that was just I was reading off her her stuff Okay, so she has something on there called white interview So, yeah, I think she's Indian but So she was in Aladdin kick race three not not the india the disney Aladdin The Indian one household too. So she's done quite a few Um Things I don't know of her at all Uh and what type of an actor she is Um So you guys would have to let us know that because I I have no idea Um, I wasn't blown away by anything she did except for I like having a character like you said in that role Yeah of a serial killer. Yeah, I love serial killer roles Especially if there's one that's a lady because there's not usually a lady serial killer I think I'm glad I think almost I'm glad you what? I was just I'm glad you added the word Roll at the end. I thought you were gonna say because I love serial killers. I love them. They're so fun Great at parties But I think almost like every serial killer ever has always been man right I think the predominant proportion of them is definitively male like rapists. Yeah, I it's not it doesn't I mean there are some women that have done that but for the most part. It's the dudes. Yeah Yeah, that'd be I can't think of a one Famous female serial killer, but I I don't I don't study them.  Obviously you guys haven't seen this because it didn't come out till May 1st But let us know what you thought about and let us know about the people involved in it If you think it's going to be worth a watch because we don't know where morons Yep That's it