privileged to focus on faith with Jennifer and States, the dentistry process last year, and with so much work as students and faculty. So, our next group of panelists will continue to explore a sort of approach to climate culture, but will focus on their ongoing work on university and college campus, please. Sorry, technical difficulties with our new set up. Campuses are dynamic places that people gather to learn, educate, work, and live, in relationship with each other and with the institution. There is a sense of development, growth, possibility, and transformation. These centers of excellence have the potential to create culture and shape the leaders of tomorrow for the betterment of all. These are very powerful aims. However, all over the world, examples and our own experiences have shown us that these spaces are also particularly vulnerable to harm and trauma and that our students are at risk. Sexual violence, discrimination, inequality, and harassment are all intersecting issues profoundly impacting our campus communities. Of course, these issues exist everywhere. They're socially embedded off campus and on. Yet, I would argue that as sites of education and transformation, universities and colleges have a particular obligation and responsibility to make a difference and to work toward social justice. As institutions, we have a responsibility to build just and healthy communities, communities of belonging and safety where students can learn and grow, contribute, and thrive. The issues we are speaking about can be challenging and complex. Addressing these issues can be even more so. We know that adversarial campus processes responding to violence and harassment can be experienced as harmful by those very individuals we are trying to support. We also know that, like the criminal processes that Lee described, they have not had the desired effect in terms of changing culture, creating healthier relationships, and preventing occurrences of violence, or in making more equal communities. Our panel this afternoon, comprised of experts from both the US and Canada, will share with us their insights on restorative possibilities and strategies to respond to harm and to shift campus culture. Donna Coker is a professor of law at the University of Miami School of Law. And she will speak about the transformative potential of restorative approaches for individuals and relationships after an incident of gender violence. David Karp is a professor of sociology and director of the Project on Restorative Justice at Skidmore College. David will explore the contrast between adversarial conduct processes and how they have a chilling effect, lowering recording, creating hostile climates, and on a restorative approach with a restorative approach that can better meet students' needs and improve climate. Jake MacIsaac, community safety officer with the Dalhousie University, will discuss restorative approaches to campus safety, and particularly moving a campus security services team from a transactional to a transformative service model. Karen Cromby, general counsel at Dalhousie University, will consider how institutions can use policy to create space for restorative approaches, rather than potentially acting as a barrier. Thank you very much to our speakers.


So, we will continue our discussion with first passage and first return probabilities, how to compute them and so on. So, I just recall quickly that your f i j 0 will be 0, because they cannot be any transition in 0 time. Then f i j 1 that means the first time j is reached from i in one step. So, that will simply be p i j. So, the first step transition probabilities are your first time transition probabilities also. And then for the for f i j n we wrote down this formula through which we can recursively compute the f i j. So, you see f i j n will be p i j n minus sigma k varying from 1 to n f i j k into p j j n minus k. And I had explained last time also that you see we are because p i j n simply gives you the probability of transitioning from i to j in n steps. And it does not and you in between you could number of times have visited state j. So, all that is included here because we were computing all possible path from i to j. So, that may include going to j and then staying over j and so on. And then going from j to somewhere and then coming back to j and all that. So, now we will want to subtract those probabilities from p i j n to computer f i j n. And so this says that here this is the first time in k steps you transition from i to j for the first time and then from j to j in n minus k. So, this again will include you know going from j and coming back to j, but in between also you can visit j any number of times. So, this p j j n minus k and here this is you have already reached j in k steps and then all this is happening because you are computing the transition probabilities up to n. So, therefore, we have to subtract.  So, n minus k steps you will be doing this, but in k steps you reach j for the first time from i. So, we have to subtract the possibility of traversing all such paths from this one to be able to compute the first passage probabilities. And so that is what we are doing. So, I thought that I will revisit this and explain it much better. Now, we can solve these iteratively from these equations given the initial conditions here. So, but then we need the p i j n are available for all n to compute this. So, just look at this example again the job assignment problem we have p square is this and your f 1. So, here we are using the notation that now just as p is the matrix of one step transition probabilities p square is the matrix of two step transition probabilities. We will also denote the first time first passage transition probabilities as by the matrix f 1 then it will be f 2 and f 3 and so on. So, if you want to compute for example, f 1 2 1 what am I doing here this is f 2 1 2. So, you want to compute the probability that you transition from 1 to 2 in two steps. So, this will be by the formula p 1 2 2 minus f 1 2 1 p 2 2 see here the formula here. So, therefore, you reach that means the one step in one step you go from 1 to 2 and then you have to stay with 2 because there is only one step here. And therefore, if you compute this you get 3 by 16 right. So, now what you see is that you have to. So, therefore, now using this formula you can compute you get the matrix f 2.   And so this is lot of work and so I will give you now alternative method of computing these first passage probabilities without wanting to also without wanting the higher powers of p just the first transition matrix would be enough. So, the alternate way now the alternate way is see what the way we explain this is now look at it as one step. So, f i j n I am writing as sigma k varying from 1 to n p i k. So, you one step you transition right in the beginning you are starting from i. So, suppose you go to k. So, that probability is p i k and then from k you can the first step transition probability I mean first passage transition probability k to j in n minus 1. So, that means k is varying from 1 to n. So, of all possible states you starting from i and you may go to some other k and then from k you want to go j for the first time. So, here you will require n minus 1. So, you see if you have already computed your f k j n minus 1 then you can compute your f i j n by using the first step transition probabilities. And so this is a liter and more efficient way of computing your f i j n recursively. So, the argument is because I have to move out from i to some this thing and so k should not be j obviously, because I have to visit j for the first time. So, but then that means I will definitely visit some other state from i to k in one step since I want to visit j from i in n steps. So, in the first step I will definitely go somewhere which is state which is different from j and then I need f k j to n minus 1. So, from k to j I should visit j from k for the first time in n minus 1 steps. So, this is a liter way of computing your first passage probabilities. And now here we just need the one step transition matrix p and of course, we are computing these f k j all of these before I compute f i j n. And so here again just doing the same exercise. So, if you want to compute f 2 3 2. So, then this will be simply p 2 1. So, remember your k does not have to be. So, your k cannot be 3. So, k can take the value 1 and 2.  And so by taking the values because this is only p 1 3.   So, here your j is 1. So, your k can be 2 and 3. So, this will be p 3 2 into f 2 1 plus p 3 3 into f 3 1. And what is happening is that what is p 3 2? p 3 2 is 1 by 4, but then what is f 2 1? f 2 1 is p 2 1. So, p 2 1 is 0. So, this is 0 then p 3 3 is 0 into f 3 1. So, this is 0. So, but then you see remember I have not drawn the diagram here, but if you remember the path 3 2 1 does not exist because you did not have the arrow from 2 to 1 in the job transition this matrix because this is 0. So, you do not have the arc from 2 to 1. So, therefore, this path does not exist. So, anyway this you cannot transition from 3 to 1 in 2 steps first time first time from 3 to you cannot reach from 3 to 1 for the first time in 2 steps in 2 time periods. So, this is definitely a better way of computing your f i j n. So, now, once you know this then let us talk about the mean first passage times. So, remember n i j we have denoted as the number of transitions that you require for going from i to j for the first time. So, then the mean first passage time will be expectation of the random variable n i j which you will write as n from 1 to infinity n f i j n. And when you put i equal to j then it will be m i i which will be the mean recurrence time. And this we have said is equal to 1 by pi 1 by pi i. So, the steady state probability of being in. So, this is the proportion of time being in state i over the long run. So, 1 by pi i would be the mean recurrence time. So, that will be the time required for reaching. So, on the average this is the time that you will require for reaching from i to i for the first time. Now, to compute m i j's you would need the first passage time distribution. So, you need to compute you cannot apply this formula because you have to then have all f i j n. So, again we will look at nicer way of computing your mean recurrence time and mean first passage times. So, as we said that to compute m i j by the formula where you need all f i j n up to infinity is not practical. So, let us now come out with another method for computing these mean first passage times. So, you see we will condition on the state at step 1. So, see what happens is if you are computing the mean first passage time then either the transition from i to j takes in one step. So, then this is 1 into p i j. Remember you are computing the expected value of f i j n. So, m i j if it is one step then probability of transitioning from i to j in one step that is p i j. So, 1 into p i j. So, either we will transition from i to j in one step and therefore, 1 into p i j or we go from i to k in the first step because since it has to be either we transition from i to j in one step or from i i go to some other state and then from k i will transition back to j. So, then it will be once I do this then the passage time becomes 1 plus m k j because m k j is the mean time of going from k to j and so 1 plus because one transition has already taken place. So, the mean time of transitioning from k to j for the first time will be 1 plus m k j and into the probability of transitioning from i to k where k is not equal to j. So, this should be clear. Now, we just rewrite this expression because you see here you are summing with respect to k and k is not equal to j. So, p i j is missing which is available from here. So, when you add up p i j plus sigma p i k k not equal to j. So, this whole thing is the summing up the components of the i th row of the first transition matrix which must be equal to 1 because from i you have to transition to one of the states and therefore, this is 1 plus sigma m k j into p i k k not equal to j and we can rewrite this as summation p i k into m k j where k is not equal to j. So, this is now again as I said the way can be computed your formula for f i j n. You know this is also a simple way of computing your m i j without really requiring to have the whole distribution for the first passage probabilities f i j n. So, these are n equations and n unknowns. I think n unknowns means in the sense that you are asking for this m 2 j and so on m n j. So, you are asking for the first transition passage to j from any one of the states 1 to n. So, these are n variables and because your i is varying from 1 to n and then in n unknowns n equations in n unknowns. Now, similarly we can also compute i i i can also be obtained this way. So, the first mean first recurrence time can be also obtained by solving corresponding set of equations here and let us so just work out the formula this will be. So, if you want to compute m 2 3 then m 2 3 will be 1 plus and remember your k is not equal to 3. So, k can take the value 1 and 2. So, it will be p 2 1 into m 1 3 plus p 2 2 into m 2 3. So, now in order to compute m 2 3 I need m 1 3. So, I will write down the formula for m 1 3. So, m 1 3 will be so here again k is not equal to 3.  So, then 2 equations in 2 unknowns and we can substituting the probabilities p 2 1 p 2 2 p 1 1 and p 1 2 I get these equations. So, it is not difficult because from here you get you know like half m 2 3 is 1.  So, this is 3 by 2 and when you bring this to this side let us see m 2 3 is 2. So, this is 1 by 2. So, this is 1 by 2 and this is 3 by 2 and this you bring here. So, this will be half m 1 3 is equal to 3 by 2. Therefore, m 1 3 is 3 it is not just 3 by 2 m 1 3 is 3 yes from here you can again substitute and make sure. So, m 1 3 is 3 this is 3 by 2 and m 2 3 is 2. So, this is what is the mistake take care. So, this is equal to 1 plus m 1 3 we are saying is coming out. So, this is 3 by 2 plus take care and this is half this is 2 plus 1 3. So, m 1 3. So, therefore, that was the right solution. So, this is m 1 3 is 3. So, working out always helps you because you can find out your. Now similarly, let us just look at the way we compute m 1 1. So, the first mean recurrence time for going from state 1 to 1 and here again your k cannot be equal to 1.  So, 3 unknowns are there. So, therefore, 3 equations m 2 1 will be 1 plus again your k is not equal to 1.  Let us see m 1 1 comes out to be pi by 2 and if you remember your calculations for pi 1, pi 1 was 2 by 5. So, the steady state probability of being in state 1 was 2 by 5. So, the mean of first passage time will be 5 by 2. Now, m 2 1 comes out to be 4 and m 3 1 is 2. So, I hope this is the right calculation because let us see if you want to do it here just verify. So, if m 2 1 is 4 then this side is it is 1 plus 2 and your m 3 1 is 2. So, that is also 1. So, that is 4. This is coming out to be high because remember there is no arc from 2 to 1. There is no direct arc from 2 to 1. So, you can of course, go from 2 to 3 then 3 to 1 for the first time. So, that is 2, but then other parts when you go around it will be you know. So, the mean first passage time is coming out to be 4 and m 3 1 is 2. So, now we will see of course, see the thing is that as I said when I was computing the steady state probabilities and the mean first passage times there are certain conditions under which these are valid. So, we now have to look at the situations where these things may not be valid and in fact, I have said that you know these may not even exist and so on. So, we will now start looking at. So, right now under certain conditions which we have to specify and we will do it soon. So, I want to show you that this will be true all these ways of calculating your steady state probabilities and mean passage first passage times and mean recurrence times. You will be doing it under certain conditions they are valid and when they are not valid then we have other quantities to define those states. So, we will talk about it. So, let us just recall what has been done so far. See, we said that limit probability x n equal to j given that x naught is i is actually limit p x n equal to j and then we define this as pi j. So, this was the tacit assumption that this limit exists and that it is independent of the initial state and therefore, we said that you can solve these pi j's through a system of linear equations and that is what we did. So, but this was under the assumption that this limit exists, but now it is not really true that this will always exist and this is what we need to now talk about and find out. So, therefore, that means our you know the linear equation method of solving the pi i's depends on whether this limit exists and that we said that this limit is also independent of the starting state and therefore, we could write down the system of linear equations and say that the solution will exist under the condition that sigma pi j is add up to 1 and therefore, things were simple life was easy. So, therefore, we will now look at the conditions under which this limit exists. Second is that so the recursive formula for f i j and that we wrote down this formula is valid. Here, we are not asking for any limits or anything because the powers of p can be computed and then therefore, through that you can recursively compute your first passage probabilities. So, that is valid, but here and the m i j again because remember I am saying that the m i i's the m i i will be equal to 1 upon pi i. So, there again the existence of pi i is assumed and even otherwise. So, the linear equations for solving your m i j's also needs to be examined under what conditions it will be valid, this method will be valid. So, let us start looking at examples and then we would want to talk about we start talking about the conditions. So, first suppose so now, you again consider the job assignment problem and you see that the matrix P 2 had got all entries positive. In the first transition matrix there were some zeros in the sense that you were not able to go from 2 to 1 and you did not have a loop from 3 to 3. So, you had 0 entries, but when you took the square of the matrix then all entries became positive and after that your P 3 was also all entries were positive. So, this implies that there is a path from remember because this is simply a transition probability in 2 steps from i to j. So, if it is positive that means there is a path from each i to each j and in such a case when you have a path from i to j and then you have also have a path from j to i because P i j 2 is positive and P j i 2 is also positive since all entries are positive. So, you have this you have a path here again from j to i with positive probability. Such a pair of states is said to communicate with each other. So, they said they are said to communicate and if all states communicate with each other and so now because P i j 2 is positive for all i j. So, we conclude that all states for the job assignment problem communicate with each other and such a chain or such a Markov chain or process is called ergodic and we will talk about this some more. So, but first let me say that. So, now what we will say is that we will define a closed set as a set of states which communicate with each other and for the job assignment problem it turns out that your closed set actually consists of all the states 1, 2 and 3, but it is possible that you may have more than 2 closed sets or 3 closed sets whatever it is all states may not form one closed set. That means all states may not communicate with each other and now let us look at this example here. See this is your transition diagram. So, you see that 1, 2 and 3 you can see that they all communicate with each other. There is a path from 1 to 3 from 3 to 2, 3 to 1 and so on and there is a path from 4 to 5 and 5 to 4, but there is no path from 1, 2 and 3 to 4 and 5 and this you can of course see the thing is that I have drawn this diagram with 5 states, but when your number of states is large the transition diagram will be very big and it may not be again same problem as I was talking about earlier that you know you cannot possibly enumerate all possible paths when you have a large number of states. So, our recourse is to taking higher powers of p now. So, let us start and of course here it is evident that these two. So, therefore, your two closed sets are 1, 2 and 3 and 4 and 5. So, this change is definitely not all the states do not form a closed set right. So, let us see let us start with p the transition matrix. So, you see there is no arc from 1 to 4 or 1 to 5 similarly, there is no arc from 2 to 4, 2 to 5 and from 3 to this right and same way there is no arc from 3 to 4 to 3, 4 to 1, 4 to 2, 4 to 3 and 5 to 1, 5 to 2 and 5 to 3 there is no arc. So, this is the 0's and let us see if when we take the second power that means p square then these 0's remain intact. These probabilities change right these 0's like this 0 goes away, but this and then again when you take p 3 these 0's do not go away right and here it becomes. So, therefore, now you can say that for among the states 1, 2 and 3 the closed set 1, 2, 3 now you have path from each node to the other two nodes because these are all positive right. So, they all communicate. So, it means you need at least three transition steps to see that there is a path from each of the nodes 1, 2, 3 to the other two and similarly here is of course, quite clear. So, this is also you know all the probabilities are positive here and therefore, so and you see that this structure will continue no matter what higher powers you take of p right. You will continue to have 0's here and 0's here. So, therefore, this is the situation where the all the states do not form a single closed set and in fact, if you have more than one closed set we call such a chain or a process reducible right and if all states form a closed set one single closed set then it will be irreducible. So, what we have been talking about so far has been irreducible chain and irreducible means that all states will communicate with each other and therefore, it will also be ergodic. So, but again even this classification is not enough we need to do it further and so continue the discussion. So, if a single state forms a class that means there is only one state in a class it is called absorbing because obviously, the state is not communicating with any other state it is just communicating with itself. So, then it is called absorbing that is so the once the system enters an absorbing state it will not come out of it. So, we will just look at the examples for all these all these the kinds of states that we are talking about. Now, from the 5 by 5 matrix of the 2 of the 2 closed sets we just looked at this example in which you had 2 closed sets as formed by the states 1 2 3 and the states 4 and 5 right remember there was no communication between the states 4 and 5 and 1 and 1 2 and 3 and vice versa. So, these were 2 closed sets right. So, now the if you look at the sub matrix 3 by 3 sub matrix see because otherwise it is all 0's this is 3 yeah it was 0 and 0 right because there was no communication from 4 to 5. So, in the sub matrix the entry 1 3 was by mistake written as 25 by 36 it should be 19 by 36 because all the rows the elements of any row must add up for a transition matrix must add up to 1 and so with 19 by 36 the numbers 1 by 6 plus 11 by 36 plus 19 by 36 add up to 1. So, make that correction and in p 3 also the same correction has to be made because this mistake got carried over from p 3 where it was by mistake written as 25 by 36 and not 19 by 36. So, you see that the sub matrix itself. So, now the case that we were talking about that your matrix P n in the limit will converge to where the rows are all identical sorry states k 1. So, this was a pi 1 to pi k and so on. So, all rows were identical remember we this is the case we had talked about, but now you see it has no meaning here right because the rows these 0's will can we remain forever. So, we cannot say that the rows will become identical well in the sense that these 3 rows will become identical maybe you can say, but then below here you have 0's right because again 1 2 3 4 and 5 are not communicating with 1 and 2 and 3. So, you will have 0's here and then you will have some positive entries here. So, therefore, you cannot say that the rows will become identical right these 3 rows will become identical exactly that is what I want to show you that if you this is p 3. So, p 3 this is 1 by 6 pi by 24 and 1 by 8. So, supposedly this number will go up a little and this number will also go up because you need 6 pi 24 is 1 by 4. So, you need 1 by 4. So, supposedly you can see that the numbers are closed similarly 11 by 36, 7 by 24 and 1 by 3. So, 1 by 3 is 8 by 24. So, therefore, again the numbers are getting closed and similarly here. So, you see that means these 3 closed states they themselves will satisfy the condition that the steady state probabilities you know you can compute the steady state probabilities and here it will not matter in which the system started. But to say that all the rows of the 5 by 5 transition matrix will converge to the same values would not be valid. Now, again this big example I have taken from Rabindran Phillips and Solberg and so this is a 8 by 8 transition matrix and the diagram I have drawn on the other board and see I have written down this matrix though I am not making use of it right now. But it will be a good exercise for you people also to sit down and try to if you can write a small I am sure from Matlab and so on. If you feed this matrix you can get different powers of the matrix. So, it is not too much of a problem getting higher powers and then whatever I am saying you can also conclude the same things by looking at higher powers of p. But in any case if we draw the transition diagram it will look something like this right and I am not writing down the probabilities because they are here and anyway it will clutter up the diagram. We just need to look at the connections and whatever I am concluding from that is enough I do not need the probabilities really except that this p 6 6 is 1 right. So, fine. So, now if you just glance at this transition diagram then you will see that 4 5 8 are connected 3 7 are connected and you may say that 2 and 6 are connected right. But then when you go further you see that there is no arc from 6 to 2 and you at when you reach 6 then the probability of coming back to 6 is 1. So, this is a certain event. So, that means once the system comes to state 6 it just stays there and so 6 is a absorbing state right and so this is not a close set because close set 2 and 6 should communicate and 6 and 2 communicate. So, there is an arc from 2 to 6 but there is no arc from 6 to 2 right. So, this is not a close set. So, therefore, you have 2 close sets which are 4 5 8 and 3 and 7 that for sure because you have an arc from 3 to 7 and 7 to 3 right. Now, 1 and 2 do not figure therefore, this is not a close set. So, states 1 and 2 do not figure in any of the close sets and such states we define as transient because see what will happen is that. So, first of all they are transient and since you have more than 1 state close state in the system. Therefore, this is a reducible system. So, that is another thing. Now, thirdly once the system enters a close set. So, for example, it enters state 5 4 then you see it will keep hopping among these states only. There is no way of going out. There is no arc which is going out of 4 5 or 8. So, system will then for infinite number of times go on hopping among these states 4 5 and 8 and so such states we will call as recurrent because they will keep occurring again and again. So, the moment a system enters a close set then there is no way of going out right because if this communicated with any other state then you would that will also form part of the for example, a 1 a 4 communicated in 1 then this will become a close set. So, that is not true. So, once you enter a close set you cannot get out of it and similarly here if you come to 3 then you will go on going from 3 to 7 or 7 to 3 that is all you just go round and round or because there is no loop here either there is no loop here. So, you will continue doing it and from here if you come to 2 and then you go to 6 then you just stay put in state 6 you do not get out of it. So, first of all now after defining the recurrent state, transient state and an blobbing state you have a close sets what we want to say is that each close set if you look at this itself behaves like now a reducible Markov chain. So, a sub chain of the whole system which is irreducible ergodic in the sense that if you just consider this and similarly if you consider the chain considering of states 3 and 7 then they together form a irreducible chain and this is both of them 3 and 7 communicate with each other. So, talk about further classification is needed. So, now I will give you another classification of these states in terms of first passage probabilities and that will also give you a good understanding and of course, another way of determining whether the state is recurrent or transient or whatever it is. So, now let us define f i as the probability that starting in state i the process will sometimes return to state i for the first time right because f i i n was the probability that it returns to state i from i for the first time in n steps n transitions. So, now when we add up this from 1 to infinity this will give us the probability of the system returning to starting from i returning to i for the first time in any number of steps right. So, all possible. So, therefore, this will sometimes return to state i right. So, that is important. So, this is the probability now we say that state i is recurrent if f i is 1. So, that means there is a positive probability or there is a certain event that the system will sometimes return to itself to the state i from which it started. So, if f i is 1 then it is a certain event right, but if f i is less than 1 then it is a transient state right. So, now you can interpret this as saying that you see if f i is 1 that means the system will return. So, starting from i it will return to itself after sometime and then because it is a Markov process memory less that means the past history is not to be considered then you will again the. So, the whole process starts fresh and then you will again go to other states and so on and then come back again to i and so every time you come back the system starts fresh and since your f i is 1 therefore you will keep coming back to i infinite number of times. So, therefore, the way to characterize this is a recurrent state that means is that once you come to i then you will keep coming back to i an infinite number of times. But for a transient state see what is happening is since your f i is less than 1 1 minus f i is positive. So, this is the probability that the system will not return to state i and so if this is a positive probability then we will say that this event will also occur. So, therefore, we want to interpret this as saying that a transient state will be visited only a finite number of times and so that will be the difference between a recurrent state and a transient state. So, let us just interpret this now you see if the system is in state i for exactly n periods starting in i and you are exactly for n periods you visit the state i again for n periods n times then the probability of that is f i raise to n minus 1 because f i is the probability of x returning to state i. So, that into n minus 1 and again these are independent probabilities. So, that is why I am raising it to f i raise to n minus 1 because of the Markov process the Markov property and then it does not come back to itself. So, I am computing the probability that exactly for n periods it has visited state i starting from i I mean this is I am writing down the conditional probability of starting in state i and then visiting it for exactly n times being in state for n times. So, it is already started in state i. So, now it needs to revisit state i n minus 1 times. So, this is the probability of revisiting state i n minus 1 n times starting and then 1 minus f i is the probability that it will never come back after that. Now, this is and for n greater than or equal to 1 this is now this are the probabilities from a geometric distribution if you recall. So, what we are saying is that coming to itself is a failure and then not coming to itself is a success remember. So, you are asking for the probability in n trials you are asking for the well here this is the best way to say it is that this is not coming to itself. So, that happens once and then this is coming back to itself n minus n times or coming back to itself it is n minus 1 because it is starting in i, but it has been in state i for exactly n periods that is. So, there are two different things I am saying. So, therefore, here you are saying revisiting itself n minus 1 times. So, therefore, f i raise to n minus 1. Now, when you want to compute the mean for this distribution then it will be that means n now varies from 1 to infinity and you compute the mean and it will be n times 1 minus f i into f i raise to n minus 1 and here you can take 1 minus f i outside.  So, this is convergent and this is the arithmetical geometric series you should all know how to evaluate it. We have done it in the beginning of this course and so the sum is 1 upon 1 minus f i whole square and so divided multiplied by 1 minus f i. So, this is. So, there is a finite this is a finite positive number that means the average of a you see if it was to visit itself infinite number of times the mean will not be finite, but here it is the mean is finite. So, that means you can again interpret this as saying that the state will not be revisited in finite number of times only a finite number of times it will be revisited. Now, another way of characterizing a recurrent state. So, you see that we have been trying to talk about the same thing in different ways and that certainly helps you to understand the things better. So, now, let us define i n as 1 if x n is i that means if at the n th time the system is in state i and 0 otherwise. So, this is a indicator wearable and then if you add up sigma i n from 0 to infinity this will represent the number of periods that the process was in state i. So, starting from state 0 sorry from time period 0 the initial time then this will count the number of times the system was occupying state i right. And now if you want to compute this conditional expectation that is given x naught is i you want to compute sigma i n and varying from 0 to infinity the expectation. So, I will exchange the summation sign that means if this thing is finite that means if this exist then obviously I can exchange the expectation. So, this is also convergent that is all I need to change. So, therefore, this is expected value of i n given x naught is i which but i n is equal to 1 if x n is i. So, therefore, this is probability x n equal to i into 1 when you conditional probability of x n given i given that x naught is i. So, 1 times that you will write down and this we buy our definition is p i i raise to n. So, therefore, summation and varying from 0 to infinity p i i n. So, you want to say that sigma i n and varying from 0 to infinity represents the number of periods that the process is in state i. So, now if so once you have computed this then a proposition immediately follows the proposition says that if state i is recurrent that is state i is recurrent if this is infinity because this is the expected value. And if our definition is that the recurrent state will keep revisiting itself infinite number of times. So, then the expected value will also be infinite. So, therefore, this will be infinity and for transient this has to be less than infinity. So, another way of looking at it now see interesting outcome from here is that if the number of states is finite see that is important is finite. So, the number of states is finite then all states of the process cannot be cannot be transient all states cannot be transient. And why because if a transient state can be visited only a finite number of times and you have finite states let us say you have the number of states are 1, 2 and k you have k states. Now, this is a if all are transient. So, this can only be visited let us say t 1 number of times this can be visited only t 2 number of times and this can be revisited only k number of times t k number of times. And now you take max of t 1 plus sorry t 1 t 2 and t k take the maximum of this define this as capital T. And then now when you consider the time t plus 1 t plus 2 what happens because all the transient states have already been visited you cannot review the process has to go on the process has to be in some state at time t plus 1 t plus 2. So, this is a contradiction because if you have only finite number of states and all are transient they will all get visited their finite number of times. And after that beyond that time period the process is going on. So, where does it go it has to transit to one of the states. So, therefore, in a finite process finite process we mean finite number of states all states cannot be transient. So, therefore, immediately the question is asked if the number of states is not finite then is this possible that all states may be transient and yes. So, we will also look at an example and we have already done looked at such a process, but we did not really talk about this aspect of the process at that time. So, yes if the number of states are infinite then the all the states may be transient.


Guide to Teaching Receptive Skills in the EFL Classroom When students learn English as a second language, there are two types of skills that they work towards obtaining proficiency of, receptive and productive skills. As an EFL teacher, you need to understand how to incorporate the learning of these skills into your lessons, and this guide will help you with that. Within the category of receptive skills, there are two types of subcategory skills the English language learner works towards, proficiency in reading and listening. There are two reasons as to why the student would want to gain mastery in these two receptive skills. The first motivation is for a purpose, the use of English when reading and or listening for a purpose helps the individual achieve a specific goal or objective. Motivations for the students An example of this particular motivation for receptive skills is seen when someone is reading an instruction manual regarding how to put a chair together, the individual is a reading the manual for a purpose. The second reason why an individual would use receptive skills is for entertainment, this means the individual is listening in or reading information because he or she finds it enjoyable. An example of this specific motivation for the use of receptive skills is recognized when someone is listening to the radio, the individual is listening to the radio for enjoyment. Challenges for the students While it is helpful for teachers to become aware of the motivations that students have for learning English, it is also key that teachers understand the challenges that come with learning receptive skills.  In regards to reading, it is easier for students to understand the language because the text is revealed on paper and can be read over as often as need be. On the other hand, listening presents more of a challenge for language learners. When listening to the language, it is only heard once, which limits the amount of time the student has to interpret the meaning and think about the language that is presented. Planning your lessons considering the motivations and challenges With the knowledge of both the motivations and challenges that language learners face, it is vital that teachers incorporate these understandings within their lessons. In order to successfully teach English to language learners, teachers must approach their lessons with some specific plans in mind. First and foremost, teachers need to choose material that is interesting and motivational for their students as a means to maintain their student's attention throughout the lesson. Prior to their lessons, teachers must build interest for their students. This can be portrayed through engage activities that allow students to discuss or make predictions about the topic. Before a lesson, teachers must also pre-teach vocabulary so students can gain a better understanding of the unknown language and structures that exist within the lesson. Throughout their entire course, teachers must make sure to vary their material types so that the range of materials provides students with the opportunities to practice different skills. In order to aid students greater understanding of receptive skills, it is essential that teachers use realistic comprehension tasks. These particular tasks can be depicted through jigsaw reading or jumbled texts. Ultimately, throughout every lesson taught by the teacher, activate phases that lead on from the text must exist so that the student's knowledge of receptive skills continues to grow. Are you ready to teach English abroad? Overall, it is essential when teaching a language that the teacher gains a better understanding of his or her students. No skill or plan can truly be successful unless the teacher takes time to know students' interests and motivations. With a better understanding of the topics that fascinate their students, teachers are able to give more successful lessons on receptive skills because of the student's desire to learn and understand the material. Speak with an ITTT advisor today to put together your personal plan for teaching English abroad. Send us an email or call us tollfree at 1-800-490-0531 to speak with an ITTT advisor today.


Welcome to the weather forecast for the week beginning, Wednesday, June 14th, 2023. This is Chief Meteorologist John Innsworth for Longmont Public Media, and I thought I'd mix it up a little bit this time and record outside next to the observatory, so behind you is the Cherrywood Observatory. Saturday June 17th is a new moon, so nothing to see there, and the sunspots right now are not pointing directly at Earth. At least not many of them, so it's kind of quiet on the surface of the sun. Speaking of summer, the first day of summer is Wednesday, June 21st, this year, 8.58am is the exact moment of the Inquinox. Looking at drought conditions, things just keep getting better. We have lost more of the drought out here, we just have a little bit on the plains just down here in the southeast corner, but not much. Speaking nationally, we've also seen a lot of improvement in Oklahoma, Texas Panhandle part of the nation, and everything else is doing pretty well, so that's good. Of course, smoke has been making the news, especially in the east coast. We have fires up in this part of Canada and fires in the northeast or eastern part of Canada, and just over the last couple of days some of the smoke has been wrapping back around and reaching Colorado. But Southwest winds, we're going to look at in just a moment, are heading in to push that back up to the Great Lakes and northern plains. Let's do our animation of Snowpack, and it's above, much above remember, and then as we seasonally go back down to no snow, we're still above normal. The cool temperatures and the copious amounts of precipitation have given a higher peaks of bump in snow, so we're still above normal as we enter summer. We'll probably look at this one more time, and then we will be in summer. Okay, precipitation, this is just shocking. Look at this, reds to purples are 6'8", and even above 10 inches of precipitation to the southeast of Denver, not on the plains. Western slopes, kind of missing it, but they are getting at least a little bit of moisture, and they're great snowpack, put them ahead for the year hydrologically, so they're doing still okay, even without precipitation happening out there, but the front range and I-25 corridor is just amazing. Okay, take a look at the animation of severe weather climatology. We have pretty much a peak right now. This is going to be our greatest chance of severe weather, and we've been having a lot of hail, there's, I guess, just about every roof south of Loveland, and even into Denver. This is going to have to be replaced in the next couple of years. We wouldn't do it yet, so don't, you don't get the roofers up there yet, because we still are in the middle of it. Speaking of severe weather, we have just a chance of convection on Wednesday. A big tornado outbreak is likely down here in the southeast. That inches back towards us, as always, they're kind of conservative, so the, when the day arrives, when it arrives, this could be drawn a little bit further to the west and north, and Friday, it's nearby. Colorado Springs, not up to Denver, but that could change when we get to Friday. We're getting some breezes here, hopefully that's not picking up on the mic. Looking at the surface map, you can still see a mix of snow and rain at the higher elevations. This is Wednesday, kind of dry on the plains for Wednesday. But then everything is getting storms again on Thursday with mountain snows. And then Friday, very similar, Friday should be quite wet. We'll take a look at that in just seconds. Here is our normal temperature on the ensemble, going from 82 up to 85. We are definitely heading into summer. 52 to 56 is the normal low temperature, so we're just feeling great if you go out and camp. It was dry on Wednesday, increasing chances on Thursday. And Friday started a, we get a dry spell in the early part of next week, and temperatures get up towards normal, but not that high, well, maybe one day. And then afternoon thunderstorms return later next week. So looking at the water vapor satellite image, we do have a trough coming in the west coast and a flow of moisture of the Pacific here. We still have some moisture coming in at the mid to low levels from the plains. It's kind of cut off right there. I'm taking a look at Thursday noon. We have this ridge to our east, and the first of a couple troughs are starting to come across the state. Moisture increases, and we get widespread thunderstorms Thursday into Friday. That all changes very abruptly on Sunday with a ridge coming back over the state. And let's take a look at that in motion. That's going to really heat us up very fast. So Thursday into Friday, you can see a complex trough kind of getting together and then moving past. This wind does turn out to be a problem. I won't do this outside again, but there's our ridge for the end of the weekend beginning of next week. And there's a big trough coming into the northeast or northwest, but we have southwest flow aloft bringing desert dry, hot air to our direction. That kind of goes up through the northern tier states in Canada, and we get a ridge back with some moisture that will be coming in. So let's take a look at the cool air in place now. It sloshes off. We've got rain-cooled air and thunderstorms embedded in there. Again, a little cool front, but we've got a lot of precipitation cooling on Friday into Saturday, and then that blob moves off. And even with the northwest trough coming in, we warm up pretty quickly in the above normal temperatures at the beginning of next week. Those are southwest flow, lots of cool air out in the west, but we stay warm until the end of next week when cool air comes through and some moisture returns. There's afternoon thunderstorms right there. So let's look at this moisture flow. This is moisture up in the atmosphere, precipitable water. It really is above normal through the end of this week, fueling all the rain and thunderstorms that we'll be getting. Then to Sunday, seeing dry air coming in, especially at east of the Rockies, there's a lot of dry air for the early part of next week, and then we try to get some monsoon type moisture coming in, a little bit of gulf moisture out on the plains. Not really getting here until later in the week. This is a surface moisture now, and right now we've got 40s and 50s for dew points that's very high for Colorado still, so that's our surface fuel for the thunderstorms and rain. The dry air is lurking down here in Arizona, and we get into Monday and it starts to spread up into the state. We've dropped to the 20s and 30s for dew point values, so still lots of moisture not far away on the plains, and that's going to help then get rain and thunderstorms and maybe get rid of that drought problem there. I've got extremely dry air. We've got dew points down around single digits, so you have to go far below freezing to get any moisture to form out of the air on something. I'm going to take a look at the precipitation and move in again quickly on Thursday. We've got mountain thunderstorms moving on on the plains, then Saturday or another round, maybe a little more central-southern Colorado, and then coming into Sunday we dry out. There goes the big truck. Sorry about that. Ah, that's what you get for filming on location. Okay, so over the next five days, there's a strange cutoff of precipitation right here on the New Mexico border, going out 10 days. Still lots of moisture for all of the state, including the western slopes. So 80s for Wednesday, dropping down to pretty cool, chilly, wet, high chances for precipitation on Friday. Oh boy. Being on location is not the best. All right, and then we're still kind of cool on Saturday with chances of storms. Things dry out and warm up quickly next week. Mountain Mount Leader and Broomfield Leader, great local sources of news, and frequent weather updates. This has been your weather forecast. I'm Chief Neal of just John Innsworth. Keep looking up.


This is Witchbase News for Friday the 21st of July 2023. I'm CMDR Buur. In Elite Dangerous News this week, Frontier announced the release date for updates 16 to the game. There's confusion over last week's Community Goal weapon rewards, a breadcrumb trail opens up pointing to the missing Dedican Megaship and more. As always if you enjoy our videos please do hit the like button and if you haven't already be sure to subscribe and click the little bell so you don't miss any of our Elite Dangerous content. You can also join our Patreon if you'd like to help directly support our work. Links to that and everything else are below. In game Galnet News announced this week that the weapons resulting from last week's Azimuth centric Community Goal would be on general release as a tech broker unlock in exchange for some materials from this week onwards. The weapons can be found at all rescue Megaships dotted around the bubble as well as what it describes as azimuth biotech core markets. You'll find them in Isle 13 of your local azimuth, sandwiched between the apples and the hand grenades. There was some initial confusion when those commanders who received them as a reward from the CG noted that the weapons did not include increased armor piercing and distributor draw as was stated in the original CG text last week. Sally was later able to confirm that last week's text was indeed an error on fdev's part and that the modules in fact use an altered overcharge modification which adds to their damage output and power draw as well as including the autoloader experimental effect. The first signs of an end to the mystery of what happened to the Dedicant Megaship surfaced on Galnet this week when late on Thursday it ran a report stating that traces of a distress call from the zealot encrusted Megaship had been detected in the LP714-58 system. In case you'd forgotten the Dedicant was supposed to be transporting peaceful Thargoid loving far god adherents to Alliance space under a federal sponsored armed guard when the ship performed an unscheduled hyperspace jump to who knows where for reasons unknown. Since that disappearance this fragment of a signal is the first that's been heard from the happy clappy insect hugging summer camp ship. I won't say any more for fear of delivering spoilers but suffice to say if you're a fan of the very elite dangerous mechanic of delivering story nuggets through breadcrumb trail cryptic pseudo quests and I have to say that I personally am then I'd recommend heading to the affected system to check it out. Thursday this week was time for frontiers now once a month livestream frameshift live. Whilst there were developer guests on the stream this month in the shape of lead audio designer Robin, graduate gameplay programmer Max and designer Curtis the team weren't present to talk about elite dangerous or the imminent update 16 more on that in a moment. Instead they participated in a cryptic quiz that had been set by developer Tom Kuhl that saw the streams host Sally and Arthur officiating. One particularly interesting statistic that did emerge from the quiz there have been over 281,000 fargoid revenants destroyed since their arrival in the game just a couple of months ago that particular odyssey centric segment of the fargoid invasion clearly proving very popular with good reason as well as an experience it is undoubtedly one of odyssey's most atmospheric encounters to date. The real meat of the live stream was somewhat unusually toward the start of the broadcast. After the usual twitch drop necessary housekeeping the stream started with a roundup of game dev news and announcements. Sally and Arthur broached the subject of the issue tracker not something that had been heavily discussed on fdev live streams since galactic life settled down somewhat in the last year in particular following the opening dark days of the launch of odyssey the team advised that three long-standing issues in particular were being closed on the tracker those issues which you can see on screen now are anti aliasing not working correctly exiting the game occasionally causes a hang and windows task manager is needed to force close the program and low fps in odyssey coinciding with low gpu and cpu utilization in summary the anti aliasing issue log was raised some time ago and the game has had a fair few updates since then addressing various anti aliasing and other graphical issues the log having had so many contributions in various areas over such a long time seems to have been no longer as specific as it needed to be to make it useful and so the inference I take from what Arthur and Sally were saying was that any future graphical issues would be better served with a log specific to them being raised instead exiting the game causing a hang requiring a forced close of the task there's no clean way to say this it does look like the company is unable to track this one down specifically and it's just closing the log and with regard to low fps coinciding with low gpu cpu utilization the vast majority of odyssey's frame rate issues appear to have now been solved regardless of what the cpu or gpu may or may not be up to and so once again the dev seem keen that any further specific frame rate problems are given their own problem log the team has added further clarification on these closures in a forum post following the live stream yesterday and you'll find that post linked below this video the team announced that next week an update was being deployed to the game's launcher specifically details were light on exactly what the nature of that update would be but as things stand it's scheduled to be pushed out on monday so watch out for that Sally and Arthur again confirmed that update 17 is in the works and there's a chance we'll get our first glimpse of that on the next frameshift live broadcast which is scheduled for the 17th of august but before of course update 17 arrives we have update 16 and i'm pleased to say that update 16 is now scheduled for the 31st of july that's just 10 days away as i speak these words we got our first look at update 16 on last month's live stream where a new version of the hunter class thargoid could be briefly seen collecting a delicious buffet of escape pods using what appeared to be a thargoid version of collector limpets the phrase thimpets quickly being coined by the community afterwards it was anticipated that content from update 16 would be further teased for this live stream sadly that was not forthcoming all Sally and Arthur would say about update 16 was that some detail would be in the patch notes but that some of it won't be and it's up to the community to explore and find it for ourselves did you acquire new azimuth branded multi cannons in the community goal last week will you be following up the trail of the dedicant megaship what do you think we'll find waiting for us in update 16 let us know in the comments below that's it for now thanks very much for watching we'll be back later this week with more videos until then oh seven commanders follow the greens on the way out and do keep clear of the toast rack we very much look forward to seeing you next time


Hi everyone, I'm Mour Weinberger and I'm here to talk about from illuminating to eliminating cryptojacking techniques in cloud native. On today's agenda, I'm going to present myself, then we will talk about the crypto mining process, then we will go over the berth of cryptojacking and why it's so appealing to bad actors, then we will go deep dive into some of the cryptojacking evolutions and the trend and we will end up with detection and mitigation. Okay, so quick intro, so hi everyone again, I'm Mour Weinberger, I'm a staff software engineer in aqua security. I joined aqua a year ago as part of an acquisition of Argon security. Before that I worked for Microsoft for about four years around the cloud security products and I really like to mix the engineering work with threat hunting and security researching stuff and this is basically why I'm here and this is basically why I'm talking about this topic. Okay, so let's start. So let's talking a little bit about what is the actually crypto mining process. So in short, it's basically the process of verifying transaction on the blockchain. This verification process is actually solving cryptographic puzzles and this requires compute power and because this activity of verifying transaction is super important for the security of the crypto network, those miners are getting reward with fee, with transaction fee in a type of, you know, new coins. Okay, so let's see how easy is that to become a crypto miner. So all you need is basically four things. So the first thing you need to choose your cryptocurrency coin. There are like multiple coins and each one has its own capabilities and its own features. Then you will need to buy our equipment and as far as it will be a strong equipment, you could mine efficiency, efficiently, sorry.  You will also need to create a crypto wallet. It's very simple and totally open source and free and you need to choose the mining software and configure it on your device. So it's super easy. You can do all those steps in just a few minutes. Okay, so let's quickly review the birth of actually cryptojacking activity. So it kind of start on 2017 when Kornhive offered a web client miner code, which basically means if you are owner of a popular website, you can take their code, put it in your websites, and then the visitors will start mining crypto coins for you, for helping with the funds of the site. Then we start seeing that there were some website, popular website, especially on the video sites that adopt this approach and add Kornhive code into their website. But I think most of them added it secretly, which means they didn't notify the visitors. And of course, the visitors, the users didn't really like it. It basically utilized their CPU till the maximum. Then we start seeing that bad actors that breach websites, focused on government-based and university, affected them with Kornhive code. And we also saw that those bad actors targeting unpatched servers with some known vulnerability. And again, they just affect them with crypto mining. Then we start seeing that they also targeting unpatched routers and actually affect them with Kornhive code, which basically means that on every HTTP request that's sent into the router, the router injecting response add a Kornhive code. And at that point, we start seeing like repo mining everywhere. This is basically an advertising screen in some parking lot. And did you spot a miner here? It's on the right. Here it is. This is a nice hash miner client that run on this IoT device. Okay. So basically, but why so appealing to bad actors? So there are multiple reasons for that. So the first reason is about the anonymization. So basically, when you create a crypto wallet, you don't need to provide any identification. And to do it, to do in the correlation is impossible. And there are like additional coins like Monero that add another layer of anonymity. And they basically not allows to see their blockchain. So for example, if I have a crypto wallet, I'm a bad actors. I steal crypto coins. I am a hijacking systems. And now everyone detects my crypto wallet as suspicious. So once I just transfer the funds into another wallet, it couldn't be traceable because the transaction on the blockchain are not public. It's also very easy to fast cash out. Once I have the funds on my crypto wallet, I'm good to convert it to other coin, use exchange to cash out. And we will see that it's super easy to do it in scale. It's also suitable for newbies and script kiddies. There is no like deep knowledge that you need to have on the cryptocurrency network. You can just run one line of code and you are good to start in the crypto mining. And unfortunately, organization consider this risk as a nuisance. Okay. So enough with that. Let's start seeing some crypto jacking techniques that we saw in our research team called Nautilus in Aqua Security. And also when connecting with organization. So the first thing we will focus on is Kubernetes environment. So on the left, you could see the master node which contains the API server and other stuff. On the right is yet another node. Okay. And we will go over on the popular attack vectors that bad actors, specifically crypto jackers are targeting and looking for. So the first attack vector is basically looking for a vulnerable application which means that in this scenario, we have engine innings that running on a pod. It exposed to the internet and this engine innings has some RC vulnerability. And the attacker doesn't, at that point, doesn't really care if it's run on Kubernetes or not. Okay. Just scan the worldwide APs looking for this non vulnerability since it exploitable. So it's very easy to retrieve the exploit code and just execute it. And now we have a foothold in the pod. So at that point, we starting in the last few years that those actors are start being familiar with Kubernetes environment and they are trying to look for a lateral movement for a privilege elevation. They are checking if this pod run in any privileged container or any configuration like mount to us that allows them to control the whole node. And this is basically the first attack vector that I review here. Second one is misconfiguration on the Docker demon. So Dockers was around a little bit before Kubernetes became so popular and we still see customers and organizations that are using Dockers. And this one is about misconfiguration of the Docker demons which basically means that the Docker demon pod is exposed to the internet and there is no any authentication or access level control that is required. And again, this bad actors basically scan the worldwide looking for this specific port and they are just starting to communicate with the API. What they are actually able to do is to list all the images, list the running containers, getting shell on those containers and deploy new containers with crypto mining. Third attack vector is about poisoning the public registries. For example, Docker hub is the most famous registry and we see that actors doing something that call this technique, sorry, called typosquadding. And basically what they are trying to do is to push malicious container. For example, this on the right we have the valid and popular tensorflow Docker image is very popular machine learning framework. And this actor published Docker image called tensorflow, which as you guess, contains crypto miner. And they are basically depends on the fact that developer will misspell the container image. As you can see, this image specifically has more than 1K pools. So this technique is quite work. Okay. The fourth attack vector is about misconfiguration of Kubernetes dashboard. So Kubernetes dashboard is an easy way to interface on your Kubernetes cluster. And what you actually capable of is to list all the running pods, list secret and even get a shell on those container, all just from your browser. Okay. This is actually an exposed Docker dashboard in the wild. And once you and this basically allows you to have full control on your cluster. Another attack vector is about accessing the Kubernetes API when it misconfigured. Again, the API, the community API port is exposed, and it doesn't require any authentication or access level control. And the Kubernetes API is actually responsible to communicate it with the node. And once you able to control it, you basically have a cluster level control. And the last one is about misconfiguration of the Kublet. So the Kublet is stored on every one of the node and irresponsible to communicate it with the Kubernetes API. And once you misconfigure it, so the bad actor has a node level control here. And basically he allows to execute command on the running containers and deploy new containers. And at that point, we also saw that those bad actors are familiar with the Kubernetes features itself, and they are leveraging them in order to deploy the mining containers in a scale. It means they are using demon set deployment and replica set in order to deploy their stuff on every node and on every pod. Okay, just a second. Okay, so basically those attack vectors are being around for like many years. But we still see that cryptojackers are upgrading their techniques and doing the optimization. One of those optimization is about changing the huge pages, which basically allows the actors to increase the memory page. And basically those actors, once they have a foothold on the containers, if they will just run the miner as is, it will not be that efficient for them. So they are basically looking for how many cores and basically the architecture of the environment. And they set the huge pages to be optimal. And by the documentation of a few of those open source miners, this could help with increased efficiency by 50%. We also saw that those bad actors are aware that there are more bad actors on the environment. We also see it on our honeypots that are like multiple actors that basically battling each other because no one of them wants to share the resources, right? So we see them trying to disable and kill each one of those. And we also see that they are adopting techniques of wood keys and filers, and they are also trying to disable and remove the cloud security agent. Those two examples are one of Ali Yun, which is the Alibaba cloud agent, and bottom one is GCloud agent. But what do you think? Okay, we saw some techniques on the Kubernetes side, on the runtime side. What do you think? Are those cryptojackers shifting left with the ecosystem? Are they aware of the new technology that the organization are adopting around the left side? So of course, yes, this is basically a campaign that we discovered a year ago of bad actors that are trying to abuse the CI-CD free tier. So basically, they are not needed to find any unpaid servers or misconfiguration. They are only need to craft some techniques that they can do it in scale. And basically, this method is unlimited. So what those bad actors are basically done here is creating a GitHub repo, connect it into CI-CD platform, okay, use the free tier, of course. And on every change of this repo, it's basically trigger a build job, a build process, all right? And basically, those actors understand that the build step could be hijacked, the resource of it could be hijacked in the favor of crypto mining. Okay, so what basically happened here? How they made it in scale? So on the build step, they set that first they will clone the repo, then they will choose some random file and made some random change, then they will push this change inside the repository. And what will happen? Another CI job will trigger, which basically means at that point that they have an infinite loop, because every build will trigger another build. And after they trigger another build, they are pulling a custom-made miner from another repository, and they run this miner until the maximum time of the CI offering. This table we found on one of those bed actor repositories is basically elaborate what are the free tiers on those CI-CD and SaaS services. And we also saw that those bed actors are learning and they are aware of every limitation of every CI-CD platform. This one targeted GitHub action. As you can see, it set the maximum parallel jobs to 20, which is the limit, which is the maximum allows. They also set that every job will run no matter if a previous job were failed. And they also use interesting evasion techniques here, which their miner is an ELF binary, which basically run on Linux, but they run it on a Windows box. And they use and they able to execute this ELF by the WSL feature of Windows, which is the Windows subsystem for Linux. And we believe they do so for running the ELF binary in kind of sandbox mode. Another evasion technique that we saw here is in order to make the network detection a little bit harder. So what they done here, they are using root keys techniques that are wrapped by NPM package. So they basically just pull an NPM package, which is very regular and popular thing to do as part of your build. But this one is wrapping root keys CLI that allows the bad actors to hide his miner from the process list. And as you can see on the right, they managed to run multiple GitHub action jobs successfully. And each jobs run into the maximum of the allow of GitHub action, until it exceeds the maximum time. Okay. And this one is kind of funny. Shortly after I published the write up about how bad actors abuse those CICD free tiers, I got a message on LinkedIn that says, hi, more, I'm a crypto miner. And I think we share the same interest regarding the field. And I think to myself, that shouldn't be the key point, right? Yeah. Okay. But what about supply chain techniques? Are those bad actors adopting some supply chain techniques? So as you guess, all the answers here are yes. So yeah, they are shifting left and they are aware of the risk on the software supply chain. And just to align here, so basically the software supply chain is start with developers that write code, manage it in source code management, then build it, package it into artifacts, and then deploy it into the runtime. And the thing about it that every one of those steps that I just mentioned, using open source third party dependencies. And those bad actors understand one single point of failure here. And they target exactly that. So the first attack vector that we saw is about techniques that call typosquadding. And this one was discovered by our friends on checkmarks. They saw that these bad actors push multiple open source package into PyPy, into the public PyPy. And it contains, as you guess, a miner and they try to mimic the popular request package on PyPy. And because PyPy just requests the GitHub repository that correlate to the package, so this bad actor just put the valid request one and he gets the exact amount of stars and forks and he was able to really make a good view of this package. Another attack vector is around something that call dependency confusion. It happened with PyTorch just like a few weeks ago. And basically what happened here is that as part of the PyTorch build processing, its load owns dependencies. And some of them were internal dependencies and the way that when you're trying to load dependencies on PyTorch, so you're first going to the public PyPy index. And if he can't find it, he will get into your internal repository. And because PyTorch didn't preserve this specific library on the PyPy public index, so this bad actor found it. He pushed a new package into the public PyPy with malicious code and PyTorch pulls it as part of the build. And it totally got compromised, this version. And if you think to yourself, okay, we saw a typosporting techniques. We also see dependency confusion techniques. It could be like some security solution around that that could help with defense. The thing about open source dependencies is that there are multiple popular packages that are maintained by just single maintainers, maybe few maintainers, and we are not really aware of who stand behind them. And what is the security measurement that he takes and how secure he is here. So we see here a bad example of UI parser that happens a year, maybe two years ago, which is a very popular UI library on NPM. And this one got compromised by a leaked token of the owner. And it got breached badly. This library was used by the most big tech. And this bad actor had crypto mining, but also a password stealing code. And he targeted both Windows and Linux. And he basically tried to target both the developers, the build system, and runtime. But you could think to yourself, okay, what is the actual risk here? So the obvious one is about financial loss and service degradation. Either it runs on your AWS account or like cloud account or on your build, it will increase your charge. You will also face service degradation. But the most important here is about those bad actors has the ability to run arbitrary code on your environment. If it's on your build, they can basically steal your secrets. And on your environment, they will try to elevate permission and lateral movement to other high assets like your DB and other sensitive information. So what we can actually do about it? Okay, so if you don't have any security measurement or if you have some, so my suggestion here is first, follow the compliance and best practices. There are like multiple organizations out there. This is just two of them with security experts that invest their time and their expertise in order to create standards and best practices specifically for each popular technology. And the second thing about it is you need to understand your architecture from your cloud into your, from your code into your cloud, understand what are the technologies that you are using? What are the integration parts? And basically follow those best practices and guidelines. And there are many like open source tools out there that could help you run those, run those guidelines and checks. This is just two of them. The first one is Trivi that basically can help you run on your Kubernetes cluster and even on your YAML before it gets deployed, security posture management to find those configuration that I just present you and others. And Chainbench which is focused on your software supply chain and running the same approaches but on your left side. And those two can also provide you compliance report. Here it's a CIS or other and then you could see your security posture management based on those compliance report. If you got to here so you can also scan your code, your infrastructure as code and dependencies for vulnerabilities, for misconfiguration and you can also do it with Trivi. And you can also run static code analysis. SEM group is a great tool for that with more than 1000 rules that supports most of the popular languages. And it's able to detect risky code even before it gets merged into your source code. Like for example, it could detect XSS and injection risk within your code. But this is not enough, right? Trying to reduce your risk and fix misconfiguration most of the time is not enough because basically you have some vulnerabilities and other misconfiguration that you didn't have the time to address. And there are always like new zero days and other vulnerabilities. So we need to get one layer deeper. We need to look for abnormal and suspicious activity again on your cloud account to look for any increase in your resource creation on your abnormal identity activity. And also you need to have some random protection. There are like great tools out there. I will just mention one of them which is Tracy is based on the EBPF technologies which means it runs on your kernel level and it allows to detect root keys and file s attacks. And if you don't trust your third party libraries, you can use Guard Dog by Datadog that has the capability to run static code analysis and detect malicious code like crypto mining on your PyPy libraries. So this is it basically. Thank you everyone. And I would appreciate if you could scan the QR code and provide a feedback. Thanks. I don't think I have enough time for question but feel free to connect me in person. Thanks.


Ladies and gentlemen, Salomite, welcome to the second car vlog in the series. We're getting my old beauty running with a little ogie and sea bass. We got to replace the master cylinder. We got to do tires. All the fuel lines got to be drained, and then we got to get the tires running. Oh, I thought we got to drain them. And then we're going to try to drive downtown. First game of the playoffs, Sacramento Kings, 17 year old you're out. We're playing the Warriors, so we might go vlog and see what's happening downtown. Absolutely popping. So welcome to Saturday and sunny Sacramento. Got oily hands, I'm sure. Actually, it's pretty good. Tillamook, sponsor me. Tillamook jerky, Tillamook. Tillamook. You don't know what Tillamook? The cheese? Are you right? I was thinking, what is it?  Ham? Yeah, if I want to change this all by myself.  You don't know my handiwork. You could YouTube it. How long would it take you? Yeah, just take longer. Probably longer. And then you probably get lost, like knowing air in the system and all that stuff. You probably, like most people don't know, brakes shouldn't have air in their system. You'd probably be like, what the fuck? Why isn't the brakes working? Why the clutch drop and stuff like that? And then you might need to Google it or? But you would ruin it. It would just not work. But you might die on a test drive. I just wouldn't test drive it like that. You got to find out if it runs. You probably find out halfway through that you don't have brakes. The driveway or something. Well, it'll probably brake on the driveway. Oh, it's just when the air was in there. Yeah, and then you try to brake.  It's not there. That's scary. And then like.  It's probably say, like, for a bit.  What if you suck? Well, you're taking the leap of faith that I actually kind of like you. No, I just want my beautiful car to work. How cute is it going to be when it says good company or not? Just an empty space, though. You know what I mean? We just put, back. No. It's the last two weeks.   That's pretty bad if you're off timing. But for the majority, I'd say, yeah, YouTube, you can be here for a week, two weeks.  Get her done-ish. I don't know how well, but get her done in Walmart terms. You know how many stories I see on Instagram of all these homies? Like, yeah, I'm about to do this. It's going to take me two hours. And then like their car doesn't run for three months and me.  Like everyone's like, oh, I can do it. And it's supposed to be small. And then they're there three months later. That's where we're a month into this. Brother. It was raining. We're working, we're working one day, every, like. Couple weeks. Every season. We're working one day a season, one day a season for like four hours. And then I don't have a parts store on go on a Saturday at Buck Cracker. Who knows when. And I can't get Amazon Prime delivery on some 90s car. That's true. If you ain't listening to country music, I don't know what to tell you. You're sleeping on it. I'm not, but you should be. You should be. You should be. Just tell me. You should be not. Are you going to country in the park? I love country in the park, bro. Catch me at country in the park. Hey, look, I'm saying put your name at the top of his list in the statue of Liberty Starter, Shaggy and her face. Yeah, this is hard. That's always a scary moment. When you never know if you're going to break the border, the brook's going to break you. Don't you see me cry? It's when you punch the transmission underneath it. Hear everything. That'll make a grown man cry. That's crying more than the note book you heard. Catch me outside. How about that? So I was thinking she was in the first Fast and Furious, which I knew was older than it was before I was in high school, which was out of three. And so then I just assumed it was a shh. If she was in the first one, it would have been a Del Sol. 2002 wasn't a thing. You know what I mean? That's how I like pattern in my head. OK, I can see it. I can see it. So it's not crazy that a Del Sol's in there, despite how mad it's acting. The Del Sol was so ugly. I know, I agree. But the whole premise of Fast and Furious, which made the series, is the first one. And they drive Civics. Civics aren't cute. And the Supra. Yeah, but I'm just saying they're in there. Yeah, the main cars are dope. But all the side cars are whatever. Yeah, the main car is a Skyline, a Charger, a Challenger, and a Supra. But all the side cars are Civics and Tegras. That's true. Easy. 36Q. This one's all right. Yeah. I still don't know where to find them. They're on Polaroids, you know? The year was 2005. I did. I bought it from 05, 06. And I sold it in like 08, 07. I regret it. That's mostly why I'm not selling this thing. The future fear of regret. Because I know what I got, you know, Matt? This thing's hot. Tell the vlog what you text me later that night. You say you're trying to buy it. Oh, man. Either way, you wanted it. I want McDonald's sometimes, but I mean, it's a good choice. McDonald's is a great choice. Chicken Nuggets in a McFlurry? Yeah, you get the Chicken Nuggets. Yeah, and a Big Mac, and fries in a McFlurry, and a Diet Coke. He had the whole order. Yeah, why not? He had the whole order. Not the Diet Coke at the end of all that. Yeah. You gotta be healthy. Yeah, it still matters. Come on. And it tastes good.  No. They still matter. They still add up. I got eggs, so I can't do that. There you go. Go like to the right, stare at that move. You good? Yeah. Look up. Don't go high. That's the house. Yeah, that should be fine. Look a little closer to the thingy-ma-jig. I'm going to do this stuff. That's it. The thingy-ma-jig. It's supposed to be called a mustache. Right there. Like, yeah, that. Like the five o'clock shadow. Yeah, that's a three-day shadow. That's like a quarter of an inch. It worked great before Matt got here. What? Last time I turned it on, I moved it. Well, that was like 15 years ago. I'm just saying it moved when I turned it on. And then now you're trying to press the clutch and it's squirting. My man, I make things squirt.  You're making a child of the fix-a-car? That's the child, ladies.  You want to identify as taller?  I'm actually 5'8", you know that? Yeah, 6'1". Bro, I'm 5'8", because when I got Air Max on, that's 5'7 1⁄4. The 5'7 1⁄4 you already know is 5'8". And at that point, 5'8", basically 5'10". And 5'10", you know that mean 6'4". So, in my opinion, your boy is a 6'2". You want to measure? Yeah. I'll wear them tonight. I'm in off-brand vans on the F2. And I'm in flats, too. Dude, I told you the same. Same height, right? I'm barely 5'9". 5'7", where Air Max is on. Shacked.  Who's you guys? The short guys. Oh, OK. I was about to say, who you got? She moves. Good job, dude. How far would it go? We would need the pump to be plugged into your car, don't I? Let's do it. It's losing so much fluid. We would need to, one, might go be swimming at the feet. Two, that's even too ghetto for me.   That's not good. Because imagine how many times you're going to need to hit the clutch. A lot, true. Every time you hit the clutch, you're losing. A lot. Brake fluid? Yeah, clutch fluid, brake fluid, all the above. So, let's towel show. We'll wait for another day. We'll wait for another day. Probably end of May. Let's see what the keys.  Yeah, if you want. The mission continues. One more part. But we might not be able to film it. Me and Seabass are hitting the road. So stay tuned on that. A lot of content on the way. We're heading to Austin, Texas, and Los Angeles, and Vegas in the next two weeks, basically. So a lot of action here on the channel. The car may or may not be working when we come back. It depends on how busy Matt is. If not when we come back, we'll try to fix it. Appreciate you all. That was destiny. Eventually, yeah, that was crazy. It will be working. We will run it up. And then we're going to make it look pretty. So stay tuned. Appreciate you all. We over me. Salam, Mike.