Niko, this is a very special one. What many of you don't know is I've interviewed 2,500 VCs, and one of the first three that I ever, ever interviewed was Niko. So this is a special round two for me. So Niko, for... Hopefully this makes me a good VC by now, right? I've got the second chance. Fingers crossed. OK. I want to start, though, Niko. How did you make your way into what I always call the wonderful world of Venture and what was really that entry point for you really into VC and general catalyst? Sure. So, you know, most VCs have had an amazing career before Venture because this is what is the street cred and what they use to source and win investment opportunities afterwards. But I wasn't nobody before joining the exciting world of Venture Capital. I was a failing student entrepreneur at Stanford University. Like anybody who goes there basically needs to have a startup on the side.  But during that experience, as I was trying to build a social network back in 2010, again, not a unique idea, I met a lot of VCs and got really excited by the intellectual stimulation and the impact that the job has to offer. So when our company failed miserably within a year, ended up getting an invitation for an interview by Chris Farmer, who is now the founder CEO of SignalFire and met the rest of the partnership at our firm, General Catalyst. And got inspired by the individuals at the firm. Everybody was a different character, one of my partners. You know, if you look at him, he looks like Woody Allen. Another one is very similar, you know, to Gordon Gekko from the Wall Street, the movie. Third one is a polymath and she's collected like five, six degrees from MIT. And I was like, wow, you know, that's a really carefully curated group of partners. So they gave me the opportunity. So, you know, it's like going to a business lounge at an airport, in venture, you know, you need to be given the opportunity. And I took a leap of faith and joined the firm eight years ago. Can I ask, and this is off schedule, but you mentioned that maybe the business that didn't work out. And I interviewed Julia earlier on stage and she said that we maybe don't talk enough about things that don't work out. How is that for you? How is the rebound personally? And how do you think it may be more meta about kind of how we approach failure today as an ecosystem? Absolutely. So spending a year trying to build a social network in 2009, 2010, again, not a unique idea, probably was five, six years too late. But we were one of the first three teams that decided to leverage LinkedIn's API and build a product on top of LinkedIn. Turns out that taking platform risk is a lot of risk. And that's something I learned, you know. Whenever you decide to build on top of somebody else, it may make life easier in some instances, but in many other dimensions makes it very, very risky value proposition. The second thing I learned is building a team. And again, being a graduate student at Stanford, we ended up attracting a lot of resume collectors, like people who wanted to join. But essentially, they were not that keen on going the extra mile and do the crazy sacrifices that becoming a startup founder requires. So that's the second thing I learned. And third and probably the most important one for me as a venture capitalist now is having empathy for all the ups and downs and craziness that the founder needs to have. And different people call it in different ways. Is it authenticity or a north star or paranoia to solve a problem your own way? Like you need to have that. In our team, we didn't have that. But I now have the empathy, you know, for the founders who pitch me every day and some of them we work with. As far as failure is concerned, it's a necessary part of startup life. Like it's 1,000% something that we embrace, especially in Silicon Valley. Like a lot of the founders that we invest in are folks who tried something before. They learned from their lessons. Hopefully they didn't engage in any criminal activity that we're aware of. Sometimes it happens, of course. But a lot of the founders we invest in, you know, often are second timers and had singles and doubles. And that's what makes Valley and other ecosystems work really, really, really well. In my home country, Greece, if you run a business and then you go bankrupt, most often you end up in jail. Clearly that's a problem, you know? But not the case in Silicon Valley where we're investing. So the fact that there is no stigma associated with failure is amazing. I do want to jump on the element of team building that because we're going to focus on scaling and scaling team, business model, and product today. Those three core elements. On the scaling of teams, you mentioned obviously your personal experience there. You've worked closely with the Snapchat team through scaling, the Livongo team through scaling. Are there commonalities in those that have really scaled team and personnel very, very well? Yeah, so it's almost like a mindset that the founders need to have from day one and spend a lot of time, of their personal time on the recruiting front. Like in the beginning, you know, if you don't spend like half of your time on recruiting, it's not going to happen. You're doing something wrong. And sooner or later, you're gonna be facing a ton of bottlenecks. So I've seen it again and again, even with teams that have three to four founders that can cover a lot of surface area. Like they have the tech lead, they have the product person, they have a growth hiker. They can cover a lot of ground, but as soon as the business is scaling a little bit, when they haven't made the right hires, they start struggling. So being very thoughtful and meticulous about recruiting and building pipeline, doing activities at the office, building a person about yourself and the business so that you can have a steady flow of the right talent can pay a lot of dividends in the long run. And then the other part of it is around leveling up as a startup founder because the job description changes every six months. Like what do you do to invest in yourself? And the very, very best founders, like the founders of Stripe and Livongo and some of our other portfolio companies, they're very aware of that. So they get like a business code, they have mentors who've been there done that, they work with some advisors in all their respective functions that they need to hire. And they ask them simple questions, like, hey, I'm going to hire VP of engineering. What are the mistakes that probably I'm going to make that I should be aware of? And if you have a couple of high-quality VP of engineering folks that can help you interview the person that you're going to bring on board, this is going to save you from a lot of trouble. Yeah, absolutely. I love the way they say about meeting as many domain experts as you can to really become one yourself as much as possible. Totally. I do want to also, and especially for many founders in the room, if that's kind of how to do it right, you also see a ton of other companies in market who maybe don't do it so well and fall for maybe more common pitfalls. What are those pitfalls that you see them falling for in the scaling team phase? Yeah, so I mean, you hire a lot of your friends. OK. Patrick Collison tweeted the other day something really interesting. He said, before you decide to bring on board one person, be prepared that there are going to be 10 others exactly like him or her who are going to join your company before you know it. So be very thoughtful about who you want to bring on board. So basically, that's a common saying, hire A players because they're going to hire other A players, especially around the technology team. This could make a huge, huge difference. The biggest mistake I see is people who don't enjoy hiring for whatever reason, they put it off and they think that their board is going to do it for themselves or they're going to hire a recruiter who is going to take care of it and it never really happens.  And we don't expect, of course, when we invest in a company that especially with first timers that they're going to turn out to be unbelievable managers. We don't expect that. But sometimes, or frankly, most times, you see founders who are not great managers. And even if you get it right on the hiring front, then the retention and the productivity is not that great. Can I jump in and ask that? For you as a VC and off schedule, sorry for that one, when you see someone who maybe isn't the transition manager that you thought they could be, how do you see your role as the VC? Is it to aid and support them in as much as you can with mentorship and guidance? Is it to bring in an alternative and place them in a different role? How do you view your role in that case? Yes, as venture capitalists at times, we're cheerleaders, which is like, you're doing great. Please do more of it. The plan is working. What can you do to go faster? And at other times, we're, wait a second, are we sure about the plan? Are we sure about our team? I mean, a good, for me, heuristic is especially with companies that start with many founders. There should be one person on the team who is like the ruthless business person that is constantly thinking about leveling up the rest of the team. So I've seen that again and again. And frankly, now it's almost like a heuristic of future success. If you start as a founding team of three to four and three years later, everybody continues to have the same ridiculous titles, like co-founder, CEO, co-founder, president, co-founder, CEO, co-founder strategy. Come on, which company has a VP of strategy from day one? But if everybody continues to have the same ridiculous titles and they're not either home or individual contributors, you're doing something wrong. So every, you know, like every second board meeting I always ask, you know, who has left from the team that we didn't want to see them leave? Who is somebody that probably is underperforming? What are we doing to make sure that the whole team has KPIs and OKRs that they can work on? And then the most expensive currency that startups have is their own equity, the stock options. So especially with the early, you know, team members that have so much in stock options, are they really worth what is promised to them? Are they leveling up themselves or not? And this is where being a good manager or becoming a good manager is a huge asset because you cannot have individuals who are on a good chunk of the company and not be effective leaders. Yeah, no, I couldn't agree more. I do want to slightly transition to the business model itself now from the team. When we chatted before, you said about sustainable business models. Can I ask, how do you really infer and interpret sustainable business models from a starting point? I mean, the easiest way to think of a great sustainable business model is one, you know, that produces unbelievable cash flows like the Dropbox one, right? This is like, or the Google one. Like these are companies that got started. They raised one or two rounds of capital. Google only raised 25 million bucks and then they went public because they started printing so much money so quickly or Dropbox, you saw, you know, from the S1. Unfortunately, we're not investors, but that's why we're in the valley right now. They were producing so much freaking money from a very scalable business model that is not one that causes issues with the future growth of the business. And it's not one that's running out of steam. Yeah, no, I get you. In terms of kind of sustainable business models, it's not, we don't see it in every business today. And sometimes it comes over time. I'm really interested, when is the timing for the implementation of sustainable business models and kind of scalable unit economics? And does it have to be from day one? It would be ideal if it's from day one, but most often it's not. You know, the history of consumer, most often the last decade, it's like, grow pretty big and then you'll figure out how to monetize. Of course, this assumes that distribution is really easy. In the last few years, we've started saying a lot of interesting subscription business models. Or in marketplaces, it comes, you know, from day one. And that's one of the advantages that today online marketplaces founders have over the others that can afford to make money from day one. And as a result, they can afford to spend on customer acquisition from day one. But in some instances, if you have a product that is not essentially offering a lot of value to the consumers or to enterprises, you can't monetize. So you need to create a lot of goodwill with your users in order to turn them into customers. And that goodwill, you can spend it either through having them pay you, which is revenue for your business, or spend the goodwill in order to get them to invite other friends of theirs, refer you to new customers. So it's growth for you. Speaking of kind of growth engines there, when we spoke before, you said about building a fundraising machine. Can I ask, how do you think about- Huge asset. Sorry. It's a huge asset. So how do you think about building a fundraising machine, the first steps to get that on board? And maybe who's done it particularly well in your mind over the past few years? Yeah, so it's something that we're looking for, frankly, when we're evaluating founders to invite them to our portfolio. So like, are they amazing at presenting their business? And if they can indeed, you know, get us really excited. If they can get the greed and the fear, emotions to come up. Because, you know, if we don't invest, we're gonna miss out on a multi-billion dollar return for us, or if we don't invest, our competitors are gonna make so much money and it's gonna be even worse. So like, this is something very important. Their ability to fundraise is also a proxy for future ability to recruit incredible talent, the ability to get the press excited, which could mean interesting business opportunities over time, or also the ability to do really interesting business development. So how do you build the fundraising machine? Sometimes it starts with the individual.  You do it for a few weeks and you walk out with tens or hundreds of millions of dollars. Of course, some of them enjoy too much and they end up doing it all the time at the expense of their business. You need to have a good team that can support you with all the materials. So a few of the high-level pieces of advice I'd offer, if you know your customer really, really well and you can think that you're like your customer, that's a huge asset. Secondly, if you have a plan for your business and you do more of that plan, and this is what VCs wanna hear, you have something, it's working, we give you more money and immediately afterwards start growing, that's a huge asset too. And lastly, individuals who can create a reality distortion field and create this very detailed picture of the future. It's something that few individuals have, but whoever has it gets VCs, especially down VCs, really, really, really excited. Can I ask, combining team and then the VCs that back the company, how much of a role do you think the VCs that back the company impacts potential candidates joining the firm? I often hear founders say, oh, if I get general catalyst, I'll be able to get A-star players. How much role really do you think that makes and is that a fair assessment that it does have that much gravitas? It plays a shitload, huge role, massive, massive, massive role because a ton of people wanna work for companies that are perceived as safe, but especially if you wanna attract individuals, not in the very beginning, but over time from the bigger companies who have very strong paths, they make a lot of money, knowing that an amazing VC firm has backed a specific early-state startup or mid-state startup makes a huge difference. And the other thing is that when you raise from a top tier VC fund, stats show that it's over 50% likely that you're gonna have your next round be done. So the combination of the two is very, very powerful. The press is more likely to talk about your company, which always helps with recruiting. Sure, in terms of kind of getting those best investors, kind of predictability, repeatability often was associated with getting the best. How do you think about kind of startup planning? What kind of good structure looks like within that and how it can entice the best? Yeah, again, it starts with the individual. So certain people are incredible at networking. They have the unique ability to just find one or two mentors who can connect them with anybody. And that's, you know, the key thing in startup life. If you manage to find one or two really amazing people, then you can connect to anybody else within a few weeks. And as a founder, if you're the kind of individual who is always passionate about your space, knows your customer really well, I mean, come on, you can't convince one person to really take a leap of faith and pay it forward for you. So if you have this kind of individual who can connect you to everybody else, then the doors start opening and it's a matter of time till you get in front of the right people. So if you are prepared during that pitching process, if you are indeed, you know, one of the founders who is ridiculously ambitious can go the distance and is a learning animal, most likely you will end up with a few good offers.  I say a short statement Niko, you know how this goes. And then we've got three minutes and 30 seconds for five questions. So about 45 seconds per one, are you ready? Let's do it. Okay, so your favorite book and why? What must everyone here be reading? My favorite book and why? One of my favorite books is The Ascent of Money by Neil Ferguson, which talks about the history of money in all of humanity. And if you want to be in finance, it's a mastery. We're not in a bubble, but we're in a secular shift towards technology and in favor of technology. Agree or disagree? I agree, we're definitely in that overheated, you know, part of the cycle. So we're not in a bubble, but things are a little bit crazy. Okay, and then what do you know now that you wish you'd known at the beginning of your time with GC? It's all about the people that you work with. So individuals who are learning animals can go the distance. Individuals who have an insane sense of urgency. When I got started, I wanted to invest in all of my friends. Then I also wanted to give a lot more chances to people. And then let's do pros and cons of taking startup, pros and cons of taking startups, taking multi-stage VC money. Maybe earlier as well. So pros is if you want to shoot for the moon and you have a plan that you do more of and things work out really well, all of your future fund raisings can be taken care of. And the signaling in that regard, it's much, much stronger. And negative is if you want to have your first timer, you want to have an exit of 50 to 100 million bucks, which is very meaningful for most people. Taking money for multi-stage VC is not a great idea because they're not going to pay attention. The fund return is not going to be there for them. And then last one. And if you want to do a party round also, you know, not necessarily a great idea. What do you think of party rounds?  Hate them. Yeah, hate them. Okay. And then final one, most recent investment. And why did you say yes and get so excited? Most recent investment is in the founder from the UK, who's trying to reinvent the death industry in California. So ridiculously ambitious founder who left Britain to move to the US to go after the big leagues. Why did I say yes? Very unsexy theme. Inspiring individual who can create a category defining business. Nico, it's been such a pleasure having the chance at a second round. So thank you so much for joining me today. Thank you, Hari. Thanks for the attention. Go. Great to hang out.


Please give it up for Jay Beal. He's going to take us through the next 50 minutes. Hey everybody. I'll let you file in just a little bit. While I introduced my co-presenter, this is Justin Searle. He's our newest hired Intel Guardians. Well, he's a badass guy. We'll talk a little bit more about him and his contributions to this talk, both positive and negative, because I'm going to blame things on him. Or at least, that's what he thinks. So, let's see. Here's what we're doing. I've been doing defensive programs for a long time, and somehow I've well spent about six or seven years now pen testing, and now and then we end up creating some tools. So, I'm releasing one. And you're going to be able to find this. I've got a URL at the end of the slide. You'll be able to find this up on Intel Guardians site. Later this weekend when I get the bugs out. So, but I'll tell you all about it right now. So basically, the tool is called the Midler. We tried and went through all kinds of names. What's that? Oh, hi priest. Don't hurt me. He is a very nice man who's got a weight race of three to one on me. And I'm telling you it's all muscle. That's great. Fill it up. Okay. So, I'm just going to get a little bit of a slow start and let a couple more people in. But basically, here's what we're doing. So, we're going to talk a little bit about, in general, an attack vector shared networks. Because we're all on a lot more shared networks than we ever were before, and we probably don't think about it quite as much. So, we'll... Come on in. Okay. For those of you watching on video, there are a lot of people in the hall, and we're finding ways to stack them around the room. Yeah, I'm not pissed. Yeah, I think the goons actually deserve quite another round of applause here. Go goons! What's that? You don't have a red cape? A red cape? Okay, great. Okay, I've been asked to reiterate, and I think it's really, really important, that anything bad happens in this room. I'm about one of the last people that's going to be able to get out. So, I want to reiterate that we... You can't block doors. You absolutely cannot block doors. It's not good to block doors. That is how people die. And I do not mean the people that you block from getting out. I mean you as you get trampled. Really, really badly. Really badly. It's no, no, no fun. So, first, don't block doors. Second, keep a clear aisle for some definition of aisle. That means goons should be able to run down, and they may just do it as like a test. And, again, the goons are called goons for reasons. So, don't block the aisles either. Okay, wow. This is really a lot of fun. I'm already having fun with this, and I haven't even gotten to the table of contents. Rock. This is just cool. Okay, so let's see. So, what we're going to talk about is basically, just one of the things I like to do every now and then, I think we all do, is basically say what kinds of, what kinds of maybe bad assumptions are we making, or what kinds of issues have we kind of left behind as things that we dealt with a long time ago, or that we figure, you know, it wasn't much of a problem anymore. I have my own favorite sets of them. You know, patching is a real fun one. I know patching is like one of the most boring things, but we start going and looking and saying, okay, how long does it take between when someone, when a Microsoft patch comes out, and it gets reverse engineered and turned into a weaponable exploit, and that number is like under a day by far. And then, you know, we look and we say our average patch time is like three months.  Anyway, it's kind of patching one of those boring little things that we kind of left behind, and well, it's actually the thing that's going to kill us one day, which from talking to Dan, is basically what's going on with DNS too. And I think he's right. Okay, so, but here's what we're going to do. We're going to talk about, we're going to have a little bit of fun. We're going to talk about shared networks, and not that much, but we're going to talk about what happens when you share a network with me. I mean, with a bad guy, with somebody who's up to no good and possibly has forgotten their, you know, laws and all kinds of ethics and stuff like that. And we're going to talk about how you can use these kinds of attacks to exploit a good number of sites, including Gmail and LinkedIn and LiveJournal and honestly tons and tons and tons of sites way, way, way too easily. And we'll talk about how you can do it against sites that are actually not as vulnerable, like online banks. And we'll talk about what you can do when you're sharing a network with someone. You can start troging software installation and update, and that was really fun to learn about, and I'll tell you how I learned about that later on. And we're going to talk about browser exploits and how it gets a heck of a lot easier when you're not trying to get somebody halfway across the country or the planet to click on a link because you can make them go where you want, and we'll get to that. And then lastly, we're going to talk about what you can do to try to survive hostile networks. I think DEF CON has been rated by, you know, at least 14 intelligence agencies as the most hostile network in the world. Okay, that's made up, but I could see it being true.  No, I burn the hard drive. I pull the hard drive out. It was a fresh one that went in before I got here. It didn't have any real data on it. I just installed some kind of, well, it used to be a Linux distribution, but now it's Apple, but it's good. Apple, yay. But anyway, I get home, and I don't torch the laptop anymore because they've gotten expensive, but I torch the hard drive, and then I grind it up in little bits, and then I kind of wait for a really, really, really windy day, and I go out to one of the places where they used to test airplanes, not normal airplanes with jet engines and stuff. I mean like the Wright Brothers kind of thing, and I try to throw up the hard drive bits into the wind. Okay, well, I'm getting way, way, way off topic. But this is DEF CON, so we get to do because you gotta assume that we're going to, that we're gonna have a whole lot of fun, and that's what we're here to do, and wow, this is a blast every single year. So let's see. The deal is basically HTTP, or let's call it non-encrypted web traffic, whatever you want to call it, non-encrypted HTTP, and shared networks. Networks you share with, well, anybody bad, or anybody who might want to be bad, or anybody who might spend a little bit of time being bad, and otherwise is a perfectly reasonable DEF CON speaker. You go to these hostels, you go to all these shared networks, and we don't really think about how many times we share a network.  I put this little thing called little snitch on my laptop for a little while, and I started watching all the stuff that was talking to everywhere, and I started realizing there were a ton of people who are still, you know, who are not behind any kind of an ad box, they're not behind really anything of a firewall or much of a firewall, and I know this because, well, my machine's going and doing Skype to them, and it's doing all, it's just, I'm looking at it and saying, oh, my gosh. But anyway, assuming that we've all got these great firewalls and so on, we think we're pretty safe, and it's nice. We've gotten a lot safer, but then we get on these wireless networks with people, and, you know, Dave Maynard and Johnny Cash taught us a couple of years ago that on might be dangerous, and, okay, well, you know, if we don't join the network, I don't have anything that lead. I wish I did, but I don't. But on the other hand, what I do have is just, if we go and start looking at actually everything that leaks out of your laptop, it's pretty amazing. I'm not going to go after everything that leaks out of your laptop. I'm pretty amazed at how much I see when I sniff a network. Of course, legally, sniffing is the only reason I'd ever sniff a network or glue or anything. No, no. Defconn speakers do not sniff glue. They apparently, I think, have a lot harder stuff. So, anyway, so, yeah, I mean, and if you think about it, you might be like, well, no, I never use any shared networks, and honestly, I live in Seattle now. This is, like, the place where, like, coffee houses are huge. Everyone's in the coffee houses. They're all on the Wi-Fi, and it's all free, and there's free Wi-Fi everywhere. The wireless community, it's just huge, and you find it everywhere. You're constantly going to wireless networks in hotels, not in this one, not on my life, but, you know, you're going on wireless networks in hotels, you're going on wireless networks.  You know, you might turn the wireless card on your laptop on and, you know, join on. You might even be paying for it. Heck, you could be paying for the wireless networks, and they're still not really any safer. You're sharing it with a whole bunch of people who may or may not have had bad people install bad things on their laptop even though they're good. So, you know, we go to coffee shops, we go to bookstores, you know, actually, there's been a series of great talks, one with Simple Nomad talking about going on an airplane and starting to just, you know, finding people with their wireless card on, and he would go and set up a little network with them and, you know, start seeing what he could see. I'm sure that he didn't do that. It's all fictional stories. The deal is, especially with wireless, we're all on shared networks with lots of bad people all the time, and it's really kind of nice to think about, well, maybe it's not, but I think it's nice. I think it's nice to think about what people can do and what people are doing, and you open yourselves up to a heck of a lot of tech. You also open yourself up to a whole lot of monitoring. I don't know anybody who does this, or if I did know them, I wouldn't have known their name or anything like that, but I've heard there are lots of people with wireless networks and just simply set up a sniffer of some sort and just start watching passwords go by. Well, and so, you know, a lot of the services that would have clear text passwords go by started saying, wait, we've heard of this wall of sheep thing, and that's not good, so we're going to start, we're going to encrypt. We're going to encrypt something. We'll encrypt those passwords, and so now, you know, my friends who I don't know the names of who would be sniffing on these wireless networks, they don't see passwords go by anymore, and they see all kinds of conversations, and they see email going by, and they see all kinds of wonderful clear text stuff. This is what you've got to kind of understand, and this is what you've got to tell your friends, you've got to tell your family, you've got to tell your places of employ, and you've got to tell everybody on the earth, if we share a land, if you and I share a land, I can view and modify your traffic, okay? Whether or not in modifying it, I break it because it doesn't work, it's useless to me and useless to you, and that's different. If it's clear text, for the most part, I get to view and modify it, and I have a lot of fun. By the way, this is one of the... I don't really have rants. I'm a pretty nice guy. I don't think anybody's ever said, wow, Jay, he's grumpy, right? But I have all these weird thoughts about things, and things that kind of bug me, because I start to think about it, and I say, you know, before you can call us a consultant, we do sell our time by the hour and all that, but, you know, I go and I talk to lots and lots of companies, and we sit down, and one of the things we do is we talk about, you know, before we start hacking anything, or looking at firewalls, or whatever we're going to do, we kind of say, well, you know, what are the threats that are most, what are the biggest things that could harm the business? And when we do that, we say, okay, they start talking about the data that we're going to be able to see. They could see secret stuff, and they say, and they could take things down, they could do denial of service, and they always, always, I swear, always forget the last one. Everybody knows that first one is confidentiality, and that, well, kind of last one, but I've reordered it, is availability. Anybody know what the middle one is? Integrity. Oh, God, wait.  Sometimes it's really good that I can see it, and you didn't know I changed it. And what if I could do that, you know, all the time? And I think that's one of the things we're going to talk about in this talk. We're going to talk about how with good tools, or, you know, honestly with even bad tools, you can get at the integrity part just as much as the confidentiality. You can have a hack of a lot more fun with the integrity. It's a lot more fun, and we'll get into the kinds of attacks.  You know, we all had hubs, and it was like really crazy because you could, like, tell your network card to just tell you everything that went by on the wire instead of just the stuff that was for it. And all of a sudden, you'd be like, wow, I can see everybody's traffic, and it's really cool. And then, well, that's been kind of a decade since that was really all the way through. You know, we got switches, and these switches were really nice, and now we can only see your stuff. And, well, unless you played some games, which we'll talk about. But on a wireless network, oh, wow, the packet goes into a hub, and the hub sends it out in all of the directions. I mean, dude, I can be really, really far away. As long as you've got a really nice antenna, you can be really, really far away, and watch all of your traffic, and you don't know it. And you didn't have to do anything, and I didn't have to throw any packets. You didn't even know I'm doing it. That's, well, anyway. So we'll get into that. So the thing you've got to understand is I can, if we're on a land together, and I'm bad, I'm looking at your traffic. This is just to stand up your own DHCP server.  I mean, everybody just kind of expects they'll put their laptop on a network, and their laptop will go and try to get an IP address, and they figure that the box that gives it to them will probably be a nice, friendly one that was supposed to be on the network. But, honestly, DHCP is this wonderful broadcast thing, right? It's like, hey, does anybody have an IP address? For me, me, me. And it says, and somebody wins a race. And sometimes that's the right somebody. And sometimes it's the wrong somebody. Now, I'm going to tell you guys something. Because we're at a hacker con, and I've been on a lot of good networks gone bad. If you're going to do that to me, if you're going to give me a DHCP lease instead of the real person, you're going to do any of these network games, please route my packets. I mean, really, how many of us have gone on a network and we're like, okay, the network's down. What's going on? There's some fools trying to sniff all the traffic.  Or he stopped a long time ago, but he didn't put the network back the way he found it. Which, really, you've got to think there's got to be some kind of ethics to doing bad things. I mean, you can be bad. But there's levels of badness.  Eating a kitten is really bad, okay? And I would pause it that if you're going to watch my traffic, if you're going to have all my traffic go to your box and you don't bother to route it out to the internet where I was trying to get, that's eating the kitten. Just don't do that. Okay, so here we are. So the DHCP server's a nice way of doing things, another nice way of doing things and it's amazingly simple and easy is you can run a little tool like ARPSBOO for Adercap or whatever and you can run a little tool that will basically say hi, I'm the router.  And if you wanted to be really, really careful about it or really, really targeted, you could be like, no, I'm that one server. That's the really, really, highly important server. But honestly, most of us, if we were bad and we were going in, we just you know, we just want to be a router. Maybe we want to, actually, honestly, maybe we want to be the DNS server. That's a good person to be too because you start saying, wow, everybody who asks for livejournal.com, that's my laptop. And they're not ever going to know the difference. Anyway, so we'll get to that. But this is, I think this is kind of fun. Anyway, yeah, I added a slide. I added a slide I forgot about adding, but I added it. DNS is a beautiful, beautiful thing to an attacker and we wouldn't be complete if we didn't talk about it. UDP protocols are so beautiful because they're so much easier to spoof and they're just, it's just so much. It makes things worlds easier. And it's a beautiful thing for an attacker and Dan, I read Dan's slides. I missed his talk before, but I'm going to see it. But Dan has some really good ideas here. DNS is a wonderful thing to an attacker. Absolutely. What I really like, you know, on the one hand you could spoof DNS replies to everybody on the network and that doesn't go away as a threat. We don't really have much of anything we can do about it. Okay, if you happen to put your laptop on a network on the same network and I send out a DNS and I send out a DNS request and you watch it go by, you can respond to it. And quite possibly, very often, trust me, DNS spoof is a great tool, you can respond to it faster than the real DNS server. Part of that is because, well, you already know the answer. Well, the fake answer, whereas it might have to go and do work to find out where, you know, what Yahoo.com is or such. Anyway, the other really cool thing about DNS is if you can poison it, if you can poison DNS for like an hour or five minutes or 10 minutes or whatever, you can get an SSL cert. Because honestly, the way they do SSL certs is kind of simple. You apply for an SSL cert, if you can get email for the domain for a short time, then you've got the SSL cert. And revocation is really amazingly difficult because, basically, the people who own the domain for real have to wait for it to expire. So, okay, well, I'll get to some more, I'll get to some more man-in-the-middle stuff, but I think that this is good stuff to think about. We trust our networks way too much. So, if we share a LAN, did I go back a slide? Hmm. Okay, so let me get on to some of the, let me get on some more of the meat. I've been playing, I've been man-in-the-middling and I've been surprised at, well, how much of it goes by clear text and how much stuff is in there and how much stuff is persistent and now I'm afraid of Google, too. But I'll get to that. So, basically, part of what I want to say is that, you know, beyond just the straight, this website is clear text. Sites that are mixed between clear text and not-so-clear text are between, you know, HTTP and then whatever you want to call it, SSL, TLS, encrypted web traffic, I think it's a reasonable thing. And the problem is that anytime you're unencrypted, I get to watch. But remember, I'm into integrity. I don't just get to watch. I can clone your session. Okay, I can throw in whatever I want. If I can route your packets for you and I try to say that that's actually pretty easy and trivial and we all knew how to do that a long time ago, if I can route your packets for you, well, then I can take any of the ones that, you know, will let me, any of the clear text ones and, you know, I can use them if I want. I could, honestly, I could keep them for myself and not send them on to their real destination. And I could send my own stuff on to the real destination and then when the answers came back, I could hold on to that and I could send you something else. And if you start scripting this, if you start going programmatic, you can really do a whole lot. Part of the way I got an idea for this was basically the idea of taking a user who's signing in to Webmail and saying, wait, if I can get them on to my Webmail server and if they can control their whole, like, email world, I know that sounds really overblown, but really it's, I can sit there and say, okay, well, I don't want them to see this email that came in. So I'm just gonna make sure that in the view that they're getting of the data, they never see that email. Maybe they never see any email from this person.  I don't know, we're both trying to date the same girl, maybe. And, you know, this guy's never gonna get an email from her anymore. And he's saying, I don't ever want to talk to you again. Right? And she's not gonna know unless she goes out of band. But, you know, but we've got VoIP and I'm working on it, right? So anyway, we've got this, so it's really, I mean, you really, it's really freaking crazy because you can put someone in their own little email matrix and they don't know they're in the matrix. They think that they're just going to their mail site as per normal and it's not that hard. And I rode a tool to do this kind of stuff. So anyway, one of the, this is actually one of the things that got me thinking about this was basically in we were, you know, we've been doing, we do a lot of web app hacking. I do a lot of web app hacking and it's really, really fun and it's great stuff. But constantly we talk to companies and we say, you know, your users are logging in and you're encrypting their password and then after that, you're leaving the whole session unencrypted and they say, well, we protected the password. And I think at the password, and I say the problem is that if I share a network with them, not to be repetitious, but if I share a network with them, I can see everything they send, but more than that I can impersonate them and I can impersonate them for, well, about as long as I can manage to keep a clone session. So it's really kind of, I mean, I can, with most applications, I can be in the application. They can be in the application. We can both be in at the same time or both the same user and they may not know if I'm modifying data, it could be subtle. So anyway, I mean, this is one of the, I take LinkedIn as example, but I only take LinkedIn as an example because it was just one of the ones I was thinking about. It's one of the sites that we all, you know, that I think a lot of people in this room use. But LinkedIn is this great site.  And you could say, no, I'm not going to be like that. I'm going to make sure that I'm not going to Jay's version of LinkedIn. I'm going to make sure that I'm going to the right one. So you'll type hdbs, slash, slash, you know, www.linkedin.com, right?  Okay, that's good. The difficulty is that you'll go to that, you'll go to that encrypted site, and then LinkedIn will give you, will take you back to clear text. And you may say, well, I can keep typing hdbs and the problem is they keep giving you pages back that have, well, clear text links all over them, so you're just stuck. And that's just how the site operates and it's really, really no fun. So that's our red link. That's where you go. So if you change the URL, clicking on any link basically just gets you back to not so SSL, not so encrypted. Anyway, there are people out there that have made modifications to browsers, they've gone and gotten plugins. They do like me and surf through a defensive proxy. And basically they make it so that all of their stuff is going, whenever the site will permit it, is going encrypted every single time. So they just keep making encrypted and a lot of applications will let you do that, but not all of them. But anyway, the nice thing for me as an attacker, it's really a lot nicer to be an attacker. I'm telling you, it's like way better to be on the attack side of this one. Okay, as an attacker all I've got to do is wait for one request to go by and I get to clone session and maybe I get to inject some things. I might inject some JavaScript or inject some redirects. So, you know, let's look at, let's kind of start thinking about what I can do. So one of the first things I do is basically I'm going to get your machine to go to my machine. Maybe it's going to my machine because it thinks it's the router, maybe it's going to my machine because it thinks it's the DNS server or the real web server or what have you. I might do it through ARP spoofing. I might do it through DNS spoofing and I might do it through DHCP spoofing. And none of that's really all that hard. I mean, there are nice command line tools for everything but the DHCP spoofing and the DHCP spoofing, well, you can use KB or HP or whatever or you can just stand up your own DHCP server that has the same settings as the real one because they're kind of public. You can figure out which IPs are taken and you know, go and assign the rest. You can be really friendly. You know, I don't know if you guys have seen this but I've thought about this but this is really kind of the way that DHCP thing works. If I can beat the DHCP server and give you an answer before the real one does, well, everything's going to work just fine as long as the real DHCP server doesn't give out your address. So if I kind of watch what address it's giving out and give you and say, okay, well, it's not going to get to this last 20 for a while so I'll give out those. It's kind of like this guy, this happened to my wife like a week ago, it's kind of like the guy and the parking attendant in that lot, if there is an attendant doesn't really wear a jacket or uniform and he just goes up to people are parking their cars and says, hey, it's $5 and writes them a receipt and then walks away from the lot and you get a ticket and you're like, what the heck? This is, you know, yet another way. You're not really quite sure who you're talking to. Somebody got friendly. They said you can have that spot, no problem. Okay. So what kinds of things can you do? I can start injecting clear... I can inject anything into your traffic. If it's clear text, I get to inject anything I want. It's fun. It's really good. I can inject anything in both directions. So I can inject JavaScript into clear text traffic. I can go and take your session keys. So, you know, like, HDB is this really, you know, web is this really, really crazy little protocol that kind of was invented as file transfer for the most part, right? It was kind of glorified file transfer. Pretty fast glorified file transfer, but glorified file transfer with this nice hyperlinking stuff. And then we've like gone and basically made everything web. I mean everything, and we'll talk about that, but we've made everything web, and so that's really nice. But the thing is, as glorified file transfer, it doesn't have any state.   And I said, okay, every time you talk to me, remind me that you're number 45, so I can remember that you're J, so I don't have to ask you for your password every single time. Okay, cool. So we've got this session cookies, but if anybody watches that number go by, very much like the deli counter, or whatever, or the pharmacy or what have you, they can kind of come up and say, oh, good, I'm so glad to see you number 45, here's your prescription. Right, this is, anyway, it kind of works very much the same way with web apps. So if I've got session keys, if I've got your session keys, if I can see them once, well, then that means I can start up my own parallel session, and some web apps are really nice and actually say, wait, there's two of you, and I'll knock one of you off, and I'll probably win the race, but you'll probably notice me. So I guess that's better than if, like, you know, we just were both there and you never noticed me, but it's still not great. So there are other things I can do. I can intercept your logout request. So you go and say logout, and I'm like, wait, if you logout, this session hijacking thing, or this session cloning thing doesn't work so well. So I'm not going to let you logout. You try to logout. If I'm proxying all your traffic, if all your traffic's routing through me, then I'll just say logouts and how I'm not permitting those. And if I know the application I'm dealing with ahead of time, instead of just, you know, this is one of the things with existing tools, right? If I know the application ahead of time, and I know this is the logout link, well, I could just make sure that anytime you send anything that matches this given regular expression, ooh, reg apps, then I'm not going to let it go by. But I'll let everything else you do go by. Just not that one. Okay, so what else can I do? I can replace, and this is his idea. It is, I think. At least I think I had it, but then I forgot it. But that's like so many ideas we've all had, because I'm pretty sure every idea I've ever had, somebody else has had before, and not just one, like 15,000. So anyway, this, I can go through and I can replace HDBS links with HDDB links. And this is something really, really cool. This is something that we're actually doing, that we're actually doing in the middler. This is part of the reason the middler is, well, not entirely working right now, because we added some functionality at the very last minute. But on the other hand, it's cool functionality. It's better. So now, well, I'll go into it. Exactly how it works. So the middler basically does this. The middler has two kinds of modes. One is an interactive mode. And that interactive mode is somewhat similar to existing tools, except that it actually is there to make it kind of brain dead easy for you to clone other people's sessions. Instead of having to be a web app hacker, instead of having to be a web app programmer, where somebody really, you know, could follow this, and it takes a while. It really does take a little while with some of these apps to go and profile them and say, what do you need, and so on. We've spent some time with different apps and said, okay, this is what's logged in. This is what's logged out. These are the session cookies I need. These are the things. And what we're doing is basically doing something non-interactive. But I've gotten ahead of myself. We've got this interactive thing. And basically what you can do is, if one person is surfing through the proxy, unbeknownst to them, and you're the bad guy who set up the proxy, you can go to the proxy and say, I'm going through the proxy and I'm coming from my IP address. Well, then when I try to go to LinkedIn or LiveJournal, I'll go in as somebody else. And I can choose the somebody else. But I can go in as somebody else that's on the proxy right now. And maybe as many of them. So that parts we're kind of all used to. I mean, we don't do that so much because the existing tools kind of make it easy to watch, but not so easy to actually, well, modify. Again, integrity, not confidentiality. Well, both. But integrity is really fun. We're more to the point attacking it. So the first part, so we can do this. This is kind of the interactive parts, the parts that you're really going to do. And this is human. This is at human speed. But I like machine speed better. It's faster. But at human speed, we can actually go and basically, you know, we can just clone someone's session and make that really easy. And you don't have to go and sit there and figure out which things you need to clone, which things are being changed, which things you need to hold static, screw that, let the proxy do it for you. And it's a useful thing. We can also just start saying, you know what, as long as you're going to be able to clone someone's session, as long as you're going to be able to proxy their session and, you know, look at every single bit that comes through and change whatever you want, we can actually start going through and injecting JavaScript and other links into the page. You can put in whatever links you want. But I like JavaScript because it means you can send somebody to links they didn't want to go to. You could put in pictures, as we've all seen with some really disgusting pictures. You can go through and, you know, we tend to see it here. I don't know why that is.  You could go and actually start putting in your own redirects. So you can say, hey, you know what, I'm going to decide that every other user, or only these three users or whatever, are going to be redirected to the site of my choice. And that site of my choice might be, I don't know, it might be my own vanity site, but that wouldn't be nearly as fun or nearly as evil. I could make it a phishing site, but that's not all that much fun. What I'd really like to do is redirect them to, I don't know, Metasploit, yeah, clients at Exploits. So that would be fun. Or I could redirect them over to, you know, Anybody Heard of Beef, the browser exploitation framework. I think it's really fun. This guy, Kevin Johnson, who's like taught everybody a lot, is like, got me really into this idea, and I'm blown away from some of the demos I've seen. I need to play with it more myself. But this is pretty easy. You can, you know, we can go through and do some of the normal stuff, which is the user's whole session, and the middleers actually got some really nice stuff. Again, trying to go and basically take previous tools to a really, really different level. The middleers actually got some stuff in there so that we can parse out the Excel that's going by. We can parse out JSON. JSON is JavaScript object notation. It's like what Google uses to send your mail back and forth. So if you can parse it, it gets a whole lot easier to read somebody else's mail or throw some in there, or delete some, or whatever. But we're making it so that the intent is to make it really, really easy, not only for you to do this interactively, but for you to add onto it, because that's the idea. It's like I'm this kind of weird open-source guy, and well, this is open-source attack tools. So I'm going to tell you that it's going to be really easy. I'm not going to get to write documentation this weekend by far about how to do it, but it's going to be pretty easy for you to add more and more sites. There's also, the really fun stuff to me, though, also is this kind of doing some site-specific features. And this is a little weird, because you say, wait, I can do all this with a browser, but I'm going to kind of go into some of the stuff you might do. So the first is, suppose Gmail and Webmail, Gmail, Yahoo Mail, all the different Webmails. Most of these Webmails all basically leave almost the entire session clear text, which means, ding, ding, we can all have fun with them. So what kinds of things might you do with Gmail? Well, you might read the user's email, which is kind of the obvious. And by read the user's email, it'll just be in their email, but they're, you know, the email that they're reading, but also all their other email, you know, and go through the folders. And part of the intent of the Middler is to go and say, let's do this programmatically. Let's say, listen, if I'm watching Justin read his Gmail, you know, it's like, it's nice. I can go and click on a link and see what his message is and all that. I hit compose and send a message. Yeah, whatever. What I really want to do is just harvest all of his messages all at once. And I want to do it before I even knew about it. I want to do it while I'm off drinking or, you know, whatever it is I do, eating sushi, because I don't really drink so much, but sushi, that I do. But so the, you know, I want to make that really, really, really easy. And that's the intent. Okay, so we're automating the... That's a bad word too. Gee, I don't have any cur... How do you not curse at DevCon?  Absolutely positively. Anyway, so you can go through and you can read their email, but you can go beyond that. As long as you're logged into Google as them and you didn't need their password, you're just writing their session. Why not do a whole bunch more? Why not read all their past Google Talk conversations? I think about that and I think, oh gosh, and why not harvest their whole address book? I mean, you know, we probably don't care about that so much, but if you were a professional spammer, a professional fisher, a professional, well, if you wanted to send client-side exploits to all of their friends or all of their coworkers or whatever, that might be really useful too. And we could send our own emails. We could do that programmatically so we can send tons of emails and they all look like they came from this guy and he can't prove that it wasn't him, right? You follow the headers and you're like, yeah, this was absolutely him. You can go and profile the user in all the other Google applications, awesome. You can profile the user in all the other Google applications and, you know, since you can prevent that, since you can prevent him from logging out, he thinks he's logged out and you're going to keep using that session for a long, long, long time. When I start thinking about all the Google applications, I really get scared. I love Google. I love all the stuff that give me, that give me all this wonderful functionality, most of it through my browser and even through my phone. That's really, really cool. But every so often I think, gosh, wow, you know, if I were Google, I have a lot of information on a lot of people. You know, I almost want to sell that stuff. But if I didn't sell it, maybe I'd just, like, one day, I'd be like, you know, screw this ad stuff. We're going to be an intelligence agency because we already know it all. I mean, we don't know it. But it's all in there. We just have to mine through it and find it all.  But be nice. Okay, so it's kind of crazy. Imagine not so much what happens if, you know, don't think so much about what would happen if somebody could get to your Google data, right? Because you're like, no, I'm too smart for that. I would never use Gmail for anything that wasn't absolutely public. I know you're all like that. I'm not. So why don't you think instead about what would happen if you could get to all of my Google data? What would happen if you could get to those docs and those spreadsheets and, you know, my email and my chat conversations and my bookmarks and my browsing history? I mean, Google will show you your own. As long as you're cloning somebody's session, why not look at theirs?  So please be nice when you're looking at all of it and, you know, keep it to yourself.  But this is bad. You shouldn't do it, so please don't go and do this stuff to me. Please. Please. Pretty please. So other sites. I think a lot of journals are really fun ones to think about, too. This is one of the reasons I targeted it as one of the first sites to do this within the tool. And LiveJournal really shows you the power of... I think LiveJournal really shows you the power of doing this programmatically. LiveJournal is a blogging site, but to call LiveJournal another blogging site is kind of really underestimating what it does. People think of LiveJournal as a private thing. I don't know. Who in here has actually got a LiveJournal? I know we're all kind of getting older, so it's, oh, more of you do than that. I read some of yours. Okay. So this LiveJournal thing can get really popular, especially among young adults. But basically, LiveJournal is this blogging site where people kind of expect that a lot of their blog posts will be private. They mark their blog posts as just for me.  But they also mark their posts as just for me and my friends. My friends can know this, but nobody else can, because this is really embarrassing. I don't want everyone to know about how drunk I got last weekend or whatever it was. But they can actually do something else. They don't know far more than I do, because I've logged into it like, I don't know, you know, once a month or something. But, you know, I've talked to people, and they have all these filters set up. They say, this is one group of friends, this is one group of friends, this is another group of friends, this is another group of friends. This group can know about my career, but this group can't, and this group can know about my sex life, but this group can't, and so on and so on and so on. I'm serious. I'm serious. I could, yeah. So anyway, but they have this expectation of privacy, and yet it's also clear text, which means you could programmatically with a proxy, if you could get them to surf through the proxy, which just means you have to be on a, you know, on a wireless network with them, which, oh, that's never going to happen with somebody who blogs. People got a blog from everywhere, right? So, you know, you can go through and read their private and their friends-only journal entries, but you can do more than that. You could go and make them all public if you wanted to. You could make some of them public. You could make some of them that aren't supposed to be seen by one of the groups of friends visible, you know, to that group of people who would be offended or what have you. You could go through and harvest their friends list and then go look at all of their friends' private posts. And if you did this programmatically, which is what we do in the Middler, you'd get a lot of it really fast and it would be kind of fun. Anyway, you could even start, you know, you could even give yourself more privilege. You could add your own user to the victim's list and now we've got something like Sammy all over again. And there have been some really great talks about social networking at Black Hat and DefCon this year and yes. So LinkedIn's another good one, same kind of thing. Just imagine the same kind of thing. It's just we all kind of have this expectation of LinkedIn that, you know, Justin's my friend. He can have my phone number. He can have all my phone numbers and my home phone number. That's okay, but I'm not sure that I want everyone to have it. That's, you know, so whatever. I want to go a little bit further. What's wrong with this picture? This is actually pretty hard to see, but this is Clear Text Banking site. This is a Clear Text. This is US Bank. This is the front page of their site. Okay, it's Clear Text. And I've blown it up a bit. There's some locks over here where you put in your personal ID. Okay, this is where you put in your username. And there are locks and those locks are there to make you feel very safe. Okay, so why are they there to make you feel safe? Well, that, this form where you put your login ID, it's encrypted. It's okay. It's SSL. So we're all supposed to feel safe. And I remember back when I did feel safe with that and I felt really dumb then once I figured it out. I said, wait a second. Since you went to Clear Text site first, doesn't that mean that that SSL page, that SSL link doesn't have to be SSL? And you may not even ever know it wasn't SSL and most of us don't look for it. I mean, honestly, Justin, you made a good point. You made a good point about this. He said, wait, I'm a security guy. Great. He said, I'm a security guy. And I don't always notice if it's gone SSL or not. I don't always notice. I'm, okay, just so I'm not just making fun of him, I don't always notice.  Okay, so anyway, this is a banking site that, you know, if you wanted to, you could fool a tremendous number of people into just, well, never going encrypted. And this is actually, this is actually something, let's see, yeah, we have it here. This is what the Middler does and this is one of Justin's big contributions. So yeah, you should speak to it because I keep telling him. Yeah, not a problem. We have this nice, beautiful, beautiful program. Nice little thing. It came up and, oh, it's Python. It's beautiful. And he asked me to go ahead and, if I could help him out, try to finish up some of the nice functionality for the nice demo for everybody here at DEF CON. And I said, sure, why not? Good friend that I am. Get out my nice little ice pick and start to reverse engineering some programs, trying to get some nice little point and click stuff in there for everybody.  You know, your concept right now is we have these secure websites and your tool only works if the first page is unsecure, if it's unencrypted. And your solution to try to gain some additional information is we're just going ahead and try to inject some JavaScript, do some other tricks that everybody's really heard. And that was kind of the backbone of the tool. And honestly, part of it was I was just going to wait. I was like, wait, they're going to go through but Justin said we didn't have to wait. But wait a minute. We're already man in the middle in them. We have controller, their connections, all their traffic's floating through us. What if, when they go to that ClearText first page, we never let them get to HTTPS. In the middle, we go ahead and we rewrite all the h-refs inside the page so that they don't have the s. And that was where I said to Justin, wait, there's a problem. You know, you try to go ClearText and it says, no, no, this part of the application is only available encrypted. So, we allow the proxy to go ahead and stay encrypted. And we basically create a proxy that strips out SSL for the client. And then it kind of keeps track. Well, right now in a kind of stupid sin cookie kind of way, but it kind of keeps track of all the things that it changed from SSL to not so SSL. All these links that used to be SSL that aren't SSL anymore, it's like, wait, the user surfs to one of those. When they come through me, I got to go and make sure that I change them around again and make them SSL again. So, we've got this kind of little clues, but we kind of like it. It works. Which is we just take the URL that was SSL and we throw a little cookie in. We were going to do a random number and we probably will eventually, but right now it was proof of concept we did secure for. So, we said to the proxy says, okay, if the user is trying to surf and I see secure for, I know that that means I'm supposed to go and pull the secure for out and make sure that I do that session encrypted. User never needs to do that. We're going to keep things just as they are. Hunky Dory, and it works really well. And honestly, I'm going to tell you, I love my family, but they're not IT people and none of them will ever know the difference. Which is really sad, because I'm really working on it, but I'm just not that good a teacher. Okay. So, yeah, and then the only problem we really have left is most of us are actually typing in the URLs and a lot of the secure websites that we're actually going to, most of us go ahead and just type the domain and it pops right up and it redirects us over to the HTTPS. But occasionally we have bookmarks that go directly to HTTPS. Or occasionally we'll actually type in the HTTPS. So, the solution for that is we either simply wait for them to go ahead and have the application drop them back out or move over to another website.  Absolutely. So we have multiple different options there, but given enough time, that person will eventually drop out of SSL mode, eventually find something to click on that is back in SSL mode and we'll prevent him from ever going back in. Okay. Now, we're running low on time, so I've skipped a couple slides, but I want to get out of just the application, out of the web application space. There's something else I realized, and that was I have a whole lot of software updates that self-updates, a tremendous amount of software on this laptop right here that's self-updating all the time. And the first time I thought about it, I was like, wow, if anybody were to sniff the wire, they could find out what versions of software I'm running. They'd figure out which ones were vulnerable and they could even send me clients that exploits specifically targeted to the vulnerable software that I have. And since they're watching me try to update and they know that update's going to take 20 minutes to download, they can do it while I'm still downloading the update. How about our ace condition there? We started watching this, we started looking more and more at this, and there have actually been I started looking at this and I said, wait, my iPhone, my iPhone's got this, okay, so any Apple people in the crowd? Could you guys, like, plug your ears? So I might have jailbroken my iPhone and it's possible, or it might have happened to me while I wasn't looking because I went to, actually I probably served to a vulnerable, I've probably served to a website that was supposed to be all nice but it had an image file that was, you know, bad. It was bad, and so it got hacked.  And I realized, wait a second, Installer.App, it's like pulling down a software catalog in clear text. That's really cool. I can man in the middle of that. I don't want it on the iPhone. Well, I mean, I already could. But I'm a baddie, so now I can change the software that's going on. Because if you can do the catalog, if you can man in the middle of the catalog, then you can actually choose where all the software comes from. Unless some college students, one of them got doing just dissertation on it, who basically figured out that he could do this to a whole bunch of open source distributions and what else? Yeah, we can do it. So we're doing it for software installation. We're doing it for software updates. Start watching your software updates, you'll be really, really scared. They won't explain vulnerable browsers. It's really, really nice for man in the middle people because they think they're going to CNN, they think they're going to their own bank site, and wow. Did they kill them both? Oh, here you go, Jay. You won't get...


There is a plethora of different health care options that you can go to get some experience. What's up you guys, it's Zodana. I am back with another video for you guys.   And then you're like, oh, that's the hype. I now want to become a PA. So now what? All right. So apart from just like your general prerequisite stuff, there are three things that I do believe that you should absolutely do if you want to be a PA. So the first thing is fill out your CASPA application. What is CASPA? CASPA is our central application website where you would go to put in all of your information where it's housed so that you can at the click of a button, just go ahead and send it off to the different schools that you're trying to apply to. If you want to be a PA, if you want to apply to PA school, you have to fill out a CASPA application. And that is where all applications pretty much go through. The website is CASPA.Liaison.com, but I will be sure to leave a link for it. It's just that specific website for you guys to just click on it and go to that website. If you don't already have a CASPA application, then you should definitely fill one out or create a new application. So that is like my first thing, biggest thing. Start putting in that information because it does take a little time. It is a little time consuming. But the beauty of it is that once it's in there, God forbid, if you do not get in next cycle or this cycle, it just kind of populates for the next cycle. So it will be able to just transfer over the major information and you would just have to get all of the new transcripts and stuff sent in again. All right, so what is the number two thing that you need to do, right? I've gone to Art's website. If you haven't seen my video about accreditation, go ahead and check that out. I will leave a link for that in the description box and probably somewhere here on the screen for you guys to go check that out about provisional or developing programs. But ARC is our accreditation body that talks about keeping the standards for the PA schools set and in place.  Yeah, you're a pretty good PA school. You're doing well. You're good. You're like, your accreditation is good. You're going to continue your accreditation or you're you're not doing too well.  You know, you're kind of new in this. So here you get provisional status, right? And ARC also in keeping with this standard has stated that in the year by the year 2020, all PA schools are expected to go ahead and transition to a graduate degree. So what does that mean? More than likely you're going to have to complete your GRE for all PA schools by the year 2020, definitely by 2021, because it is stated that if you do not come, if they're not transition, if those schools don't transition to a graduate degree program by the year 2021, then their accreditation can be pulled and you don't want to be out of school where their accreditation is pulled because you have to actually graduate from an accredited PA school to sit for your certification exam, which is the PANTS exam. So that is definitely one thing that I suggest all of you do. If you want to go to PA school, take your GRE. It's not the subject based GRE. It's a general GRE. So make sure that you're choosing the right test when you're actually applying to take the GRE, which is something that you'll have to do to sit for the test. And the third thing that you need to do is get health care experience, right? So there is a plethora of different health care options that you can go to get some experience. There's Home Health Aid, which is the HHA, CNA, MA. You can be an EMT, a paramedic. You can be a scribe, but be just be cautious because not every school accepts scribe hours because they don't actually touch the patient. But there are some schools who do. So if you want to be a scribe just in your early years of patient care and health care experience, that is OK as well. But there are many options out there. So do your research, find out what works best for you and then go ahead and get that health care experience. Schools look really highly upon that. So if you get like a good 500, I think that's a good solid amount of hours. But anything a thousand and over, you are golden, OK? So what are my three things? Definitely fill out a CASP application or create one if you haven't already done. So number two is to go ahead and take your GRA because most schools or every school should be transitioning into a graduate level PA program by the year 2021. And then thirdly, go ahead and get your health care experience in and shadow some PAs as well while you're at it so that you can actually understand the health care field and what you will be doing and how to interact with patients and get your hours in for your application in PA school. All right, so I hope this was very helpful to those of you who are considering a career in PA or who want to now become a PA after seeing some of the information out there on the profession. If you have any questions, go ahead and leave them in the comment section below. And if you have any suggestions for videos that you would like to see next, go ahead and leave those as well. I will be sure to get back to them. Thank you guys so much for watching and I will talk to you guys later. Bye.


I'm going to ask you to come down, maybe sit in here for the Q&A. We have 20 minutes for questions. And I'm sure you have many. I'm going to ask you to try to be as brief as possible. Oh, Hernando Zuleta from University of Los Andes. Just one short question for Noam. So you just show us that there is a big preference for redistribution. But I'm not familiar with this literature, so maybe it's obvious the answer. But do we know about preferences for taxation? It's related to one thing that Santiago Levy said yesterday. In order to have redistribution, we need taxation. And it seems to me that we don't want taxes. Yes, I'm sorry. I forgot your name. The one who's writing, yes, hi. No problem. I can't see it from here. But in any case, do you have a theory for why it is that the legislators are to the right of the top 20%? One more question. This is for Leopoldo. So the narrative is, despite political inclusion and major economic advances, there's major economic advances in Latin America. By comparison to Asia and everywhere else, there are all these graphs of how Latin America started over here. Everybody else overtook us. There's only Africa below us now. So I wanted to comment on that. All right. Why don't we go first round of answers? I don't know who wants to start. Do you want to start? Yeah, I guess what your benchmark is. And I think you're completely right that we talk about the success of Latin America relative to perhaps some benchmark. And we're doing relatively well. But if we think about like, and that's not new, right? If you think about 19th century Latin America, our reference should be the US. So we did very poorly. Whereas if you take perhaps other reference, we're not doing this bad. But I agree with you and I was trying to sell the glass half full kind of story in the sense that it's not the things that have been still in terms of economic progress. And I do think that some countries and in particular the context that I was showing, Colombia does have some things to show in terms of reduction in poverty rates, increase in life expectancy, increasing coverage in health provision to its population. So there are all shades of grays and blacks and everything in this. But I just didn't want to be completely unfair with respect to everything has been still since. But I agree with you. And actually my benchmark is that we should be aiming higher and we should think of ourselves as falling far behind for where we should be. So, yeah. Thanks for both those comments or questions. So I don't think we have great data on preferences for taxation in the sense that or preferences for redistribution. Honestly, I mean, these questions are quite vague. I think where there are slightly more detailed questions about taxation on whom and for what purpose. Taxation on the sort of top of the income distribution in order to redistribute to the bottom of the income distribution are quite popular. But you have to ask these questions in a way that sort of suggests what's actually going to happen is something to do with redistribution. And there wasn't I think it was there was another paper in the in the program on, right, the sort of experiments on sort of expectations about, you know, whether the state is going to actually sort of do these things and things like that. So this is also a problem with sort of asking the question of preferences for redistribution because it's sort of contingent on whether you think the state will actually do the things. They actually redistribute rather than, you know, corruption, sort of taking the resources and things like that. But I don't think I don't think that if you looked at sort of these responses in southern Europe, for instance, that that would be very different. Whereas, you know, they do have higher levels of redistribution even in southern Europe. Why the elites are to the right of the top 20%. So I don't know. But one possible explanation was which is consistent with sort of what Marty Gillins and other people have found in the U.S. Is that the what those elites are actually sort of the preferences those elites are actually responding to are much narrower than the top 20%. They're the top 5% or the top 1%. And so to the extent you think those preferences are moving to the right, then that would be consistent with that. Good afternoon. I have a question for Mariano. Okay. Well, it was all, I took the information from Mariano and Pincey. I think it is Pincey. Sorry, I didn't remember your name. Ah, Pilar. Pilar and Noam. And what was common in all of your presentation was that Peru had one of the worst indicators in almost everything. Yeah. In Peru, you saw, as Pilar showed that the public schools, when you start increasing your income, you move to private schools because they are clearly better. In Peru, that's clear, clear. I live in there. I did my undergraduate course there. And I know that for a fact. And he's Peruvian. He can confirm that information. And I think you, Mariano, you showed us that in Peru there was little preference for redistribution. I think it was the worst country with preference for redistribution. And my question is for Mariano, because you showed that 243 Madrid, where you put some kind of equilibrium, right? In my opinion, Peru is located in the equilibrium where you have, like, when the rich and the middle income families, like, they joined and they left out the poorest of the population and they are not taking into consideration for anything. And that's my opinion of Peru. Well, for what I've seen. So I don't know if you know of any cases, any examples from countries where they were, which were there, like, standard in that position, but they did something that could change, like, the path of the country in order to get a better situation. Because it's not, for example, in this moment they have a left president. And what I have listened from Peruvian friends is that thanks to that president, at least in 20 years there won't be any other left president. Because he's not the best. So I don't know if you know of cases where they have turned out to change that path of development. Any other question or comment? I have a question for what you already raised, which is this tension between the two approaches that you are presenting. And I was wondering whether that tension truly exists from coming from different frameworks and whether we need Mariano to enlarge his framework to actually be able to help us rationalize these two views. Or whether there are situations in which weak parties can still provide a new fresh perspective with moderate distribution. And I want you to reflect on under what circumstances you think this may happen. Well, great. Thank you very much for the question. Thank you, Julián. And again, a pleasure to be here and part of this conversation. The question is very difficult, so I'm not going to answer it, but I'm going to say a few things related to that. One are very small things from my little model, then more important things relating to the later questions to your later questions. In this little model, I only have rich and poor models version with two groups. In that case, what you described at the Peru data point will fit the equilibrium that give me small taxation, small redistribution and inefficient state. So that Peru kind of fits in there in our data set. Of course, this is an extreme simplification. Another paper, I have two authors to my left who have worked on that. Once you include middle class, other things would happen. And there are very nice papers showing that there are some conditions under which the middle class naturally ally with the rich. And in those cases, those equilibria predict you have little taxation because that's what the rich want. You have some redistribution, but redistribution benefits mostly the middle class and doesn't get to rich and poor. That's a bit the story of many of our countries in some points in our history that truncated welfare states, etc. So that's observation number one. The second observation is a deeper point that was also to some extent common to the two questions. One thing is in this humble model, we try to explain equilibria and that is very hard in itself. Then explaining transitions is very complicated theoretically and identifying which theories are in practice is even harder. Perhaps going that way would be the way I suggest we should answer some of your question and your later question. How do we move to one equilibrium to another? It's quite natural in the history of humanity and that has been a great contributor to our understanding of that. We are moving to, on average, we are moving obviously to a more inclusive society, to a more inclusive state. They will focus on a particular democratic transition. Now we are going, Argentina underwent a second incorporation and some people have worked on that. And in this incorporation and the Colombian change in the constitution was part of that game. And as many people have said, some of us focus on institutionization, parties, the standard thing that works in the steady state. Obviously we want to get there, but sometimes to get there we have to try and say to incorporate the other people. And perhaps that's the tension we're seeing among those two stories. Yeah, I guess the one thing I would say that is related to this that sort of struck me, Leopoldo, this time that I hadn't seen last time. When you presented the emergence of new parties, almost all of them are indigenous parties. So the sort of the color that emerges as sort of the biggest. So the literature that I'm drawing on would say class-based parties is what's going to get you, so that's the European model. Ethnic parties are not going to do that. So if what you're considering inclusion is sort of encompassing both sort of marginalized class groups and marginalized ethnic groups, then you might be sort of including two different things that sort of the literature on parties would not, I think, believe has the same effects. And so if the inclusion that we're seeing in Colombia is sort of ethnic minorities, then you might not expect economic outcomes to be different. I don't know if that's the story, but I do agree with Mariano that there's an element of sort of change will sort of include some period of time of instability. And maybe we're at the point where the equilibria are sort of shifting and we don't know which way we're going. But I guess to that I would say that the experience of sort of social democratic parties emerging in Western Europe was a period of sort of change, but had kind of the prior sort of the ability to mobilize sort of social movements. And one feature of the region in the last 20 or 30 years is not the emergence of sort of new parties on the basis of sort of large social movements, but new parties because the existing parties kind of fell apart and new parties that are simply electoral vehicles, right? The kinds of things we see in Peru. And Peru has sort of new parties at every election because the same people run for election under a new party label with some sort of new coalition, but not really because there's a social movement sort of behind those parties. So maybe that's one of the big differences between the trend in Latin America and the kind of emergence that we see in other cases. So I was thinking differently, but as you spoke, I think that it really relates to what you two just said, which is I think context matters a lot. And we're looking at a context in which when we had sort of a strong parties in Colombia, the liberal conservatives, they were strong, but they weren't able to represent large cross-sections of the society. So of course, all else equal, I also want strong parties. And I also think that if you build strong parties that are able themselves to put together diverse but somehow coherent different views, then those are more likely going to say a kind of rich agreements are more likely to reduce uncertainty are more likely to have broad based redistribution. I fully agree with that. But the context of Colombia is one in which these strong parties were not representing large thoughts of the population and the form of political entry. And so this relates very much to what Mariano said was initially a form of political entry in which, you know, outside of these two parties, other groups that were not represented by them started entering. Actually, they started entering so much in so small parties that nobody liked it. And we did this 2003 reform and we fix that to some extent. But it is still the case that Colombia has not produced two or three or four large parties that within themselves can have diverse but nonetheless coherent kind of different views. So in that sense, when we show this data for Colombia, what we really have in mind is not, oh, now we have weak parties and that's kind of good because, of course, what we have in mind is, well, that's a sign of how political entry occurred. Now, had it occurred inside the liberal and the conservative parties, then, yeah, perhaps much better, but that's something that didn't happen. So, and that connects to what you're saying, which is these groups that were entering where, yes, in one of the graphs, majority indigenous, but when you look at who then got to power, then indigenous were important, black groups were important, women were important, former guerrilla groups were important. So these are all groups that didn't have access to formal political power. They just distrust this exclusive political party so much that it's only reasonable that they didn't do it within the strong political party system. So in that sense, I think that, you know, if I abstract myself from the Colombian context and if I just look at whether stronger weak parties are better, then, of course, I'm going to agree with you and I'm going to agree with the reduction of uncertainty, broad-based redistribution and so forth, but we were not so much looking at the effect of strong versus weak parties but as a measure of the extent of fluidity in political power and competition and contestation, which even in a strong party system you want to see. You want to see that, to see, if you see a very entrenched political power, you won't see broad-based redistribution, you would see some fraction of the elite over some fraction of the party controlling the party and staying in power and so forth. So that's an attempt at reconciling these views but I'm still thinking about it and I think it's a very interesting tension, the one that has arisen with the paper so this is just, you know, on the spot thoughts. Thank you. Thank you so much. You wanted to have it. Just one last word because I also like the two interventions and I still am passed, you know, by your deep question about how can we think transitions for, in your example cases like Peru towards a better, more inclusive, yet more cohesive and institutionalized equilibrium and I just, I don't have the answer but I look here at my famous friends who have power to organize things so I think we should organize to think better about this. Again, the notion of equilibria is useful to think about approximation to state states but many of our countries are in transitions and I think your paper is very nice description of the current state of the Colombian transition. If I had to throw one example but every country example will have somebody upset, I think you know I did a bit of a job or there were two parties and then a third one entered on the left and they kind of accommodated and they live in a rather civilized manner so we have to look for examples of that and my fear coming from Argentina is that in some of the cases the incorporation period makes you jump from elite domination to populist none of which is a good equilibrium for welfare or for the poor for that matter. Thank you. We have one last pressing question. Just more than a question is a suggestion for Pilar for future research and thank you very much for your presentation. I really liked it. At the moment what happened with COVID is that a lot of these private schools for the low income desiles were closed because they were bankrupt so I think it's a very nice opportunity to understand thinking about what you were of your paper to think what implications would that have and what implications is having right now. All these school closures and what we are seeing is that a lot of people migrating to public schools and public schools completely overflowed in many countries so I think that's an interesting opportunity for future research thinking on what you're doing right now. Thank you. Thank you very much everybody.  All of the papers that you've seen here discussed are going to start popping up on this website. There is very little yet in there but there is something useful which is you can follow us. You go there you put your email address and then you will get emails with a lot of interesting stuff that is going to be coming in the next few months and maybe some of the things that you are doing please bring into that so that we can actually be aware. I mean this conference has been great for that. Thank you very much. Thank you for the great.


I go first. Okay. My name is Gabriel Ecolumbro, executive director of PINAS We are the Fintech open source foundation and we enable Really old constituencies of the financial services industry to collaborate through open source We've been operating now for six years And since two years we joined the Linux Foundation. So we are a hyper ledger sister foundation I would say We've been really growing in terms of banks, buy sides, regulators and now Fintech's increasingly joining the open source collaboration, which is quite unprecedented and if you ask my first introduction to open source it was about 15 years ago as a open source Committer to the Apache Software Foundation. It's pretty different back then. I think I had dreadlocks As Dave treat I In this context, I so I founded extension blockchain practice back in 2015 Had and then almost immediately. I mean, it's the you know shortly thereafter spoke with Brian Bellendorf and said, hey Let's get involved with hyper ledgers was a founding founding board member with hyper hyper ledger and and one of our I suppose One of our main focal points right from the beginning actually we we took a look at where were the deepest value pools the most important spaces to work on and I really came down to Digital currency digital identity and supply chain and so digital currency has been a focus of ours from the start My first intro to open source Nobody lets me code anymore But in the 90s, you know, right, so I remember you know using open source But I think really my awareness of the governance of open source and actually, you know, what open source projects are Was really Brian sitting me down and convincing me that hyper ledger was was it was the right thing to start so He's a great ambassador. He was the ambassador.  We are a Non-profit based out of the United States that's focused on bringing the private sector together to do exploration of a US central bank digital currency My first exposure to open source does not date as far back as these gentlemen sadly because that's amazing but started in 2012 with my work at the consumer financial protection bureau and when that agency was opened it was open source first and We had the first open source policy in any financial regulatory regulator And we helped support the then Obama administration in drafting the first US federal Open source policy for the US government. So it was amazing More than back I head up the Swiss center of the BIS innovation hop the bank for international settlement of the BIS has been promoting monetary and financial stability through international cooperation for over 90 years and for the last two years we've been doing it Through innovation and we started out with three centers in Hong Kong, Singapore Switzerland and we've just opened up in London and Stockholm as well and later this year will have a euro system one and even later one in Toronto We also have a strategic partnership with the Federal Reserve So my introduction to open source has really been through the projects that we've been doing in the BIS innovation hop So it's it's fairly recent compared to the rest of the panel