Hello everyone, welcome to theCUBE's presentation of the AWS Startup Showcase, the next big thing in AI, security and life sciences. In this segment, we feature Orca Security as a notable trendsetter, within of course the security track. I'm your host Dave Vellante and today we're joined by Gil Geron who's the co-founder and chief product officer at Orca Security. And we're going to discuss how to eliminate cloud security blind spots. Orca has a really novel approach to cybersecurity problems without using agents. So welcome Gil to today's sessions. Thanks for coming on. Thank you for having me. You're very welcome. So Gil, you're a disruptor in security and cloud security specifically and you've created an agentless way of securing cloud assets. You call this side scanning. We're going to get into that and probe that a little bit into the how and the why agentless is the future of cloud security. But I want to start at the beginning. What were the main gaps that you saw in cloud security that spawned Orca Security? I think that the main gaps that we saw when we started Orca were pretty similar in nature to gaps that we saw in legacy infrastructures in more traditional data centers. But when you look at the cloud, when you look at the nature of the cloud, the ephemeral nature, the technical possibilities and disruptive way of working with a data center, we saw that the usage of traditional approaches like agents in these environments is lacking. It actually not only working as well as it was in the legacy world, it's providing you less value. And in addition, we saw that the friction between the security team and the IT, the engineering, the DevOps in the cloud is much worse or harder than it was. And we wanted to find a way, we want for them to work together to bridge that gap and to actually leverage, allow them to leverage the cloud technology as it was intended to gain superior security than what was possible in the on-prem world. Excellent. Let's talk a little bit more about agent list. I mean, maybe we could talk a little bit about why agent list is so compelling. I mean, it's kind of obvious. It's less intrusive. You've got fewer processes to manage, but how did you create your agent list approach to cloud security? Yeah, so, I think the basic, the basis of it all is around our mission and what we try to provide. We want to provide seamless security because we believe it will allow the business to grow faster, it will allow the business to adopt technology faster and to be more dynamic and achieve goals faster. And so, we've looked on what are the problems or what are the issues that slow you down? And one of them, of course, is the fact that you need to install agents that they cause performance impact that they are technically segregated from one another, meaning you need to install multiple agents and they need to somehow not interfere with one another. And we saw this friction causes organization to slow down their move to the cloud or slow down the adoption of technology. In the cloud, you have, it's not only having servers, right? You have containers, you have managed services, you have so many different options and opportunities. And so, you need a different approach on how to secure that. And so, when we understood that this is the challenge on, we decided to attack it in three, using three pillars. One, trying to provide complete security and complete coverage with no friction, trying to provide comprehensive security, which is taking an holistic approach, a platform approach and combining the data in order to provide you visibility into all of your security assets. And last, but not least, of course, is context awareness, meaning being able to understand and find these, the 1% that matter in the environment. So you can actually improve your security posture and improve your security overall. And to do so, you had to have a technique that does not involve agents because, and so what we've done, we've find a way that utilizes the cloud architecture in order to scan the cloud itself. Basically, when you integrate Orca, you are able within minutes to understand, to read all and to view all of the risks, we are leveraging a technique that we are calling side scanning that uses the APIs or uses the infrastructure of the cloud itself to read the block storage device of every compute instance and every instance in the environment and then from, we can deduce the actual risk of every asset. So that's a clever name, side scanning. Tell us a little bit more about that. Maybe you could double click on how it works. You mentioned it's looking into block storage and leveraging the APIs, very clever, actually quite innovative. And so, but help us understand in more detail how it works and why it's better than traditional tools that we might find in this space. Yes. So the way that it works is that by reading the block storage device, we are able to actually deduce what is running on your compute, meaning what kind of ways, packages, applications are running. And then by combining the context, meaning understanding what kind of services you have connected to the internet, which, what is the attack surface for these services, what will be the business impact? Will there be any access to PII or any access to the crown jewels of the organization? You can not only understand the risk, you can also understand the impact and then understand what should be our focus in terms of security of the environment. The different factor is the fact that we are doing it using the infrastructure itself. We are not installing any agents. We are not running any packet. You do not need to change anything in your architecture or design of how you use the cloud in order to utilize Orca. Orca is working in a pure SAS way. And so it means that there was no impact, not on cost and not on performance of your environment while using Orca. And so it reduces any friction that might happen with other parties of the organization when you enjoy the security or improve your security in the cloud. Yeah, and no process management intrusion.  First of all, is that true? And if so, how has your use of Orca as a cheap product officer helped you scale Orca as a company? So it's a great question and I will, I think that something that we understood only on is that there is a quite a significant difference between the way you architect your security and cloud and also the way that things reach production, meaning there's a difference and there's a gap between how you imagine, like in everything in life, how you imagine things will be and how they are in real life in production. And so even though we have amazing customers that are extremely proficient in security and have thought of a lot of ways of how to secure their environment. And so we, of course, we are trying to secure environment as much as possible. We are using Orca because we understand that no one is perfect. We are not perfect. We might, the engineers might, my engineers might make mistakes like every organization. And so we are using Orca because we want to have complete coverage. We want to understand if we are doing any mistake. And sometimes the gap between the architecture and the hole in the security or the gap that you have in your security could take years to happen and you need a tool that will constantly monitor your environment. And so that's why we are using Orca on our own from day one not to find bugs or to do QA. We're doing it because we need a security to our cloud environment that will provide these values. And so we've also passed compliance auditing like SOC2 and ISO using Orca and it expedited and allowed us to do these processes extremely fast because of having all of these guard rails and metrics. Yes, okay. So you recognize that you potentially had and did have that same problem as your customer's been. Has it helped you scale as a company? Obviously, but how has it helped you scale as a company? So it helped us scale as a company by increasing the trust, the level of trust customer have in Orca. It allowed us to adopt technology faster, meaning we need much less diligence or exploration of how to use technology because we have these guard rails. So we can use the richness of the technology that we have in the cloud without the need to stop, to install agents, to try to re-architecture the way that we are using the technology and we simply use it. We simply use the technology that the cloud offer as it is and so it allows you a rapid scalability. Yeah, allows you to move at the speed of cloud. Now, so I got to ask you as a co-founder, you got to wear many hats as at first of a co-founder and the leadership component there, but also the chief product officer, you got to go out, you got to get early customers, but even more importantly, you have to keep those customers retention. So maybe you can describe how customers have been using Orca. Did they, what was their aha moment that you've seen customers react to when you showcase the new product? And then how have you been able to keep them as loyal partners? So, I think that we are very fortunate, we have a lot of, we are blessed with our customers. Many of our customers are vocal customers about what they like about Orca. And I think that something that comes along a lot of times is that this is a solution they have been waiting for. Many, I can't express how many times I hear that I go on a call and customer says, I must say, I must share this is a solution I've been looking for. And I think that in that aspect, Orca is creating a new standard of what is expected from a security solution because we are transforming the security role in the company from an inhibitor to an enabler. You can use the technology, you can use new tools, you can use the cloud as it was intended. And so we have customers like one of these cases is a customer that they have a lot of data and they're all super scared about using S3 buckets because all of these incidents of S3 buckets being breached or being a people connecting to an S3 bucket and downloading the data. So they had a policy saying S3 buckets should not be used. We do not allow any use of S3 bucket. And obviously you do need to use S3 bucket is powerful technology. And so the engineering team in that customer environment simply installed a VM, installed an FTP server and had a very easy to use password to that FTP server. And obviously two years later, someone also put all of the customer databases on that FTP server, open to the internet, open to everyone. And so I think it was for him and for us as well, it was a hard moment. First of all, he planned that no data will be leaked but actually what happened is way worse the data was open to the world in a technology that exists for a very long time and is probably being scanned by attackers all the time. But after that, he not only allowed them to use S3 buckets because he knew that now he can monitor now he can understand that they are using the technology as intended. Now that they are using it securely, it's not open to everyone. It's open in the right way. And there was no PII on that S3 bucket. And so I think the way he described it is that and now when he's coming to a meeting about things that needs to be improved, people are waiting for this meeting because he actually knows more than what they know what they know about the environment. And I see it really so many times where a simple mistake or something that looks benign when you look at the environment in a holistic way when you are looking on the context, you understand that there is here a huge gap that should be breached. And another cool example was a case where a customer allowed an access from a third party service that everyone trusts to the countries of the environment. And he did it in a very traditional way. He allowed a certain IP to be open to that environment. So overall it sounds like the correct way to go. You allow only a specific IP to access the environment. But what he failed to notice is that everyone in the world can register for free for this third party service and access the environment from this IP. And so even though it looks like you have access from a trusted service, a trusted third party service, when it's a sub-service, it's actually, it can mean that everyone can use it in order to access the environment. And using Orca, he saw immediately the access, he saw immediately the risk. And I see time after time that people are simply using Orca to monitor, to guard rail, to make sure that the environment stays safe throughout time and to communicate better in the organization, to explain the risk in a very easy way. And the, I would say the statistics show that within few weeks, more than 85% of the different alerts and risks are being fixed. And I think it comes to show how effective it is and how effective it is in improving your posture because people are taking action. Those are two great examples. And of course I've often said the shared responsibility model is often misunderstood and those two examples underscore that, thinking that, oh, I hear all this, see all this press about S3, but it's up to the customer to secure the endpoint components, et cetera, configure it properly is what I'm saying. So, what an unintended consequence, but Orca plays a role in helping the customer with their portion of that shared responsibility, obviously AWS is taking care of it. Now, as part of this program, we ask a little bit of a challenging question to everybody because look it, as a startup, you want to do well, you want to grow a company, you want to have your employees grow and help your customers and that's great and grow revenues, et cetera. But we feel like there's more. And so we're going to ask you, because the theme here is all about cloud scale, what is your defining contribution to the future of cloud at scale, Gil? So, I think that cloud has allowed a revolution to the data centers, okay? The way that you are building services, the way that you are allowing technology to be more adaptive, dynamic, ephemeral, accurate and you see that it is being adopted across all vendors, all type of industries across the world. I think that Orca is the first company that allows you to use this technology to secure your infrastructure in a way that was not possible in the on-prem work, meaning that when you're using the cloud technology and you're using technologies like Orca, you're actually gaining superior security that what was possible in the pre-cloud world. And I think that to that respect, Orca is going hand in hand with the revolution and actually revolutionizes the way that you expect to consume security, the way that you expect to get value from security solutions across the world. Thank you for that, Gil. And so we're at the end of our time, but we'll give you a chance for final wrap up and bring us home with your summary, please. So I think that Orca is building the cloud security solution that actually works with its innovative agentless approach to cybersecurity, to gain complete coverage, comprehensive solution and to gain, to understand the complete context of the 1% that matters in your security challenges across your data centers in the cloud. We are bridging the gap between the security teams, the business needs to grow and to do so in the pace of the cloud. I think the approach of being able to install within minutes a security solution and gain complete understanding of your risk will is goes hand in hand with the way you expect and adopt cloud technology. That's great, Gil. Thanks so much for coming on. You guys doing awesome work. Really appreciate you participating in the program. Thank you very much. And thank you for watching this AWS startup showcase. We're covering the next big thing in AI, security and life science on theCUBE. Keep it right there for more great content.


Good morning. I am Dr. Benjita Pinto. I am a consultant rheumatologist in Manipal Hospital. Today I am going to talk to you about an extremely common clinical problem which is joint pain. So the first thing is what is arthritis and what is joint pain? So the first thing to note here that not all joint pains are due to arthritis. Joint pain are extremely common in clinical practice and it could be due to various other conditions such as fibromyalgia. It can also be due to vitamin D deficiency. All these things can present as joint pains. On the other hand, when we talk of arthritis, it means pain and swelling of the joint. So what causes arthritis? So arthritis may be either inflammatory or non-inflammatory. When we talk of inflammatory arthritis, we refer to conditions that lead to pain and swelling of the joints due to immune dysregulation. Some of the common forms of inflammatory arthritis are rheumatoid arthritis, psoriatic arthritis, spondyloarthritis, gout. So these disorders are called inflammatory arthritis which are due to autoimmune or immune dysregulation. They can occur at any age group and they can occur in both genders. Certain arthritis, for example rheumatoid arthritis is more common in women. Spondyloarthritis on the other hand is more common in men. Gout usually occurs in men and occasionally in postmenopausal women. But arthritis can occur even in children and can occur at extremes of age also. So unlike what is commonly believed that arthritis only affects older individuals, it is wrong and it can occur at any age. How do we diagnose arthritis? So arthritis is primarily to assess whether it's inflammatory or non-inflammatory. It is a clinical assessment that we do and patient needs to see the doctor and a clinical examination will be done to examine the joints and the diagnosis will be supported by certain investigations. So what is the treatment? Treatment of course depends on the diagnosis and the earlier you are diagnosed, the much better will your outcome be and that is why there is an emphasis on early diagnosis of arthritis. Arthritis if left untreated can damage the joint and lead to deformities and after the joint is deformed, we cannot reverse the disease. So that is why early diagnosis and treatment is extremely important. Thank you.


Hello, I'm Drew Staney. This is my first FOSDEM. I've been watching videos for many years So this is my first time actually getting here. So I'm excited to be here Actually from Chicago, but I moved to Berlin this past year. So I'm in the area now I am part of the Beagle Board of Dark Foundation. We make small single board computers Most popularly known as the Beagle Bone Also part of the open source hardware association This is a group that we have an open source hardware certification program And I mentioned Berlin if you are in the area in a couple weeks We have the Berlin Embedded Linux meetup. So if you're around would love to have you stop by that And then on March 13th in New York City the open source hardware association We organize an annual conference called the open hardware summit So if you're able to this will be on March 13th in New York City And since I mentioned open source hardware just want to give a brief introduction of what that is So it's hardware whose design is made publicly available so that anyone can study modify distribute make and sell the hardware Help sell the design or hardware based on the design So for electronics, which is mostly what I do that'd be the schematic you'd be sharing these schematics the board layout In the editable source files, so if you're using a program like eCAD you would share your board file and your schematic file and then also the bill of materials and One of the best practices if you want to do this is to make sure that the bill of materials You have the components are available in small quantity So like with Beagle Bone, we make sure that all the components are available in quantity of one from distributors and the reason for I Also gave a talk at CCC recently that I go more into depth about like open source hardware Some the different licensing and also some of the different open source hardware boards that run Linux So if you're interested in that you can check out my 363 c-talk But going back to the open source hardware, why would you do this? I would say the main reason to do it is you want to enable other people to collaborate on your hardware project So by sharing your schematics and your board layouts and edible format You can get people to contribute back changes to your project and if you make the components available If you choose components that are available through distribution people can actually build your project so I'm very excited right now about risk 5 which is a open instruction set So what's an instruction set? So probably many of you have heard of x86 or arm These are instruction sets which is essentially the standard for what tasks a processor can do at a low level The instructions that the processor can execute Though with both x86 from Intel and AMD and the arm instruction sets. They're all proprietary So if we want to make like an open source chip, we need to have an open source instruction set So risk 5 I think it's about 10 years ago now They it was started by a group at Berkeley that was doing computer architecture research So risk 5 is a free and open instruction set. I believe it's licensed under a Creative Commons the standard is So anyone can take that instruction set and implement it There's a couple great talks if you want to get more in depth on risk 5 One is from David Patterson is one of the people that originally started risk back in the early 80s And then also Chris Asanovich who's the professor at Berkeley. It was leading the risk 5 team And he does this talk at Probably like every six months at these risk 5 conferences So it's always kind of changing because it's there's a lot of development going on So if you ever want to check out like deep dive into what the current state of affairs is with risk 5 is they do the state of the Union probably like every six months So one of the things about risk 5 was the idea was to make it a modular isa that you could Be extensible so to make it last for something that's going to be valid decade from now two decades from now They wanted it to be something where they're planning for the future So there's 32 bit 64 bit and there's also 128 bit Version of the risk 5 instruction set so the idea being that you know once we have petabytes of memory We'll still be able to address all that memory Yeah, so it's going back to the project beginning. I guess in 2011 all the way up to now we we have a bunch of different companies are involved now and The ecosystem is probably the most important thing the software ecosystem So it's fine to have an instruction set, but it's not worth it's not that valuable if you don't have support in Compilers and tools and operating systems So there's support in GCC LLVM Linux kernel Free our toss now Zephyr so pretty much everything that you need to have a system that you can develop and Build and put into production So this kind of gives you a bit of a Bit of an insight into the instruction set so it actually is a very small base So the base of the ISA is just a 32 bit integer. So that's all the bases for risk 5 so You can write software for this base ISA 32 bit integer and you'll be able to run that on a in the future We have some like 10 core 128 bit risk 5 processor. It'll still be able to run this base ISA Which is frozen? But then there's lots of extension. So this is the risk 5 32 bit integer And then there's a bunch of extensions as well So they had a person gave this talk and in his pocket there is what is called the green card So I guess back in the day when people were programming Machines with like, you know terminals and teletypes and stuff like that They would have these cards that showed all the instructions for the for the CPU So this is the risk 5 equivalent of the green card So you can see here. This is just the instructions for the base ISA, which is the 32 bit integer And it's maybe like 20 30 instructions and then this is for all the current extensions So we have 32 bit 64 bit 128 bit and then there's like a multiply and divide Different versions of a floating point compressed instructions so Even putting all that together. It's still not still not that much. It's not overwhelming and it's architected so that you can Just choose the extensions that you need for your use case So it was started at Berkeley at a team at Berkeley they not transitioned it where it's being organized by Something called the risk 5 foundation. So the standard lives at risk 5 org They also have been growing a lot So I think they have over 400 members now, which is companies and universities You can also become an individual member as well of the foundation And one of the reasons to join for companies and universities is they can join these working groups where they're Setting these new extensions like one of the things I think is in the works right now is a vector extensions So in hypervisors and so these sorts of things are adding to the base I say you can join the foundation and get involved with shaping those in companies like Nvidia is Using the risk 5 as kind of like a management controller They replace their own proprietary isa in their graphics card not the GPU But something that helps manage the device and then Western Digital is probably one of the most heavily involved companies And they're replacing all the controllers in their drives to be based on risk 5 So in in the future in video and Western Digital and other companies will be shipping millions of devices every year with risk 5 Processors in it One of the things companies can get when they do this is they don't have to pay licensing fees for proprietary ISAs and proprietary implementations, but more than that they get the freedom to Implement it as they want like I think with arm you have to have an architecture license if you want to do substantial changes To the micro architecture, which I think only a few companies have like Qualcomm and Apple everyone else like with Beaglebone We use ti parts and I think ti just licenses a specific core from arms. So if you want to Make more changes to like the micro architecture you often times can't do that whereas with risk 5 you're free to do that There's also a lot of open source implementation. So boom and rocket from Berkeley and pulp is out of ETH Zurich In swerve which I think is the Western Digital one. So there's a lot of open source implementations. Also yesterday There was a talk from open piton out of Princeton. They also have this kind of one to many Core design capable of running Linux called open piton. So there's a lot of existing projects out there that people can leverage And there's this event. I guess it used to be called the risk 5 workshop I think now it's called the risk 5 summit But these things happen like every six months So if you're wondering what's the latest and greatest that's happening with risk 5 is you can you can go to risk5.org And they just put up the proceedings in the videos from the one that they had in December In California. So if you go to the risk 5 youtube channel, there's tons and tons of talks on there I think one of the one of the main ways I've been able to kind of find out what's happening in this community is watching a lot of these videos so one of the other things I find interesting is kind of the global sense of risk 5 and One point is that the risk 5 foundation was based in the US. They're now moving to Switzerland And part of that is to be free of political implications Nations like India and I think also Pakistan have declared that risk 5 is going to be their national architecture and I think that A lot of countries want to have more control over Technology want to have more sovereign control over process architecture process architecture. So You know in this past year we saw the US Prevent there are the US current presidential administration prevent US companies from doing business with Huawei and Back at the beginning of last year was also uncertain if arm would be able to do business with Huawei They ended up deciding it was okay because arms at UK based technology, but You know, I'm sure a lot of Chinese companies don't want to be don't want to be in the position of not being able to license The cores that they need from arms. So I think there's a lot of motivation for Companies in China and other nations to have more control over the processor technology And I think like the biggest uptake in risk 5 foundation Membership has come from China recently I tried to kind of give an overview that overview of this and a recent issue of Hackspace magazine This is a short column, but if you're just trying to get a sense of what's going on risk 5 It's a hopefully a good way to in like a few minutes get up to speed So the first time I saw a risk 5 chip was the open V Which was a microcontroller from a group in Columbia? Colombian University They call themselves on chip. I think the university's UIS But this was a 32-bit microcontroller And it was a completely open source implementation They also did analog which was kind of unique about their project is they're interested in the analog peripherals One of the other organizations that I've been watching for a few years now is low risk So low risk is a not-for-profit organization out of the UK And I like that their mission statement when they started was they wanted to create a System on chip completely open source that you could use to build a single board computer Some of the people that started low risk had been involved in Raspberry Pi So I was really excited like we get like a fully open source single board computer Most recently they've been working with Google on the security project called open Titan but you can You can try out their SOC and run Linux on it. So there's a Version point seven of the low risk release right now And you can get a FPGA development board for less than three hundred dollars And you can actually run like a little graphical Linux environment on it So if you follow this tutorial, I just found out about this like I'm like two days ago from someone here at Fozdom So I'm I'm eager to go try this out myself So that's kind of like their long-term vision I think is to have a you know an SOC that's produced in volume that you could use to run Linux on Alex Bradbury is one of the people involved in low risk and he gave an interesting talk about the Ecosystem for operating systems in the tool support around it last year in the summer so one of the I'm so I'm part of the open source hardware association and kind of I would say the equivalent to that to some degree is the Free and open-source silicon initiative for chip design. So they're a great organization They organize several events throughout the year. So they have Orconf which happens every year here in Europe Which is stands for open risk conference, but there's a lot of risk five content there now as well They started doing an event in the US called latch up. So last year was in Portland in this April It's gonna be at MIT and the US in less the past year They also did a week a week of open source hardware at zero ETH Zurich So they're a great place to find out like what's going on with beyond just risk five as well But with open source chip design and they now run a website called Libre cores Which you might have firmly heard of as open core. So this is kind of a successor to that the idea is to aggregate together Processor design. So, you know, if you need to get a controller for SPI or you need to find like a USB controller You could potentially go on Libre core So they're trying to set up a way for you to have a place to go to if you want to share your Chip design IP and if you're looking for something you could potentially go on there and find it So some of the people that were at Berkeley that created the risk five ISA originally went on to start a company called sci-fi, which some of you might have heard of I think it was maybe two or three years ago now. They launched this microcontroller called the FE310 So this is kind of a Arduino form factor board that has the FE310 in it So this is nice It's interesting, but I really want to have a system I can run Linux on so I was really excited here at Fosdom two years ago I think it was that Palmer unveiled the sci-fi of Unleashed, which is their 64-bit a Quad-core 64-bit Linux so see so There's a board called the high five Unleashed, which is a pretty exciting board. It's open hardware It is unfortunately a thousand dollars because they only made a thousand of them I believe the idea with this was to be something for like early access for developers So this is one option that a lot of people are using that have access to it for doing like bring up of distros and tools and things like that so It's probably like the highest performance risk five board you can get right now But it is expensive and only available in limited quantities So Fedora actually has a risk five port as right now and they've been using the Unleashed board to Bring it up and also a QEMU So there was this talk back in December at the risk five summit from one of the people involved in here Is them running a GNOME on the sci-fi of Unleashed board which requires a lot of hardware which is probably not something You would probably want to set up if you weren't at one of these companies that's bringing up, you know something like Fedora, but Here's a you know an image of what it might look like in a few years if you Have a risk five system and you're running a Linux desktop on it So the sci-fi Solution with the Unleashed board in this FPGA board that does the graphics is quite expensive So the thing that's much more accessible to everyone is QEMU So you can with just your computer that you have right now your x86 computer You can download QEMU and the Fedora image you can run it on your computer Which is the way a lot of the work is being done right now for people that are bringing up Risk five tool chains and distros and things like that So here's an example of booting the Fedora risk five So if you have the sci-fi board, then this is the flow, but not that many people do so most people are just working with QEMU so if you Want to get started right now. You don't have any hardware QEMU with Fedora is one way to do it There is also Debian so Debian also has a port for risk five 64-bit as well. So you can either grab Debian or Fedora and go ahead and start running it on your system with QEMU now there is a Microcontroller There's smaller processor from a company called Kendrite. So this is a really cheap Processor, it's a dual core 64 bit. It's 400 megahertz with eight megabytes of SRAM Which is pretty decent for like a microcontroller And you can get like dev boards from a bunch of places seed studio has one for $13. So like a really inexpensive risk five development board Now can you run Linux on it? So there's a person at Western Digital Damien who's been hacking way on it and there's a couple or Linux kernel hackers that have been working on it With somewhat limited success. So Damien gave a talk back at Linux plumbers in September About trying to run it. So one of the issues with this Kendrite ship is that Technically has an MMU, but it's not the right type of MMU. So You have to run it with with MMU is at memory management unit So normally on your computer in most things that are running Linux you have a memory management unit and If you don't have that you have to Kind of take a path that's Atypical so you need to have no MMU support in your libraries and Linux and stuff like that Linux now has that capability In it to run as M mode. So with risk five there's machine mode and supervisor mode. So machine mode is just like we're just running with a Unified memory view not with like virtual memory and user space and kernel space. So Right now They're still kind of hacking away on it, but if they're able to get it working or if you're interested yourself you can you can check out Here's some links So here's a screenshot of them booting Linux on that sidepeed board that's $13 But it only kind of gets to this point basically logging into busybox and one of the reasons is is With out of the memory you need I think it's fdpick support, which isn't an arm way of dealing with the fact that you don't have virtual memory so Basically it's work in progress if they're able to progress it farther then we can probably start running risk 5 on really inexpensive sub $20 boards And playing around with it. It only has a megabass memory though. So How useful will it be? I'm not sure but for now qmu is probably the way to go However coming up in this year Is three processors that I'm kind of excited about from having watched some of these talks at the risk 5 summit So Andy's has a processor that's coming out. That's supposed to be Linux capable. They're saying q1 of 2020 microchip Firmly micro semi they have kind of what would be the equivalent to these island zinc So this is going to be a fpj with a hard risk 5 core and that's called the polar fire SoC And I think they're talking about second half of 2020 And then the one I'm most excited about which I saw one of my friends tweet about at the risk 5 summit was NXP is working with this organization called the open hardware group to produce a risk 5 IMX style SoC, so if you've heard of like the free skill IMX 6 or IMX 8 They're pretty popular for embedded Linux systems. You see them in a lot of different boards So I think the idea here is Something that has the peripherals that you normally have an IMX system with a risk 5 core instead of a arm core So this is supposed to be second half of 2020 I think they announced it would be like clocked at 1.5 gigahertz So pretty hot pretty high performance Supposed to have a GPU So if it's one of those vivante GPUs that we have the atnaviv open source drivers for then I think this would be really exciting There's no information on pricing yet But like this might be something that we could actually build like an affordable single board computer with That would run Linux Yeah, so by the way in these slides there's links to all these different articles if you want to check them out so one of the things I would love to do is Get a group of people together that want to help make a cheap Linux capable open source hardware board I think we kind of have to wait for a chip like this to come out So if you're interested in getting in touch with me However, we don't necessarily have to wait for these SOCs because there are also FPGAs which is what I have here So this is a FPGA. It's actually a badge with an FPGA on it and it can actually run Linux on risk 5 However, this is not going to be the same performance as this So with the FPGAs we're talking about maybe 50 megahertz 100 megahertz, maybe 200 megahertz So not the same performance that we have in a SOC So one of the reasons I'm very excited about FPGAs now like I learned them in school a long time ago And it was all proprietary IDEs and Windows and I had to run a VM. I didn't like it We now have open source tools for working with FPGAs, which is really exciting. So Back at Hackaday Super Conference, which this badge is from Person from sci-fi Megan walks gave an interesting talk about overview of risk 5 and FPGA So this is another thing I recommend checking out If you aren't familiar with an FPGA is it's a field programmable gateway So it's basically a chip that has a bunch of gates in it Like for example, this one has 45,000 gates And we can take those gates and reconfigure them to implement whatever Digital logic we want including a processor core. So like this one has a soft risk 5 processor That's the the fabric that C of gates has been configured to be a processor And then the thing for me that this made this more exciting is the fact that we now have free and open-source software tools to Do the synthesis and the place and route and load it onto the FPGA. So this started a few years ago with a group of people most notably Claire Wolf that Started building these tools for a lattice FPGA called the ice 40. It's kind of a modest FPGA But it was the first one that had like a free and open-source tool chain for it and that That referred to is generally its project ice storm And then this is actually an ECP 5 FPGA, so it's much more capable. It can do things like HDMI Higher throughput things like USB 3. I believe as well So this was enabled by the work from David Shaw So one of the things they have to do with both the ice 40 and the ECP 5 is document the bit stream So that work was done in project trellis so we can now use the ECP 5 with these free software tools and Hopefully soon some Xilinx parts as well. So Xilinx is like kind of the market leader in FPGAs And if we want to have higher performing parts The sorts of things we probably need if we want to have like a more usable Linux system in a soft core Then the Xilinx parts are going to be probably the best way to do that So I'm told in the next couple months. You might be able to use one of these Xilinx boards with the free and open-source tools If you can find him Tim Ansel is here at FOSDM He's he's pushing hard to try and get these tools working with Xilinx. So He always has the latest information. He gave a talk at a hack a day super con back in November Where it's kind of the status of where this is all at So This board I'm quite excited about is called the orange crab. It's from a person in Australia Greg Deville It's a completely open-source hardware design and he's managed to put the ECP 5 FPG on there along with a hundred twenty 128 megabytes of DDR memory. So it's a nice little small board That's actually can run Linux quite nicely. We were at the chaos communication Congress and Someone was like hey you should run Linux on it and then like a few hours later Greg and Tim hacking together They got they brought up Linux on it. So and I think Linux boots in like 17 seconds on it. So it's actually Not too bad. I'm hoping that Greg will do a crowdfunding campaign at some point this year for it Because I think this would be a nice board for people to get started with There's also a board from a hacker space in Croatia called the Radiona This one has SD RAM though So it's not quite as capable as the orange crab, but this one will be coming out soon from crowd supply I think in the next month or two you'd be able to go and back this campaign on crowd supply and Then David Shaw who did the work on project trellis which enabled us to use these tool chains with the ECP 5 He created this like ultimate board I think mostly for his own development needs But this has like a gigabyte of DDR memory either net PCI all these all these things on there This is not available. It's something you can buy you can build one if you want. I think it's probably Couple thousand dollars if you want to build one, but if you're looking for like a high-end Board for doing using the ECP 5 free software tool chain, then this is probably the highest end one One of the things I thought was interesting was someone posted on Twitter that What it what does it look like when we configure our FPGA to be a Linux capable core So we can see here like this is like the macro view of the place-and-route utility called next P&R And so this is what it looks like when we've configured all the gates to implement a risk 5 processor That's capable of running Linux So this is the badge from the hackaday super conference. It kind of is in a Game Boy style form factor I think the primary intended thing was for people to Program games and little graphics on it and walk around like your name in flames or like Tetris and things like that So there was a graphics engine and see that you could write games on their tutorials about how to do this But there was a some of us at super con that wanted to run Linux on it So we were like, oh, that's cool. It can do all these graphics, but let's see if it can boot Linux So one of the issues with this was it only had a hundred it only had 16 megabytes of SRAM it's not just it's external SRAM over SPI so it's quad quad spy SRAM which Not really that great for trying to run Linux So we banged our heads against it for for like the first day and didn't have any success And then it turned out that someone had showed up to super con having already designed a DRAM add-in board So we were like, oh, I think we really need DRAM if we want to boot Linux and Jacob was there And he's like, oh, well I designed this before I came. We're like, oh, okay. That's what we need So he had a board here with 32 megabytes of SD RAM and that proved to be Enough for us to be able to get Linux running on it so that one of the other things of this badge was the idea was you'd have cartridges so this is a One of the cartridges There's other ones like for PMOD connectors and different peripherals So I do is you know, you could give someone a cartridge and they plug it into their badge So this one you plug it in and you get 32 megabytes of DRAM So but how did we actually get a System on chip into the FPGA that was capable of running Linux and the way we in in like a day pretty much So the way we did that was with light axe, which is a pretty interesting project That is leverages me Jen, which is a Python based language for doing chip design So if you've heard of verilog or VHDL, these are hardware description languages that people use to design Hardware that goes into chips or into FPGAs So instead of using verilog or VHDL you actually program in Python. So it's Python code that actually is describing the hardware describing the Logic inside of the chip and then that can be synthesized that produces something that goes into the into the Synthesis tool So it allows us to basically do chip design in Python Which proved to be I think pretty powerful because we were able to Pretty quickly iterate on this and bang away and get it working I Light x is kind of a combination of a few things So there's me Jen, which is the domain specific language based on Python And I'll show you a little a few snippets of me Jen and a bit so you get a flavor for what it looks like And the other part of light x is these IP blocks So there's like a DRAM controller either net controller PCI Express controller SATA There's a few other ones there So these are IP that you can go and grab and tie together to build a system on chip for your FPGA And then the thing specifically that we use is this project called light axon Linux So this takes a risk 5 CPU called the vex risk Which is a 32-bit Risk 5 CPU that's kind of designed to fit well into an FPGA So they take that and they take some of this these IP like the like DRAM controller internet controller And they put it all together into an SOC that you can load into your FPGA So this is Linux booting on the vex risk risk 5 processor inside of that Linux on vex Linux on light x vest risk Yes, hard to say Linux on light x vex risk v so see Which we still don't have the display working so yeah, it's like to me this was very exciting I guess some people like graphics on the display video games and stuff is more exciting But we were very excited when we got to see Linux boot over the the you art So after we got back from super con, you know, we were hacking away trying to get it work I'm one person's laptop and then I got home and I built the board and then I was like, okay I want to get it set up and it took a bit to like figure out. Okay What's all the different stuff that we changed when we were at the conference? Finally did that so there is now upstream support in Linux on light x for this hackaday badge Which you know only people that are at the conference has the badge But if you want to have a sense of what it is like to add a new board to Linux on light x you can Take a look at these pull requests also just to give you a flavor for what the Light x and in using me gen which is Python looks like so this is Basically the file that finds the board so the hackaday badge Hatch badge And then this is basically to find the different pins that we have on the badge and how they map to Signals inside of the FPGA. So, you know, whereas you might otherwise do this stuff and vera log or VHDL Here we're doing it in Python and we have the nice object-orientedness of Python where we can import things in inherent classes and things like that And then this is also just kinds of gives you gives you another sense of what's going on here So we can you know, we import things like the Light x clocks and the light x SD RAM and then we can basically kind of just tell it the parameters that we have for our thing Hopefully I have a screenshot in it for for it as well Yeah, so like we had to add our DRAM module because it wasn't already in there So we're using a 32 megabyte SD RAM module wasn't already in light x So we just extended what was already there and added a new class where we say okay Here's our timing so you know from the data sheet had to figure out the banks and the rows and then basically the timing and then It kind of uses all the existing Infrastructure inside of like DRAM so kind of made it a minimal amount of effort to have to bring up new DRAM chip And then this is how we like add the board into the build system. So Thing here is like it's pretty basic if you look at some of the other ones They have like many many many different things that is in the base SOC So our SOC right now only does serial right now I'm trying to get it to add in flash as well, but so it's a pretty basic light x on Linux SOC so we just have serial there and then here is how we actually load the The gate ware which is produced out of our when we do the synthesis So we just use DFU util which allows us to load the gate ware over USB into the badge so if you take a look at The light Linux on light x you can see what some of the other boards look like some of them have a lot more capabilities than than this one And then it was running really slow it would take like 300 seconds to boot which is annoying So I hope this was like a great like github moment or open source development moment Where I was like oh, it's going really slow and I opened up a issue on the github repo and then like that same day enjoy digital Florent who's the person behind light x goes by enjoy digital and he posted a improvement and it was going 10 times faster So I thought that was a pretty good pretty good open up a github issue and also boots in 27 seconds instead of 300 seconds Also when I was doing this I discovered this cool thing called ASCII cinema Which maybe some of you have used before but it allows you to record your terminal Which was really useful So like I want to show was happening when the badge was booting up So I would run ASCII terminal and record it and then I could post the link in the github issue and you could see what was happening and also You know sometimes this doesn't boot when I want to show people stuff because the batteries are dead So I can always just link people to the ASCII sending video And what specifically what he did Was interesting so and kind of shows you the power of I think the the Mijian and the object-oriented nature of using Python is One of the one of the optimizations was it was having to go to memory too often Because it's just an 8-bit wide memory So we were having all these expensive memory accesses and it was slowing things down So he just made the L2 cache a hundred twenty-eight bit and that speeded it up to Brenda's Lee And that might not be like a good optimization for everyone So it's something that you can play around with in in optimize it for your use case And I played around with this number a few times putting up the 256 that shaved off like a couple more seconds So to me it was quite powerful I can just go in there and change these values and go and load it up and see how long it takes and see if that improved it or not So that's pretty much it I can hopefully show you what it looks like in the terminal so this is we're hooked over a view art here and What light ex does right now is it just runs busy box? Which if anyone's interested I think would be interesting to do something more like maybe Debian bootstrap or something like that. So It's an area of active development. The other thing too is there's drivers for the Linux kernel like you are and The other peripherals that we have in there So if you're interested in in those sorts of things if you check out light ex on Linux There's a lot of opportunities for people to get involved So let's log in to our system here. So we have Linux running on a risk-by processor and FPGA using all open source tools, which is pretty fun. I think so If anyone has any questions, I'd be happy to take them. Yeah So I'll do this first and then that one. Yeah, it's absolutely fantastic. Thank you I mean I too have been waiting since I was a you need to be able to play with this Mm-hmm. I started out with the black ice mx Phognologies. Yeah. Yeah, I got Zephyr going on top of Saxon. So I need to have a slide for that. Yeah, so Yeah, so, you know and again totally open down to the gates So I want to be able to put together a secureable IoT solutions that I just completely open this way Yeah, so the next step is to try to follow what you're doing here putting Linux onto these boards Yeah Which is very exciting, and I you know taking down some of the examples of boards to get going with Commercial terms if we're trying to manufacture Obviously we can go out and get a six. It's really exciting to see that nxp are coming out of the risk. Yeah Talking to my colleague who does the hardware side of things. He's a bit sniffy about all this, you know Because he says well FPGA is there expensive, you know, how do we make this stuff cheap? I really want to see completely custom cores with standard soft cores in them and then some custom magic to do acceleration I've heard that there's Libra silicon, which is a project. Yeah kind of small-scale basic manufacturing Yeah, I'm wondering if you know anything about the economics of how this is going to be possible to drive down cost Yeah, so I the question was about Open silicon and in the idea of pushing this down and getting things manufactured for cheaper So I learned some more about that yesterday. I think there was a Talk or actually I ran into the person that does a thing called chips for makers where he's trying to produce his own So see And he's trying to push down the cost by like grouping things together. So there's the chips for makers I also saw some the Libra silicon stuff So there's a group actually called Libra silicon and they're trying to Have like an open-source fab techniques So they I think they're working in a fab in Hong Kong trying to like bring down the cross So there's the Libra silicon people and they're also trying to create like these cell libraries I think the downside to that is it's a pretty old technology process so The one thing I have heard of that maybe maybe will help at least in terms of not having to pay for software Tools is yesterday in the open piton talk in the CAD tools room They were talking about having a chip EDA tools that are open source now. So there's a project called open roads Out of I think you see San Diego And they're creating like an open source tool flow for doing chip design So at least maybe that'll lend me some of the cost of having to pay for these expensive proprietary tools Though I think Most of that is still going through TSMC so the Libra silicon people always I know they're trying to like do their own fab technology But it is like older processes So And the other thing to just I should mention is sax so I was talking a lot about latex on Linux There's another project called Saxon sock s a x o n s o c So that's another option for running risk five Linux on risk five in FPGAs as well Yeah Have the PCB somewhere so this is sadly not Linux we're using a Nordic microcontroller But it's going to be a wristwatch style Form factor badge. So we were inspired by the badge from a camp this year at KS communications camp called the cardio So the idea is a wristwatch form factor badge running circuit python Yes, not risk five, but hopefully people have fun with it. Yeah For the kendrite or Okay, yes, yeah, yeah, so yeah Yes Yes, so if people are interested in risk five microcontrollers, there's a company called giga devices that has a really inexpensive Risk five microcontroller so I think it's like kilobytes of memory So you're not going to run like Linux on it, but you could run a real-time operating system on it in there They're quite cheap and they think Do they also have they as they match the SDM peripherals or okay? So they also have the SDM 32 peripherals so basically the things you're used to on SDM 32 But with a risk five core as well from giga devices A bit So the the hyper RAM would be at least better than the quads five SRAM Yeah So how how would hyper RAM compare to DDR memory Okay Cool. Yeah, and what was the board that was $80 that you Okay from lattice Yeah, yeah, so maybe with this lattice Board from lattice with the hyper RAM we could maybe get Linux on latex working with it or something like that Yeah, yeah, yes. Yeah, cool. All right Cool. All right. Thank you


So, look, if you got it to get out of here, it's okay. What we're going to do now is we're just going to do a quick Q&A and then get out of here. Mondays are always, well, Mondays are Mondays. That's what we got. Exactly. One flip flop. So, let's get into a little Q&A and go from there. Whoops. Okay. Ah, thank you, Rob. You're welcome, James. Damn it. Five is two is the same. Okay, perfect. Mm. Hey, when I screw up like this, I thought they were both the same. Let me do one more just to make sure. This is the alternate if we can't get a hold. Great. Atomski.blockchain. Great. All right. So, now I got to put that in. So, right there, that'll be this. That'll be the six. Thanks, Vanessa. I appreciate it. Adam, I'm wherever sold and wish I had. I bought a lot of tops too. That's okay. Do the same thing in 2017 and here we are, 2022. The big thing is just, you learn from your mistakes the next time around. That's it. Yeah. Thank you, Theo. Appreciate it. Any bear market strips or purchases? Once a week, I buy Bitcoin and usually it's been Coinbase. Although I did sign up for a strike account and I bought like $125 just to see how it all worked. But even with strike, which uses a lighting network, it works really well, but there's a limit and set at $1,000. I don't know how it is in your country or your region. I have no idea. But also, if you want to get more higher limits, you have to do the whole KYC. When are we going to get our coins back from Celsius? That's anybody's guess. Nobody has any idea. I wish Celsius would be a little bit more forthcoming, but you know, they can't. Avios waves? From LA, very nice. All right, so yeah, Lera, we talked about it. I mean, I don't know. I know he's out there. Legal represents him now. What if Bitcoin's still smashing before all-time highs? All right. I don't see any all-time highs coming anytime soon. Definitely not this year and probably not even next year. Rob, would you consider yourself a Bitcoin whale? No. I'm a whole coiner. I think everybody knows that, but a whale? No. Yeah. Yeah. I got in a cell because of you, Dan. Yeah, a lot of people did. It's true because I look, what I knew about it, it looked legit, re-hop-optication, but it looks like it was a little bit of collateralization and things were on the up and up. There wasn't these crazy DeFi putting it into anchor protocol at 20% and then getting pulled. That's why I want this to all come out, but whatever. I will say this.  And then again, like I've been saying, on June 9th, 10th, 11th, when I was at consensus, people were telling me, yeah, Celsius is going to go down. And I'm like, ah, you don't, that seems like legit. They go, no, you don't understand. So much exposure to 3AC. And I was like, hmm. And I took a look at some different articles and postings. I was like, yeah, probably not looking good for them. So that's why on June 12th, I put out a video.  And nine hours later, it was shut down. Sucky. Yeah, personal responsibility. I mean, look, we all lost some, right? Some people lost a lot more than others, but we're all in the hole. That's just how it is. And it'll make, you know, it is one thing that it is, we're at this point. And the market cap that we are, that we're at, and we lose those things. But what if it was like 20 trillion market cap and you were, you were all millionaires, all you multi-multi-millionaires because of all the investments. And then you wake up one day and all the withdrawals are gone. Would that hurt more? Or does it hurt more now?  I can't afford food.  Thanks. No, you just, it's like the army. You just show up. You show up in the right outfit and usually things work out to you. This is a good question. Do you personally communicate with Alex Machinsky? You have the cloud too? Man, I haven't talked to Alex or Steve since this whole thing went down. So I've reached out. They're not, they're not talking to me. So there's a good point. Brian, some influencers made major bank on sales referral of 50 bucks per cent. Here's the question though. How much didn't you guys get something when you guys signed up? That's what was told to me. Like if you use the affiliate link, you got like X amount of dollars. Am I wrong? I, because I could have sworn this what it was. Yeah. Don't think Alex is allowed to talk to anyone for legal reasons. Yeah. Yeah. You get a perk. That's, that's what they told me unless I was like, and no one ever said anything like, Hey, I didn't get my bonus. Everybody seemed to have got it. The real question was, when did you get out?  And I did. And I did that in the morning. Then in the morning, I also put the video out and like, Hey, and of course I can't, this is the thing about it. Like when I say I'm not an active financial advisor, I can't tell you what to do. So like in the video, I'm like, this is what's going on. These are the things that I hear. I wouldn't leave it in there, you know, but I can't go to your house and take it out for you. I can't do it. But I was like, this is not looking good. And when, when Voyager came up, when I do that video on June 22nd, I'm like, look, here's how much they loaned out. Here's the public records because they're a public company. And there's the collateral they took in. They didn't take any squat. I'm taking everything off. And that was it. Yeah, I got 50 bucks. Yeah, everything is the Voyager situation sucks, but you don't take a risk. You can't take profit.  And that's what the big, I think the big conversation is like, when you go to, I don't know, any picture, any, any casino, MGM grant, right? You walk on there. This is a casino. I'm going to gamble. I know it's a gamble, right? But it seems like some of these companies that were out there, they weren't telling you what they were doing behind the scenes to give you that yield.  There's a little bit of rehypothecation. Then we have, you know, these hedge fund managers, they do their magic with it. And we get the yield back from the, the small percentage that we make. And it wasn't about, yeah, we're putting it into these super risky DeFi plays and getting 20% yield back. And that's how we're getting all those yield. Did you know that? I didn't know that. But it'd be nice to know. Just saying early investors. No, I say that. I say don't trust anybody. Even if your mom texts you for your, your coin based password, it's probably a scam. Rob will be in the other slight pump coming soon. I maybe buy a coin is a, is a powerhouse. You know, they, they, if you look at stakingrewards.com, they are staked like 80%. Let me show you. Check this out. And I'm going to tell you why it's so much staked or whatever. So this is stakingrewards.com. It's pretty great website. This is where I pulled all my, my Cardano is a ghost chain video from, or part of it. But look at this, the staking ratio. So on a 75% still, Cardano 71%, Avalanche 58, Binance chain 81%, Binance chain 81.64%. That's crazy. That's a lot. But you have to remember, it's pretty centralized coins. So take it with a grain of salt. Yeah, so is mine. The chief forgets everything now. So yeah, me too. This is the reason, squadron courses, I feel bad for the peeps had a lot on Celsius. Yeah, me too. That's why I'm here every day. Because people need to hear the information and people need events and people need to they just have to. So that's why I try to show up like it's easy just to fade away, you know, and do nothing. But you'd have to show up. And that's just how it goes in with life, with family, with finances, with work, with everything, you just got to keep showing up. G loco. Well, what's your username? So I'm getting, you know what? Speaking of which, thanks, Michael. Sweatcoin. Let me see. Where'd it go? No one, no one to get their hands dirty with ETH gate, because everyone's have a ETG gate. Sure. So this is a great Jing and Chao. First of all, does anybody here live in China? That's the first question. The second thing is the question is, what's your opinion on security forces in China attack protesters seeking frozen funds, bank deposits, demanding their money back were beaten, kicked the ground right away. I keep hearing different stories about this guy from Coin Bureau tweeted this out. And he said, there was, let me show you what I'm talking about, because if I just keep talking about it, it doesn't make any sense to you. Also, follow me on Twitter if you can, that's where I'm most active. Follow Rob Kynes, Gold Silver Pros. Good guy. I'm going to show. Let's see. Coin Bureau. That's pretty funny. This is it. So this is Citizen Storms Bank of China in Xinzhou over, I know, over frozen assets. That's what it says here. And then if you look in the, let me ring this up. But if you look at some of the comments, ah, son of a gun. Let me go back then, because in the comments, people are saying, no, no, no, that's not, that's not what that is. Everything is liquid in the Chinese banks because of the rim nimby. I think that's how you say it. And they say this was actually not a bank. It was something else. And I'm like, well, I can't trust you. I can't trust anybody anymore, because who knows if that's a bot or that's a Chinese national or somebody from, I mean, who knows? I don't know. So, and people were saying a bit different. So the question that I have is who lives in China and who can verify that so hard these days to verify anything. Bank runs in check. What do they have in the USA? Thunderdome. It's when economy and culture and the entire country collapses on top of everything else. So Robin Realty, do you know anybody right now who's truly happy? I'm pretty happy. I mean, look, we all should have taken more profits. Am I wrong? We should have taken more profits in the bull run. We screwed up, right? I took some profits, should have taken some more, didn't do it. Nobody's perfect. That's just how it is. And then we all got bamboozled hood winked with the things that were going on in these, in these different platforms, let's just call a spade a spade. However, I take a look around and I look to myself and I'm like, this is cliche, but it is the truth. I am not underground. I am healthy.  So just remember that. And then I have family and friends around me. I'm feeling pretty damn good in all honesty. And today, my grandson's with us, we're going to go to another water park. It's not like a good day. Did I miss out a lot of money? Yeah, I did. But I mean, I've had a ton. I've had less. And things just kind of move along. This is why I show up to answer questions and comments like what Matt says. Never forget this guy's shilling Voyager. I'm not actively shilling Voyager, but I did talk about Voyager quite a bit. Did I not? I think we can all agree on that. And then did I not say that Bitcoin was going to 150K? Well, that didn't happen. And did I not say that a VGX is going to 30 bucks? Well, that didn't happen either. And actually, I called that in January 7th, 2021, I want to say, when it was 29 cents, one of the $7 did pretty good. Didn't hit 30 bucks, went back down. So that prediction was wrong, just because I have no crystal ball. And the Bitcoin thing, that didn't work out at all. I mean, it only hit 69,000, which was half roughly of what I thought it was going to be. And as far as Voyager, everything was good until it wasn't. Let me ask you all a question. When you signed for Voyager, were you able to buy and sell crypto? I think you were. And the next part was, were you able to gain some yield on that? I think you were. And then past that, these loans came out later. I had no idea. Look, anybody in the right mind, I can't say that. I don't know. I don't know the circumstance behind it. But if you loan out over a half a billion dollars to an enormous fund, three arrows capital, and don't take any collateral, I think that is insane to think about. And of course, when I learned about that, on June 22nd, I put that video out and said, this is ridiculous. Who would do this? I'm taking my money out. You can do whatever you want to do. So, Matt, you are right. I did talk about Voyager quite a lot. Celsius, not so much, but I did talk about them. It's true. And everything's cool until it's not. And when it's not, I'll let you know. That is just what I know. I mean, look, even Simon Dixon, who was on James' channel of Est Answers, was like, you know, we figured this stuff out way later than what we should have. And then, of course, couldn't really say much because they were the contributor or part of the Celsius, as they were getting funds or whatever it was. So, yeah, Matt, you are correct. But that's just how it is.  Good deal. Bank runs in China like in 2016. Yeah. Again, Giovanni. Hey, Rob, four-year cyber domination. So, right now, and what Giovanni is, that's a great name, Giovanni. What he's talking about is this. And tell me where I'm wrong on this one. So, here's the four-year cycles. Have we not hit these? Because we know in the past that it always comes with a Bitcoin halving, right? Bitcoin halving comes up and the miners can only mine half of what they used to as far as Bitcoin every 10 minutes. So, that happened in 2012. That was the first one. Then they hit an all-time high because there was a more scarcity, essentially. Then after that, when it goes crazy, then it dips down, and then it goes and it really dips down next year. And then it just kind of chops sideways called a reset. Something happened in 2016, 2017, halving all-time high dip reset. And I think the same thing happened again. I don't think I know. There was a halving in 2020. In 2021, we hit our all-time high, which was why it's 67,000, 69,000, somewhere around there. But we didn't go past that in 2022. And now we're just slowly going down after a big drop-off. And then next year, we'll probably chop sideways for a little bit before we rebound back up again, just like we did in 2018-19, and just like we did in 2014-2015. Four-year cycles are still intact. Will they actually maintain? Don't know, because nothing is guaranteed. Nada. But I will remind everybody of this. When it's boring and it's chopping sideways, not when it's actively dropping like a stone, that's my time when I buy. Just a thing. And for me, the second best time is when it's starting to take off. But that's kind of tricky to do. I just buy when it's boring and everybody's like beaten down. So yeah. Nah, Cass, it doesn't take balls. It's just like I said, it's just like going to the military. You just got to show up. Just take the hits and keep going. Somebody said, somebody named a specific CEO and said, that guy's face is only good for a roll full of quarters and fists. I thought it was pretty funny. I don't condone violence, but that was pretty good. I have some of that a punch. Scott says, if I'm like a two or three-year crypto nation could be, could take longer. But I can tell you this year's shot. And I think next year, maybe a little rebounds and up and down, but you're not going to see all-time highs next year. I don't think so. Have I been wrong before? I just omitted it. So yeah, it could. But so far, the four-year cycle is still intact. Here's a good question for everybody. Is there a static in practice trades on without actually making trades using hypothetical money and would track my stats? Somebody will just say just to do that on a spreadsheet, but I know there's websites that do that. Anybody know which one it is? Put in the comments. Beardy on the internet as he's working. But thanks for stopping by, Beardy. What exchange are you currently using? I'm using Strike and I'm using Coinbase. But you have to remember just because I use them doesn't mean I keep the money on them or the crypto.  Even if there's a waiting period, what's up, buddy? Yeah, want to go? Grandson says we got to go. All right, buddy. So that's pretty much it. Yeah, it's perfect. Thank you for answering. Coingecko, they can track that stuff and so on and so forth. And also BitGit. I don't have any links to those, sorry, but you can find them. All Beardy says is day off. Well, that's good. I'm glad Beardy. Everybody, thanks for showing up. I appreciate it. Like this video, thumbs up, like all that good stuff. And that's it for today. So I know it's not the best days, but just show up. And as time goes on, usually things work out. Thanks for stopping by. I appreciate it. I'll see you on the next one. Adios.


All right. So now what you're seeing on the screen is the set of steps for the field of the ransomware. In the first screen, what you are seeing is it's the folder with a name tools. That's where we have got most important files. So when I look at it, I've got two files in there for this proof of concept. One of the name is most important file and the second one being the sensitive passwords. So let's open one of the text files. Looking at the text file, it seems that there is some text in there for the demo purposes, but it's in plain text right now. So let's close this file and let's look at the second file, which is sensitive password files, which contains some dummy passwords in there in plain text. So I'm going to close this files now. So now you know that these are the important files on the machine, which we are going to encrypt it through Filotti. Okay. What I've got on the right is the C drive of the machine in which we are going to infect it with ransomware. What I'm going to show here is this is the folder structure. And remember that right now we have configured our ransomware to encrypt files in the tools folder. However, this can be customized to encrypt the full folder of complete C drive or the whole document folder or pictures or whatever you like. Okay. So let's keep it open and see how things are changing when you run the ransomware on the infected machine. The third folder I have opened here is the temporary folder. That is where all the certificates and the symmetric keys are going to get dropped and then it's going to get exfiltrated out on to the attacker. In the fourth window, I have got browser open. In the first tab, I've got the Google Drive. Right now, if you look at this Google Drive, there is only one folder and a file. However, there is no other thing available here. So if you're not the users for the exfiltration purposes, when you have big files, it's going to get exfiltrated to Google Drive. So I tried it with this test MP4 file, which is 126 MB and it works perfect. So what is going to happen is these files over here is going to get copied into the Google Drive when you run the ransomware. Okay. And remember that we have distributed our attacks infrastructure in a way that we are not relying on one single service. So for the symmetric keys are going to come to poke mail. And how do you set up poke mail I'm going to show you in a moment. But before that, let's look at what sort of USC controls we have on the infected machine. So let's look at the USC settings. It seems that the highest level of USC is always notified. Whenever the app tries to install a software or make any changes to the computer, this is going to notify the user. So this is currently set on always notified. Let's minimize this and look at the current certificate store, which is the local store on the on the box. So the current store has only has got only one certificate in here. However, when when the ransomware is going to get deployed, you will see one of the one of the other certificates, it's going to get installed and then then it's going to get removed afterwards, right? Once you exfiltrate and encrypt this files inside the tools folder. Okay, let's minimize this now. So let's set up our ransomware with the email address where you wanted to exfiltrate the keys for the certificate. So I'm right now I've chosen the Statue of Liberty as a location. So I'm going to click on this and then get the chord this geographic coordinates. And I'm going to paste it in here. So this this is just geographic coordinates as for the Statue of Liberty. I'm going to set this as my location. So once I set this as a location, you'll see that it has created a unique location for me. And then it has generated a random looking email account for me, right? And then it has got one email in it as of now. Okay, so so you have to copy this email and then put it inside your ransomware file and have to make changes in the email address parameter. So I'm going to do that now. So I've modified the email address for one of three, one in here. And the other place where you want to make changes is email one parameter over here. So after you make those changes, save the file. So I'm going to save this file. And I'm going to minimize this for now. And I have got I've opened a PowerShell file. And I'm going to run the ransomware. To run the ransomware, all you need to do is just run one single PowerShell file. Once this is going to run, you will start seeing files going to get dropped inside the temporary folder. And then, you know, in Gmail Drive, you're going to see a zip encrypted file, you know, containing the exfiltrated data, right? So I'm going to hit enter. So it is going to create a B64 encoded certificate. This is going to be the public key. And then it's identifying. So then it's going to install the 7-zip module onto the machine. However, let's see if this has already installed the certificate on the machine. Not as of now, but let's give it some time. And then you'll see another certificate being installed in here on the machine. So once that is done, you know, it's going to start encrypting the files. So right now, it is zipping the files. So if you look at this, it has already created the certificate. It is creating files. And now the files are already zipped. And email has been sent to an attacker on the poke mail. So if we go here and refresh it, you know, it has created the zip still dot zip file. It is, it is running some enumeration on the files on what are files the the ransom and needs to encrypt. And then the it's going to start uploading the files to the Google Drive. So once it's going to upload the large files, it's going to delete it from the temporary folder. And then you'll see that it is going to start encrypting the files. If you look at here, you'll see that the files are already been encrypted. And we have successfully deployed the ferrotti ransomware onto the machine.  So, you know, as of now, I have put 30 seconds for the proof of concept. But then you can set this timer for your timer for, you know, however long you want, right? And so once this is going to done, it's going to close the UI, and then it's going to change the desktop of the infected machine. Right now, if you see that if you have a quick look at the the folder where we had sensitive files, the files have been changed with dot ferrotti extension. The file type is again changed with ferrotti. And then once you see here, see here, the background gets changed as well with with the ferrotti background. Okay, so that that's been done as well. And if you look at it here, right, you have received emails containing the private key for the certificates, or the certificates is already deleted from the infected machine. And then and then if you try to open the a close folder again, and see if it and try to access the files, you'll see that, you know, it's no longer accessible. So if you open it, you know, that there is just chunk characters in it. And it's been encrypted with dot ferrotti. So, so that's what the ransomware does. And so the next step is to actually go ahead and download the encryption keys. So I'm going to download the backup one dot zip file. And if I go back to inbox, I'm going to download the other file as well. So I'm going to copy this. I'm going to backup this as well. You know, so once downloaded, you can go to your Google Drive and you'll see that still dot zip file is already in there. And if you try to open this, you'll see that you've got the same two files in there, the most important file dot txt and the sensitive passwords dot txt. This was the actually in the, these files were actually on the infected host in dot txt format, which is now converted to dot ferrotti. Okay, so if you try to open this, you won't be able to open this, the reason is, but however, let's download this. So just scanning for wireless and once it's going to download, let's go to the download folder. It's not downloaded yet. So let's go to the download folder and see if we can open this. So if you can try to open this, you know, it requires the password. And this password for these files are actually inside the poke mail, right? So and in the backup dot zip file. So if you try to open the backup dot zip file and look at the sys dot txt file, that's the private key for the zip encrypted file, which is on the Google Drive. So, but however, it requires the password at this password is encrypted using the this initialization vector over here, which is using the symmetric key, right? So this is the symmetric key for the very first file, which is the sys dot txt, right? So this initialization vector as an attacker, you are the only one who holds this. And since this is running inside the memory, and as you rotate your infrastructure, no one else would be able to gain access to this, okay? So let's verify and put this as a password in there. And sure enough, this is the password for the stolen file, right? So this is the password for the sorry, certificates using which the files have been encrypted. So when you want to send this decryption key, this is what you are going to send it to the user, okay? So that's how the attack works. And if you look at it, that there is going to be ferrotti dot txt file on the desktop, such as this, and if you try to open it, it's going to give you the same note which you saw it in your pop-up window, right? That your files have been encrypted. They're asking for 0.10 Bitcoin. If you don't pay it, they are going to you know, release your files, sensitive files to the internet. So the same can be done with the phishing emails, right? So if we go to, let's go to Gmail and see how this attack can be done via phishing emails. So one thing I'm going to show you here is how do you bypass antivirus? Because that's not the scope of the project. We are purely looking at the ransomware and how you can create a proof of concept and make your incident response team work for it to see their behavior and identify the gaps, right? So supposedly, you receive emails like this with a subject line, important promotion list for 2020, right? And supposedly, you receive this from your colleague whose email is compromised using various other means. And since you trust that your colleague and internal email addresses, you think this is an important file to work with, okay? So once downloaded, the files look like this, okay? And this looks very legit. An attacker can generate this kind of data and use someone to, you know, download files and run it, okay? So once you have downloaded this, there is a note here saying that click on the chart to display the insights. Suddenly, you'll see that, you know, the data is good. However, the issue is the chart is not getting loaded properly. So let's look at the macros and what an attacker has done in here. So the macro looks like this, okay? So it's going to download the test.patch file from the GitHub and then it's going to run demo.patch file. It's going to save it in the temporary folder and then it's going to run it, okay? So let's see what's in the GitHub and how it's going to pull this stuff. So right now, I'm in the test.patch file. This is what it is getting pulled. So once things are getting pulled, it's going to run somewhere which can be downloaded on the machine itself, right? Like the way we are downloading this patch file. So, okay. So let's try to run this and see if it is actually working. So since it says that, you know, click on the chart to display the insight and what I've done is on click event or for this chart is going to call the macro and it's going to run it. So let's see if this is working. So once I click on this, right, it has open.cmd and it's going to pull the file from the internet into the temporary directory of this machine. So let's go to TMP directory and the demo file has already been downloaded, okay? So if you look at the timing, it's 11.16 and just now the file has been downloaded. It is creating the sys.txt file. The ransomware is running in the background. You can confirm this by the way this CMD has opened. But if you don't want the CMD file to pop up, you can hide that as well. See, it is creating different files. It has created backup.zip file and it's going to perform the same attack again and what it's going to do this time, it's going to repeat exactly the same send steps on the machine but without even user realizing that something is happening on the account, right? So if you see that still.zip file has already been created, zip file has been created. Let's see if there is actually the certificate created on the machine. Yes, it says CER has been created just now. But you can verify the same stuff by actually downloading, by looking at the personal certificate store. So this store, it is going to create a self-signed certificate on the user machine even though we have a USC of Always Notify, right? So if you double-click on the certificate, you know that we have got a private key which is getting sent to an attacker via poke mail, okay? So once this is going to, once the attack is going to be successful, it's going to delete this self-signed certificate and the private key from the machine and then user won't have a chance to encrypt their files, okay? So that's how the attack vector works even with the phishing and let's go to our, oh, so the attack has already been finished. It is refreshing the window and that's why the window's got closed and then when you, you can confirm this by going into the same tools folder and see if the files are encrypted already. So the files are encrypted and then the certificate is going to get deleted. So if you keep refreshing it, if you refresh it, the certificate is already deleted and that's how the attack works through phishing and that's how the ransomware gets sprayed from one machine to the other. I hope you like this demo and you've learned something new out of it. So let's jump back to the presentation and see some mitigation strategies now.


Successful people are lucky but not how you think because people think you're lucky like you inherit money or you launch an app And it goes viral he said in his studies of the top success in the last 50 years It's who they bumped into so my biggest lucky thing was like jump bumping into Joel Salatin Who's this like down-to-ear super entrepreneur yet farmer guy? And I grew up kind of in the inner city and then a mobile home and all of a sudden this guy Opens my brain to like there's a whole another universe sure it's a rare life That's bathed in opportunity most of us only get a few chances right when you see the chance jump on it because I mean You want to get lucky get lucky on who you bump into


Beach one of the odds, but for today's video is gonna be a chitchat get ready with me Vlog style. I love doing my chitchat vlog style now, but I'm just gonna be getting ready is now It's a 40 y'all. I gotta be At the club where we're all meeting at at 10 30, but you know, I gotta get my Instagram pictures in Time for that Trees like what the time is tomorrow so 4th of July, so the city is pretty crazy I'm pretty sure all your cities are crazy right now and happy 4th of July to y'all This is probably gonna be a after the 4th because it's tomorrow, but yeah I hope you guys have a good holiday a safe holiday. Please be safe. There's so many crazy people here.  Like what is really going on in the world?       That is just not a telling Y'all so I'm gonna be so cute tonight like I'm so freaking excited Tomorrow's the 4th of July. Jasmine's here. I'm gonna eat with my mama and my family and then after that She's having a party because then she leaves the next day in the morning time because y'all know So it's gonna be late like I'm pretty happy and excited and I Just love like I just love the holidays sometimes sometimes not all the time. I Hate when people be like all the holidays is for kids um blah blah blah, but not really like because on the holiday people like get together and People that are always busy.   I was like, oh, yeah, thank you And I thought Kamar Lee Simmons was bomb like she's a model.  I don't know But Kamar Lee Simmons is canceled for that. Like I'm sorry. Mm-hmm.  I'm literally so indecisive on what I want to wear tonight Because it's not even like an actual club.  Oh, like it's in a ghetto I think could get done with my makeup in like Literally Call I put it on my Instagram story the other day It's called euphoria with Zendaya and basically like it's so good y'all like It's so good.  I got these from the beauty supplies. Have y'all ever smelt this before? This smells like actual chocolate What did y'all do for the 4th of July? Let me know in the comment section below because I want to know This wig is from african mall. It's so beautiful. I love it so much It literally set me on my comfort zone So make sure you check the description box below to get all the information on this hair. Love you guys So this wig is definitely big head girl approves. Okay That is so cute So I'm just about to get dressed. I really didn't need to do too much. This is really a Like a simple wig. It's so cute You can be but anyway, so I'm just about to get my clothes on real quick and Yeah, I'm really feeling this hair y'all like I cannot stop touching it. It's so soft I just want to show y'all my fit real quick. So this is my outfit y'all It's cute. It's a little you know motor sport vibe going on so yeah, so So I'm about to you know make my way to the club So don't forget to like comment subscribe to this video. I hope you guys enjoy it Don't forget to like comment subscribe And how are y'all feeling about yes comment down below? Let me know what you think and I love y'all so much and I will see y'all next video. Bye