So then you've got the investing activities. So normally these are going to be like things that have to do with the purchase of equipment or the sale of equipment, property plants and equipment, a balance sheet account activity. And you can kind of tell it would be not under the operating, which is the default that most stuff goes into. Notice we're now going down to a balance sheet account again. But the key here is the others, we're not putting it into the operating activity because the other side isn't an income statement account necessarily. When we buy equipment, we pay cash and then the other side goes to, if we paid cash, if we financed it, it gets more complicated. But if we paid cash, then the other side goes to a balance sheet account. That's why it's not up here in the operating activities. Why is it called investing? Because you would think it would just be stocks and bonds maybe. But investing here is a more broader sense of investing. We are investing in the fixed assets because we're putting our capital into the fixed assets in order to generate revenue in the future. So that's, in that sense, it's in the investing activities.


So, but those are the actions and now we get to the emotions, okay? What are the emotions behind this?   You can't. So, there are people that don't have emotions, right? Sociopaths or they get some sick sort of emotion out of really bad things, right? Or they're, even with training, we see the whole reason for PTSD is because of the emotional side, not the whole reason, but that has a big impact upon it, right? We don't stifle these emotions, they'll happen.  And it will imprint you. So, whether it's violence or whatever it is, we don't control our emotions. But we can get to the point where our emotions don't control us. So, we control our reactions to our emotions. And that in turn will help to dispel the emotions, okay? So, was I nervous before when I first got here? Yeah, I was nervous. Was I nervous before that? Yeah, in street fights, I've had plenty of street fights, bad, bad situations. The build up of the street fights, was I ever nervous? Yeah, every time, especially when somebody's mouthy and they're directing it towards me and you know it's coming, right?  But the moment the fight happens with training, none of that exists. It doesn't. And over time, the more I do this, the feeling comes up, I can dissipate it. It's a high level state control, right? It's just like approach anxiety, same thing. But with time and with practice, people can start to control that approach anxiety. They're top guys, I'm sure, always have it, it never goes away or, you know, sometimes it's not there, but sometimes it is. But it's your reaction and how you react to that, that will determine the outcome, okay? So our emotions, when we are out here, when we're non-rattled, right? We wanna have some sort of detachment. But we want to almost be aloof, okay? We want some sort of emotional attachment, but it's more of aloofness. You don't care. You're not attached to the outcome, but yet you are attached to the process, right? You care about the process. You're involved, you're present, but you're not attached to any outcome, right?  Ooh, watch out for that, oh, yeah, you know?  You might, yeah, nice shot, right?  But our emotions on this, what are they? We decide to kick in. It's every bad intention you could imagine.  It's rage, it's fear, it is commitment, right? It is just pure destruction. It is chaotic, because you need it at that moment. Because if you don't have it, you're gonna be overwhelmed. Or perhaps you will die, so you have to kick into it. But if you do that without this, you may not have control. And this happens to people all the time. They're in their box, and they've never experienced this. And all of a sudden, they get fired. And all of a sudden, their girlfriend breaks up with them.  All of a sudden, they find themselves here without ever having been here, and now they're popping off rounds in their old workplace, right? Cuz it consumes them. They don't know how to deal with it. And that's not what we want.  So our emotions are whatever to the up degree when they're expressed. We have to feel it. So we have to conjure that up.


So hello everyone we want to we need to start Okay, because we have only Few minutes okay to talk about a lot of things Welcome to our presentation about the video data and open source intelligence My name is Frank Gomez. This is this are Jimenez We work at Divo, okay Today we went we were going to talk about Video analysis and phase recognition. Okay, and the idea is we want to start just making a demo Okay before to explain how to do all the things that we are seeing in the in this demo. Okay, so Like you prefer Okay, so We need this mobile. Okay, this mobile is just an Android and have a steaming server so the idea is We we want to Share our mobile phone with you to try to recognize The guys that are here tonight today. Okay No Okay, we are getting the the streaming. Okay, perfect. It's working. So I need a volunteer Okay, these guys are the perfect guys to a star you can Okay.  These guys are working on Divo. Yeah, obviously You want to try Nothing unknown Okay, the the next minutes we will try to do this but using or LinkedIn contact to search if any of you are in or LinkedIn contacts so Wait wait We are talking about the video analysis the idea is Today, we're trying to explain you the importance of the processing of the video right now because it's one of the things that Government and companies are doing to get a lot of information. Okay First we will start talking about the open source intelligent. How many of you know? What is open source intelligence? Nobody To guys. Okay, the open source intelligence is just to get all the information that you can Get from different sources. Okay, mainly I don't know governmental information Network social networks anything else. Okay Open source intelligence was defined in 1992 1992 with an all-style definition, okay, but since soul seems out of date, but the definition is Good for our time or nowadays because the only the The format and only the way you are getting the information is changed. Yes, but talking about newspaper and the cities The city is necessary. Okay a modern definition is this okay open source intelligence Is the data collected from policy available sources to be used to be in an intelligent to be used in an intelligent context? Okay, so the idea is get a lot of information and Apply this in a different use case. For example, national security counterterrorism cybertracking and monitoring people and even to Get calculate the Roy in your advertisement and so on So today we are focused on the video analysis. Okay, because by 20 by Twenty twenty-one twenty-twenty-one 80% of the world's internet traffic will be video. Okay video is one of the things that is growing exponentially in the social networks. Okay, so Nowadays in this year 90 million of terabyte per month per month and on internet are video. Okay, and only two percent are from Surviolence so Video is a really great opportunity to get a lot of information to use in your companies or in the governments So you can see all of the networks support to upload video to the to this networks Next we will try to explain quickly a video that that is just processing a Easy propaganda video and the content is maybe some sensitives. Okay. We apologize for them a month so the idea is You can get a video. This is typically from the military intelligence or No mass. It's more to the Cia This kind of hatching. Yes. No, no, no the typical information that you are looking for in a video. Okay, the idea is With the information about the context of the video the building the buses you can get where the the video was recorded, okay this case just using Google Maps to Correlate the information that you are seeing in the video with the information that you can get from Google Maps and then Even you can get you can know when the video was recorded because in this case This guy's it was killed by this terrorist and the the blood in the in the ground and the brushes You can show when the the the blood appears in the Google Maps history Screenshot, okay, so the information in this video is not only a guy is killing other guys Okay, there are more information in the video, but today we are focused on the Face recognition, okay, in this case because the face recognition is an application which has a lot of advance advances in recent years, okay before this early start Explaining you in detail how we can Correlate how we can detect the faces and compare with the faces that you have in your database I want to explain you in a six simple steps Okay, first you need to know where the faces Using hug or CNN you can get where the faces in the image, okay Then you get get the same you can get all the information from the face in this case Creating or calculating the landmarks and then you can scale or rotate or cutting the the face that you are getting Because you need to put in the same position that all the other face that you have to do that in your database When you have this you can calculate the vector array that define this face.  I don't know try to find Okay In the first step we are talking about where are the face the first problem in the first step is identify where are the face and The recognition of space is a very complicated task in some case like you can see in this image that will further and Charles Smith are it's like a twins and Not only face Recogniting objects in some case is a very very complicated task No, if you can to try to identify Chihuahua's and muffins in this image is very very difficult this kind of things Make The the new algorithms not new but is with more advanced in the last year And the first of the techniques that see is hook histogram of oriented algorithms the hook techniques was developed in in 2005 and Try to find in In one image a pattern the pattern is the movement to the more darkness points in the image and with this move meant We make or we draw a vector in this direction in this image or faces You can see the hook Result in the little window and in this hook result you can identify the face patterns and The the technique is to compare all the objects all the cells in the image with this pattern and When you find the same pattern you find a face Okay, let the classification for this kind of Patterns is across a support vector machine support vector machine is a All algorithm in machine learning, but it's very useful in this case because you can and You can separate the plane in two areas and in each area you can find Faces or not faces in the image the separation is between a Hyperplane in n dimensions you can see in two dimension and is aligned but in n dimension This is a hyperplane as true fights in the in the in the scope of the of example Sorry Well, the next method to find to try to find faces in in image are convolutional neuron network You can see in this image the transformation across the convolution subsampling layers, but The first of this step is a convolutional Liar the convolutional liar is very easy to understand because I have a matrix the convolutional matrix So there are the kernel the matrix in the middle of the image I think this kernel you can put some values in this case This kernel is used to detect vertical edge in a image you can an image in the in the left part of the Presentation and you can move the kernel across all the image and Make this this operation that you can see in the first steps seven Times one plus two times zero and their final result go to the final convolution matrix For example, if you can if you need to detect vertical edge in an image You can see the image in the left hat in the left side and with this kernel You can detect in the center the vertical the vertical edge You can use this kind of convolutional matrix in GIMP GIMP have the in tool the option to apply this kind of matrix and You can practice and try with this kind of convolution Well, the second step in a neural in a convolutional neural network It's a sub sampling the most used operation is max pooling in this case. It's very easy You could the matrix in Portions in this example two times two and In each portion of the matrix you can choose only the highest value in this case for the first two times two Portion you can choose the seven in the next the nine and this kind of things well these operations are Previous a neural network and You can concatenate a lot of these kind of operations to obtain in the last step of these layers of a vector flattening all the Previous matrix and is this vector is the input to a normal neural network with her inputs Her layers her Outputs and her way it's and like a normal neural network okay caution You can use CNN in a singing in video because the wall can be explode by recursions Okay, when you choose to To identify where are the face? her or CNN well her has best accuracy Pardon her Has faster and can be used in video in real time and CNN have best accuracy And can be used in processing offline videos and these kind of tasks Okay with these techniques we only we've not only Recognize face can be used to recognize objects like flags in this example The next step We know the coordinates of the face in an image the next phase is Calculate the face lag mar the face lag mar are only points in the nose in the ace in the a brown to identify the face And this kind of points can be a lignet to the same position For the next step. This is a best technique to the to obtain better results in the next phase only apply apply a fine transformation like rotation translation and scratching and this kind of things and You obtain all the landmarks in the same position a league to the same position Well, the the last step in face recognition is a face encoding face encoding is used an algorithm creating to 2015 by Google and Obtained 128 measurements of each face. This is like a automobile plate or plate of The person because this number is the same or very similar for the same person But are very different for persons that are not the same person This is like a vector in a 128 dimensions when you when you try to identify the faces you only compare these two vectors and You calculate the Euclidean distance between these vectors and try to find if a person is The person that I can find In this case you can obtain true positive the person is and is recognized False positive the person is not the fine person, but is identified like a person That I try to find The false negative the person is but Don't identify the person and the true negative the person is not the person that I can Find and is not recognized like this We we use a tolerance to move between this balance between true positive false positive and Using this balance you can move the tolerance Move the rock to obtain the result that you that you can try Okay Yeah, if you like We have time to try the another demo using this The mobile okay, and we will try to detect who of you are in our LinkedIn contacts So maybe can I use the camera?  Okay. Yes because in Facebook Sorry in LinkedIn. We have only one you want to photo Person this kind of training with With a few photos of the same person Launch a lot of false positives. I know all of you You are in my LinkedIn contact No And this is our contact I Don't know but I think no Okay, the problem here is you need to to to take the the video in a good Light okay a great camera right now we are just sending the the video in streaming today to the laptop but The idea is if you only have one picture from your target you can get the target now in a good way Okay, but we have here a video That we are using the the same approach but with Or the guys in the in the company I think Okay, here we are trying to get from all the guys in the in the office who are in the LinkedIn contact from Cesar My LinkedIn contact, okay The idea is here The the the training is the same we have only one picture, but the camera is good and the light is good Here we can show Some of guys are in the both of Contact, okay So this is the the the idea is you are getting all the information So you are getting the information from the face and you are trying to to recognize in base of your database but now We're going to show the next step the next step is this unknown unknowns. How many of you knows where this expression come from? The unknown unknowns nobody Okay, don't I'll explain us There are reports that there is no evidence of a direct link between bag dad and some of these terrorist organizations There are known knowns. There are things we know we know We also know there are known unknowns. That is to say we know there's some things we do not know But they're also unknown unknowns the ones we don't know we don't know So that is the unknown unknowns. Okay all the things that you know that you know That you don't know. Okay. So this is to introduce our use case Our use case is just to try and to process all the information from isis propaganda I don't know if you are familiar with this, but isis is the the stomach islamic state Okay, and it's polishing in social networks a lot of propaganda Related with the with the terrorist. Okay So the problem is the social network can't stop This kind of videos and we think we need to to take advance from the videos and the idea is We are getting the videos from the propaganda To classify all the people that is in these videos. Okay, because the guys you you know The people that are in the database from Interpol fbi. I know It's easy to to to to the tech in the in a video to to know that this video contains this Okay, the problem is we need to Catalogate all the people that is in this kind of videos. Okay, because it's the first step to identify these guys so Our demo is it's completely live. Okay. We have here On an storm. Okay We have a topology The idea is we start the topology right now using Two videos just to show how the topology is working And then we try to explain the architecture of the topologies. What is the topology doing? Yes All the code was published will be published in our Github account of the company github account as you can obtain this kind of proof of context in four weeks Or not Sorry You in this in this proof of context you can try to use with videos photos and and whatever you want and the idea is all the They the ideas in the presentation Can be used for us in in your in your computer Okay, we start the topology the topology right now is just waiting for a for a video in a in a folder Okay, the idea is just to get in this this video using Different queries from the from the group from youtube. Okay Okay And then Start working Okay, the results are in the phase folder and we are getting Two two kind of results the the guys that we know Okay, the guys that we have in our database we train the database with these guys And in the other side, we have all the people that we don't know Okay, but we don't get only the people that we don't know we don't get the people that we don't know in in different folders and Each folder is the one folder to one guy. Okay because it's it is We are trying to to get all the all the people in the in the video To process in a bad processing just to identify using another techniques. Okay so because this is a hard processing and Maybe we need to to wait To see some results here. We have the first guy zero folder the second guy. Okay Maybe we can put this Running and then continue with the presentation Okay Maybe you are like Homer Simpson right now Now we're going to run a few tests. This is a simple lie detector I'll ask you a few yes or no questions and you just answer truthfully.  Yes Okay, so Let's just start We need to explain the the architecture architecture is quite simple We are using open cv just to to processing all the image. Okay And then we are using a batch storm just to to the to the real time processing because we are using delete Join to Faith recognition library in python that help us to to processing all the information in the in the image Okay, the idea is we are we are just getting the information and trying to to to processing at real time Okay, this is why we are using the storm and not only just an an script.  Okay, the faster recognition is just to query or database To know if this face Are isn't your in or database or just putting in a The sorry and put in the know people. Okay, if you don't know Who is this guy you put in the next step and the next step is trying to detect The relationship between the unknowns. Okay, we are putting the Guys that we don't know in the unknown people And then we try to process these unknown people to Correlate to put join all together in different folders. Okay, the the question is What kind of algorithms we are using to try and to catalog all the people that we don't know Why we are using Chinese whisper. Okay I'm talking about this kind of algorithms Well, the question that we need to resolve is In this video How many different peoples appears in this other video? How many people appears that appears in the first video? This kind of task needs to agroupate or or make a group And with all the face that you can find in a video Okay, for this we are trying some Techniques the first of all is a proximity has a proximity has Is a hash function but not like a cryptographic function because in this case can be used over image and this function Take an output E and the output is Very similar when the image is very similar This kind of techniques don't work properly because The background of the image the lighting in the image can can modify The output of this proximity has and don't work properly the second And the second technique or algorithm that try is Cummins algorithm is a very use useful algorithm When you try to classify it without training and in this algorithm you Choose the groups of the of the of the data in this case the group of the face Basset in a partition of the euclidean space And choosing a centroid around all the similar Objects or the similar data are agrouped in this case the the algorithms work properly When you know how many people are in the video how many different people are in the video But in this case don't work properly because the estimation of the number of centroids No We don't we don't we don't obtain a good result with this kind of estimation Well What algorithm of techniques works for us the chinese whisper The chinese whisper is an algorithm that used in natural language processing And it's very simple to understand and very simple to implement because only Follow these three steps Organize all the people in your case in a groups Linking this group for the proximity of the 128 measurements that are staying the Across the recognition phase and Is work properly and group every people in in in a very simple and speedy speedy Okay Go back to the to the demo I don't know if the Okay here for example This is a guy that we have in the database in this case is Abulafa is all Okay, we are training the We are half we are in the we have in the database So we are detecting this guy in the in the video, okay And in the other side, we have these guys the the groups in the whisper algorithms that are The same person the problem is the The algorithm works properly when the time pass, okay You need a lot of time to move The guys in the different groups and put in the correct group. Okay, because The the right now the algorithm is just trying to move trying to to to overpay this kind of persons Okay, yes, because it's working in real time And in the algorithm if you see the step previously in the in the slide the algorithm Moves the person from one group to other group around the time until the The the works converge or predeterminate number of steps But in this case The algorithm is working Until all the groups converge and have a good approximation This is a phase positive because all the phase that we have for this guy the abu Alback daddy are just in front. Okay. It's not the the side of the of the face And in this case this guy is Just trying to the the algorithm is trying to identify a phase, but the phase is not in the correct position. Okay So just Yeah, as you can see the false positive is a very complicated problem to solve in this kind of work And in all the work that you can see in presentation only So the true positive case in this case We prefer to show what is the reality of this kind of algorithms work properly, but need a lot of training with correct phases and Required to choose the tolerance For that kind of detection that you can obtain So what what is the social impact right now with the face is the phase recognition? Okay, the the phase recognition is just in the in the companies is just in the In your life. Okay Companies and government are trying to to know where are you to know what what are you doing here? Who are you? Okay, so the retail stores are using the face recognition to know how many times you are going to the To the to their store.  Yeah in this article Talk about Walmart Tesla Tesla is deployed a massive new autopilot neural. Okay, what means this? Tesla has a lot of video where people With people with cars with another with all the streets. Okay This information right now is just using to to the cars, but This information will be sell in a moment. Okay, and this information is a great information to know Where a guy are in a moment. What are they are doing? so Even the the visual search is one thing that the the companies are doing. Okay, you just See, uh, something just search and buy. Yes. This is a demo in your snapchat Visual find So even you can buy A webcam including all these features. Okay all the features in face recognition are included in the amazon In this amazon webcam, okay And then the the the best example of this is the china social score program Because they are trying to to Correlate all the information of the date to they want to know all about the citizen just to to Put an score in each citizen and then because I don't know maybe punis the the guys Without fast trains without the Good schools for hotels Bum for flies. So we need to defense. Yeah, okay. It's time to defense What can we do to defense against this? You can spend money and get this cup. Okay, this cup is just trying to To to blind to blind the the cameras. Okay, but you need to to put all the day the The cup and you need to pay. Yes, this cup works properly with the night vision cameras because the leds are infrareds Okay, in another way you can just buy Some glasses It's better but are cheaper. Okay, or even if you don't want to spend nothing in in this you can Yes, this is the sign of the fence. Okay, it's nice little cyberpunk Maybe you can you can do so. Thank you very much and this is our approach of the defense to the face recognition Yes, we have a defense And you got put Thank you guys. Thank you


How far back would we have to go To find the person who is responsible For making the world what it is today to achieving All of the cures and all of the purity and goodness in the world today This is an impossible task We cannot find one soul individual because everybody Matters any success in this world does not come from one person There's not one person that has purpose Everybody has purpose and that's what I'd like to talk to you about So think about it. How far forward would we need to go in your life to show the difference you make? There are generations yet unborn Whose varied lives will be shifted and shaped by the moves you make and the actions you take today and Tomorrow and the next day and the next because I know you will not stop fighting You will not quit you will always see tomorrow Every single thing you do matters You have been created as one of a kind On the planet earth there has never been anyone like you and there never will be again Your mark is here Your spirit your thoughts your feelings your emotions your ability to reason and act all exist in no one else The rarities that make you you The rarities that make you special are no mere accident Or mistake you have been created in order that you might make a difference and you are You have within you the power to change the world You have to know that your actions cannot be hoarded They cannot be saved for later or you selectively by your hand Millions and billions of lives will be altered Caught up in a chain of events begun by you this day the very beating of your heart has meaning and purpose The very step of your foot has purpose The very thoughts you think have purpose The smiles you give have purpose The tears you give have purpose your actions have value far greater than silver gold Now your life and what you do with it today and tomorrow and the next day Matters forever.


Hi, just today I was reading the this week in GNOME blog post and I discovered that this new application of GNOME had launched. It's a third-party application, but you know, it's already available on the flat app. So if you're interested, you can get it from there. And I think that we don't talk about about the fact that we can run GNOME application in KDE and KDE application in GNOME without any issue really. And even though this is presented on GNOME's blog post about the application to manage money for GNOME, this doesn't mean at all that we cannot use it in KDE plus neither.  So I've seen how it works. It's actually rather simple. Let me just do a example account. And everything really revolves around the concept of our transaction. And these are the data that we do have about the transaction. It has an ID of increasing, which is increasing for each transaction. Although we can set our own 16, or maybe we can add, we cannot set an ID. We can set the date that this happened, description, type, which is either income or expense. And we can choose whether we want this to be a one-time transaction, either a one-time income or expense, or if we want to repeat it either daily, weekly, monthly and so on. Now, this is currently very simple. As an example, you do not have the possibility to set a repeated interval that is something that is not daily or weekly. As an example, something very common that I see is bi-weekly. So that is, I guess, something that we will see in the future. Keep in mind that this is, as far as I know, the very first public release of this application. So the fact that it is rather simple is completely expected and not an issue to me whatsoever. So let me actually do some money like this. And we do have this. So we can export and import as CSV. And if we look into the preferences, we are also able to change the currency symbol. As an example, I do prefer to use euros like this. And euros, I do prefer them on the right. You do have to restart the application. Apparently, I just discovered this for the new currency symbol to actually apply. I kept getting the old one. But I mean, what else? It's really that simple currently. And again, that is not the issue. That is the starting point. What I would like to see personally, and just making an example expense just to give you an idea of how that looks like, you do get a running total and income and expenses. What I would expect is now that you do have the interface to actually set a transaction inside and outside of the account for it to have an actual ability to elaborate those information to convey you even more information about them. Something that I usually see is the ability to show graphs as an example, like how much money was spent and earned for each month. Again, as an example, another option would be to add categories for each transaction to be able to see how much money is spent on each category and also see a graph of usually when that category is spent during the different times of the month, these kind of things. I think this is a really good starting point. It is not quite something that I could start using to manage my personal finances. I do have a XSL actually, Google sheet form for that. But if this keeps on developing like it's currently doing, then I will switch to it immediately because it actually looks good. It is very simple to use. I like it. The second one is that we actually get a new again for this week version of Endrever, which is version 43. I am using the version from Flatup again, which you can see is version 43. Now, there is not as far as a significant change log outside of some UI improvements and such. However, I had never used Endrever before. And the third, let's redeem that. Let's try it out. And if this all revolves around the concept of a transaction, here everything revolves obviously around the concept of a task. So let's add one. And we do have a couple of ways to customize this. Now, obviously, we can drag and drop it around to reorder our to-dos. We cannot do that. The application crashes. It might be actually that function require, I don't know. I don't know why it crashed. I should probably check. We can select a due date. We do have shortcuts for two days tomorrow, which is nice. And then we do have a way to sort and actually filter the to-dos depending on what will happen in the next seven days, which is rather useful. Now, again, this is super simple and things that I would like to see for this to become my main to-do application, which it totally could become to be clear, is stuff like being able to customize the fact that next seven days, for me personally, I do prefer having the next day because I do actually have lots of tasks and it would be used the next day, not today, like tomorrow. I usually use a tomorrow view, which is in my opinion, particularly useful. In fact, I would like to end this video with suggestion. And that is, if you do need an application that manages to use and you do need for it to be very powerful, I would suggest that you give a look to tasks.org. We can see it here. This is an open source. Obviously, I will only recommend you open source alternatives application that is meant for Android to do tasks and remainder. And actually, I've never seen an application even for desktop that works this well. So I really suggest you that you give it a look and it basically supports everything, like everything. I use it for everything. You can filter the tasks however you want and you can actually add custom rules in whatever way and then you can add widgets to the home screen using those filters. It's extremely powerful and customizable, customizable, customizable. So I would suggest that you give it a look. That said, this is it. Thanks everybody for following and see you tomorrow with another video.


Hello everyone, my name is Devon Bowers. I'm a software engineer at Microsoft where I've been working on code integrity systems within Windows for the past four years. And I've been working on code integrity systems within Linux for the past two years. I'm here to talk about our new LSM and the last year of what we've done, what kind of prototypes we've added and a feature that we're particularly proud of called integrity name spaces. So real quick, what is IPE? IPE is a proposed LSM. It's not yet upstream, even though the patches are posted online publicly, but it seeks to address code integrity for fixed function devices. Now, this is a little bit of a misnomer. It actually seeks to achieve more of a trust-based access control solution as opposed to solving code integrity in and of itself. So trust-based access control here means hey, we need to prove the integrity of the file and then the policy authorizes what is allowed to run based on that integrity claim. Also, what do I mean about fixed function devices? Well, fixed function devices are devices that essentially only do one thing. So an example that's gonna come up during this meeting, during this presentation a lot is the IoT device or a container host. So essentially, they do one thing if you black box the container for in the case for a container host, all it does is run, launch and report a container, which is essentially one big mechanism of the management of a container. Other examples include IoT devices, as I mentioned before. So recently I just bought a washer, much of my sugar in it is connected to the internet of things so the security is probably terrible. And my washer only needs to be able to wash my clothes, dry it, maybe emit a beep after the cycle is done. It doesn't need to run doom, even though I'm sure somebody else will be able to find a way to get it to run doom. So IP is really designed around these scenarios that help it out to get, to ensure this promise of it continues to only run one thing. Well, this presentation is not, is a walkthrough of all of IP. If you're interested in more of the policy constructs, you know, how does it work under the covers, things like that, I did a presentation last year at LSS that you can look up online and should be able to answer all these questions for you. So real quick, it's been a pretty good year for us at IP. We've added a prototype for SS Verity integration that allows full parity of what we have for DM Verity and IPs, public postings. So you can both allow anything signed by the FS Verity built-in key, built-in signatures, and you can allow or revoke based on a specific digest that is provided by FS Verity utilities. Additionally, we added support for specific file reads, forcing integrity verification. So the way this works right now is if you have an application that you know opens with a specific path from user mode. So say, you know, I know my SSHD server opens ETC, SSH, SSHD. I've seen the open syscall for that. So you can write an IP policy. Hey, anyone tries to open ETC, SSH, SSHD config for read, make sure that it is an integrity verified object. So in that sense, we've managed to accomplish some stuff for legacy applications that you can't really recompile, but it's a relatively fragile system. So this is why there's that in progress at the end because we wanna make that a little more robust and the intensive way that we're thinking about doing that is the trusted for patch set, which was just recently merged, adding a new flag and say, hey, can I trust, does this file descriptor trusted? According to, you know, the trust access control in the system or the integrity claims either be through IP or IMA, and am I allowed to open this and should trust it as such? And finally, the last big one is namespaces, which is a little bit of a misnomer. It's not namespaces in the traditional sense of the word that you think of when you say clone or with the clone system call or the unshare system call where you would actually create a namespace primitive like Mount PID users and so on and so forth. It's more thought of like a variable policy or a contextual policy that a new trust, a new definition of trust is created for that process tree. So it's a little bit different and it's probably an inaccurate name at this point. So some motivations why we wanted to build this kind of variable context, variable policy of trust for systems is that we want to increase IP's flexibility a little bit. So, you know, lockdown systems as IP originally proposed, it was four are pretty rare. These lockdown systems imposed a ton of requirements on the people building these systems. So the whole system itself must be designed around this trust-based access control. So things like updates need to be changed. That story needs to be reworked. The build systems now need to be set up for code signing correctly. You might have to maintain multiple PKI chains. It becomes a little bit of a night resourcing nightmare that essentially means only the really big companies with hundreds of engineers working on a project can essentially get these systems working. So for that reason they're pretty rare and we want to extend IP's applicability to the other kind of systems. Additionally, some execution contexts are designed to be unrestricted just by the function of the device. So I mentioned earlier container hosts are kind of the example that we're working through for this entire presentation. So container hosts in general create basically a sandbox that is trying to protect the rest of the system from being attacked or isolating a small fragment in the system while sharing the same kernel. So in this sense, we want to make IP more applicable to that scenario. Since the whole kernel is shared, if we were to use a normal IP policy, all the containers would be subject to that policy. It's not usually always a great thing, especially if you're running other people's containers as like a Kubernetes node or something like that. But you also want that kind of security policy for the host so that no one can just log in to the host and execute whatever they want. So we just need a way to make sure that those execution contexts that are owned by other individuals or that are properly sandboxed and protected do not have a way to use IP and gain some benefit, which brings me to my next point of a little bit of applicability, trust-based access control or proving code integrity of your executable resources is useful. Even if it's only on one process, you still get some security benefit for that one process and it's better to make small steps towards a big security goal than not adopt the security goal at all because it's too much work in the first place. Finally, some isolation principle. So IP, this is really good for at least privilege since this trust context, this trust policy applies to a process tree. We can now define more of a least privilege style thing on our processes and say, hey, my SSH process shouldn't need to load kernel modules because unless you use it as a remote connection for a headless terminal or something similar. And so I'm going to say, hey, SSHD, you're allowed to execute stuff but I'm not allowing you to load kernel modules. And so that reduces the attack surface of SSHD kind of dramatically with loading like a potentially vulnerable kernel module or that was signed previously but has an exploit available. So this is kind of a classic example of the fork exec. I hope everyone's seen this before. It's a pretty basic thing on Linux. So this is kind of basically how the IP namespace works from an interface perspective. As a consumer, what do I need to do to set up a namespace? Well, this is a pretty common pattern. So we kind of plugged into it immediately and we said, hey, after you call fork and you created that new process or the start of that process tree, here's an interface. Here's a file that you need to write in security of us because we're security FS based as is typical for LSM. And then all you need to do is write what you want to set up. Your namespace like or your trust policy. So you define things like some metadata associated with the context, a name or an ID for the context itself. Whether that context starts in enforce or permissive and what the active policy, what the policy should start with that trust context. And after that, what you do is close as you do with the open syscall. And once that's done, your variable context is created and then you can follow the rest of the calling flow for the classic fork exact to spin off your new process. After the last process calls exit, the namespace is cleaned up or the trust context is cleaned up for the end user. You as the calling application without any you need to do anything. It's pretty easy, simple, low overhead and fits in nicely with this model. So real quick, I have a demo here. So this is a real system with IP enabled real distro. This is Arch Linux where I've applied the IP patch that's in built to full kernel. I think it's about two versions at a date now. But it's a two-stage policy where we bootstrap trust. We start with trust for only the internet ramfs. The internet ramfs trusts the root fs partition which is the de-embarity volume, which is why you see this error on fsck because fsck does not expect to read write drive and it's read only because of de-embarity. So we'd look at de-message. We can say, hey, we loaded the OS policy, which is that internet ramfs policy that expands the trust to the root fs. You can also see that BPF was blocked because it did something that did not match IPs respective of what it should be allowed to do. So if we look at that policy that was loaded in the internet ramfs, we can see everything we expect. We can see, hey, we're allowed to make namespaces or contexts and we trust fsvarity signatures of what I need for the demo to demonstrate my custom version of RunC. And then de-embarity root hash, which is our root file system and then the internet ramfs itself. We also looked at IPs and enforce, this confirms exactly what we expect in the, what's it called, the de-message output. So if I try to run RunC, this container that I've added, we're gonna get permission denied as we expect because it doesn't match any of our integrity policy requirements because this is an unwriteable drive. It's not the root of fs, it's not an internet ramfs, and it's not a Missouri sign. So everything's blocked and as we fully expect, even if we change it into no dice, and we can see that, hey, it's in the path, it's blocked. So we do a root of fs and we try to run steam locomotive, same deal, exactly what we expect. So that's kind of boring, right? It just shows that exactly what we'd expect that we've had no regressions from our past process. So now we're gonna do a little bit slightly different with the namespace still in the same page of, we're still blocked even if we create a namespace with a currently active policy. So we have our OS policy, which is exactly what we want. We're gonna spin off a new process by bash, that new process tree. We're gonna set our metadata ID, one, two, three, four, five, with our extra metadata of two, NS2. Start it with the OS policy and then all we do is we're finishing that right to security, IDE, new namespace. That will then create our new policy and when we change root, it's still going to fail because obviously we're spinning on the same policy, but we're in this brand new namespace, which you can see by the NS name, NS2 right there. And we can even see that the policy, hey, it was started with OS policy and so on and so forth. Now, if I managed to type exit, that we should not see any namespaces whatsoever in our, except for our root namespace in the namespace history. And lo and behold, it's right there, it's cleaned up for everybody automatically. So what happened there exactly? This is a diagram of what we're gonna follow through that whole example. Hey, so we write in bash that created a new schedulable task in the kernel. When that new task is created, there's this convenient security hook that's called whenever new task is created. And we just say, hey, inherit the current namespace immediately. So we just assign our little LSM blob memory region to say point to whatever the parent's name task is and then return back to fork. When they call write, which is a brand new part of our system call, we just check the restrictions on the current namespace. So, are we allowed to create namespaces over ourselves? Other things like that is required to have a policy, things of that kind of nature. And then if that all succeeds, all goes, we set it up, we allocate, we do all the fancy stuff that we need to do to make sure that we're gonna start in a good state. After that, all we do is swap the two regions of memory on the task. So, hey, the current task now gets a slightly different namespace. That we've already set up and made sure that it's completely active. And then we return to write. When you call exec, we just check against the tasks active policy. So that's in the, you know, that context that I was talking about earlier, the namespace itself. And then when something calls exit, we decrement the reference. And you know, when that reference count equals zero, that means there's no more policies that are referenced to it. And we scheduled the free. Pretty easy.  Let's walk through, you know, more of a concrete example of how something could be set up using this. So we start off, as I said, we're gonna use a container or Kubernetes host scenario. The host is still fixed function. It's deploy and run the container. We're just blackboxing what the container does. So the system might ultimately look something like this.  And you might have something like this.  And then the specific policy for the partition is allow host only, you know, allow children to be created and but require a policy to have in our child. So this comes, this environment comes with a little bit of requirements, you know, workloads are unsigned, they're isolated from the host, but the host itself is immutable and high uptime per sensitive because if you're in the, you know, the cloud wars, one percentage of perf lose you customers. And finally, the big one is that as the host owner is not the same as the container owner, the host owner is some, is a person that has no contact with the container owner and vice versa. So it's important that we be able to accommodate basically the least restrictive needs while also allowing the container owner if they have the knowledge and the technical expertise to leverage exactly what they need to do to set up their own, you know, namespace for their container. So in this, we're gonna use that same system before we're just gonna log in real quick and we're gonna load a more restrictive policy because we wanna trust only the host. So this first more restrictive policy I've called, you know, IP restrict very, very intuitively. We're just gonna load that into the kernel by catting it to the new policy node which adds it to exactly our current context. So IP new policy, we've created and loaded it. If we look at the policies node in the IP security tree, we have, hey, there's that host lockdown policy. So we're just gonna make this active. This is done by writing one to the active policy name. Well, first we're gonna show the policy improve, you know, hey, those nameshaces, you're only allowed children, you have to require policy, you have to require enforcement and we are only allowing necessary signatures because I needed a custom version of run C and then also de-enverty, this specific de-enverty root hash which is fine because we've left the new run of us and de-enverty root hash is our specific root FS. So if I echo one to active, it's going to make that policy active and now we're now enforcing. This is kind of boring because there's nothing really changing about the execution state. We can see that it was loaded and then activated that 1800 event is the load, something was loaded into the kernel, 18.02 event was, hey, this was made the active and enforcing policy. So if I create that new, if I first run my enable FS Verity script, which loads a my key into the FS Verity key ring because it's a slightly different key ring than de-enverty which uses the system built-in key ring and then I write the namespace policy that I'm going to put used for these container namespaces so that I can use it when I set up my namespace itself. So if we look at this content of this namespace or this policy that we're using for our children, we can say, hey, it just allows everything but you're not allowed to create namespaces of your own because I don't trust you that much. So then we're just gonna quickly go to the VAR demo. We're gonna try to run RunC. My custom version of RunC, you know, this is really RunC, nothing sketchy. You can see the commit v100, dirty, real help text so on and so forth. So if I try to run even the upstream version of RunC, it's gonna fail. This is exactly like we expect because hey, you can't create a new name, doesn't know how to create a new namespace and fails immediately. If I try to use my custom version of RunC, we get into the container because it's created a namespace and we can run steam locomotive. There goes steam locomotive right across. It's a fantastic application if you need people to learn how to type out us correctly. So if we look at the namespaces tree, we should be able to see our namespace that 98765 is new. That's exactly what we're running. If we look at the policies within that 98765, we have that NS policy, which is exactly what we loaded before. And if we exit that namespace, our last reference is dropped and we are free. There's no more namespaces, it's cleaned up on behalf of the user and we're good to go. So what happened there exactly is we have our typical container stack here. We're starting from RunC to the right. And in RunC, there is that nice little fork exact diagram that we saw earlier. In this fork exact, just like our proposed changes, it does the same kind of thing where it calls fork, creates the namespaces and these are the official namespaces like MountPid, user, whatever. The app armor and then it calls the security systems to build their own more contextual policies or to apply to the container. So app armor goes and set comp, which isn't an LSM, but is a very similar product of similar security value and then SE Linux. So we just split IP right at the end there to do our open, right and close that we mentioned previously. And it's important that we go at the end because when other security systems need to be set up, we're changing essentially what is allowed to be accessed as far as execution or reading. So the other security systems might have like LibSE Linux and it might not be allowed by this new trust policy. So we wanna go at the end and make those applications as late as possible just before we start the container appropriately. So now we're getting into more of the theory about or in the design of how we created a LSM namespace. So when we originally approached our design, there was two approaches that we ultimately considered a general security namespace. This would be something that would be like a more official MountUserPid namespace that allows multiple LSMs to leverage the same kind of framework and create something that is appropriate for their needs. This is a really good idea in theory, but it falls short in execution. The reason is because you can't manage to solve any of the harder questions when it comes to namespaces on behalf of the LSMs. So things like how do you reconcile two conflicting policies? How do you, you know, if there's a super policy inherited above or like in the root namespace, does that, how does that translate to everything in its children namespaces and things like permissions, like who has permission to view its policies and security of us. So this turns into a really complicated problem that isn't really possible to solve the LSM layer as an abstraction. So it essentially just turns into LSM blobs where you're giving a reserved memory region for and maybe a more customized interface that will ferry information to the correct LSM and it just turns into LSM blobs. So we abandoned that idea pretty quickly and we went into LSM specific, you know, namespaces and we created for IP. The concept was pretty natural to be expanded. The old approach was essentially, we already had an implicit context. It was for init, init being the first, you know, first thing to spun up on the system and that was all that we had our trust context for. So all we did was make that init be generic. So it could be login, it could be shell, it could be anything you want, you name it, it can be it. And it applies to a process tree. So a process in all of its descendants no matter how far deep you go. And it relies on, so in general, this is kind of the principle of, it's just a new trust context for that process. If you want to isolate things, you should be using the other namespaces which are far more official for the Mount PID and username spaces. So in general, we also wanted to have some stuff for the policy, you know, policy should be able to both restricting span controls which I'll go into in the next slide a little bit. And we needed the parent to be able to provision limited information about the children because as soon as we jump into that namespace essentially we're treating this as its own thing but whoever set us up, we trusted at the time that they made that decision. So for IPs namespace properties, we needed some flexibility, you know, the existing namespaces enforce rigidity. So in the early in design there was a comment from one of the people that we were reviewing this with and says, hey, can you attach this to the username space? Does that make more sense? Because, you know, privilege namespaces don't have a username space and does it make sense for this to be a separate thing? There was two responses to that. The first is it's a pretty a lot heavyweight system for a username space. So like a username space would work for a container host which runs generally on privileged containers, on privileged containers, don't have a username space, you know, root is real root.  It's pretty expensive to, you know, spin off a new username space every time you log in and does that even make sense from a conceptual point of view for the system? This was also raised during my presentation at LSS this year of how does this make sense with privileged namespaces? Well, it's still on the same vein as like SE Linux policy. So Alexi also recommends, you know, you use, if you're going to use privileged containers, you should lock them down with mandatory access control system. Privileged containers still exist. So this is just another way to also further restrict control and protect a privileged container in this sense because the privileged container can be started with a fixed policy that you know is going to run. So you can mitigate some of the damage by having a privileged container which has more control to effectively screw up your own system. Additionally, you know, requirements can change for namespaces and our implementation should be conscious of that. So examples of that include, like, you know, we might have a VM host node in the cloud is responsible for only spinning up a VM and it's, you know, has this trust based access control that says, hey, I'm not allowed to execute anything that I don't trust based on this code integrity claim. It's locked down by default, you know, there's no debugging tools, but when something goes wrong, someone needs to be able to log in and diagnose what's going on. As soon as that happens, they need debugging tool access unless, you know, you have logs a million miles long and S trace on every synthesis, you need to figure out what's going on that way. So this poor soul needs to log in and get access to debugging tools and it needs to expand. When you log in that integrity policy, that trust policy needs to expand to now include the number of debugging tools available for the diagnostic purposes. And then when they leave that node, it will restore the old integrity requirements. Additionally, container host, which is the example that we've been working with, so I'm gonna breeze through this, you know, host's integrity verify, the containers need to run, which may or may not be. So we can remove the integrity requirements in the container or we can alter them in the case of privileged containers where you can lock it down even further.   And when you log into a laptop computer, you know, you have all, especially at schools, it's completely restricted, you can't run any games or anything. So, you know, this application control is, you know, 99% of students have the same level of application control in trust-based execution as before. However, when you're a computer science student, you do need a lot of things. You need a compiler, you need an IDE, you need to run your own code. So how do you do this? When I was in high school, they gave me a whole separate account, which was a very heavyweight solution, a whole separate computer. Instead, why don't we just make it so that you can create a different kind of execution context when you log in so that these customer, these students can basically execute exactly what they need to do, which aren't typically signed. So it creates this kind of system where we have different integrity requirements. In general, IDE takes the approach for all these, requirements can change by making the policy, being the driving force to enforce the requirements. So things like the policy can say is, you know, require policy to be active, always require everything to be enforced, no more permissive switching for you, and prevent additional namespaces from being created. The next big topic of IPs, you know, namespace properties is a little bit of isolation. So when you do say the word namespaces and as I've said, namespaces is probably a bad name for this particular feature, it implies isolation from other parts of the system. And implicit hierarchy, you know, everything belongs to a namespace implicitly and higher in the tree of this hierarchy can see lower in the tree and will have more power over it, so to speak. So in a general isolated system, you might have something that looks like this where, you know, you have namespaces with various different policies, very different applications, nesting and so on and so forth. So this, originally when we designed this, we wanted, you know, namespaces to be always able to create a bond basically between a root namespace and a lower namespace and have the policy and the root namespace effect continuously over time, all of its children. So this created actually an issue which is why we abandoned it with this dependency graph of between these higher level namespaces and lower level namespaces. There's a lot of edge cases regarding when a process dies in the middle, you know, your integrity requirements now suddenly change, what happens? So instead, we just kind of abandoned that issue entirely and said, hey, when you create a policy, when you create a namespace, we provision the initial state and just leave it alone. They are now effectively completely isolated in separate instances for our purposes, only used for permission checking. So additionally, there's this interfaces. So in our example, we say, for our interfaces, we said they're exposed through security FS. Security FS has one instance across the entire kernel when you mount security FS in a new place, it brings the whole tree with you. So everyone can see every security FS node. So in the case of privilege containers, you can see now every single node that you want. So we're just gonna assume that all forms of namespaces or anything that's using our IP namespaces can mount security FS and see everything that they care about. And then we need to assume, since that is true, everyone can see the namespaces. So if we have a multi-tenant device, something that has multiple users, so for example, the US military or the US government and the Chinese government, if that ever were to be an actual thing or Home Depot, Microsoft, Google, whatever, they're all running on the same host, we need to make sure that they keep their separate from everyone else, because obviously you don't want another company to be able to view, another entity to view into another entity's container, especially if that is part of a targeted attack wherever you can. So for that reason, there's two things. You can name the namespaces however you want. You just have to be aware that when you identify a namespace, there is going to be portions that leak. So if you name all your containers based off what tenants using them, you're implicitly leaking some information there. So we've created this kind of purpose, that this division between identity and purpose in IPs policies or IPs namespaces. We have the ID, which is something that you expose to everybody. Everybody knows who your ID is and it can be whatever you want. And then we have a name on the inside of our namespace listing, which is more metadata like who am I, what am my purpose. This doesn't provide any security benefit. The real security benefit of protecting these interfaces is handled through a permission handler in the directory and saying, hey, back to that first concept up with the hierarchy. Only if you belong to a higher namespace than me in my tree, can you view my information. So in our multi-tenant example, the root namespace, the owner of the container can see all into the Microsoft, Google, Amazon, whatever containers. And the Microsoft, Google, Amazon containers can't see into each other because they're not higher than them in the tree. So we divide these two concepts so that we can associate metadata and private data with these other namespaces, but still have a way to identify the containers as a unique primary key. This results in only the attacker knows how many namespaces there are in the box if you use anonymized IDs. And it may not get that information disclosure attack. You know, so this implementation isn't without its flaws. I will admit, there's some serious issues with management. So in general, when you come to management and namespaces, there's two philosophies, essentialized and decentralized management story. In general, I favor centralized management because if you do a system as a centralized point and updating comes a lot easier and you know, you only have one point of failure to investigate when something goes wrong. However, right now we have this problem. You're essentially trusting the namespaces completely blind that they're not lying what kind of names, what namespace they're in. Because currently there's no, you know, extension to say, hey, based on your process ID or who's contacting me, I can look up in the root namespace, what namespace you belong to. So this is a big flaw that we're looking to solve eventually. In general, you can also get around this with a decentralized namespace, a decentralized management solution. However, that comes with its own issues like updating. You basically have to maintain a separate library for every single thing that wants to manage their own namespaces that involves updating and cascading updates. And it becomes a very complicated process very quickly. So for future work for IP, we wanna be upstream eventually. This is going to be a long and arduous process based on my current postings. The patches are available upstream as of today, October 17th. And I would really, if anybody's interested in reviewing, please feel free to jump on and criticize me, boil me alive, whatever, do the Linux kernel maintainer thing. Next, support for targeting specific signers via policy, which is the next big feature that we're gonna try to tackle. So the key rings kind of have a cross-volutionation issue in our view that basically when you add something to a key ring and validate a signature against said key ring, you can match any key in that key ring whatsoever. So if you have something like a kernel mode signer versus a user mode signer, you have no way of knowing which key it matched or forcing the key to match to a particular set other than creating a whole separate key ring. So we wanna have a way in policy that you say, hey, use our system-trusted key ring. But for current modules, I only wanna see this certificate as the signer. And for the standard execution workflows, I only wanna see this certificate or these configuration files, I wanna see this certificate. So the policy gets to drive a little bit more finer-grain selection of what the certificates are. Additionally, I talked about this a little bit earlier. We wanna support that trusted four-patch set. This is something that we wanna do when we're upstream and not the other way around because it's much better as the system as whole to get upstream so everyone gets the goodness of the implementation. It's tightened and hardened and everyone feels comfortable or at least less bad about the implementation before you start changing around other things in the kernel. So additionally, before the last two examples kind of glossing over a little bit, hardened resistance against rollback attacks. So IP is a policy version. I mentioned this before in my last year's presentation. We don't allow you to rollback to policy version. So preventing that fall rollback to vulnerable policies but the kernel loses all state when you reboot. So the policy version gets reset back to zero giving you a slight window of opportunity to use an insecure policy to potentially compromise the system. We wanna do something about that. We wanna investigate that, figure out how to close that gap. And then the final big thing that's gonna come much, much later is hopefully we would like to figure out how to verify EVPF programs. We've done some initial work in the space to see how feasible it would be with the loader rearranging instructions and all that stuff. But it's somewhere along down the road. And on that note, and on that note, I would like to thank you for your time and I will take any questions at this time.


Hello, I'm Dr. Peter Harrop, Chairman of ID Tech X. Very excited to be on the Korean stand at our busy ID Tech X show here in Berlin. I need to have it explained to me because I've been given a dog and it's glowing and I hope it's not radioactive. I need an explanation. So could you please introduce yourself and tell us all about these many things? Hello, so we are here at this Korean Pavilion. We are from the KTTA. This is the Korea Textile Trade Association and we are having this LED from DLS that's a Korean company that we represent here. DLS is making LED stripes and LED patches, as you can see here. And actually they also make LED stripes with sensors in it so you can use them for snowboarding or riding the bike with sensors that give you the direction of the movement for example. Then we also represent other companies like AlphaClo, which you can see here. They have sports equipment or sports shorts and shirts for example, and they give you information on how effective your training is because the textiles in the shorts themselves give you information on how much your muscles are used. We can see here the jacket is from Blackjack. It's a famous Korean outdoor brand. And Blackjack has made this jacket with heat patches in it. So you can just connect the power bank here and the heat patches are in the pockets and at the back. So the jacket is actually very thin but it's still very warm and without the power bank you can even wash it just like a normal jacket. Nice. Let's walk around here. So what's the market for this one? This one. So we've actually, yeah, DLS as I said, they're making the LED lights, stripes and patches. And this is just for the safety of the dog, actually. Okay, let's walk around. Should we ask some stuff about this? Yes please. You can stand here, stand here. Okay. Okay, so you seem to have an enormous variety of things. What am I looking at here? This is a sitting mat and the sitting mat is actually still a prototype by the company PSSolution from South Korea also. And the sitting mat gives you information on how good, how you are balanced, how good your balance is when you're sitting so it gives you information to for actually for a better health result. Yes, yes, yeah. Without any heavy electronics, not intrusive. Yes, right, right. And why are we looking at shoes? Smart shoes. Smart shoes, right. So they're actually also blinking if I would switch them on. These shoes are made by Decentre, a Korean famous sports brand. And these shoes are smart shoes which should be used in the gym. And in the gym, the trainer can give you with the help of the application that we can use on the phone or on the tablet. It can give you information on how your balance is during your training. So there are sensors and microchips in the shoes themselves. So it gives you information on how your balance is on the toe, on the hip. Awesome, absolutely. Awesome. And the red shoes? The red shoes, they are also from PSSolution. So we have here again two microchips and 12 sensors in it. And they are actually for medical uses. So in Korea, we use them in hospitals. And the doctor or the orthopedist gives you or can give you information after like one minute of walking, how good your balance is again, right? Excellent for people recovering and so on, obviously it is, so on. So if you could lead us through these, this is most intriguing, gloves. Yeah, the gloves, here we have motorcycle gloves. This company is called Yongpung Filtex. They are a South Korean company which also makes very different types of gloves like wear gloves also. And the specialty about these gloves is actually the conductive textile, the conductive fabric that we have over here. So without taking off your glove, you can already use your phone or other touch displays. And also for wear gloves, it's very important because there were many accidents on work sites where the workers had to take off the glove to maybe use the machine or touch the screen. So now they don't have to do that. Excellent. And this looks like a shoe insert. Is that keeping me warm or what? Now this is actually a sole with pressure sensors beneath again. And this is from the same company which is making the sports shorts like Alpha Clothes. So it's medical. Okay, carry on, do tell us. Here we have the company Kwangrim. It's a Korean company which is focused on pressure sensors and conductive yarn. And here, yes, here we can see. So we have this stretchable yarn as you can see here. And yeah, it's a conductive stretchable yarn and they used this, for example, in this sensor. Excellent. And on the screen you can see. Monitoring the stress. Yeah. What is the application that that's likely to have? What's the most promising in the dream? So these kind of yarns are, for example, used in the sports shorts? Sports. Yeah, that could be like one application. And possibly underwear or something, I don't know. Anyway, yes, I see. Very interesting. Thank you. Can we work our way around? I'll be very, very quick. So here we have again. Body temperature now. Okay, good, right? Yeah, so here we have, again, the conductive yarn that we also had before, but here we have different colors and they have different materials and they're for the colors and for the conductivity. There? And this is to show you, again, the pressure sensor. We had the pressure sensor before with the conductive stretchable yarn and this is just to show you the principle of the pressure sensor itself. And this, I'm not able to demonstrate at this point, but can you describe it? Yeah, so there's a sensor, this is a snowboard goggle and the principle is that you have a sensor here at the side and the sensor can give you the information on when you're snowboarding, you're all moving to the left or to the right and the sensor can give the information on to which direction the person is moving and then the blinks are blinking into that direction, just like with the car. Yeah, yeah, yeah, yeah, yeah, yeah, absolutely. Oh, excellent, love it. You don't have to do anything. Yeah, yeah, yeah, yeah. Oh, come on, man. So is that complete now? Oh, wait a minute, we have some more mannequins. What are we seeing here? So here we have the sparkle for women. The specialty about this is this electric little device. This is actually for women, very important. It's like a warning or alarm signal, alarm device. So does it give location? Yes, right, it gives location fire. Oh, that's really critical. Yeah. Oh, that's very important for elderly people as well, isn't it? Yeah, it is. Some people without timers may get lost in a town and they just have to, they don't know how to get back. Yes, right. Others may have fallen over or need to signal. They don't know where they are and other people don't know how to contact their family. Oh, that is superb, that's marvelous. And on this model here. This one is a sports shirt again. It's a one layer heating shirt. So the specialty about this is that it's really one layer. It's not very thick. But it's still a very, yeah, it's a functional sports shirt and here we have the battery, which is giving off the energy for the heat patches, which we have at the front and at the back. It needs quite a substantial battery, it's quite a lot of energy, isn't it? But that won't, even that battery won't last for long, will it? It will last long, but you can also. How long? Just take it off. Yeah, how long will it work for? I think about, oh, I'm not really sure. No. But it's more than enough for like one sports session. Oh, right, so it might be for an hour or something. Even more, even more than an hour. Right, okay, good. Well, that's wonderful, thank you so much. Yeah. And it's a really exciting tour. Thank you for your interest. Very grateful. Thank you for coming. Yeah, thank you very much. We'll spread the message. Bye for now. Thank you.