Ice cores drilled from glaciers and ice sheets are like a window into the past. Every year a new layer of frozen snow traps pollen, microbes, volcanic dust, among many other things. Even air bubbles act as a snapshot of the atmosphere that year. Scientists can use this data in combination with archeological and written records to understand rare but highly significant events in history, sometimes called black swan events. In the mid-1300s, for example, there was less lead in the atmosphere. Scientists think that's due to the sharp drop in mining and smelting during the black death plague in Europe and Asia. Ice cores in the Peruvian Andes and the Himalayas showed signs of an 18th century drought that spanned the globe. Today the world's ice is melting at an accelerating rate and some glaciers will soon completely disappear. Scientists like Lonnie Thompson and Ellen Mosley Thompson at The Ohio State University have been working to store ice cores from around the world to preserve the ice core record for future scientists.


This video will introduce you to the word Ideology and explain where it came from and how it was appropriated by Karl Marx and Friedrich Engels in the mid 19th century The information cited here is resourced from Andrew Haywood's book Political Ideologies and Introduction Haywood begins by pointing out that the word ideology was coined during the French Revolution by Antoine de Stout de Tassie and was first used in public in 1796 For de Tassie, ideology referred to a new science of ideas, literally an idea-ology However, this was just the term's humble beginnings because later it would be inserted into new contexts for new ways to think about class structure and systems of beliefs Actually, Haywood describes ideology as a word that has a long career This career really took off as a key political term stemming from the use made of it in the writings of Karl Marx Marx's use of the term and the interest shown in it by later generations of Marxist thinkers says Haywood Largely explains the prominence ideology enjoys in modern social and political thought Haywood continues Marx used the term in the title of his early work, The German Ideology written with his lifelong collaborator, Friedrich Engels This also contains Marx's clearest description of his view of ideology The ideas of the ruling class are in every epoch, the ruling ideas i.e. the class which is the ruling material force of society is at the same time the ruling intellectual force The class which has the means of material production at its disposal has control at the same time over the means of mental production So that thereby, generally speaking, the ideas of those who lack the means of mental production are subject to it So in Marx's view, what is ideology describing? Well, according to Haywood First, ideology is about delusion and mystification It perpetrates a false or mistaken view of the world, what Engels later referred to as false consciousness Marx used ideology as a critical concept whose purpose is to unmask a process of systematic mystification, writes Haywood He goes on to write that second, ideology is linked to the class system Marx believed that the distortion implicit in ideology stems from the fact that it reflects the interests and Perspective on society of the ruling class The ruling class is unwilling to recognize itself as an oppressor and equally is anxious to reconcile the oppressed to their oppression Haywood continues on to explain that in the third sense, ideology is a manifestation of power In concealing the contradictions upon which capitalism, in common with all class societies, is based Ideology serves to disguise from the exploited proletariat the fact of its own exploitation Thereby upholding a system of unequal class power After Marx, the term ideology continued to be built upon by many others, one of which was Antonio Gramski Gramski argued that the capitalist class domination system is upheld not simply by unequal economic and political power But by what he called hegemony Hegemony means leadership or domination Gramski highlighted the degree to which ideology is embedded at every level in society In its art and literature, in its education system and mass media, in everyday language and in popular culture As Haywood continues on to write, ideologies are embraced less because they stand up to scrutiny and logical analysis And more because they help individuals groups and societies to make sense of the world in which they live As Andrew Vincent put it, we examine ideology as fellow travelers, not as neutral observers So that's a few minutes for an introduction to the term ideology


I'm Christine Deschler, I'm chair of the Allington Finance Committee, and I hereby convene the April 24, 2023 meeting of the Allington Finance Committee. This is a hybrid meeting, so let me go through the procedures to make sure that everyone can hear and participate, should participate. First I'll do a roll call and for members and staff, when I call your name please respond in the affirmative, starting with Jordan, Shane, and you're remote, Jennifer, Sophie, Brian, Marilyn, here, and remote, Rebecca, here, Josh, Grant, Charlie, here, John, Daryl, here, Annie, here, Al Jones, Tofer, Peggy, here, Al Tosti, Dean Karman, and Josh LaBelle, here, let me do the script real quick. On March 29, 2023, Governor Philly signed into law a supplemental budget bill which, among other things, extends the temporary provisions of the open meeting law to March 31, 2025. Specifically, this further extension allows public bodies to continue holding meetings remotely without a form of the body physically present at a meeting location so long as adequate alternative access to the deliberations that the meeting is provided to the public. Added an adequate alternative access to Zoom video conferencing this evening tonight. Ensuring public access does not ensure public comment or public participation. This meeting will not feature public comment, those wishing to provide comments may be disturbed by feeling. Our executive secretary, Tara Bradley at tbrallyatown.onit.ma.us. Please note that this meeting is being recorded accordingly. Be aware that others may be able to see you and take care not to screen share your computer for those who are attending remotely. Anything that you broadcast may be captured by the recording. All supporting materials have been provided members of this body or available on the town's website. Unless otherwise noted the public is encouraged to follow along using the posted agenda unless the chair notes otherwise. The share will introduce each speaker and then we'll recognize members wishing to provide any comment questions or motions please hold until your name is called remember to mute your phone or computer when you are not speaking. Remember to speak clearly one way that helps generate accurate minutes and all votes taken in this meeting will be by roll call. And I also want to confirm that our executive secretary Tara is in attendance here and so he joined as well. And she is participating remotely. Can you hear us Sophie. Yes. Okay. All right. This will be a quick meeting because we really don't have much to cover we don't have minutes ready from our last meeting. We'll probably hopefully get to them on Wednesday night. I hope everyone has a copy of the finance committee report. And there are two mistakes that happened. Excuse me I'll set those three. One is article 47, 47 to vote on paragraph 10 indemnification of the cost is not 12,035 it's 10,000. I'm sure 10,000. 8802. We have the right number in appendix C. That is one and that's really the only substantive the other one is. Yes. This is on a consent agenda. Yeah, so you need to correct that. And then the other one is article 43. The vote is correct on article 43. It's just that when we were typing wording. And we changed it. We pasted article 42, which is soars and sewer facilities. And we pasted that into article 43 and didn't change. Water. Mains and water facilities. But the voting is correct. Just those two words. Yeah. So it should be sewer mains and sewer facilities. It should be on article 43. It should be water mains and water facilities. It should be water mains and water facilities. That's what it is. In the article language, not the. The vote is correct. It's that just. The article. So this should be. Oh, there it is. Water. Okay, so the, the motion is correct. Yes. Just in case someone asks or points it out. That's correct. That's, that's a no consequences to both that's. Townsend's vote that. Um, Annie have we confirmed minute by minute man would be ready to present. Last year they contacted the moderator directly. I will check. Um, I think Sandy was talking about. Yeah. Eight or something. Six or eight, but can you confirm that? Yep. All right. And the composting people. Are we expecting to have. Something to tell me. Yes. At this point it's. On them. Ready. For. And they were supposed to be in touch with. I can check with Dean or Jennifer. Or Carolyn about. They were the last people to email. About whether the kids know like sort of approximately under art. We can probably send a prediction. That's okay. Jennifer Carolyn. Do you know anything more about the composting people? I haven't reconnected to them. I know. I know it says it's fairly late in the agenda. I don't know. Yeah. I'm sorry. Just follow up with them and let them know how this goes. Yeah. And when they need to be ready. No. All right. So we will meet Wednesday here. I don't know if that other than the men's, but we'll see. And at some point when we're meeting. Sort of, I want to spend some time at one of our meetings before Tom. Tom meeting to follow up on the various ideas that we've had. This season that we want to follow up on. Like. Moving the council on aging out of an enterprise fund. I think there were some. Some other issues. That came up that people said, well, maybe we need to follow up on this. So I like to have an opportunity to discuss those things and see if we can. It volunteers to, to do some, some of the work. Prioritize to see what people want to concentrate on. So give that some thought and talk about it. And then other than that. I don't have anything else as anyone. I just have a good question. That's okay. So I believe the clarification came out that we do not burn. The yard waste. And that is indeed composted. Indeed. That was my part. He actually. He didn't confirm the place. I don't know. I don't know. I don't know. But when I sent him that direct question, he answered it directly. So. Yeah. And one of the things I know. I haven't talking about is. Better reporting so that the information that we get from the town manager is a little bit.  But that goes on for that. But we'll see what we can do about that. But I feel like that should be a. And I think Carolyn, you were talking about some water buys issues. That you want to follow up on and. And I know. Sophie, the disability commission continues to be. Something to talk about. So those are things that. And I think there are others if I go through my notes. So we can have a discussion about. Those things. Does anyone have anything else. Motion to return. So moved. Second. All in favor. All right. Thank you everyone.


Hi, I'm Zor. Welcome to a new Zor education. Today, we will solve a few problems on kinematics. Basically, we have talked probably about everything we wanted to, as far as the kinematics is concerned. So it's time to solve some problems before taking an exam, right? Okay, so the problems on kinematics are part of the course called Physics for Teens. It's presented on Unizor.com. That's the website. The website is free, has no advertisement. So I suggest you to watch this lecture from this website, because, first of all, these are problem solvers, right? So you can actually take a look at the problems themselves first, and they are on the website as notes for the lecture. And try to solve these problems yourself. These are very, very easy problems, and there are answers provided, so you can check your solution. And, again, besides, I was talking about exams. The website has exams for every topic, or will have exams for every topic. So I do suggest you to go to the website for this and every other lecture. Now, the problems. Well, first of all, we are talking about physics, about the movement, etc. So we are dealing with certain units of measurements. And I will prefer, in most cases, I will actually do it, to use system international units, like meter for the length or distance, second for the time, and all the derived units. In time, we don't really have any discrepancy. Everybody is using seconds and minutes and hours. And as far as the distance is concerned, yes, you can use meters, or you can use kilometers, millimeters, whatever the derivative from the meter is. Most likely, I will not use non-standard units, like miles, or inches, or anything like that. All right, so my first problem is, let's assume we have a certain object, and it moves according to certain coordinate functions. X of t is equal to t square, and y of t is equal to zero, and z of t is equal to zero. Now, what does it mean? Well, it means that in this Cartesian system of coordinates, we are talking about movement only within this x-axis. So, it's a straight line movement. Now, this is the way how my distance from zero is changing with the time. Well, obviously, time is equal to zero. I'm here. And then I can actually put my position on this line at every moment in time, substituting the time into this formula. Now, here is what the question is. Let's assume we have a completely different system of coordinates. Now, its origin is at point five, and the axes are parallel and similarly directed to the old system. So, y one is parallel to y, z one is parallel to z, but the origin is at new point, which is five zero zero. Five along the x-axis, and zero and zero along y and z. So, my question is, in this new system of coordinates, how will my motion be described using the functions, basically? So, I need x one of t is equal, y one of t is equal, and z one of t, which is equal. But for y and z, it's obviously zero, because we are still moving within the same x-axis, or x one, actually, axis. So, there is no change in y and z. y one is equal to zero for all t's, and z one is equal to zero for all time. How is x one? Now, since my coordinate system is shifted by five to the right, every point which used to have coordinate x, now will have a coordinate which is shorter by five, right? So, this was x, now this is x first, right, if this is the position. So, my x one will always be five shorter than x, which means this is t square minus five. My old coordinate, which was t square minus five. By the way, at time t equals to zero, my point, my object positions here, right? And this is exactly minus five along the x one coordinate, right? Because it's to the left of the new origin of coordinates. So, this is the transformation, basically, of coordinates. If I shift by five, my system of coordinates, well, parallel to itself along the x axis, then my new coordinate x one in the new system will be shifted by five with a minus sign. That's my first problem. By the way, I do recommend you first, before you listen to all these solutions which I'm suggesting, do try to do it yourself. I mean, in the website, there are all these problems listed with answers, so you can check yourself. That's a very useful exercise. Next, next I have the movement within the z axis. I'm pulling down from point zero, zero, twenty-five, so this is twenty-five. The coordinates are zero and zero on x and y, which means I'm on the z axis itself, and the z coordinate is twenty-five. So I'm falling down from the height of twenty-five. Now this is the ground level. Now my equations are obviously x and y are always equal to zero, but my height is changing as twenty-five minus t squared divided by four. So t is equal to zero, I am at twenty-five. And then I'm falling down using this particular formula. Now my question is, what is the time until I reach the point zero, zero, zero? So what's the time of falling? Well, obviously this thing is diminishing from twenty-five at t is equal to zero to zero at some point. So to find out the time I have to solve this equation, whenever my height is equal to zero, my time t would be equal to exactly the time of falling. So the solution of this is twenty-five is equal to t square four, t square is one hundred, t is equal to square root of one hundred, which is ten. So my answer is the falling time is ten. Let's say seconds for instance, if everything is in seconds and meters, then this is seconds. Okay, now my next problem is very similar. Now I am asking what is the speed at the moment of falling to the ground. Because the speed is obviously increasing as we are moving down. And what is the speed? Well, the velocity vector obviously is the derivatives of this. Now derivative of x is equal to zero and this is exactly the same as y because we are not actually moving in these directions. Now derivative of z, so it's a z component of my velocity is equal to, this is the constant, this is the minus from t square is two t divided, okay, so it's minus t over two. So this is my velocity vector and we are interested actually only in the z component. So my velocity, first of all, it's with sine minus y because we are moving the opposite direction to the direction of the z axis obviously. And again at point zero we are at rest, so velocity is equal to zero and then as the time is increasing the velocity is also increasing by absolute value being negative. Now so what is the velocity at the time when I fall down? Well, all I need to know is t, but I have already calculated t in my previous problem. So obviously my velocity is z of ten is equal to minus five. In this case the unit of measurement will be meters per second if my original is meters and time is in seconds then this is meters per second. So at the moment of hitting the ground the object moves with the speed minus five meters per second. And again minus because I'm moving opposite to the direction of the z axis. Velocity is a vector so it's very important which direction we are moving. All right, fine, next. Now before we were talking about one-dimensional movement along some axis, along the x axis or down along z axis. Now in this problem I will have a two-dimensional movement. So let's consider this is my z, this is my x, this is my y and direction now y would always be equal to zero y of t. Now in this particular case what I'm doing is I'm shooting the projectile within this plane x z plane. So that's why y is always equal to zero. So I'm shooting the projectile and obviously it moves like this. So the gravity pulls down the object but I'm shooting at certain angle to horizon so it moves a little bit up first and then the gravity actually pulls it down. Now what I see is that horizontally my object always moves with uniform motion. And uniform in this case is 2t. Now that's uniform because the velocity along my x axis which is the first derivative is equal to 2, it's a constant that's why it's a uniform motion. At every interval, in two equal intervals I will cover two equal distances, right, with this constant speed along the x axis. Now as far as the z is concerned, z is my movement which is basically caused by the gravity. So first it moves a little bit up and then the gravity pulls it down. So my z function is given as 10t minus t square. So my question is what is this distance, how far my object will fly in the air, right? So I'm not talking about forces of gravity or inertia or anything else. No forces are involved. The kinematics is studying only the movement. So movement is given. That's it. I'm not talking about y and half. Movement is given. So all I need to know is how far it will go. Alright, how can I address that particular problem? Well let's just think about it this way. What is the characteristic of this particular point? Well at this point my z-coordinate is equal to zero, right? It's a ground level as well as in this particular point. So this is the parabola because it's t square, right? Minus and that's why it's directed with its horns down, right? So all I have to know actually is what are the moments of time when this particular z function is equal to zero. The one I know already is t equals to zero. What is the second one? Well again, the same problem was before. All I have to do is solve this equation. Now this is obviously ten minus t times ten times t is equal to zero. This is one solution t is equal to zero and t is equal to ten is another solution. So this is t is equal to ten. So I have the time moment when I reach. Now what happens during this time as far as the x-coordinate is? Well it moves with this particular function, with this particular formula, right? So I know the time. So what is my location, my position along the x-axis at this particular time? It's equal to two times ten, which is twenty. So it goes for twenty meters in this particular case. If everything else is meters and seconds and whatever, all right? So first we get the time of the motion until it hits the ground using z of t is equal to zero equation. And the t substituted into x and that's my distance, okay, next. Now this is a horizontal movement along the x-axis so I will only put an x-axis. Now I have an AB, let's say this is zero. Now and this is 720 kilometers, kilometer is one thousand meters, right? So what I know is that half of this distance I was traveling 60 kilometers per hour. And another half of this distance I was going with 90 kilometers per hour. So my question is what's the average speed during my trip? Well let's just recall what is the average speed. Average speed is total distance divided by total time. So all we need to do is to find the total time because the distance we know, 720. So how can we calculate the total time? Well, the total time contains actually two halves, so to speak, not halves in time but halves in distance. So half of the distance, which is 360, half of this kilometers, I was driving with the speed 60 kilometers per hour, right? So my distance, as you remember, if this is a uniform motion, now the distance is related to speed with this formula, right? So speed is constant and this is the only function which gives me the constant speed as a derivative, right? The derivative of this, well, probably I should say x of t is equal to v times t. So the derivative of my position is the speed v. Now if I have the distance and I have the speed, how can I calculate the time? So 360 is equal to 60 times t. So t is equal to 6 hours, right? Kilometers, this is kilometers divided by hour per hour, so this is hours. So we've got the first half. Now the second half, analogously, I have 360 again because this is another half of this distance. Now it's equal to 90 times t. So what the t is? Now let's say this is the t1 and this is t2. So t1 and t2 is equal to 360 divided by 90, which is 4 hours. So my total time is 10 hours. So I have the total time and I have a total distance, which means if I divide one by another I will have an average speed, right? So it's 720 divided by 10, 72. Now what's interesting is this is 72 is not a arithmetic average between these two speeds. That's very important. The average is, sum is 150 divided by 2 is 75. So the average between these two numbers is 75, but that's different. So you have to really think about it. If you divide distance in half and then you have two different speeds, the average speed is not the average between these two numbers, these two speeds. Average speed is the total distance divided by total time. So you have to calculate separately time and time and they are obviously different because there is a different speed with the same distance 360 here, 360 here. But speed is different, so the time is different. And that's why you don't have exact equality between the arithmetic average between these two numbers and the real average speed on the entire trip. Now my next problem is kind of similar, but in this case instead of dividing the distance in two halves. I'm dividing the time. So my trip from A to B took 10 hours. Now my first hour I'm accelerating and my average speed is 60 kilometers per hour. And there at the very end I'm decelerating, I'm slowing down and my average speed is also 60 kilometers per hour. Now this is one hour and this is one hour. So I'm accelerating and one hour decelerating at the end. Now in between eight hours, total is 10, right? So one here, one here and eight in between. In between my average speed is 90 kilometers per hour. Now my question again is, what is my average speed? Well, let's think about here again. Average speed for an entire trip is the entire distance divided by entire time. Time we know, 10 hours. So what's my total distance? Well, I don't know the total distance, I have to calculate it. It contains three independent pieces. Now one piece, I know that within one hour, 60 kilometers per hour, I was driving during one hour. So what's the distance which I have covered? Now this is average speed which means it's distance divided by time. So basically this is 60 kilometers. Now the next piece is 90 kilometers per hour times eight hours, that gives me 720 kilometers. And decelerating, again, average speed was 60 for one hour, so I have covered 60 kilometers. So what's my total distance? 12840 kilometers in 10 hours. So my average speed is 84 kilometers per hour. Well, that's it for today. These are six different very, very easy problems which do not require anything except the concept of distance, time, average speed, which is distance divided by time. And in some cases I was using derivative to find instantaneous speed. But that's only in those cases where it was given the formula for the movement, like x of t is equal to t squared divided by whatever. So that's it for today. Thank you very much and good luck.


In our previous videos we learned about gene cloning, we saw how a gene of interest gets inside of a vector and through transformation gets inside of a host cell, where all this takes place inside a test tube and by the end of the process we expect that in the test tube we will get cells of this three possible genetic makeup. So we will have cells that has the recombinant DNA, we will also have cells that has the empty plasmid and we will also have cells that has not taken up anything at all. Now we do not want these two types of cells to grow any further because we are interested in the gene that we care about and that is present in this first type of cell that has the recombinant DNA. Now the question is how do we select this type of cells from millions and billions of cells that are present in the test tube? Well there comes the saviour that is selectable, selectable marker, well this selectable marker are genes in the plasmid and in this video we will see how they help us to isolate the type of cells we want. Now before we even jump into the process of selecting the type of cells we want we need to let the bacterial cells grow in a petri dish. We will have to pour a little bit of content from the test tube into a petri dish having nutrient medium and what will happen after that?  Now these bacterial colonies are formed by division of bacterial cells and millions of bacterial cells pile one above the other to give the appearance of this circular patches you see here. Now for the ease of understanding let's say we just have five colonies. Now the interesting thing about bacterial colonies is that every single cell in a colony is an identical copy of each other, it is an exact replica of one another. As a bacterial cells do not undergo sexual reproduction there is no variation and therefore every single cell in a colony will be the same. Let's say if we extract one cell from this colony and it has only an empty plasmid inside of it that means every single cell of that colony will have only the empty plasmid. Well having said that let us assume let's just consider that the recombinant DNA is present in cells of this particular colony. Say let me number them let's say this is colony one, two, three, four and five. So the first and second colony has cells with recombinant DNA so let me number these cells as well and let's say the third and fourth colony has cells which is just the empty plasmid. So third and fourth colony has this type of cells and the fifth colony has cells that has nothing inside of it. Let's say this is the type of cell present in the fifth colony. Well now our goal should be to extract the first and the second colony but how would we know that in a lab? How would we differentiate? Well what about we find out a way to stop the growth of the other three colonies the third, fourth and fifth one or maybe how about find a way to just kill them? Well we know about a chemical substance that kills or stops the growth of bacterial cells and that is antibiotics. How about we go ahead and put some antibiotics into the medium? Well wait won't that kill the first and the second colonies as well because those are bacterial colonies too and we do not want those colonies to die because it has the recombinant DNA. So what should we do next? How about while designing the plasmid we put in a gene that would give resistance to antibiotic. To be specific let's say the antibiotic we are using here is ampicillin a fancy name given to an antibiotic. Well how about while designing the vector we put in an ampicillin resistance gene inside of it. That way when when we pour in ampicillin in the medium any cell that has the vector inside of it will be able to grow but cells that has not taken up the vector will not be able to grow in the medium so that way we can get rid of this type of cell the cell that has not taken up the vector which means that we can get rid of this fifth colony but wait the problem is not solved yet we still have colonies with two different type of cells and if you can see both these cells has the vector inside of it and as we have inserted the ampicillin resistance gene they have the ampicillin resistance gene inside those vectors so put this vector has the ampicillin resistance gene inside of it and now the question is how do we differentiate between the two because both the cells have the vector inside of it and making any further change in the vector would create the change in both the cells this is when scientists came up with an idea of inserting another antibiotic resistance gene into the vector say the antibiotic resistance gene here is for tetracycline cycline this is another fensiname for another antibiotic and this is this gene here is resistant to the tetracycline antibiotic but now you may think how is that even helping us both our cells now are resistant to another antibiotic which is tetracycline but how is that even helping us differentiate between the two well here comes the master stroke of the scientist what they did they inserted the multiple cloning sites inside this tetracycline resistance gene now if you can recall from our previous video we discussed about multiple cloning sites those were sites in which we put in the gene of interest now when the multiple cloning side is situated inside of another gene here it is the tetracycline resistance gene it inactivates the gene that was previously there well to tell you in simple words that is similar to inserting a new word inside another word for example if we take the word tetracycline and we divide it into two and we insert a new word say insulin here now the word that was previously there loses its meaning I mean Tet and racycline individually makes no sense right similarly when we insert a new gene inside of another gene the gene that was previously there becomes inactive and that inactivation was caused by the insertion of new gene right so we call it insertion inactivation and this insertion in activation will take place in any cell that has the insert inside of it which means the tetracycline resistance are here stands for resistance so the resistance power of tetracycline will be lost by any plasmid that has the gene of interest inserted inside of it so the recombinant cell that has the insert inside of it will not have tetracycline resistance now can you think what might happen if we allow both these cells to grow in the presence of tetracycline can you pause for a while and think about it now in the presence of tetracycline any cell that do not have the resistance power would die now as we have inactivated the resistance power in the recombinant DNA the cells having the recombinant gene would die which means the first and the second colony will die or we may say they would stop growing but we do even want them to stop growing because at these where the two colonies we ultimately focused on extracting of this patriarch right these colonies had the recombinant DNA but now what we have done is stop the growth of this recombinant cells well you need not freak out because we take care of it in the lab let me show you how it is done so what happens is we keep this plate untouched we keep it as a master plate let me write it down this is a master plate just like we make photocopies of important documents we create replica plates now you need not worry about how do we create them because that's not very important what's important is in both this petri dishes along with nutrient medium we now have antibiotics in here in the first petri dish we have ampicillin and in the second petri dish we have tetra cycle now how about you pause for a while and think about the fate of these colonies in both the petri dish all right let's start with the fifth colony the colony that has not taken up the vector since it has got no vector it has no gene for ampicillin resistance and no gene for tetra cycle in resistance therefore it won't grow in both the petri dishes so the fifth colony won't grow in both the petri dishes all right what about the third and the fourth colony this colonies have cells with empty plasmid that means it has an ampicillin resistance gene intact that means it would grow in the presence of ampicillin and it has an intake tetra cycle in resistance gene which means it will be able to grow in the presence of tetra cycle all right what about the first and the second colony the cells that has the recombinant DNA inside of it what will it do in the presence of ampicillin since it has an ampicillin resistance gene intact inside of it it will be able to grow in the presence of ampicillin but then due to insertional inactivation we have inactivated the tetra cyclin resistance gene right therefore it won't grow in the presence of tetra cyclin all right while working in a lab we will not have the information of which cells are present in which of these colonies let me get rid of these numbers first okay so the only information we will have is what vectors we are using what genes are present in our vector and where is the multiple cloning side where the insertional inactivation would occur well just with those information we need to tell which of these colonies has the recombinant DNA just by looking at these two petro dishes all right let's try to do that when we look at the first petro dish we'll see that the first second third and fourth colony are growing fine so that means it has resistance to ampicillin and that is possible only if they have taken in the vector but the fifth colony is not growing in the presence of ampicillin that means they have cells that did not ingest the vector all right now let's look at the second petro dish in here the fifth colony is not growing that means it has not taken in the vector no resistance against tetra cyclin as well now the third and the fourth colony seems to be doing just fine even here it has a tetra cyclin resistance gene intact but the difference is in the first and the second colony it's growing in the presence of ampicillin but not growing in the presence of tetra cyclin mm-hmm interesting right so what must have happened the insertional inactivation must have happened that has inactivated the tetra cyclin resistance gene this also means that it has the gene of interest inside of it so these are the two colonies that we would want to extract now that we know the first and the second colony has the cells with recombinant DNA inside of it we can go ahead and extract those colonies from the master plate and carry on the experiment with it all right now if you look back and see what actually helped you to select the first and second colonies it was actually the antibiotic resistance gene in the vector the ampicillin resistance gene and the tetra cyclin resistance gene so we call this genes as selectable markers all right this was all about antibiotic acting as selectable markers and now after watching this video you should now be able to tell what is a selectable marker how antibiotic resistance gene act as selectable markers and what is insertional inactivation now if you're not able to answer any of these you can always go back and watch the video


Hello, my name is Michael Llewellyn, and this is a talk on Ethereum hacks and how to stop them with opens up with this is a re recording of my talk for dev con 29. And I hope all of you watching this virtually will enjoy it just as much as the people that did in person. So without further ado, I'll go ahead and get started. So, the agenda that we're going to go through is going to be about a 60 minute talk probably a little less since we won't have q amp a. Since this is a virtual talk, the introduction will be going over my story and blockchain how I got here. A little bit about open zeppelin which is the company I work for and a lot of tools will cover will be open zeppelin based. Some of the Ethereum security case studies that we're going to go over are going to talk about Ethereum hacks that we've seen in the space. Some of them old some of them new reflect on the what these incidents made possible what we learned what the community ended up coming to agreement on and then explain how we now can prevent these incidents using tools with open zeppelin. So without further ado, let's get into it. So first of all, my story and blockchain started out in mining. I was actually in school when I first learned about Bitcoin. So I started mining on school computers made a little extra money, got very interested in it at that point because I suddenly learned how to print money with the computer so naturally I got very curious went down the rabbit hole of crypto economics and technology and everything I was just fascinating about the space. And once I started getting into it I started to actually go to local meetups here in Dallas, Texas, and began consulting professionally as soon as I started to meet people that wanted to learn more or needed help setting up minors or doing security on their wallets that was the sort of thing that I ended up providing as a service. So we, once that happened, you know I did some traveling you can see me here at the Bitcoin Center in New York City before I got the beard, and then basically in the blockchain space ever since. So over time, I started to learn more about other applications for blockchain beyond just the money in Bitcoin. I still very much love Bitcoin but I also saw the need for things like smart contracts and Ethereum ended up coming out around the same time that I was studying for my computer science degree. So as I was learning computer science also started to learn how to program smart contracts on Ethereum, and then started to do that professionally as well as a developer so I did some startup work, worked on some ICOs as well as some startups doing supply chain here in Dallas. And then eventually started to also do some corporate consulting so I worked at Thompson Reuters doing tax accounting. Did some supply chain at Toyota using an Ethereum blockchain and then also did some consulting at Verizon on some high culture fabric instances so got got around a lot did a lot of work in the blockchain space both startup and corporate. So during that whole time I was using opens up on contracts so this is a library will talk about more detail but as I learned more about it. In the last year I actually ended up applying to work at opens up one. After doing a lot of consulting I wanted to work at a single company and opens up and luckily accepted so I joined the team this year as a project manager for their security services team. And you can see a picture of us there at a retreat in Mexico recently and we all get to meet in person for the first time, or at least I did. And then so in addition to opens up one I've also been working in the space as a lecture at UT Dallas teaching a blockchain course and then I've also been doing some public policy work with Texas Blockchain Council trying to basically help the Texas government make blockchain technology easier to use and you know clear up regulatory technologies and things like that we've passed some laws and in the recent months, got some good traction going and hopefully that will continue. But we're going to talk about security so without further ado, let's talk about open zeppelin and the work we've been doing. You can see we've worked with a lot of companies in the space we've done around for years, working coin based compound of a continue have a lot of relationship with these customers either using our products or auditing services. I think we're very well known in the space and this is going to be a talk that gets more detail on like, you know, how our products and services are really reflected in the systems. The hacks that have occurred in the ways that we've addressed them. So without further ado, let's get to the actual tech the hacks the reason that people come to deaf con to learn more about what are these vulnerabilities and how can you protect against them. So the Dow hack is the first big outs the first real instance where we learned that security on smart contracts is not going to be easy. And in fact it can be quite destructive if not done well. So, many people know about the Dow but for those who might be new to the opinion space. The Dow was an early set of smart contracts built for crown funding a theory and development projects. For those who might not know even about Ethereum smart contracts. These are essentially pieces of code that reside on the Ethereum blockchain and Bitcoin, you know, people move money around using private keys you have a public key that kind of corresponds to your wall address and you have a private key that you alone control that lets you send money back and forth. So, these contracts actually let you do that with code so instead of there being a private key that controls funds. There's actually a bit of code that determines how those funds are going to be handled so you still have a public key you have a public address that corresponds to a smart contract, but the code will actually determine how funds that are received are handled and then potentially send elsewhere. So, you can use these smart contracts to do things like escrow, or even manage a large amount of money for a kind of decentralized organization so the Dow stands for decentralized autonomous organization and its purpose was to be kind of a venture capital suite of smart contracts that helped fund development projects in a way that was kind of like crowdfunding with Indiegogo but with decentralized nature to it. So, this attracted a lot of investment in the acquiring millions, you know, millions of dollars of Ethereum was deposited in these smart contracts, and that ultimately led to it being quite a large money pot. And so on July 17, 2016, the Dow suffered a hack that resulted in the loss of 11.5 million a theory, either, or $50 million. And the attacker was able to achieve this by exploiting multiple vulnerabilities, including a re-enter and see bug that let them recursively call the smart contract and pull out funds repeatedly before the balance was actually updated to reflect the initial withdrawal. So this basically let them lead the contract dry. And they were ultimately able they were you know the funds were locked up for a little bit. And during that time, this caused quite a stink because this was a significant amount of Ethereum. And at that time, so there was actually a decision by the community and the Ethereum Foundation team to effectively fork the protocol and use that fork to return the funds to the user and essentially reverse the hack. Unfortunately, this was very contentious and a lot of people in the Ethereum community were not happy about this because it kind of went goes against the core tenants of the blockchain to be censorship resistant for transactions to the final. And this split led to a fork of Ethereum classic, which was a version of Ethereum where the hacks were not reversed. It stayed the course and that community continues to this day as a separate spot off. And so that did that did cause a lot of issues that the hack was reversed on the main Ethereum chain or the chain that most people recognize as Ethereum today. So to give you an example of what this really looks like what is any re-intrancy bug. Let's look at this example so you can see this contract as a kind of kind of an example of what happened it's a simplified version of the Dow, where you have this withdrawal function. And if you look at it line by line notice that the first line is just going to check the balances of the message sender which is the person calling that function so it's basically saying, you know, is the amount that they're trying to withdraw. It's lower than or equal to the balance they have in the smart contract. And what it will do is if that condition is correct, it will then call that smart contract through the fallback function, which is important, and send that value to the contract. And so it's important about this fallback function is you're effectively giving control to whoever's calling the smart contract and if it's another smart contract and that smart contract can actually execute code against the original victim contract. So as an example of that, you know, let's say that we called it with this attacker contract and then the attacker contracts fallback function is then triggered when the funds are received. And because you notice that the balances at the bottom of the victim contract is decremented so the amount is withdrawn from their balance after the amount is sent. And if you're able to essentially call the withdrawal function before it returns to decrement that balance then you can actually call the withdrawal function again. So it goes to essentially, you know, the attacker contract recalls withdraw function. Once again it goes through and checks the balance and the balance hasn't been updated so it thinks it still has an amount to withdraw. So the funds are sent to the attacker contract the attacker contract and again calls the victim contract and this essentially repeats until the funds are our blood dry. So this is a effectively how the Dow was was hacked with this range and see both. So what were some takeaways from this. And this was this was monumental this was a massive hack on the Ethereum space where, you know, prior to this I think smart contracts were kind of seen in a rose colored light of. Well it's on a blockchain therefore it must be secure but what we did learn is that ultimately our contract developers need to write that code securely. You know logic bugs are going to be immutable. If you do actually deploy that onto a blockchain and you also need to account for malicious calls from external contracts and accounts so even though, you know if we look at the code for the Dow on its own it seems secure it seems to be accounting for the balance correctly. We're not accounting for the fact that we can see and other external calls can potentially do things that are not expected. So ultimately there needs to be a lot more considered with a smart contract rather than just the code itself. We also learned that when you update state and balances you should do it before you send funds or perform external calls because if those external calls do something you're not expecting then the balance. You know they might be able to do more things that the balance should be updated prior to. So, you know that was another big thing we learned to make sure to update your balances prior to sending funds. We also learned that forking a protocol in this case is is possible to reverse an attack you know that is an option, but it's, it's not a great option it can heavily damage the community, and the platform's reputation for censorship persistence so it's something that really should be a last resort and the Ethereum community has not done a hard fork like this ever since there had definitely been calls for it when other hacks have occurred. But this is really kind of a one in done thing we haven't seen any other community hard forks to address a hack. You know, anytime after this and I think that's probably for the best because it does come with a lot of risks that that become the more common occurrence, which would potentially reduce the censorship resistance of that protocol. Finally, but of course, we need better security standards and more secure celebrity implementations to prevent these exports so a lot of this code that we better that is being written, ultimately needs to have a higher level security standard that needs to go through checks and tests and most importantly, we need to use implementations that are already battled hard and threatened to try to write our own code. So, how can we do this well, we can use the opens up and contracts library. This is a battle tested open source library smart contracts on Ethereum, or for Ethereum and other EBM blockchains that is available on GitHub, as well as a website and many other places and as an MPM package so really what this is is just a way to say hey if you're going to create an ERC 20 token. For example, or 721 token, you're going to want to do that with the set standard, instead of trying to write that implementation yourself and open yourself up to make a mistake so there are hundreds of thousands of smart contracts out there. Well, I don't know about hundreds of thousands there's a lot of smart contracts out there. The vast majority of the projects for example, use the standard of code and use a smart contract implementation, primarily because it's so battle hardened that there's an expectation in addition to that you get additional functionality you can make your, your tokens possible you can create snapshots, and a lot of other extensions that are available, kind of as a as an add on that are very simple to use. You can also add in proxies for upgrade ability and cloning that makes, you know, upgrading your smart contracts possible so if there is an issue that comes up with a smart contract or you want to get change. You know smart contracts are immutable by default there's no built in functionality to solidity or theory to upgrade your contracts but we do have logic that makes it possible. We also have the ability to provide access control who owns the contract what roles can people play in minting tokens or burning tokens or pausing tokens there's you know you can create a whole access control paradigm using a lot of our contracts. Governance which is kind of extension of access control people can have time locks on certain functionality you can have potentially the ability to create governance protocols compound governor, like the compound protocol something that we're implementing right now. We have utilities, you know basic stuff photography math create to which lets you do deterministic generation of smart contract addresses data structures things like that, and upgrade plugins which just help you do upgrades directly to the smart contract to hard hat or truffle. And then finally security module, which is the thing I'm getting to for how we can address things like a reentrancy by using some some modules were created specifically to ensure that you cannot be exploited by the same sort of bug that exploded the Dow. So to give you an example of this for preventing renters exploits we actually offer two options depending on what you're doing. The first and the most simple is a reentrancy guard it's essentially a function modifier that prevents reentrancy so all you need to do is put that modifier on your function. And whenever your your function is called by an external contract it prevents that contract from being able to call any other functions inside of your, your smart contract so essentially it just makes reentrancy impossible. The other option that you have in the case of payments, because in the case of payments, for example, if your contract, if you're calling a contract that is a rather you're sending funds to a contract that needs to update any token balances maybe that, you know, balance relies on your smart contract and there are cases in which they have to call your smart contract in order to handle that transfer. You have a model called full payments, and some modules to go with it so essentially it's a reverse pattern of a push payment, which is essentially what happens when you make a transfer to an external contract directly from your contract. In this case rather what it does is it says if you have a balanced draw, it takes those funds and sets it aside in an escrow, and then that escrow can be withdrawn by that contract any separate transaction so essentially, because it's in a separate transaction there is no possibility for reentrancy in that case. And that's that's the advantage there so that's that's a separate model that just provides better security against things like reentrancy. So both of these are options with the contracts library and there's a lot more details where that came from. You can check out the blog from from Francisco that talks more about we can see after Istanbul and the current modules that we have. So that was the Dow pretty pretty famous but let's get into an even messier hack, one that really I think broke the assumptions that there are coders out there that can't make mistakes. The parody multi sick hack that proves that no one is perfect. So the parody multi sick hack occurred with parodies multi signature contract library so parody is a well known company in the blockchain space. At the time they had a parody node that was essentially an Ethereum node, or for syncing with the blockchain and the node came with the idea of a basically contract library that was multi signatures so if there were funds that that node controlled, you would create a multi signature library that allowed multiple keys to have control of those funds. And this was all deployed as a smart contract on the Ethereum blockchain. And what this did is essentially let users create their own mythological contract. But that contract would be dependent on a core library or its logic. So, for example, you can see these two contracts below owner 123 owner 456 both have different balances both control different funds but the logic that they would use for some withdrawals and many other things would all depend on this one library contract that they essentially are dependent on. And the reason for this is that you can save a lot of gas costs, you know you don't have to deploy the same logic over and over again. You can also let you know that team wants to do updates to library contract it would automatically apply to the contracts that are dependent on it. So you have a lot of advantages with this, but there are also some vulnerabilities. So an attacker was actually able to find a vulnerability on July 19 2017 and stole over 150,000 of their ether tokens or $30 million from free high profile multi-sig contracts that were storing some funds from token sales. And so this was very significant hack the attacker was able to do this by obtaining exclusive ownership rights to each multi-sig by calling an initializer function inside the library using delegate call. So we'll get into that in a little in a second in terms of the details of that but basically because of the dependency in the library contract and was an exploit available. So there was actually kind of a follow up to this. It wasn't a hack but rather more of a kind of an accident more like where they deployed a new library contract. But there was a bug in that where anyone could call the self destruct function that will destroy the library contract. And that actually caused $150 million worth of funds to be locked up on November 6 when that that function was called because all of the multi-sig contracts out there to dependent on the library contract for its logic no longer had the logic to do with draws the funds were frozen. So this caused an additional loss on top of the initial hack. So very damaging and I'd recommend reading the post mortem from parody below to want more details on that. But to give you an example, you know what that hack looked like and this is actually the code from the hack summarized. You basically have this library contract and it contains an initialized wallet function that lets you initialize your wallet with the owners and requirements and time walks and things like that. And the idea is that this should only be called once it should only be called after the contract has been initially created and then no more. And that's the way it was it was set up. But if you look in the contract victim, and you see this fallback function there, you can actually see that there's a way potentially to call it again. So if you go through you can see that initially has the logic to handle a deposit and then otherwise if there's no deposit or no value attached to that contract or that payment. You see that essentially it says if there's any data contained in the function call, then the delegate call function will be called on the wallet library and it'll pass that data onward so basically says if there's a function that I don't know about. You know the contract victim doesn't know about it'll pass that on the library contract is they hey do you know this is a function that you can handle etc. And the attacker could basically use this to call the initialized wallet function. So he basically, you know gave it the attack his own address and then called the multi contract victim and it delegated that call to the library contract and allowed him to set his own, or him or her allowed to set their own themselves as the owner of that contract and that's essentially how this has occurred. So it seems very simple but it was missed because of visibility. It wasn't clear that the initial wallet function was visible to the contract victim, or rather the dependent contract, even though it really shouldn't have been. So, what did we learn from this. So first of all we learned that anyone can make a mistake because parody was founded by Gavin Wood, who's a former CTO of Ethereum, and the creator of solidity and the EVF. Of all people should be aware you would think of all the pitfalls of using Ethereum smart contracts wasn't always clear exactly how involved he was but he definitely this was his company his team. He probably looked at the code at some point. So even the most reputable that all of us can ultimately make mistakes in these in this regard so it was, you know, definitely a great wake up call to say that you know no one is perfect and we ultimately need to be able to have processes and standards in place to make sure that you know any developer can fail when you to catch that before something like this can occur. The other thing we realized is that functions defaulting public visibility are a serious issue like contribute to exploit such as this one. And so there's actually a change to solidity and version 0.5 or down it's required that you specify the visibility for all functions so it won't compile unless you say if it's public or private so that at least it's clear. Because you notice if I go back to this there was no, you know, function, there's no visibility modifier added to say what the visibility should have been wallet so it defaulted the public and then that made the attack possible. So the other thing we learned is that complexity can definitely add to security risks. So using libraries and delegate call and increase that because there are definitely more scenarios that can occur. So it was trying to save gas but that ultimately led to a vulnerability being possible so it might be better to simplify your code rather than try to make it more complex just to save gas or optimize things. Optimizations are still important, you should still do them as much as possible but you should always know that there's a potential trade off to security if you're adding complexity to it. Another important thing is that no bug bounty exists at the time to incentivize reporting of critical issues. It's not clear if this would have prevented the hack if the hacker would have preferred to be paid by bug bounty rather than do the hack. But, but we know that this has been successful in, you know, current times to catch a lot of bugs in production. So ultimately what we learned is that a bug bounty is is essential to catch it by this, you know that was an option that might have prevented it we're not sure but it's one that should have at least been available at the time. And then finally, another thing we learned is that audits are important and not just important but but the need to be very clear and eventually need to be recurring. There was an audit on the multi-stake wallet at one point, but changes had since been reintroduced before the attack so it was very unclear which commit had been audited. So it's really clear that we have recurring audits on code if it's changing over time. And that there's clear get logs to ensure that we know what was audited in with. So naturally with open Zeppelin, we do security audits and we definitely encourage all of our clients to work with us on having a clean get log to make it clear what was audited what was patched what PR what commit. So it's very clear to the community and to future audits, you know what what should be considered potentially secure and what has not yet been checked. And we do these audits with many teams and many companies out in the world and we know that there's also a lot of other audit from out there and we would encourage everyone to get audits if not with us then at least with someone. Another thing that we learned, or rather one thing that we are learning at open Zeppelin is that there are limitations to audits, not because we're not good at our job, we feel very good at our job but because we're ultimately there's only so many of us and there's only so limitations in the entire ecosystem so having a quality assurance process in place is still critical because ultimately the messier your code is the more bugs that there are contained in it. When we initially go through, especially if they're simple, obvious bugs, the more time that takes away from us to do our job and so we highly encourage all of our clients, and anyone in the industry anyone deploying smart contracts to go through a rigorous QA process within your process and build that in as a requirement for any code that goes to production or even goes into an audit. You should be doing this regardless of whether you get out so you should still get audits, but you should absolutely have a QA process that catches this many bugs before the audit even occurs. So maintaining a disciplined get workflow with transparent log, having cold requests that are approved and merged with clear understanding of what was changed and when. That's very important. Having that's not sec comments to all contract code and keeping it clean so we want to make sure that we know, you know what that code is doing having an understanding of the arguments and the return values that makes it far easier to read. We want that you need to be documenting the architecture and all the protocols that's another thing that helps with an audit as well as any community members trying to understand how to use the smart contracts correctly. Sometimes there can be bugs that occur, not because the smart contract is has above but because there are users that under misunderstand how to use that smart contract and the cause of the loss of funds, or other issues to occur so documenting everything is crucial. Also running an exhaustive test suite is important if you make any changes you're able to test against that. It also makes it clear to both community members and developers and auditors what your code should be doing or what you expect it to do. So having that one person code coverage or at the very least close to it, another very important step that we want to, you know, we would encourage a lot of projects and protocols out there to follow and adhere to also using code libraries you know opens up when is obviously one of them but there's also a lot of other, you know contracts out there that people commonly use such as compound governor Bravo, or the genosis. And we think it's important to try to import those as dependencies through MPM, or something similar rather than copy pasting the code just because copy pasting the code doesn't make it clear what version you used sometimes that can be bugs introduced. So when you're auditing code you have to take a closer look at that versus if you're pulling it from an external source that we already know and trust then that always makes it easier to audit cut down on time a bit and it also just is best practice. And then finally just having your own internal security reduce you know take time exclusively just for digging into the code and making sure it's secure, trying to break it yourself.  Try to dig in and see if there's anything you missed that we're really cut down the box we've seen a lot of teams that will catch bugs prior to an audit that we start with them when they're they're giving more time to do that.  I'm only going to get paid for finding this by hacking it. You never want that to be the only option they have so definitely keep a bug bounty program out there. So with that being said, let's stick into the last hack we'll talk about today. This is a more recent one the urn why divulge exploit. This is your example of flash loans and how they are coming for everyone's collateral a for not careful. So a little quick primer on flash loans. These are a new type of uncollateralized defy lending protocols where liquidity is borrowed instantly and we paid in the same transaction block so this is as opposed to other lending protocols out there were typically need collateral. So, for example, if I wanted to, you know, borrow some, some funds from maker Dow I would need to put up some ether or other funds as collateral and then I can borrow against it usually it's it's actually over collateralized. In this case, they will you can do with the flashlight because it happens in the same transaction block you actually get guarantees as a lender that someone can pay you back. So for example, if a trader wants to flash borrow an amount just to make a trade, you can borrow that amount make that trade to some sort of a defy protocol or or or decks and then you know take some profit from that, and then return those funds, plus whatever you do to that protocol, all within the same transaction block so the idea is that if anything happens along the way, or anything could happen along the way that would make it impossible for the trader to repay their loan in full. Then the transaction never happens or gets reverted and essentially the lender has like a guarantee that they won't lose that money. So this is a really awesome tool for traders and people that want to use more financial products out it also means that people have a very powerful tool set in there. A very powerful tool to potentially make profitable hacks by conducting economic attacks so this was first introduced by Ave in early 2020. So this is still a fairly recent development, but it's definitely gained a lot of traction recently there's other protocols that now support it. We now see a lot of exploits using flash loans so this effectively what they'll do is they'll be able to borrow a lot of money and use that to manipulate on chain pricing by you know unbalancing a pool or a dex and kind of messing with the pricing mechanism. By just having so much collateral that it that it kind of overwhelms protocol kind of like just a whale attack except anyone can be a whale with flash loan. But what these can do is they can you know take out under collateralized loans as a result, they can trigger liquidations and then also increase the profitability of other exploits so they find an exploit that lets them, you know, but you know, basically mess with the balance of the smart contract or something like that, if they can unbalance pricing they can potentially increase the profitability of that. So let's look at this specific exploit with your finance and urine is a lending aggregator what they essentially do is they optimize token deposits with pools, including the be one wide I vault, which utilizes another protocol curve finance for strategies to so to give you an idea of this you have the urine wide I vault. Essentially, it's looking at the curve free pool which has three different stable coins in it. And it uses that to understand the pricing that it uses in its strategy specifically in how it calculates deposits and withdrawals. So what the hacker was able to do is call the loss of 11 million dollars to the vault, while making a profit of 2.8 million by doing several steps that mess with the price and allowed them to make essentially a loss deposit some withdrawals. So, essentially what they did is they just made those deposits and withdrawals and an incredible exchange rate and after 38 minutes, the urine team was able to mitigate the attack by disabling deposits and saved about 24 million other 35 million die. It could have been a lot worse that they weren't able to do this and saw it immediately. So basically what the attacker was able to do, they were able to receive a flash loan from the lending protocol imbalance three pool using that flash loan so essentially causing a imbalance that caused the price to be wrong. And then they made deposits into the urine wide I vault, and then withdrawal and essentially, you know, got it added unfavorable unfavorable price. And then they did a better breakdown of this is a diagram built by Steven from our team. Essentially, you can see the attacker depositing funds so they essentially deposit to the stable coins withdraw another stable coin tether that causes an imbalance and they deposit die into the victim vault. And because it's using the exchange rate from three pool. It does a deposit and causes a loss and then the attacker is able to do the deposit back in a free pool with the US DT they had originally taken out withdraw the die from the vault at another bad exchange rate and then withdraw US DT in the last election so essentially through the whole and then and then they do an exchange on on m curve to withdraw us DC and in the die and in the end they they've ultimately at a very large profit and the victim vault has lost out. So you know this shows me and they were just able to essentially keep repeating this I think they repeated about five times to to make a considerable amount of money it could have kept going if the vault had not been frozen. So what are some takeaways from this. The first is that flash loans have very much changed the game by making economic attacks far more accessible so prior to this. There were economic attacks that occurred but they were kind of only available to Wales in terms of actually like changing the pricing on exchanges or the changes just had very low liquidity. So, you know, anyone can potentially balance a little bit of money but now flash loans make it possible to do it for anyone that can just do it within a single transaction block so economic vulnerabilities and your protocol like the ways that you're, you know, automated trading strategies could be broken by another trader are now almost as important as logic bugs because of the fact that someone could cause nearly as much damage to your protocols that they were able to break it directly and withdraw funds in an unauthorized way. So, definitely an issue that that auditors and security teams everywhere need to be aware of. You also have dependencies on decentralized exchanges like curve and other on chain pricing, but basically opening these these protocols up to attack with flash loans and other ways so we have these dependencies now in the defy space, kind of like Legos where everyone depends on each other for pricing or trading strategies and so you have to really know the implications of using third party protocols especially for on chain pricing and so you need to consider using things like off chain oracles or or multiple aggregated oracle pricing to make sure that you're not dependent on just one protocol that could potentially be manipulated so definitely something to consider. Also something with flash loans is that they're technically only viable for an attack if they are completed one transaction block so while this isn't great because it definitely could cut back on the user experience by by increasing the time it takes to do certain transactions or certain functionality. I consider multi block flows for for sensitive functionality that you don't feel is well protected against a flash loan or something like it. So not a great option but something to at least consider. And then finally the attack was really only mitigated by a quick response from the ear and team, when someone noticed that there was a complex transaction pattern occurring and ultimately that early, you know that that early notice was able to save millions of die. So what we're learning is that fast threat detection and response is critical for protecting user funds. We no longer can treat smart contracts as something where you know if you secure the code prior to deploying and then you deploy it then you should be good. You know I don't think that was anyone specific attitude yet but I think this has shown that they're they really can't be any more complacency about production code even if it's a smart contract you need to be watching that clearly and and directly to make sure that you know if there's an issue you can respond quickly. So one thing that you can use to respond quickly is open set when defender so this is a new product that has come out for operations automation and security infrastructure. It has both the UI and SDK provides teams a lot of options to secure their smart contracts and respond to two issues. So when a few of the features we have one is admin, which is an interface of contracts administration can bring your own keys if you want and use it to basically do a specific resolutions to upgrades to deployments anything that requires potentially a multi sig or just you know you want to go through a clear process with your team to ensure that it's deployed correctly. This is a great tool to do it. Another thing we have is relayer, which is a hosted key solution to ensure they're kept secure as well as doing reliable transaction delivery so it's just a way to ensure that when you send a transaction. You're able to sign it securely and get it processed without worrying about specific gas issues, or you know it not going through you know the relayer essentially handles that for you so especially if it's an important transaction, like pausing a contract that's under attack. You want to get it there as soon as possible and relayer helps do that. The next thing we had is auto tasks, these are, this is essentially serverless code for automated tasks and off chain logic so these can be handling like specific things like you know, updating your contract every day. For specific things you want to do off chain or even responding to things directly that are happening such as a security incident. And then we also have sentinels, which are monitoring tool for monitoring transactions events and then triggering notifications and auto tasks for certain things that occur. And then finally we have advisor which is essentially collection of our blockchain security best practices for you to look through and consider when you're building your projects. So, let's take a closer look at urine and think about how we could have actually mitigated this even more. So, from the urine exploit post mortem, we saw that the opportunities to automate detection and mitigation steps for an even fast response, you know, were possible so you know this is from the post mortem you can see that the complex transaction pattern is what first peak their interest and cause them to jump into action and cause the contract. So we were able to respond within 11 minutes within 11 minutes of noticing the issue occurring, which was probably about little little over 30 minutes after the attack had started to occur. Then they were able to respond and so what we want to see here is that you know the your team did a great job responding but we would want to do is provide them a tool that lets them do this even better. So there's a solution that Steven Lander came up with in a defender workshop recently that we did that you can see below. But to summarize here, what we can do is we can take the factors that they notice me attack, you know that the it was a large complex transaction which meant there was a lot of gas being used. And there were also multiple functions being called all in the same transaction there was an earned function withdraw function and deposit function these are all things that might cause you to worry, you know someone's doing deposit and withdrawal then they might be doing that specifically because they're causing a trade imbalance, for example. And we can also see there was a loss of fun we see that the balance is going down after each transaction and that there are probably a lot of funds being lost. We compare this from, you know, this box previous box to see that this is not normal occurrence. So ultimately these are all factors that you can use to take into account on how to prevent this sort of attack. So looking at kind of a, you know, a solution that we can put together using defender and the parameters we just discussed. We can, we can basically take a step through each one of them. So, like the admin tool, you can use as an interface for contracts administration and use that to deploy. So this is a safe contract that lets you have a two out of three multi-sig arrangement, and then use that to control your vault contract, you can do things I've upgraded or posit directly from this admin. So that's a great way to ensure that your team is able to securely respond to things with with a clean interface or or however method you prefer whether you're using arc, you know keys broaching for you, or keys that you have yourself will work well either way. If you have that all contract deployed, you want to be able to keep an eye on it so you can use sentinels to monitor the function calls and events. There's anything fishy going on or if there's any specific events you want to know about you can get notifications through emails like in discord telegram or even data dog. And if we want to let's say specifically look for high gas usage, we can trigger Sentinel to respond to that notify it and we can also have Sentinel invoke an auto task. So what auto test can do is there are other triggered by schedule or web hook or of course of Sentinel, and that can execute custom code such as a way to analyze the transactions occurring to determine. Hey, are any of these factors matching potential attack factors so it can determine if there's a loss in the contract that that's causing you know the balances to drop significantly. And then it can several send a web hook to the team for an alert notification if the loss exceeds the threshold and that team can then respond manually by going to the admin panel and then you know pausing that contract. Another way they could do it optionally is they can actually send the mitigation transaction through the relayer. So basically instead of even having to wait for someone to, you know, get online and press the button and pause the contract you can actually let the system do it itself, where the relayer will send a transaction to the vault contract and pause it directly. So you have these two options for ways to respond to attacks. Ultimately what we want to do with offenders make it easier for people to have clear security operations of let them attack. I'm sorry, respond to attacks quickly and effectively, because time is on the essence and this is a system we think would definitely improve that and I know that your team is now using offenders so we're hoping that definitely improves them as well. So, in summary, for this full talk. What we've gone over our three major hacks and what we've learned. So with the Dow hack, we showed, you know, contracts can be broken from an external attack using a renterancy. Ultimately smart contracts are new paradigm, there's going to be a lot we have to learn security so using simple modular code that's been battle tested and built with the theory of security in mind is crucial opens up in contracts is definitely standard we believe in but there are other contracts that also are good to use in certain scenarios that are battle hard so better to use these simple systems that already exist rather than build it from scratch yourself. The parody multi sec hack show that any skill developer can make mistakes. So we really need audits and bug bounties and an internal QA process to ensure that we keep smart contracts secure so there should never be a dependency on one person being smart enough to avoid a mistake. So we should have multiple steps in place throughout the process of building code and securing it prior to employing it to make sure that we're not going to miss anything and even if we miss something we have bug bounties to ensure that if someone does find a bug, they have a chance to report it and make money rather than hack and make money and the team is in a far worse position so you know all these things we think are essential for any project that's handling millions of dollars. And finally the year in why they evolved exploit, along with similar exploits are showing the growing prevalence of economic attacks between flash loans and we're just seeing a very, you know, the attack surface of scoring there's more complexity involved b5 protocols than we're used to in the past so, ultimately, you need to have operational security as well as kind of a post deployment security plan. So, you know, to respond to instance quickly are it's going to be critical to mitigate the unseen attack factors so there's always going to be something you potentially miss, and having a way to respond to the things you miss and mitigate the damage if not prevented entirely is really crucial and every team that's the points in our contract should be keeping that in mind and using tools to protect against it defender is one option we highly recommend but if you want to go with building that code yourself or whatever you think is best. We would encourage you to at least have something. We just see defenders the best tool because we obviously have everything ready to go right out of the box. So ultimately, the attack services growing for smart contracts and you really need to be keeping an eye on how this complexity changes if you're going to be making deployments in the space. We have attacks frequently right after dev con there was a $600 million attack with poly network. That's like kind of a cross chain protocol so I mean cross chain interactions are a whole thing we didn't even get into in this talk that's becoming growing area of potential attack. So ultimately developers really need good security practice, both before and after deployment to mitigate these sorts of issues. We'll probably be seeing more hacks in the future and the best thing that every team can do is to ensure that they're covering all the bases possible. Learn from these past hacks or the very least those aren't something you have to worry about and for the hacks you know can't foresee being able to respond to them quickly is going to be the make the biggest difference. So, last but not least just consider what we have it opens up when we have contracts library that most people now use. But we also have an audit team that works closely with a lot of the best teams in space to ensure that we have, you know, they have secure code. We catch bugs release reports allow the community to read through them and understand them. And then we also have a defender product that lets teams manage their smart contracts securely and respond to threats quickly. So, that's it for this talk won't have any, you know, questions here since this is virtual but I do encourage you to check out opens up one after this. You know we have I have links here for contracts or audits our defender tool. We also have a jobs posting we have plenty we're hiring security engineers and open source developers to work on these sorts of tooling and audit these sorts of projects. We also have a forum where you can ask security best practices either about our tools or about general smart contract issues that you might have and also read our documentation for more details on what we support. For example defender supports not just Ethereum but finance smart chain arbitram moon beam and many other medium based blockchain out there. And then finally, if you have any questions or you just want to reach out and available at that email linkedin Twitter or whatever you prefer. So, thank you for listening to this talk, and I hope you have a good day.


T F N N headline news update Welcome folks. We had the Dow industrials finished up a hundred and one NASDAQ down up eight S&Ps up nine gold contract gold contract down a dollar thirty trading at twelve eighty four and ounce We had silver down six cents fourteen dollars fifty five cents an ounce light sweet crude up eighty seven cents fifty eight dollars seventy seven cents a barrel Notes and bonds. We had the ten-year note down seven ticks one twenty four thirty one thirty a bond down nine at one fifty one O five and King dollar King dollar down two hundred and eighty three ticks trading Ninety seven four forty the euro at one twelve to one US dollar the unit one on nine thirty and the pound at one twenty seven Fourteen we can only take a look at the dollar first what you're looking at is this folks What we did out here this week is that we made it to the swing high Failed on price the swing either we're talking about here was the 97 90 808 five We get over it yesterday spiked over it gave it up in spades Down lower today, and now the real question is going to be is this little King dollar going to make its way down to the 94 area 94 at the bottom of this consolidation if we go take a look at the euro which is 60% of the US dollar What you're going to see there is that that did reject lower price yesterday Trade and higher now it hasn't broken its downtrend yet If we take a look at the euro what you're going to see is that we are going to be approaching when we come back to work Next week the trend line of the this has been down since January 1st The break in that trend line is going to be that the break would be one twelve Twenty-three and right now you're at one twelve oh eight now if we break that if you want to look see the dollar going lower which I happen to want because I Think gold's going higher what you're going to see what you're going to be looking for is wide-price spread on the break and Well, the euro wouldn't have volume on but that's what you'd be looking for We go to take a look at the gold contract gold contract caught a bit out here yesterday Bottom line this Hasn't also really broken its downtrend from The 20th of February. I it's got to get a little bit higher to break that downtrend You know, you can you can make the case that yeah, you actually you know do have a break in it And we broke it a couple weeks ago, but came back underneath it Bottom line it's going to need another wide-price spread accelerated volume Have a great weekend. Have a safe weekend folks. We look forward to speaking there right back here Tuesday morning nine o'clock


Throughout the videos, you may have noticed me reading code like this as x becomes the list 3, 7, 2, 5, and y becomes x sub 0. What's that sub all about? In algebra, when mathematicians want to represent a group of related variables, they write it like this, using a subscript for the index number. When computers first started being used for scientific purposes, programmers needed to represent lists, but they couldn't do subscripts on a teletype or punched cards. If they wrote something like this and read it as x0, x1, and x2, that wouldn't work because those are the names of independent variables, not part of a list. Those early programmers came up with a solution. They put the index number in square brackets to represent the subscript. In fact, in a language called FORTRAN, one name for a list was subscripted arrays. That's why we use brackets for indexes, and why we read them as x sub 0, x sub 1, x sub 2, etc. And that's the story of SUB.


Historically, there have been different approaches to screening and vetting people for positions of employment. One of the oldest are paper and pencil tests, integrity tests, where people answer questions and from those questionnaires they try to determine if they're honest, if they're going to be good employees, if they'll be suitable in the workplace. They have been around for a long time and people just fill out these questionnaires. There are also voice stress analyzers that people use that purport to be able to assess whether or not a person's telling the truth when asked a series of questions. There are polygraph tests that have been around for a long time, testing current employees, periodic screening it's called, and those have been around for a long time. Each has advantages and disadvantages. The paper and pencil tests have the advantage that they don't require a skilled examiner, they're relatively cheap, they can be done quickly, people usually don't object to taking them. The problem is they don't work. Polygraphs have the advantage that they're pretty accurate. The scientific evidence shows in screening situations that they're probably somewhere between 65 and 85%, which is a lot better than the usual interviewer who can be fooled by the biggest liars. The psychopaths are the ones that fool everybody. So you need some way of detecting them, but polygraphs are expensive, time consuming, and you require skilled examiners, and there's always the potential of bias because there's a human who conducts the test, who interprets the test, and they can be biased by their interaction with that person, they can be racially biased, they can be biased because they don't like the person, they can be incompetent and make a wrong decision. The advantage of ID Tech, which has now come along, is it overcomes all the problems I've just talked about. It's relatively inexpensive, it's fairly rapid, it takes 35 or 40 minutes, it's relatively unintrusive, the person just sits in front of a computer and presses two false keys when they read simple statements, they don't even answer out loud. It's all automated, so there's no potential for bias, it's analyzed automatically by very powerful algorithms that give the result a very detailed report and it's highly accurate. It's accurate or more accurate than anything else that's available for those purposes. ID Tech I think in the future is going to play a very significant role in the vetting process in all areas of our society, as our society becomes more complex, as the risks of hiring the wrong people become greater and greater, such as terrorism, corruption and so on, that we need these technologies and ID Tech is ideally positioned to provide the kind of service needed for these growing problems that we have in our society. So I see ID Tech as becoming a fundamental part of the whole vetting process in our society, whether it be government or private industry, I see it as a major tool, perhaps the most important tool that we will have.


Hi, I'm David Cantor with the Law Offices of David Michael Cantor and today I'm going to talk about the Maricopa County Juvenile Court Specifically the court in Phoenix.  Some people call this the Durango Juvenile Court. You pull off in your park on the north side You walk into the courthouse and you're going to go up to the front desk and you're going to check in They're going to send you up to the second floor and when you get up to the second floor You're going to wait outside of the courtroom, and they will come and get you when it's your turn As far as any food there is a cafeteria there and you can get some food either before or after And they do have soda machines and things of that nature.  It's 30 minutes. It won't cost you a dime I'll go over your case with you from top to bottom and explain what we can do to help you out and hopefully get you out Of the entire charge completely. I look forward to hearing from you soon