All right, folks, let's get started. One more week. Plus, like, about half a week. Let's go. Do you have notes? Yeah. No, it'll be over when it's over, just whether you pass or not. Hey, failure is fine. Once people fail. All right, any questions before we start? I don't think it's going to be super long. So now I'll get to the crown jewel of web security that we've been hiding from you up until now. So, cross-site scripting is the most prevalent vulnerability on the web. OWASP, the Open Web Application Security Project, so they're an organization of security people, and they come up with every year a list of top, or every few years of the top 10 most prevalent vulnerabilities on the web. Of course, there's all kinds of controversy surrounding those, but cross-site scripting is usually always near your top. So, this is why I said that the same origin policy is one of the most key things to web security, and that is because, fundamentally, what cross-site scripting means is that an attacker is able to bypass the same origin policy. So, what would that mean? Upload code from a different site. So, just if they're able to bypass the same origin policy, so what would that mean that they can do? Send some payload to their server, which is supposed to be on the same order. Payload? Request, or whatever. Request. So, let's think about this. What can some JavaScript code running in the same origin do? So, what can, let's say, Facebook.com's JavaScript do? It can send responses back to Facebook.com? What else? Access files on its server. And try to make requests to files on that server. Access all of the, access all the HTML that was returned from that page, including any types of tokens or forms. What else, what else are you going to look for? Cookies, it could read the cookies, right? So, the core thing to think about is, okay, now if we're saying that JavaScript, that an attacker controls, is now able to execute in the same origin as Facebook, what capabilities do they have? And it's all of those things, right? So, the attacker could completely control the DOM of Facebook.com and completely change the layout. The attacker has access to the cookies that Facebook.com has access to. It can make requests. So, we'll see all kinds of cool stuff. So, this is the core. So, at the core, if you can bypass the same origin policy, that really is what cross-site scripting is. We'll see that the name cross-site scripting is a bit of a misnomer. It doesn't really mean anything. The core is being able to bypass the same origin policy. So, you can even do cool stuff, like getting back into the day, you used to be able to trick the browser by using Unicode or something to think that the iframe you were loading was in a different same origin, right? So, you can try to find bugs in browsers based on how they compute the same origin to exploit those. That would be, I guess you probably wouldn't call those a cross-site scripting attack, but they would definitely have the same result of bypassing the same origin policy. So, if you guys were assigned this, you'd like to classify things into neat little categories and boxes. So, here for cross-site scripting, we categorize them in two different ways. Cross-site scripting attacks, which is basically when, so we think about how, so now the question is, so we know the result is that cross-site scripting attacks bypass JavaScript's same origin policy. The question is how? So, how does the browser, how does the browser assign an origin to JavaScript code? So, which website? Isn't it always? So, it depends on where the page comes from, right? So, let's say, so this is why it's a little tricky just thinking about the JavaScript there. So, let's, oh, no. Oh, yeah, that's nice. I promised I won't drop. Okay, so, an HTML page. So, because we're good people, we'll use example.com as our domain. Why do you use example.com? Can I just use any random name if I just want something that's not worth the value? Yeah, so example.com is actually an RFC, so the camera crew, but somebody guarantees that example.com will never be owned by anyone else, and you can actually use it. I think they own .com.org. So, there's an RFC that specifies this, so you should always use example.com in your examples. I've heard of cases where, like, people use a different domain and then somebody buys that domain, and they get a lot of people running stuff in their command line, like taming that address or doing random things, and it's super annoying. I think somebody has a test.com or something like that and they get a lot of emails from test systems. So, and this is the domain that I go on, and I have, what type of JavaScript is this? Inline. Yeah, okay, inline. So, this JavaScript is an inline JavaScript. What is the same origin domain of this JavaScript? Example.com, AD, HTTP, right? So, port, post, and... and a post named port and protocol. Cool. So, this definitely makes sense. Somebody said, hey, the JavaScript wherever I sent from is here. Now, what happens if I do... So, this is going to then go... and your browser is going to do what when I see this tag? It's going to... It's going to make an HTTP different request to this Google.com. Let's... This is a bad example. I'm sure this file doesn't exist. Right? And this returns... This returns this. So, what is the origin of this code? So, in a script, in external script, this is the way to circumvent the same origin policy. By the developer including this script in the Example.com page, they're saying, hey, go fetch this code from somewhere else, execute it in my origin. So, this code will be downloaded from Google.com, but we execute it in the domain of Example.com, HUE, and PortAid. So, this is the fundamental way to circumvent the same origin policy. Now, the browser... When the browser gets... Let's say this is the HTML response that the browser gets. Right? How does the browser know which... the inline JavaScripts and the external JavaScripts? Yeah, how does it know? I mean, it's a... It's not a complicated answer. So, what's that? It has a parsing engine which... HTML parsing. Yeah, it all comes back to parsing. I keep parking on that because it's actually important. So, it hasn't parsed this HTML page. When it sees this script tag, it says, okay, I'm executing the script, and I know it's an internal script, so it's executing the same origin. Great. Then, we get here, it says, okay, there's an external script, but set this origin. When we've touched this, there'll be this same domain. So, the same origin domain here, v, hdv, ad, example.com. So, what happens... So, okay. So, fundamentally, the way an attacker... Sorry, sorry. The way we can circumvent the same origin policy is essentially either through external JavaScript code. Right? The key question is, what JavaScript code did the developer of example.com want us to execute? Can you tell? So, I'm trying to... I'm trying to build that somewhere, but... I can't tell because there's just a link there. Right. So, fundamentally, the browser has absolutely no way to know which script tags the developer intended for there to be versus which ones were maybe injected by a... an attacker. So, let's say v... Let's say this is a PHP script. It looks something like this. Super simple. Echo. Okay. So, this is now the PHP code. I mean, it's a terrible program. I guess... So, fine. So, we'll be... It's not very good. We'll just throw it on the HTML tags to be good people. Right. So, it's super simple, but it's something that just hopefully will illustrate a point. So, this is the code. If we access user foo, what HTML are we going to get? Something like this. So, this one likes foo. Now, when we look at the PHP code, what JavaScript did the developer want us to execute? None. Zero JavaScript code, right? There's absolutely no JavaScript code in this PHP function, right? Now, what if we wanted to execute some JavaScript code? What can we put in as the value for the foo... for the use variable? Yeah. So, we give you search tags. Now, is this correct? Can we just send this? What do we need to do? Yeah, I'm going to view our own code just view parameter. Well, let's send it to the party button. Right. Then, now the question is, what exactly is this PHP code going to do? Yeah, replace the foo with whatever you have in here, which is this script tag. And then, when your browser gets this response, what's it going to do? It's going to parse it, and then it's going to execute the things inside those script tags. And then it's going to show an alert box. So, that JavaScript code that got executed, right, it's executing in the origin of hdpexample.com 80. But where did that code come from? Did it come from the developer of example.com? No, it came from, well, here it's coming from the parameter, but I wanted as an attacker to get you to execute code in the domain of example.com. What could I do? And then, how do you get me to execute that? Send the URL to me and trick me to click on it, right? So, send me an email that says, hey, I found some students cheating in your class. And then, link me to this. Immediately as I said it, I was like, yeah, I would get me to click on it. Right? So, this is an important distinction here. So, and would I click on a link that looks like this? Hopefully not. So, what would you do to obfuscate it? Do you use a shortener, like Vickly or something like that? What else? Encode everything, including the script. And the alert, everything, right? That would actually super you. You're actually used to getting these emails from websites that are just these URL encoded, huge garbage strings. And then, let's get on with that. So, this is an example of what we call reflected cross-site scripting. So, the idea is the cross-site scripting payload is taken from a URL parameter and is being used and displayed back to the user. So, in order to, so I guess we should, so do you guys, as an attacker, do you think you could get somebody to click on a reflected cross-site scripting link? Yeah, pretty easily. So, that's part of the way we think of the threat model of the web. An attacker can basically try to force you to go to any website, right? I mean, it's not really forcing, but eventually they, I've seen crazy things. This is actually how they did some of the attacks. I think it was the Aurora attacks against Google, is they figured out who worked on the team they wanted to get on, then they figured out where their Facebook accounts were, created somebody who was an account of somebody that they knew who was not on Facebook and then friended them through there and then sent them a link during work hours to their Facebook, of course they're on Facebook, and then they clicked on that link on their work computer and then went to a site that infected their browser through a drive-by-download attack and executed malware on their machine, and that's how they originally got into the network. So yeah, clicking links is bad. It also works the other way. So there have been cases of people, law enforcement and the FBI, finding out who bad guys are because they infiltrate like IRC in different organizations and then get people to click on links that then expose their IP addresses. So yeah, they were careful out there. But it's part of the threat model of the web, right? So we can essentially get anyone to click on the link at any time. So, and normally the way you think about these are some kind of error message or a search field. I mean, this is the kind of standard ways that these reflected cross-site scripting can occur. Anything that includes the server's response, the includes the cross-site scripting payload that's parked on the request to the web server. Now, what would be the flip side of reflected? I mean, not literally the opposite word of reflected. I don't know what that is. Yeah, so what would be a typo? How would you describe something that is not a reflection? Transmission. Injected. Yeah, so describe it. What would it be? Is that injected? That's it? A thought, a one word thought. Stole the script in a database speed and when the data speed is loaded on a gateway, it will execute that script. Exactly, so think about like any, let's say a web page that is what am I thinking of? Web page, vulnerable, it's gross. Oh, oh, oh, like a comment page on let's say items on Amazon, right? When you make a comment, that comment is stored by Amazon and every time somebody visits that page, that comment is going to be displayed. So let's say there's a cross-site scripting vulnerability there. Now you as an attacker, inject your cross-site scripting payload, the web application stores that and sends that to every single person that requests that page. So let's step back for a minute and let's think, how do we fix vulnerable.php? How do we fix this code? What did the developer likely intend? Did the developer intend for people to be able to input arbitrary HTML tags here? Probably not. Yeah, sanitize, how, what kind, yes. So the key problem is, so anybody in php? Is it just HTML entities? Yeah, it's just a special shot, a special shot. I'm not having any. So it doesn't have that functionality yet. So by doing this, now what will be the output if I drag this payload? What does HTML special character do? Is this going to change? So it's going to replace, it's not going to interpret the script tag, it'll just interpret it as that tag. By escaping all the HTML characters. So less down the greater down. And so on and so forth. Just those actually. Right, so the web application, the php code is making, essentially doing a string replace on any of these special characters with the HTML entity encoding version of those special characters. So now when the browser gets this response and it sees this ampersand LT semicolon, what does it do? Does it interpret that as, does it say that's a start and a start tag? What does it say? This is the start of the less than character, right? This is text as the less than character. And it'll keep going. So you will actually see in the HTML of this page will look, it will be a start script tag, it will say alert tick, XSS tick, and then an ending script tag. So you will actually see that as text. We get the distinction here, but it's super boring. So stored attacks are very similar. So the payload is still going to be the same. The difference is in how it gets transmitted to the users. So stored cross-site scripting, basically the ejecting code is permanently part of the web application now. So it is part, it's not part of the application's code, it's part of the data of the application, and it will get sent for every single request. I actually remember seeing these, gosh, way back in the day on GeoCities, I remember the GeoCities had like guest books. And I found out at some point that if you put in like HTML tags, it would completely just ruin the rest of the guest book, but I never knew what that meant until much, much later studying this and being like, oh, that's essentially what was happening. Like, if you did an end HTML tag, it would basically ignore all the other guest book problems. So the other third way, so the important thing here, the way I like to think about these, these first two, where is the vulnerability in this code? The server side, in the PHP code, right? And again, if we go back to here, this is exactly the same problem that we had in cross-site scripting, right? In cross-site scripting, we had PHP code concatenating together strings in order to send to a SQL query, but here we're concatenating together strings to send where? To the browser, right? As part of the HTTP response. So here we're essentially concatenating strings together and we're doing it in an unsafe way where the user's data, what should be data, will be interpreted as code by the browser. So it's an important distinction and it's important that in both cases the vulnerability exists on the server. So I can go back a couple to the server side in cross-site scripting because that's where the vulnerability is and because that contrasts with the third type of cross-site scripting vulnerability and that's DOM-based cross-site scripting, which is, well, so the idea is so JavaScript, as we talked about, has lots of different functionalities. One of these is an eval function. What does the eval function do? It takes string, which is, you know, a string text and turns it and executes it as code, interprets it. And so now if the attacker can control that JavaScript, right? Like let's say it grabs one of the parameters and takes that and then injects that into the page or just calls eval on it, right? Now we can put arbitrary code in that parameter and now that is in cross-site scripting vulnerability, but where is the actual vulnerability like? Can you fix this with changes to the server side code? No, because the server side code isn't vulnerable, right? The server side code is not the thing that's turning text into actual code. The vulnerability exists on the client side, so I like calling these client-side and cross-site scripting because to me it makes much more sense because it takes a completely different mindset to think about these DOM-based cross-site scripting. I'll give you an example. Okay, cool. A little bit of another example, maybe a DOM-based XSS. So reflecting cross-site scripting, we saw it like this as we saw. When we go here, we have Adam. We can see him here. If we do reflect in XSS, it'll say XSS here. So by sending out that page, you put your clients at risk or... Which page? This page? Like in a client-side cross-site scripting vulnerability, you're putting your clients, the kinds of your site at risk to getting attacked. Yes, so for any cross-site scripting vulnerability, the end people who are going to be affected are your users. Okay, so the question is where does the vulnerability exist? Does it exist in the server-side code because it is incorrectly generating an HTTP response or does the vulnerability exist in the JavaScript code? Let's go over your example. I actually don't remember. We're going to have an example. So that's where I go on. So I'm going to go to this page and it's going to give me a constant output. Okay, so it's going to give me nothing fancy. There's nothing in here. It's not doing any server-side processing of code. It's always giving me a constant output. But let's say this one does something silly and it doesn't necessarily need people's help. What is it, locations? I think it's just locations about hash, right? Let's say this is a search chart. So let's say here it's like this. So we're talking about which part is this in the URL, in the URI, the fragment? What's interesting about the fragment? What is it used for? Sub-resource identification. Yeah, so identifying, so remember, a URI specifies a resource. The hash, everything after the hash represents the fragment which is the sub-resource. So what part of that resource? Realistically, it's used mostly in your browsers because there's an element with the same ID. So if you have a DOM element with an attribute ID equals food, it will automatically scroll down to have that be where food is. Now, the super interesting thing is browsers, because they know that the fragment is only meant for the client side, right? It only affects the user agent. Your browser never sends the fragment part to the server. So when you make a request for this page, the web server is only going to see a request for example.com.nom.html. That's it. So what this means is, so now if I want to execute code, do I do this? I hear no, why no? You don't need the script tag. Why? Because this is not valid JavaScript code, right? This is the HTML to start a JavaScript code. Everything between these tags is valid JavaScript code. So how do I change it? Get rid of those script tags. So now here, the problem is there's a vulnerability in the JavaScript code I'm sending to the client. And the super interesting thing part about here, and it's kind of a fine distinction, but when I sent this request, what did the example.com see as the URI they're trying to access? The entire thing with the script tags, right? So the example.com could actually be looking at their logs to try to see if there's any types of attacks like these. And actually, on the flip side, they're going to be attacked like this all the time. So it's kind of a fool's errand to look at all of them. But at least you have a log of this happening somewhere. What does example.com see in this case? DOM.html and nothing else. So they don't see any of this attack on the user. There's also other interesting distinctions here. Is there a question? Yeah. Apart from the URI, is there any other way for which we can take some script in the event? Yeah. Act. Oh, you mean from here? Yeah. Yeah. So this could be anything. This could be, I've seen, there's crazy examples of like getting tweets on a topic. Like taking a tweet or something and then calling eval on it. Or getting your user preferences as a JSON object instead of parsing it as JSON, calling eval. And maybe they're not encoding your value correctly when sending it back. I've actually seen that one in a pen test that I did. Was they, your preferences were, they posted, I think, as like an object, but they weren't validated as an object. And you were sent back whatever you sent back and they called eval on it. So you could create this object that had additional code after it so it would do basically two things. That was a really fun one. So in order for this to be vulnerability, you'd want to get something to pick on that. Correct. Just like in the reflected case. So you could, and that's also where it brings down a little bit. So you could have a DOM-based XSS that is stored because the JavaScript code is fetching it from a server. You could have it where it's reflected, where it's getting those parameters. You could have, you could, there is kind of this category of what they call self XSS where, like let's say it was the cookie value, right? Like to set a cookie, you have to be JavaScript executing in that same origin. So it'd be very difficult to get somebody else to set a cookie on your behalf unless you found this other weird functionality in the website that allowed you to influence the cookie value. I mean, that could be possible.  I think that's important here. We'll come back to it. Okay. Reflect the XSS so you can see something like this. Oh, that's a good one. So if you try this in your browser and you're using a modern browser, it will most likely not work. Why? Could you do something wrong? Probably. But then once you fix that, it still doesn't work. Yeah, they're doing something incredibly simple, which is they look at the URLs. If any of the URL parameters have script tags that are exactly the same as script tags in the response, they'll block that script tag from executing. So yeah, they do have very basic protection mechanisms against these super simple reflected cross-site scriptings, but not always. I mean, not all browsers, and not in the same way, and there still can be ways even around that. So you can try to evade those in various interesting ways. Sweet. I think we did all this. Oh, yes. So the other thing is, so we'll talk about attacks, right? We talk about, okay, what can the attacker do with this capabilities, right? So if you think about from the attacking perspective, do they want to send you inline JavaScript? Why or why not? What was that? It could have a lot of text. It could be really large, depending on what you want to do. Yeah, that would be one. What if it would be another one? What if they made a mistake? You guys never make mistakes? Yeah, so if we do, if we inject instead of an inline JavaScript, we inject an external JavaScript to something that we wrote, now that will be fetched and executed from each of the browsers that we exploit, we also may be able to get their IP address that way and may be able to get other information about that. The downside is it gives them a place to kind of lock and stop our attacks because we have to put some kind of source that we get in here. But maybe we can point it to like a, you can use like a GitHub gist or something like this, like a random one or something like that. There's probably ways to get around that. Okay, so what do we do, right? So we can, as we saw, we talked about we can steal cookies. If we steal cookies, then what? Because that user... We can try using those cookies to authenticate to that user to the website? Exactly. What else can we do? That's it? We can try to access some information in the database using their... Don't you mean in the database? Can we talk to the database directly? No, but we were, they had their user credentials. But we don't have their user credentials, but we're executing in JavaScript. Yeah. Can do basically anything the user can do? We can do anything the user can do on that website, exactly, right? Because we can inject requests to that website, asynchronous request, and every asynchronous request we make to that website, the browser will automatically send along the cookie, and so the server says, hey, it looks like this user is pressing this link or is requesting this resource, great, give them whatever they want. So we can fundamentally perform any action on the website that the user could perform. So this is insane, right? So this means any JavaScript code executing on your browser, we could... Any JavaScript code that's executing in Facebook.com could do anything that you could do on Facebook. You can post on your wall, it can post on people, it can message people, it can literally do anything you can do. The same thing with in your bank, if any JavaScript code is executing there, they can transfer money, they can do all kinds of nasty things. And it's coming from your IP, too. If you steal their cookie, they may be checking IPs. What if I wanted more permanent access? We have more permanent access, what are you talking about? You could get their password... How? You can make by using... Browser stores... Browser may store it, but you probably can't access it from JavaScript. You can access to the data. What was that? Get access to the data. What data? You can steal their cookie. You can steal their cookie, but that's not... Maybe they're going to wipe out their session, or maybe the session's only for like a day. I could create a pop-up with an Oscar password and then crack a pop-up. So you could create a pop-up that asks if they're using a password. That's good. What else? You can request for the reset password. And the reset password page usually asks what an email ID or who sent the reset password. But a reset password would have to go to their email address. So I don't think you as an attacker would be able to see that unless you can somehow influence where it got sent. Maybe you could use the application and change their email address associated with their account and then reset their password. Could you log their keystrokes if you got the script on the login page? You can definitely log their keystrokes on the login page. But to go up with... So to follow up with the pop-up, pop-up's a good starting point, but a pop-up would be suspicious, right? Because a pop-up, you know, no website pops up for using passwords except for terrible like SharePoint sites in ASU. But what you could do, you have total control of the DOM. So you can change the DOM of the page to be exactly like the login page of the website. And what's even more insane because this is happening over, let's say, HTTPS, you'll still get the green lock because all of that code is actually coming from that website, right? I almost said the name of the website but we're gonna just do it. Right? But the page will look like the login page. The only thing that will be different will be the URL bar at the top. Right? And again, you can encode that so it looks maybe more legitimate. Right? So imagine somebody sent you a link to, let's say, Facebook.com. You click. You go to something that's Facebook.com but it has the... But it's a login page, so you log in, you fill in the form, you hit Enter, and when you hit Enter, the JavaScript code now goes, or maybe it's key logging in, it goes in, it looks in the form, grabs your username, passwords, sends it to the attacker, and then goes and submits the form to the real login. So now you're actually logged into Facebook once you get in. All kinds of fun games for you, but in that way, and now if you're using a password, you can get in forever. It's not limited to a certain time frame. So yeah, I can send. So I have done this before now for Facebook.com but for another domain. It is super cool because it looks exactly... I mean, it literally is. You use the HTML content and all the style sheets of that website to make a login form that looks 100% identical to their own site. And then... Oh, I have my email address. That's nice. It's been my career. And then... So all I have to do is basically encode this here and URL code all this and it would look like kind of random gibberish. And maybe I can put something before this, like login.php and then something, right? Or I can change the URL link. So you can do really cool stuff here. So sort across that scripting. The idea is essentially as we talked about a two-stage attack, right? So you first, the JavaScript code that the attacker wants to be executed then an attacker themselves sends it to the server in an HTTP request. The web application stores it usually in a database but it could be a file or anything like that. Then the victim downloads and executes the code when another person uses that page. So all kinds of things are vulnerable to this. Stored XSS are really, really bad. And you actually get into this really interesting circumstance if you mix a social platform with a stored cross-site scripting vulnerability. So there was a case a long while ago back when MySpace was actually still a thing where a security researcher found a stored cross-site scripting on the profile pages of MySpace that anytime you visited an infected profile would change your profile to include that code that would infect people. And it would also add this and Sammy is my hero to the bottom of the page. And so you see in the span of 24 hours like how millions of people had this and Sammy is my hero at the bottom of their profile. So this thing's spread throughout the network. This also happens with Twitter, cross-site scripting vulnerabilities that are once in a while so Twitter will have something like this and it will just spread throughout the network because of course the first thing you do is you write a tweet that includes this thing, right? And then anyone else who sees that that's vulnerable writes a tweet and then it spreads vitally throughout the network. Okay, so JavaScript so actually getting to JavaScript execution is not always as simple as we have here a script text. So often web applications perform some kind of filtering or sanitization mechanisms and if they're the only way to be 100% secure to use something like this HTML special characters. There's a lot of different ways that we can execute JavaScript. So we can... there is now a... there is a cross-site scripting cheat sheet that you can go to that has a bunch of different cross-site scripting payloads each that have different characters and different types of things. You may not be able to use single quotes or double quotes so how do you get around that? All kinds of cool filters out there. There's also very interesting when we started digging around in there because some of these payloads are specific to specific browser versions so why is that? Yeah, so each browser implements HTTP... sorry, HTML parsing differently. So depending on what browsers do in the case of errors maybe they do something that you can actually take advantage of. And so this would be a simple type of thing. We can code it so any coding we can get around there may also be a web application firewall in the way. We can inject so the other cool thing is we may not even need script tags at all so if somebody is filtering on script tags like the script keyword we can use body so the body tag has an onload event and attribute that that value is JavaScript so whatever is inside there will be interpreted and executed as JavaScript when the body tag loads. Super interesting one so let's say maybe we can use bold tags if we use the on-house over event this is a JavaScript event that will fire when the mouse goes over that part of the page and so then whatever is inside the value of that attribute will execute. What's the downside here? You have to mouse over it so how can you help them? Make it span the whole page? Yes, this is actually a super cool thing to do. You can use CSS style sheets to make that element be the entire width of the page and you can even make it transparent so they can still look at the rest of the page and then as soon as they I think right when you go to the page if you don't move the mouse it won't fire but you move the mouse any pixel and that thing will fire which is a lot of fun to play with and then you can even have this JavaScript get rid of this element now so you don't have multiple events firing so you can do anything in JavaScript so you can then move that away and then the page will see exactly the same. This is actually one of the easiest ways of doing this that you get this auto-loading behavior so the idea is you create an image tag you create a source usually you want to you can put it to some file that doesn't exist and then image tags have an on-error handler which will trigger whenever there is an error loading some of the content and so that is JavaScript code in there that will run when there is an error so you want to basically include the image source to something that doesn't exist because when it doesn't exist that's when the error handler gets triggered and so this will happen automatically yeah you can even sometimes use interesting like you can try utf8 encoding part of this JavaScript you can even do this with so it seems like you need single quotes or double quotes but you can actually execute arbitrary JavaScript without like you can do without any single or double quotes in here so here I'm creating a string from a regular expression in JavaScript so it's turning this into a string atom and then it's alerting that up so lots of cool stuff and this is like I said this gets really really complicated okay DOM based so yeah the other term is third order I don't know we talk about that necessarily but I prefer client-side XSS so this this is an interesting different example so here we're setting the name to be the location on hash and then we're writing out using document.write hello name so what does document.write do it writes what ooh yes so it's it's writing to the document and what does the browser then do with what's written parses it as HTML yeah so it means any script types and then it will be it's a lot so we're going to something like this example.com test that HTML hash tag atom it when we go here into name and then it will print out hello atom so it will write out to the document hello atom now if we go to example.com test that HTML hash the script now why in this case did we need to use the script tags versus in the previous DOM we needed to just do the alert was it yes because we're using document.write the HTML parser is parsing the page whereas eval assumes that it's going to be JavaScript code that is parsing so the warble crossline scripting that I talked about so there's a case in 2005 was the sandy as my hero face a tweet deck there was a vulnerability in the tweet deck application in 2014 that allowed a warble crossline scripting vulnerability oh so this is cool so so the sandy as my hero had a he wrote a blog post all about what he found and so if you look this is a screen shot from back then if you look you'd see all these examples of this sandy as my hero and then you can see this one here is tech support got forms my stick it's got hacks and then even on NSN search which is a huge blackjack is sandy as my hero and so the other thing that they would do with them is they would all friend him sandy so all the JavaScript code would not only propagate themselves but also friend him and so he has also millions random requests here almost as popular as Tom so crossline scripting is a huge rabbit hole actually we're trying to close here now we may well we'll talk about it in a second but we may go more into depth in here we can look at all kinds of cool weird types of XSS payloads and those kind of stuff but fundamentally crossline scripting is incredibly difficult to prevent why client side is incredibly difficult so even thinking about client side crossline scripting is incredibly difficult but even just server side crossline scripting why is that difficult? yeah any every just like SQL injection every time you use user input in a query it must be sanitized similarly whenever you're using user input in an HTML response back to the browser back to the browser which is almost all the time right a lot of your content is going to be made based on user input now any of that can be used as a crossline scripting attack incredibly difficult to prevent because every single piece of data that came from the user right and this is where we talked about the injection vectors in a web application not only all the parameters but also post parameters cookies request headers anything from the database content anything from a file actually found back I don't remember I think it was probably I don't know there used to be this web music service that was eventually bought by Apple which eventually became Apple music it was this streaming music service and so I was using it and I found out that they had this functionality to upload your own music file and then I saw it get included in the website so I was like I wonder if I make a name of a song as script tags like an alert and I did it and it worked and so I got code execution there playlist so that I could send people the link to that playlist and then it would be basically a store cross-eyed scripting on anybody who visited that playlist and then I emailed them and I literally never heard from them ever and then they were bought by Apple so I'm sure they could care less and that entire website went away it was actually a really cool model because they had this thing where you could stream music for like 10 you could unlimited you could stream buy albums for dollar or so I don't know it was an interesting model anyways so this goes into the file content literally any place that user input is used and it doesn't need to be to that application it could be anything else they're pulling in any third party content languages so this is actually what gets to be incredibly difficult so let's go to the so we go here so the solution here is pretty simple we talked about it HTML special characters so let's think about a different name let's say like this let's say we'll do this so is this safe your instinct at first should be yeah right because I took something that was safe right I'm using the correct sanitization function and I just moved it right I didn't move the code itself where did I move it I put it into the ID attribute of a div tag maybe but let's let's try to force it to do can I add different attributes to this div tag what character would I need in order to do that double quote double quote so what is is double quote an HTML special character I'm actually getting an unknown character because I don't actually know what it does it almost keeps single quotes so single quotes so I can change my example there we go I'll go to the manual we also learn that in my class once again actually I don't have any question on me okay oh it doesn't do that only end quotes it's set because unless it's set wait it replaces it unless oh this one but only one yeah okay so it's a special option yeah so let's do change this because we know to HTML these are exactly the same right so if I try to do too much if I try to use our previous payload it will look something like this is this across that serving order movie no definitely not so now what character do I need to escape from outside of this attribute single quote and then what do I need based on the HTML spec to start a new attribute space well we'll be awesome there since we all know how to read you are not coding now percent 20 and then let's say I want on mouse over and then is equal sign in here no equal yeah the second single quote that's going to be added there but actually we try out the browser first but a lot of browsers are very tolerant of extra errors in there so it will just probably ignore that second one so now when we have HTML special characters applied in here does anything get changed so now the HTML that gets sent back to us is going to be this and now how do we execute a JavaScript on this page yes so we successfully perform a cross-site scripting attack even though they're using sanitization what seems to be correct sanitization so what's the problem yeah so fundamentally well the ID so the problem is right when the user input was being output in between tags right here what the attacker needs to execute JavaScript is an opening script tag right fundamentally you can actually fix that by just changing every less than symbol to ampersand LT semi-colon maybe that may not be 100% secure can't remember but anyways that's the character they need they need a less than symbol in order to transition the parser to start interpreting a script tag but here now when I move that exact same what does the attacker need to break out of where I wanted that to be a single quote which they may not be which the sanitization that I'm using may not be encoded correctly so this is actually I really believe is the fundamental reason why cross-site scripting is still so prevalent today and still occurs even on Google products right I believe it is not only that you need to sanitize all of the user inputs but you need to sanitize them for the context they are used in the HTML that you're generating so things that are used in an attribute need to be sanitized differently than things that are in between tags let's look at another example because I actually really like these examples so what's the purpose on this code why would somebody write code like this it's easy it's easy to do what but what's the why are they doing what is the purpose of writing code like this I know in this style it's easy yeah so I think the general concept is to put some value that the server knows into your JavaScript code to make it more dynamic exactly so the idea is like the username like putting the person's username into a JavaScript variable that JavaScript can use to manipulate or do something like this the good ish way to do this is to have a JSON endpoint or some JavaScript object that you can fetch to get all these values as we'll see but here this is a very natural thing to do you're essentially passing some data that the server side code knows and trying to pass it to the client side code that's going to execute on the user's browser correct so this cannot go on right so that when the user fetches and requests this page right the PHP code will be at whatever the view parameter is of get so like let's go over a a non XSS who do you guys think that's not so when we make this request is this what we're going to get back no why not the PHP code executes at that point then it gets this parameter here csc545 gets the value here passes it through the HTML special characters function which doesn't change at all and then it passes the echo function which means this entire thing is going to be replaced with this so this is the result that our server our browser will see that right the server doesn't know about any of the PHP code that's happening and now this job is going to add like a dot dot dot here this is not interesting but there's something else actually like this so let's think about this can I do this can I do this HTML special characters will make sure that all of my script tags are turned into HTML entities exactly but this would not work so we get I mean I don't want to do it and do all the other ones but you can you can write this code you can actually run these programs it's not it's not very difficult so that's not going to work so that's what I do can I just do this what do I do with this it's going to crash about this pretty well sometimes if you ask questions you don't know the answers to get good results exactly some name will be this string in here just like this right the important thing is now we're not talking about the HTML parsing we're talking about the JavaScript parsing because JavaScript is going to parse this and it's going to say okay we have a variable name and it's being sent to this string great so now how do I get it to actually execute my workshop then yes we're using something inside eval and close with new single code and plus so we've got cabinet something with eval but what are you doing I don't know what it is so this is like single code plus eval and then your JavaScript code and then ended with plus and single code like that let's get this in here and put this in here so what's going to happen so are we going to call alert 1 it's not this string though yes we'll still call it first though so we'll try to mechanic these strings together we'll call the eval function but before we do that we'll call alert 1 which I think return null or undefined and so we'll try eval the string undefined which I know will probably do nothing so we actually don't even need this eval here right but because why why don't we need the eval yeah it's going to run alert 1 as a function because it's JavaScript because we are injecting into JavaScript code exactly we are already executing JavaScript so we get rid of this get rid of this we also need to no not you again we also need to make sure that the URL includes these pluses otherwise they would end up as spaces so this would be something super important but we would see something like this and so now we'd be able to execute so let's say we don't want to do alert 1 we don't want to do the pluses we want to execute some arbitrary statements what would we do yeah use semicolon so oops I use a semicolon I can do alert 1 I can do alert 2 but then what do I do afterwards so just like single injection everything that I put would be appended to my query yeah so I can comment it out that would be a super easy way to do this so I would go into here and so oh let's see this isn't going to fail right because we have this well it'll have this single quote all the way over to here right so we didn't actually execute anything but you know I didn't include that here okay the name is there alert 1, alert 2 alert whatever we want as much JavaScript as we want here and then this will comment the rest of this code and so we're going to go so this is kind of what I consider as dynamic JavaScript so you're so this is not a DOM based cross-site script and why exactly the JavaScript code itself is not turning a string into code where is the problem then PHP PHP code exactly and this PHP code needs to know that this context that it's in is not in between two text two HTML tags it's not inside of an attribute tag it is actually inside of a JavaScript variable which means different escaping than all of those other ones combined all of these is this kind of set in much more verbose way of what I just said here so all of these different this kind of lists all the different contexts that context context context that you can have JavaScript and that sorry you can use user input in HTML and different characters that must be escaped depending on the context yeah super interesting so there we go all right so the other one there is a really good prevention in Gigi the key about preventing JavaScript is you should never try to do it on your own so you should go back to the so part of the problem is often times people want people to use some HTML not people to be able to write bold tags or write links or something like that but they don't want them to be able to execute JavaScript but that's a very difficult problem and it's very hard to get right so you're much better off working with black lists okay cool any questions on the processor thing stop all right what do you want to do on Monday review what do you want to review well how do you I'm not going to you can ask questions so this is what I was thinking we can either do I could either prep something about let's say XSS or Siebel Injection or maybe I could talk about current modern defenses against all these things I could talk about like click jacking or frame jacking I could talk about attacks like this or we could do maybe in class web hacking or something like I can send something up and we can try that I think that one sounds fun right less work for me and lots of fun for everyone okay so bring and that could be good prep for the midterm so bring bring your laptop I'll try to send an email but bring your laptop install docker on it if you can because I have the vulnerable web app I wrote for the the the that we can use and play with so that should be so we'll do that on Monday


In this discussion, we will discuss the discussion question of describe gross profit and how it is used. When considering gross profit, we're talking about a term that will be used for a merchandising company. And gross profit is going to be included in the multiple step income statement. We don't see it for the service company. We don't see it in the single step income statement. And it is comparing the sales less the cost of goods sold, giving us the gross profit. So it's going to be, and we might want to be more specific, we could say it's net sales rather than sales, meaning it's sales less the returns and allowances, which is really kind of the same as the sales number because the returns and allowance are contra sales accounts. So it's really kind of sales or net sales minus the cost of goods sold. It's going to be an important calculation because the relationship between the gross profit and the cost of goods sold if we sell merchandise is going to be huge. In other words, the cost of goods sold is the expense related to us selling merchandise or using the inventory asset of inventory to help generate revenue. And so that's going to be our one of our hugest expense, probably our largest expense if we are a merchandising company. And therefore we want to see that specific relationship related to the gross profit. And we can also use a ratio and take that gross profit divided by sales and look at what we're walking away with on a percentage basis after each sale. So for each dollar sale, how much are we getting in terms of gross profit? Often a useful number for when we're going to be analyzing a company that sells inventory. And then of course, once we have the gross profit, we will be reducing it to get to the bottom line of the income statement by all the other expenses and that will be the all the other operating expenses to get to net income at the end of the day. So gross profit is going to be that major one major component, one major step, one major breakout that we will have in the multi step income statement along the way through the path to the net income.


We started 2015 off with a reboot, cleaning up after all the holiday food, one full month of only drinking juices, a lot of juices, and business as usual. Take your time Google, we will wait. Meanwhile, we went to see what happens with our electronic waste. We wanted to go to the beach. We're going to the beach today, to beach day! But realized this whole plastic problem is pretty serious. I did some talks about my work, we had to say goodbye to Frida, I got my first toot hole ever, made a realistic lunge, learned to ride this thing, well sort of. In the meantime, I'm two years without shampoo. It was my first time wearing a tuxedo, and we really wanted to go into North Korea. We got super close, but it didn't happen. Saw this guy, prepared myself for my midlife crisis, and we woke up at 6 in the morning in Africa. We heard some noise. I saw this little guy in front of our door. What I love here is that you can see stuffed crows. Avocado! Cacao! It's weird and jelly from the inside, and this little bean there used to make chocolate. And the biggest discovery of all is when I realized there's actually soft fresh coconut, which is so much better than all those dry brown ones. If you ever see them, get it. Or just buy them somewhere, they are awesome. Meanwhile, I launched Storyhopper, a place that collects stories worth sharing, compressed into a tiny YouTube video. But by far, most time this year is spent in this workspace. Together with Alex and Kees, two heroes helped me out developing precious plastic, making a lot of prototypes, tests and improvements for the plastic recycle machines. We shredded a lot of plastic, and this big project will be online soon. And finally, we build ourselves an online community. If you ever want to get involved in our projects, or have a chat, go and hang out here. See you next year!


This is stock number 20T61A. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used light-duty truck headquarters today. We are checking out this 2010 Chevy Silverado 1500 crew cab short box. This truck has the 5.3 liter V8 motor. It has been fully-safetyed and inspected by our service shop. Has a fresh oil and filter change. All the fluids have been checked and topped off. This truck's 100% ready to go. Top gray is the color. We shoot all of our videos in 1080p 60 frames per second. So if you have HD capabilities on your computer tablet or smartphone device, turn them on right now because it is like you're right here looking at the truck with me. And definitely your best way to ensure the quality and condition of the vehicle before seeing it in person. And if you want to check out all the photos on this truck in the upper right hand part of your screen is a link right to our website. Click that and check us out there. Has the Z71 alloy rims. Firestone Destination 26565R18 tires with right around half the tread left. Front fenders in pretty nice shape. Didn't see any major dents or dings on that. Has the factory fog lights, painted front bumper. Couple of little rock chips and stuff on there but nothing too bad. Painted grille. Has a nice chrome bug shield on it. Passing her side. Front fenders in nice shape as well. And the passenger side rim. About the same condition as the drivers. As you go down this side the truck take note of how clean the body is, how reflective and mirror like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down but you're still interested in purchasing the vehicle. You can see the vehicle, hear the vehicle and have confidence in what you're looking at before you even get here so that when you get here there's no surprises. That's why we offer the Summit Auto Fastpass option in the upper right hand part of your screen. Link right to our website where you can apply for finance and get pre-approved. Even appraise the trade if you have one. Off from the comfort of your own home. Back rim. About the same condition. And back tires have just as much tread as the front tires. Frame and underbody. What you'd expect on a hundred and thirty thousand mile truck. Lower rockers all look really good. And it does come with those factory chrome step bars. As we come around to the back of the vehicle, rear bumper is in pretty nice condition. Has a towing package which includes a receiver hitch and seven pin wiring. Tailgates in pretty nice shape. Has a little bit of bubbling on the bottom but that can be inspected on a 10 year old vehicle with a hundred and thirty on it from Wisconsin. The tonneau cover. Didn't see any rips or tears on that. And it does come with a factory GM drop-in bed liner. Tailgate shuts nice and solidly and that is a locking tailgate on there. Does come with the bed rail covers.  Pretty clean on this side. And for full disclosure this back rim. About the same as the rest. Down the rest of this side. Pretty good condition.  There are no rips. There are no tears on the seat. It does come with side curtain airbags. And power driver seat. We have factory all-weather floor mats throughout. Auto headlamps. Aftermarket brake controller. Information center controls. And power windows power locks. And power mirrors. As we hop inside the truck here you can see that this one indeed does have a hundred and twenty nine thousand seven hundred and forty six miles. Instrument cluster is very nice and clean. You get the Z71 instrument cluster with the background there. Leather wrap steering wheel. Bluetooth and audio controls on the right. Cruise controls on the left. And this one does have the six speed automatic transmission with the optional tap shift. Turned out four wheel drive. This one also has remote start on it. AM, FM and Sirius XM radio capabilities. And it does have a CD player and an Augs jack. Dual climate control. Stability control. And you do get a USB port right there as well. Carpeting and passenger side floor mat are in excellent condition. Passenger side seat is in excellent shape as well. I don't think this truck's ever been smoked in. Headliners nice and clean. You do get map lights up there and home link buttons for your garage door security systems and lighting systems. Also comes with on-star capabilities in that review mirror. And we'll take a quick look at the back seats and then check out under the hood. You do get the 40 20 40 split bench seating in the front. And the back seats are exceptionally clean as well. Latch child safety system. Fixed glass rear window with the built-in rear defrost. Seats are really really nice back here. They do fold up for extra storage. And the carpeting and everything is really nice back here. Thing I like best about these seats is they do fold down like so. There's no lock or anything and you do get the all-weather floor mats back here. Child safety locks on the back doors. And the kick plates all look really good. And we'll take a quick look under the hood. I would personally like to thank you for checking out the video today. And hopefully from this HD video. We've been able to tell the overall condition of the truck so you can make a smart buying decision. Under the hood we had the 5.3 liter V8 motor. Engine base very clean runs very smooth. This truck has been fully safe and inspected by our service shop. Has a fresh oil and filter change. All the fluids have been checked and topped off. Truck has been gone through mechanically 100% and is 100% ready to go. See more pictures of this truck or one of rather 450 new and used cars, trucks, SUVs, minivans, Wranglers, half tons, two quarter tons, one tons. You name it we got it go to our website www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at summitauto.com. If you'd like to check out more HD videos you can go to youtube.com slash summit auto. Remember to like subscribe and share on this video and all the videos that you see there. In fact in a second you will see a link to subscribe to our YouTube channel on your left. A link to more Chevy half ton truck videos like this one on your right. If you have not been to our website on the bottom link to this vehicle on our website click those check us out and we really look forward to helping you with this 2010 Chevy Silverado 1500 crew cab short box LT1 Z71 in top gray metallic. Thanks again.


How does a 144-year-old institution continue to remain relevant? Now, let me welcome Mr. Pundi S. Sriram. Please put your hands together for him, Chief Product Officer of the Hindu Group. He will be disclosing all the secrets. Please, sir. And among the whole storm and all Andhi Tufan, since the morning, I've seen one person who was just calm, still calm. I'd like to welcome Sneha Walke, National Director of Growth and Strategy Exchange for Media Group. Please put your hands together for her. She'll be accompanying Mr. Pundi Sriram for the session. Thank you, sir. Sneha, thank you so much. And thank you. Please, bigger round of applause for her. She is the one back born behind this. And thank you, ma'am. Please take it over. Thank you. Thanks, Anupam. You called me calm. I don't think my team agrees with you, but thank you for the compliment. Namaskara. Can everybody hear me at the back? Yes? OK. Actually, I wasn't checking the mic. I was checking whether the Bisibele Bhat and the Chicken Biryani have worked, but it doesn't seem like they have. So thank you so much. Good afternoon, Mr. Sriram. How are we today? Good afternoon. Thank you. Thank you for this wonderful event, and thank you for having us be a part of it. Most welcome. Ladies and gentlemen, not very often do we get to hear from somebody who's managing or who's the chief product officer of a 144-year-old brand. I don't think many of you have missed this, but the Hindu celebrated its 144th birthday, 144. 144th birthday earlier this week, and they did some very cool stuff in that birthday celebration, like dropping newspapers through drones and all of that. First of all, a big round of applause for the 144. I don't think 144 years ago there was anything like a title like Chief Product Officer.  And today, Sriram, you have this huge responsibility of carrying this legendary brand on your shoulders. So let me rephrase and ask you this question again. How are we today after the launch? After the launch, actually quite relaxed. It's been a very, I would say, very successful launch. I don't have to bear this burden alone. I have a team of wonderful people that's 2,500 of us who all carry that load together. But you're right, it informs every decision we take. We have to be extremely conscious of the fact that this is not a little change of font. It's a change of a legacy of 144 years, and it's got to have a very good reason for why we're doing it. Every one of our decisions has to be informed by the heritage and the legacy of the brand, because it means a lot to our readers and our consumers and people who have been with us for all these years. So this launch has been good.  Don't hold your breath for drone delivery of newspapers anytime soon, but I think that was a very cool little thing we did, but feedback. It went viral, right? People have been sharing this, and maybe sometime in the future you could get drone delivery, but it's a little easier to read it on your mobile. So we won't go there yet. Since you mentioned reading on mobile, so I'd like to, perhaps I've not done this and I'd like to do this, formally introduce Mr. Shiram. So he's the Chief Product Officer at the Hindu and it's also, as the business head of a division called Step, and I believe you are interested with the responsibility of creating high impact products across the Hindu group. Mr. Shiram has been an entrepreneur himself. He's also been consulting with a lot of Fortune 500 companies on corporate strategy. So lucky to have you here, Mr. Shiram. We are very excited about this few questions. Some of them perhaps difficult, but let me start with the most, I think fundamental question. Newspaper relaunches. There's a lot that goes into it, monetarily, energy-wise, bringing lots of different sets of stakeholders together. What prompted or what motivated this relaunch now? Yeah, interesting question. See, fundamentally, a lot has changed. The last time we, the Hindu has been redesigned about, I think this is our 9-3 design in those 144 years. So it's not something that happens often. In fact, I don't remember the last major redesign of any paper other than the Hindu in India might have been around 10 to 12 years ago. So this isn't something that we do often. And then it's actually a fairly complex thing to do. We don't think about this every day, but the newspaper is a new product every day. Like every day, we have to put out a product that has no resemblance to the product of yesterday. And this is true for other media as well, of course, but in the newspaper business, it's complicated to do that because you have to create and design a structure that will work for every one of those situations. That's what takes this kind of effort. So newspaper redesign is a pretty complex affair and we don't get into it unless we absolutely want to. So what prompted this redesign? If you think about, the last redesign was 2017. And in the last five years, the world, the earth has shifted. A lot has changed in these five years. Consumers have changed in terms of reading habits, in terms of how they access news, what kind of news they have access to, how they want to access it during the day. It's no longer, I mean, it hasn't been that way for 15 years, but it's even more so now that the newspaper that you get in the morning, you already know all the news that's in it, right? Because you got it on WhatsApp from your grandfather and you got it on Telegram from your son and you got it on late night news with Arnab Goswami. My five family groups, yes.  You had all of this, right? So you already know what news is gonna come. So what can we do to make that news special? So that's a big part of what we had to think about. We said, the world has shifted in these last five years. Consumer preferences have shifted. And it's important for us to meet our consumers where they are and bring to them something that they've gotten accustomed to in the digital world. So some of the principles that we had going in were how do you make this more colorful experience? How do you allow users to, or I should say readers, to have more of a browsing experience in your newspaper? Skim through a lot of stories and dive deep into those stories that you think are really important. How do we create that kind of experience? So when we said, that's the kind of experience readers are looking for, we realized that that's not the experience we were offering. So that's really what prompted it. It's a big exercise. I mean, in eight, nine months later, here we have a completely redesigned newspaper. I think the AV kind of highlighted a few key changes, but if you could throw some more light on it, what specifically has changed? Yeah, somebody called this the Instagram style of news. So I think one of the big changes you'll see, whether it's a business line or the Hindu, is a lot more imagery that we're using. You'll see that we have big promos, these big square promos that consume like seven, eight centimeters at the top of the page, that call attention to you. The news is calling out to you to read in the same way when you scroll to Instagram, we're calling out various influencers or family, are calling out for your attention to watch what they're posting. So there's a little bit of that, that's a big shift, both on the front page as well as on the inside pages, there's a lot of that. I think a lot more use, just use of images and infographics, not just in the format. I think another big shift for us is the use of white space. This is really underused in design of course, and in newspapers because every page and every square inch of newsprint counts and it costs money, so it's a bold decision to take. But a lot more white space to draw attention to the things that matter. We want to be able to say this is our lead story for this page, this is the second most important thing you need to know today, and these are the next five things you need to know. This kind of hierarchy that we create with white space and the use of imagery is not easy to, it's not easy to create usually, and it's from a reader's perspective, it directs them through the curated experience of a newspaper, which is what they're paying for at the end of the day. So this is another big shift for us, the use of white space, all of these imageries. A lot of users have told us about readability, a lot of people are used to reading larger fonts on their phones, so we have made the typeface a little bit bolder and bigger. And we've also done something interesting, I think if you see the newspaper today, you'll see two line and three line headlines. This is not something you often see in India. So this is partly to enable users to browse through the paper. You can read the headline, if that headline interests you, you can read the strap line below the headline, that's another two or three lines, and if both of those interest you and you still want to read the article, you read the article. You don't have to read the article to get the full gist of what it is we're saying, right? So this is a completely different type of storytelling that we've now embarked upon this direction. Not without resistance from our editorial colleagues, but we've had to go in this direction precisely because this is what our readers and learners want. So I think it's also prompting a lot of rethink. I think after the, if you look at, I think it was there into the Bangalore paper as well this morning, but if you look at today's paper, you'll see something interesting. We did a, the top is a L, right? An inverted L shape, and probably for the first time in my memory, there is a cinema story on the front page of the Hindu at the bottom, at the top left. It's still a very Hindu cinema story. It's about the French director Godard who recently passed away and has impact on cinema, but it's a cinema story on the front page of the Hindu where it would be news and politics and almost nothing else. Maybe India winning the World Cup, right? That's about it. So we're also learning to play with content in a different way to be able to fit all of these new formats in and work with the new formats, allow this kind of different presentation, right? And that's a big part of what you'll see in this new paper. Business line of course is another big, big, big shift. I think if those of you are used to reading business line, you'll notice that the new design is a much more younger, much more vibrant, energetic newspaper, a lot more color. It's not just grays and blues or grays and pastel blues, which is what we used to use before, much. And I think that reflects the, I mean we're 144 years old, but we want to be young. And if you look at the Indian economy today and the stories that the business line tells, it's telling stories about a young, energetic, vibrant economy. Business line needs to reflect that energy and vibrance of the economy, and that's part of the spirit of that redesign. That's the other part of why we did these redesigns. And I think you will see in the next few months, we'll also do something similar around two of our magazine publications. And I think people are gonna ask, really, are magazines needing to be redesigned today? And I think they are. Sportstar and Frontline will go through another redesign over the next four to six months, and we'll see there as well some very fresh ideas and new things that we'll do for the younger digital age reader, but also for our traditional reader who likes what we've been putting out. Nothing changes from that in terms of quality or content, but how they consume it will change over the next few months. Nice, I think you gave us a piece of breaking news here saying that there are some more, so my editorial colleagues here will perhaps pick it up. Since morning, we've been listening to a lot of marketeers, a lot of brands talk about customer experience, customer experience across this whole, the omnichannel way, right? So across multiple platforms. When it comes to a media house, I know you just spoke a little about it, but how are you making it apart from the font, apart from the wide spacing? How are you ensuring that your customer experience across platforms is something that your readers look forward to? Yeah, interesting. Today, Hindu has, I don't know, about 200,000 subscribers. It's like digital subscribers in addition to our new circulation. In fact, a lot more people read our content online than they read in print. There's something that we often don't think about, but a large number of readers who read our print content also then go and read online. And vice versa. People who read online first will come back and read the story the next day again in the paper for a different reason because we would have updated it, or what have you, right? Or they want to go online and watch the video interview of what they just read. So there is a lot of interplay between our print and digital readership. They are active. And because of this, we also want to give that experience. I think we may be inventing ourselves into becoming a younger and more digitally savvy brand, but at the same time, it's the 144 year heritage and legacy that we talk about. Even when you're online, we want you to experience that. So bringing more elements of that, just like I said about bringing more of the elements of the Instagram digital world into print, we're also bringing many of our print elements into that digital world in making. In fact, I was kind of sitting there and smiling as I saw. I don't know how many of you noticed this, but that experience where they showed on that video, the, you scan a QR code and you go, it's almost like you haven't changed screens, right? You scan the QR code on print and you get almost the same experience as soon as it pops up on your phone. And this is the kind of experience we're trying to create because readers aren't thinking of, they want news from us, they want content from us, they are readers are platform agnostic, they are going to consume it on whatever platform is most useful and convenient at this point. And we should create that same brand consistency, product consistency and consistency of experience for users across all of these platforms. So that's a big part of this effort and redesign, everything from that Instagram style of storytelling to the opposite, which is using some of these traditional print elements, which you will, well, we have a digital redesign as well that we will be doing. And you'll see things like drop caps, which even newspapers have dropped, we're going to bring that back into digital so they get a little bit more of that experience of, you know, I'm not just reading a article, I'm reading an article from an established authoritative source, that is a newspaper, right? And that's part of all of that connection that we're building across platforms and across media. Wonderful. You mentioned about this, some concerns that came up perhaps from the editorial side of, and you have a very strong editorial ethos. So on this entire revamp, you worked with Dr. Mario Garcia, and for those of you who perhaps already have heard about him and those of you who haven't, Dr. Garcia has worked on about 700 odd publications, you know, which include newspapers, websites, magazines, and helped them revamp themselves. These include like, you know, The Wall Street Journal, The Washington Post. So working with somebody like that is like working with a legend. And how was it working with him? Yeah, it's exciting. It's helpful to, Dr. Garcia is 78 years old, right? He's dynamic, enterprising, and he moves faster than any one of us in this room, right?  So he told us when he came in that, hey, let's get started. The Hindu is my 749th redesign and the business line is my 750th redesign. So I have forgotten more about newspaper design than any of you guys in this room know, right? And I think that was a, and that's true. And that's true. When you talk to him, he, in his experience, I mean, I won't get too technical, but one of the big changes that he shepherded the Wall Street Journal through was the change from print to black and white to color. Right, so these are, this is three or four or five different generations of change. And this current change of taking a newspaper and building it for the new mobile first digital age is something that he's thought about in a lot of detail. He's done this in other places, but this is a very, very, very unique thing that we're doing with him in the last minute. And he's an inspiring person, both from a design perspective, as well as his encyclopedic knowledge of how design and content work together in this whole newspaper and media world. It's incredible. Was there some referencing to some international publications or was some part of that conversation also around that? Yeah, yeah, of course. I think we look around the world. We see, you know, papers like The Guardian, the papers like The New York Times that have very well navigated this change. Right, their print publications are still as good as they ever were and they're continuing to grow and their digital publications are also reflecting everything that that print publication was famous for. Right, so those are papers we looked at. A lot of other designs that he's done over the years like Wall Street Journal and all of that of course inspired these. But these were two that are particularly important for us. In terms of feedback, I know that I'm sure there must be some kind of feedback that you would have arrived at from focus groups, from readers. Could you share a little about how you bring together this feedback or how do you collate this feedback both before deciding about the event? And I know it's too early to ask, but what has been like the kind of feedback in the last few days? So the interesting thing I'll tell you is if you look at the paper today, you'll see all our readers' feedback. We're just publishing everyone whether there's good or bad. Without really any editorial thought on whether we should publish this reader's letter to the editor or not. And surprisingly, I mean, not surprisingly, it's been good. It's been excellent. People, a lot of people welcome change in any number of ways. They welcome change in this as well. A lot of people have said really good things about the increase out of color, more white space. They find that the 1,300 word editorial is not as intimidating in this new presentation and they are moving to read it more. So a lot of positive feedback from that front. How we got here, I mean, usual slew of things that you would do as a product person, you've done surveys, we've talked to customers about collecting feedback. We have a reader's editor who gets feedback continuously. And our inboxes are always open, so we hear a lot of feedback. I mean, some companies struggle to do surveys, but when we ask our readers for feedback, I have to turn the survey off before I can turn it on literally because that's how much volume of feedback we get from our users. On the day of your launch, I'm sure that you would have got feedback from a lot of, because there was a lot of mention about making the Hindu more youth oriented and you met with, I think, the most youthful personality of South India, then actor Rajnikant himself. So you met actors, politicians, celebrities that day. Any first thoughts, any feedback there? Yeah, many of these people, interestingly, have grown up with the Hindu. Right. And so I almost want to say that feedback isn't honest because it's a very emotional feedback. It's not a feedback on the product, it's feedback on the brand which they connect with at a very deep and emotional level. Right. So they are great things to say across the board, whether it's politicians who've grown up reading this or Rajnikant and Kamal Hassan. The other thing that we hear a lot about is, oh, I grew, I learned English through reading the Hindu. This was an important part of my life and it's where I am in my career because of this. Or when we talk to people in the civil services, IAS, senior government officials, they'll say, I'm in this job because I used to read the Hindu every day. That's how I prepared for my civil services exam. So there's a lot of different types of feedback that we constantly hear. It's humbling, actually, as somebody that collects all the feedback and collates it. Yesterday, I had this one note from this gentleman who says, I've been reading the Hindu for 77 years. Right. And he had this beautiful note and he said, at the end of this note his last line was, and then my grandson came up to me and said, Tata, where are your glasses? And that's when I realized that I'm reading the Hindu without my glasses for the first time in 20 years. So I thought that was a very, very cute and smart note from somebody who's been reading this paper for 70 plus years. It's great to be able to do something for some of those readers. Nice, very nice. Revamps are usually targeted towards two groups. One is the readers that you mentioned, but a major focus these days is also advertisers, brands who come to you who want to use your platform. So what has been their feedback? What is it that you're doing through your publications for them? Yeah, actually, we didn't forget about advertisers, as you can imagine, through the three design. No, a number of things. Of course, one of the things that advertisers value about the Hindu is the reader connect that we have, right? This is fundamental to who we are. And everything we've done is around building a better, tighter relationship with that reader. So that's definitely a part of what we have to offer for our advertisers. But there are also some very tactical things. You will notice in today's paper, for example, there is a big sky bus on the top. And we've actually given more space for the sky bus. You can build a bigger, bolder ad right under our masthead. That a lot of advertisers will find very valuable because it catches the attention of the user. I think that's one example of a change. I think the other big shift is all the white space, it's not just for, the content is not just the articles. The content is also the advertising, right? So the white space also brings advertising to the fore just in the same way as it brings content to the fore. So we think these are things that advertisers will appreciate over the next several months. We'll see the impact of some of these things playing out. Very nice. Shriram, I won't let you go without maybe two to three personal questions. This is the Pitch CMO Summit South. So I have to ask this question to you. I come from a place called Belgam, and it's a town on the border, the Karnataka Maharashtra border, and it's known for something called Kunda. You come from a place called Pundi. What is Pundi famous for? So Pundi is a small, it's a small village about half-favorite in Bangalore and Chennai. So what it's famous for, I mean, the one thing I can think of is the suite we call Manoharam. It's, I don't know how to describe it, it's like a chuckly, or a murk, but dipped in good. Right, so it has a... Do we want to have an audience poll whether between the Manoharan and the Kunda, which will win, but I don't know because I've not eaten this. But lovely to know that. Yeah, yeah, lovely to know that. A book that has stayed with you, Shriram, because you're the chief product officer, you would be reading a lot about innovation, about product, about strategy. What is a book that you've perhaps read and stayed with you for a long time? Yeah, maybe the one example that, maybe it's not innovation and product and strategy, but the book that I go back to often is this Thinking Fast and Slow. It's interesting, and it's I think very useful for both marketers as well as for product people and really understanding what users and consumers do. I'll tell you one interesting thing I find. A lot of our users have an instinctive reaction to our product. So among all this good feedback we got, we also got feedback that said, we don't like the new fonts in the Hindu. And you know what? There are no new fonts in the Hindu. It's the same exact font, but something that we did somewhere told the reader that something has changed and made that reader uncomfortable. Now I had no way of knowing what that's, in all the hundreds of feedback we have, that's one example. You will hear, but I think the interesting thing about Thinking Fast and Slow is it understands how you appreciate those inherent biases in humans, right? There is a sense of, there is often the decisions we make are often because of inherent biases that are within us, just like that user, right? And understanding that what is a rational decision versus what's a biased decision is something that's really, really helpful from a buying or marketing or from a product point of view. I think that's something that I keep going back to.  As somebody who is the chief product officer, what is one product? And it could be across any category, anything, that one product in, say, recent times that has made you stop in your tracks and say, wow. You know, there are a lot. This morning, I wanna say, this morning I was discussing this with my colleague and we looked at the telegraph in the UK as a newspaper, right? And it is extremely well-designed as a product. That's an example. Can I go back to Manoharam? That's a product, that's a product that makes me stop every time. No, there's definitely all kinds of, you know, I'm studying these things all the time and there's all sorts of products that we can draw inspiration from. There was somebody here today. I find Swiggy is a very inspiring product. Yeah, John was here for Swiggy. I find Swiggy is a very, very inspiring product in terms of how easy it is to use, convenience and what length of change they've brought about in life. So there, I give you three examples. Yeah, you spoke of Swiggy and you spoke of Manoharam and my mouth is watering even without knowing what Manoharam is, but thank you so much for this interesting conversation. Thank you. And I'd request my colleagues to play the business line AV because I don't think we've seen the changes in business line, so if we can also play that. Yeah. Change is constant. We are living in a fast-paced world where business is constantly evolving, embracing the one constant in business, change. Introducing the Hindu business line's new look, a redesign that draws parallel to the new age of business. Say hello to a premium news reading experience with an enhanced visual design upgrade and reader-friendly features, a design that will make analytical and explanatory journalism an indispensable must-dreamt. Our brand-new masthead reflects the spirit of our young and vibrant nation. Lesser, sharper edges reflect a soft and relaxed stone, a reminisce of the past and a mark of change. The new logo is a contemporary design that gives the best of both worlds. The concentric circles show how BL has the last word on business reportage. The gray background, red pointers and a large image at the center highlight the best stories of the day, giving the attention they deserve. Headers are now in a distinct red color, big impactful pictures and more visual elements. Clearer content hierarchy and demarcation. Shift to a more digital-friendly brand identity from business line to BL, a reader-friendly design that separates the content from the daily business report. Cross-platform navigators to aid content discovery. Portfolio is now a visual treat with more of a magazine-like look. The reader will be taken into a depth of infinite information aided with powerful visuals. Now standardized to the color family of blue, the BL graphics are dynamic and direct. Layout is now made vibrant, bolder and smart with more emphasis on the magic of white spaces. A page aligned to such perfection, giving the readers the most enjoyable and organized reading experience. Text and visuals blend like magic to carry out storytelling in the same intuitive way in which we communicate via text messaging. When entrepreneurs make bold decisions, our font matches them. When markets become vibrant, our ink shows it in our changing colors. Business is evolving and so are we.  Business looks good. Thank you so much, Sneha Ma'am and Sri Ram. So please step on diaries and Sneha Ma'am, if you can thank him with a small token of appreciation. Thank you. And once again, please put your hands together for Mr. Sri Ram. Thank you for being here and thank you for sharing your insights. And thank you, Sneha Ma'am as well.


People in the Hunter expect the University of Newcastle to be a leader. Our students expect us to lead. They want us to take action on climate change. In 2019 the University of Newcastle developed our new Environmental Sustainability Plan. It's guided by the United Nations Sustainable Development Goals and we have committed to becoming carbon neutral by 2025. We have a very clear road map of how we're going to deliver that. So all of our sites are now powered by renewable electricity and we've signed a seven year or 48 million dollar contract with red energy to supply all of our sites through wind, solar and a mix of hydro power. The University's carbon emissions is around 52,000 tonnes every year. It's now been reduced by 70% down to about 17,000 tonnes. We have over 2 million trees planted and we've also set aside around 30 hectares for purely conservation purposes. We plant 2,500 native endemic seedlings across our campuses every year. We know that we're now sequestering around 230 tonnes directly to mitigate the impacts of climate change. So our food organics is collected on campus. It's sent to a facility where it's processed to generate renewable electricity as well as composting material. Our Environmental Sustainability Plan has committed the University to six star green star design and as built for all of our new buildings. We have four electric vehicle charging stations on campus currently and we've also future proofed our campus to install an additional 20 over time. We are committed to reducing our reliance on potable water. We've recently installed 2.2 million litres worth of rainwater tanks and in addition to that we have around 500,000 litres of rainwater tanks. As a student of the University of Newcastle I'm really proud that they've taken this step to achieve 100% renewable energy. The Hunter Region is transitioning to a clean, green and brighter future and our University is committed to leading the way forward.


So, the generalization of this for all Eigen values is the following theorem, which is a very central theorem in this variational characterization of Eigen values. This is a theorem by two people, Courant and Fisher. This is called the Min-Max theorem. So, as usual, our setup is A is an n cross n Hermitian symmetric matrix and it has Eigen values lambda 1 less than or equal to lambda 2 less than or equal to etcetera lambda n and suppose or let k be an integer, 1 less than or equal to k less than or equal to n then we have two results, the minimum over W1 through Wn minus k in c to the n. So, I am allowed to choose n minus k vectors in c to the n over which I am doing this minimization, the maximum over x not equal to 0, x in c to the n, x perpendicular to W1 through Wn minus k of x Hermitian Ax over x Hermitian x is equal to lambda k and the maximum over W1 through Wk minus 1, the minimum x not equal to 0, x in c to the n, x perpendicular to W1 through Wk minus 1, x Hermitian Ax over x Hermitian x is also equal to lambda k. So, there are two ways to write lambda k as a solution to an optimization problem and in both cases it is a double optimization, there is a Min-Max in one case and a Max Min in the other case and of course like I mentioned before if k equal to 1 or n in this case when k equals 1 this goes over W1 through Wn minus 1 and x perpendicular to W1 to Wn minus 1 whereas in this case, this maximization step you can drop it because there is no such thing as W0 so this constraint does not arise. So, you just have to do the minimum over all x not equal to 0, x in c to the n, x Hermitian Ax over x Hermitian x that will be equal to lambda 1 and so this constraint also drops off. Similarly, when k equals n there is no such thing as W0 here so this minimization drops off and similarly x perpendicular to W1 through W0 there is no such thing so this constraint also drops off and so the maximum over all non-zero x of x Hermitian Ax over x Hermitian x is equal to lambda n. So, when k equals 1 or n in one of the two cases we will be omitting one of the outer optimizations. So, we will prove this result we will only prove this first part the other part is actually almost exactly the same but you just have to modify the steps a bit.  Then let k be some number which is between 1 and n then if x is a sum vector which is not equal to 0 then x Hermitian Ax over x Hermitian x is as usual u Hermitian x Hermitian lambda u Hermitian x divided by u Hermitian x Hermitian times u Hermitian x and further if I look at all vectors such that x is over all non-zero x okay is the same as so I will write it this way u Hermitian x x in c to the n x not equal to 0 is the same as the set of vectors y in c to the n y not equal to 0. In other words I am thinking of u Hermitian x as y and if I want to optimize this over all x not equal to 0 I can as well optimize it over all y not equal to 0. So, if w1 through wn minus k in c to the n are given then the soup of x not equal to 0 x perpendicular to w1 through wn minus k of x Hermitian Ax over x Hermitian x is equal to the supremum over y not equal to 0 y perpendicular to instead of since x is since y is u Hermitian x I can write this as y is perpendicular to u Hermitian w1 etc up to u Hermitian wn minus k of y Hermitian lambda y over y Hermitian y and as before I will expand this out and this numerator is actually equal to sigma i equal to 1 to n lambda i times mod yi square and further I can impose a constraint that y Hermitian y equal to 1 and optimize this over all y Hermitian y equal to 1. Okay, so just for the sake of completeness let me write this step this is equal to supremum over y Hermitian y equals 1 y perpendicular to u Hermitian w1 up to u Hermitian wn minus k of sigma i equal to 1 to n lambda i mod yi square. Now I will do my brilliant thing from the previous discussion and I will say that this is greater than or equal to the supremum over y Hermitian y equals 1 y perpendicular to u Hermitian w1 up to u Hermitian wn minus k and I will further set y1 to yk minus 1 yk minus 1 equal to 0 of the summation i equal to 1 to n yi mod lambda i lambda i mod yi square but since I have set all these guys equal to 0 I can go i equal to k to n lambda i mod yi square and this in turn is equal to the supremum since the first k minus 1 terms are equal to 0 this constraint y Hermitian y equals 1 reduces to yk square plus yk plus 1 square plus etc up to yn square equals 1 and y should still remain perpendicular to u Hermitian w1 up to u Hermitian wn minus k of sigma i equal to k to n lambda i mod yi square and of course as before this is a convex combination of lambda k lambda k plus 1 up to lambda n and this convex combination is at least equal to the smallest value here and another way to think about it is I will replace all these lambda i's with lambda k then I am only decreasing the value and summation k equal to i equal to k to n mod yi square equals 1 because of this constraint here and so there is nothing left to optimize and so I can say that this is greater than or equal to lambda k okay so what we have shown then is that the supremum over all x not equal to 0 x perpendicular to w1 through wn minus k x Hermitian ax divided by x Hermitian x is greater than or equal to lambda k and this is true for arbitrary w1 through wn minus k but again the previous result above shows that which is I am referring to this one here I am scrolling up so the minimum over yeah yeah so as a first step I need to change k to n minus k then what will happen is this un I would be doing so if I replace k by n minus k I would be going from un up to un minus 1 up to u I've replaced k with n minus k and I would have I'm counting down I have to count down up to um u k plus 1 okay and this if if x is perpendicular to all of these vectors then what I will get here will be let me write this with a different color so that it is not confusing later on un un minus 1 u k plus 1 will give me I've replaced k with n minus k so I'll get lambda k here okay now what I'll do is I'll call this vector w1 this vector w2 etc then this will become w so if yeah so this will so how many vectors do I have here I have I'm going down from n to k plus 1 so there is there are exactly n minus k vectors here and so I have w1 through wn minus k so basically if I set w1 equals un w2 equals un minus 2 and w wn minus k equals uk plus 1 the maximum of this subject to x perpendicular to all these vectors will be equal to lambda k okay so the largest value this can take for that specific choice of w1 through wn minus 1 uh w1 w2 up to wn minus k is equal to lambda k so therefore yeah just go back and think about it so this result shows that uh equality equality here is valid when wi equals un minus i plus 1 okay that implies that the infimum over all w1 through wn minus k of the supremum x not equal to zero x perpendicular to w1 through wn minus k x emission ax over x emission x is equal to lambda k which completes the proof okay so um I don't want to go further ahead the next theorem is a is another very very crucial theorem which is called Weyl's theorem we'll discuss that in the next class but what I strongly suggest is uh you know you guys should definitely go over the proof on your own and make sure you understand every step of this proof because the ideas in this proof will use again and again to prove many many more results and um uh and these arguments are uh slightly tricky to convey orally especially in this online mode and since I can't see you guys I don't know if you're able to follow the proof as I explained it or not but based on whatever I said if you now go back and look at the proof on your own you will be able to fill in the steps and if you're not then please stop me at the beginning of the next class and ask me which step you weren't able to follow and we can go over the argument again but the arguments we made today are crucial we are going to reuse them in many proofs going forward and uh at that time if this proof is not completely clear to you you won't follow many of the proofs that we are going to discuss in the following classes so please spend some time on it so we'll stop here for today and we'll continue in the next class