We continue this mammoth week of driver tested. It's more head to head stuff and the TS3 remains in my hand. Then in the other hand, I've got another big boy and it's from Callaway and it is the rogue. Now then, in terms of loft again, we've set these up exactly the same. There's a 10.5 head with one degree taken off and that matches straight up to this 9 1 half degrees. You know that I've got the tenside blue 55 stiff shaft in the TS3. That's not available in the road, but we've gone to something as similar as possible. It's the synergy shaft and I'm going to read what's just from Aldeitha. It's 60 gram stiff. Very, very similar indeed in terms of what you put them up in terms of a head-to-head. Question is who's going to come out on top.  OK, so these videos are coming at you thick and fast this week in terms of head-to-head videos on these big boys on the drivers. Like I said, I'm into the Callaway Rogue. Just talk briefly again like I have on the other videos. If you want my opinion on this sort of broken down specifically about the Rogue driver then please go back and see that review in the back catalogue. What I will say is one thing I notice from the driver, again, Rogue concentrated very much on dispersion and it performed very well in that aspect with good ball speeds. It became, for me, it moved the epic on a little bit in terms of dispersion, in terms of overall distance it maintained some good ball speeds across the face. Dispersion was very, very good indeed and that's pretty much what we've seen with all the drivers improve dispersion without a loss in ball speeds this year. Like I said, I'm not going to do an individual review but I'll talk about the looks of these things and again very much from a personal opinion and then when I hit a few balls now I'm going to talk about the sound and feel. For me, again, I really like the look of the Callaway Rogue driver. I forgot the name of it for a minute there. I love this kind of pattern that fades off in their head. It's slightly elongated compared to the TS3 but again it's that high gloss finish, this sort of carbon looking crown if you like this imprint. I really like the look of it, classy looking club. Once again, like I said, Shaft's very, very similar indeed. From the eye, nothing to split these two to be quite honest with you. I'm a fan like I said of this Callaway look.  I'll put this down and then I'm going to hit a couple of balls on camera and I just want to give you my feedback in terms of how this club feels and sounds. I think the talk about on the eye is very much to the individual. Like I said, this is slightly elongated shape to the to the Rogue and I like, and again it seems slightly more offset I would say at address. They're two things very visible when you put these two behind the ball. And the first thing, I'm going to hit another ball before I make comments to it but I seem to remember it from the initial testing. It's very much a more muted sound. It's an absolute fly of that second ball far better than the first but the sound was the same on pretty much both of them. Like I said it's a more muted sound. It's a duller sound.  Very difficult to explain. Do I like the feel? I don't know maybe maybe not as much as I do the TS3 and others. Like I said they've really softened it down but dampened it down and all it doesn't do it doesn't give you that oddly enough. It doesn't sound like that explosion of clubhead of ball speed off the face I don't know but certainly goes out there there's no doubt about that. Anyway very much like I said personal preference on what I'm hearing.  Let's get them. The dry ball data were on GC2 were on TaylorMade TP5 golf balls. There's no differences for these sit back down and discuss the numbers. Right they're not going to move in far from this spot for quite a few hours as I go through all this data from yesterday and the previous days testing it ended up going over into two days and I've got lots of data to go through. Lots of the top drivers are tested and this is the second video that I'm going to post so this is the obviously we're into the numbers now of the rope versus the TS3. I'm using it it's going to be a bit of a video. If you watch every video this week then the TS3 numbers that have produced are going to be exactly the same numbers that we use for every one of these videos because they were obviously it's not worth me hitting the driver every single time these were produced on the same or the following day of each other. GC2 is the data once again collected. I'm going to start waffling and we're going to go straight into the numbers for the road so let's throw that data up on screen now. Real interesting one for me the road I think from the initial review I wasn't overly keen on it I kind of I don't know it was a bit hit and miss for me in terms of overall performance it didn't really do anything that really for me tick the box I'm afraid but anyway into the ball speed 143 on average quite low the 138 a couple of 141s dropped off quite a bit it's launching way too high at 17.8 and again maybe that's something that the road wants to achieve maybe it wants to help people in launching the ball higher they got that CG well and truly well back into the head but for me on the setting that it was in terms of a 9.5 head with this shaft launching 17.8 way too high incredibly the spin was a decent number 238 1 but you can see that peak height at 41 this thing was going into orbit and carrying overall 243 and once again I think just on that 243 well we're on that end column there we've got to consider the fact there was a 230 ball in there which has dropped off that average quite a bit and if we talk about yesterday's numbers which was the m3 you take out the 230 ball and it's probably in terms of overall yardage carry very very similar to that m3 but for me I'm just going to throw up the dispersion numbers and once again similar that I've seen from all drivers tested them if I'm being honest with you let's make no mistake the person on the end of the club and the swing they brought it is going to dictate where this ball ends up yes there's they are more forgiven yes I think there is a bit of help in that clubface in terms of ball speeds off of the whole clubface but where that ball ends up is largely down to the variety which of of swing patterns that I will put on it and that's why I review these things from the base of the average golfer anyway once again it's a similar pattern to the m3 that I hit yesterday and one you'll see quite a bit from me the sort of what is that three seven shots right of target relatively okay with that I think if we look at their right of centre of target and there may be some of them wider ones are grabbing the first quarter don't know but they're not miles away I take those and once again the balls that three which again I keep saying about the m3 I did exactly the same yesterday I'll always throw in that sort of hooky shot of mine which I'm trying to stop doing and I've managed to do what sort of seven out of the ten but those hooky shots down that right hand side which tends to be the low spinning higher they'll be the longest distance as well but I'm trying to stop them so they're kind of I I think in terms of dispersion I'm okay with what's happened with the rogue I think it's fairly good in terms of performance there and like I said the blame in terms of where those balls have ended up is clearly on my head and not the Callaway rogue anyway I'm going to throw these TS3 numbers and like I said um well I'll throw out the full chart because if this is the only video out the series that you've watched then obviously we'll have to start from scratch but for those of you who've seen this in yesterday's video I do apologise but I'll go through them fairly quickly so and if you want to stop and pause this bit and analyse this data a little bit longer for yourselves who didn't watch yesterday's video they'll be able to do so so with the TS3 146 ball speed 14.8 launch so a much better launch angle for me spinning arguably just a little bit too low at 18 and a peak height may be affected I could do with just getting that up a little bit however the whole thing's combined between launch spin and the ball speed 256 carry I said in yesterday's video by far the most consistent numbers in terms of yardage carry that I've ever hit on a video with any club since I've been doing this testing and once again I'll go through the if I can find it the dispersion numbers I'll throw up again on screen for you now almost identical to what I've just said the shots that I'm hitting down right of target is what I'm trying to do more of and that's more about my swing once again those hook you on from right to left I'm trying to get rid of and then hopefully at some point you might see some balls going down the middle but at the moment it's a bit of a struggle but I think I said I'm an average golfer and that's exactly what I would expect from me on a Saturday afternoon as well but anyway once again the assessment between the two clubs is simple I'm not a massive fan of the road some people may say that you know I've gone into it with a negative attitude then and I have bias maybe okay I'll take that on board but I can only tell you the way it is I I've hit it on a number of occasions I don't particularly like the sound and feel from the road and I don't think it does anything particularly for me in terms of overall performance again it's not a driver I would sort of buy or move to whereas I think numbers with the TS3 once again have pretty much blown it out of water for me not necessarily for everybody but in this it was a visible difference in terms of overall the way this club performed the TS3 would have won this all day long for me so there you go the winner of their head-to-head between rogue and TS3 is by far for me the TS3 on on every ticket for me looks feel performance it wins hands down anyway that is only my review only my perspective love it if you've as ever if you've tried the TS3 if you've tried the road stick your comments down below disagree with me agree with me throw some opinions in I'll try and get back in the comments if I can I'm going to carry on doing more of this like I said it may be a bit repetitive but I'm determined to go through every major driver that's been released in 2018 and I'll be moving on tomorrow to a big one for me personally because it's the TS3 versus the G400 max which is the club that is currently in my bag and I'm a little bit worried anyway thumbs up thumbs down comment down below subscribe if you don't already see you soon


What is going on everyone Sam here with latent sports cards, and we are doing 2022 fanatics memorabilia diamond box break number seven Random hit style. So ways is gonna work is we're gonna open the box. That's right next to me right here We're gonna show off all the hits all five that are included within the box Well as we're doing that Don is gonna type in the hits into the random hit sheet Once we are through showing off all the hits all the hits have been shown What I'm gonna do is copy that over into a random org I have all the names over already have Andrew Frank John a John D and Thomas J We're gonna random both the names and the hits the same amount of time whatever the dice roll tells us and whatever Hit your name is next to at the end is the hit you're going to receive so without further ado Let's get right into this sipping and I would do forest here Got me some fun stuff that in a means these things are crazy Okay, that's going last Yeah first day here guys we got a sign of football Yeah Go ahead and rip this top part open still be able to go ahead and put it back into this Pretty cool one here though. We've got a You can see it through here. This is gonna be a Terry Bradshaw and Lynn Swan signed football autographed Super Bowl MVP and other Super Bowl MVP Nice one there. I don't want to take this this front part off I'll make the face cam a little bit bigger here and I could show you guys on the face cam as best as I possibly can So you can see Terry Bradshaw Right there trying to get that glare out of the way as well as Lynn Swan and you could see on the Where was that right here you can see Bradshaw Swan auto Super Bowl MVP Pro football so pretty cool one there leave you with that one. I guess Make this face cam a little bit smaller We'll do the Got a helmet coming up next guys. We've got and Lunar speed Riddell Autographed helmet Charles Woodson Hall of Fame 2021 Very sick. Good luck to ever get to that one. That is really cool guys Charles Woodson Hall of Fame 2021 Very nice Um, we'll do this one next another helmet coming you guys as well as well We've got wow. That's actually a nasty helmet. That's so cool That is gonna be wow bunch of inscriptions on this one too. How about an Emmett Smith signed? I believe that's the lunar speed as well Hall of Fame 2010 Super Bowl XX V II MVP and 93 NFL MVP Heck of a helmet there. I'll expand our face cam a little bit see I can see that one that one's kind of fire This one's a really sick the Emmett Smith signed helmet So sweet Good luck to that one a lot of inscriptions on that as well looks like a pretty authentic helmet Obviously, it's lunar speed So it's not gonna be like one that they were in the game But you know the the designs I do with a lot of the helmets like the matte coloring is really really awesome We'll get that one Next one up here. This is sick We have got a Super Bowl Signed Drew Brees ticket Beckett authenticated Good luck on that one That is so awesome autograph grade is a 10 Gate G section 332 a seat 15 That is a sweet ticket as well Like sweet as cool then sweet as actual the actual legitimate sweet, which is awesome So good luck to you guys on this one that one is really cool man big fan of that and Then I've got to be super careful with this next one do my best. I possibly can hear guys We have another autograph football.  I think it's gonna be a little bit easier to see it on this But how about That is a oh my god, man. I'm just gonna take this out. There is plastic wrap on it How about a Tom Brady? signed signed football Seven times Super Bowl champ five times Super Bowl MVP That is in sane Insanity a Tom Brady signed football can't believe I'm holding this man. That's unreal Could lock on that one. That is absolutely crazy. Yeah, I'll put it down so you guys can See the ball a little bit better as well oops Yeah, not touching the football doing my best possible job. I will not touch the football Seven times Super Bowl champ five times Super Bowl MVP. That is in sanity in sanity. Then we've also got our I'm assuming this is gonna be our COA usually day with something big like that. Yep. That is the fanatics Certificate of authenticity right there of the Tom Brady autographed Wilson Duke football full-color Football seven times Super Bowl champ five-time MVP inscriptions If you need any verification that'll obviously come with the football to whoever receives it So I Would say bubble wrap it Oh Perfect and then you and I can work on getting this getting that back in like it's super careful after I'll probably put it back into that one too. All right guys now. It's time. Oh, we got to put it back into this So that'll probably that'll probably be enough All right, let me get these random hits copied on over. Oh, man big one here Take you over to our random screen We are doing the random now for those five hits you guys just saw so we've got Andrew W. Frank L. John a John D and Thomas J as our participants And we have the Lin Swan Terry Bradshaw dual autographed football Charles Woodson autographed helmet Emmett Smith autographed helmet Drew Brees autographed Super Bowl ticket in the Tom Brady autographed football So we're gonna go ahead and roll the dice Gonna do each seven times one two three four five six and Seven Andrew down to John D. We've got seven times on your hits. Good luck everyone one two three four five six and Seven that is the Brady autographed football down to the Lin Swan Terry Bradshaw dual autographed football Get these copied over. We'll see what our results are God Andrew W. Picking up the Tom Brady autographed football. Congrats Andrew. That's awesome Frank L is getting the Emmett Smith autographed helmet inscribed NFL MVP Super Bowl champ and Hall of Fame 2005 or seven or whatever he was don't remember up top my head Thomas J is getting the Charles Woodson autographed helmet also inscribed Hall of Fame 2021 John a picking up the Drew Brees autograph Super Bowl ticket back it authenticated awesome hit there John and John D picking up a couple a pair of Steelers legends Lin Swan Terry Bradshaw dual autographed football That was awesome. That is gonna do it from the break guys I'll have these results over on the website as well as chat and the video will be uploaded. Thank you again. I appreciate it


Hi. Thanks for joining us today. My name is Ben Feinstein. I'm the Director of Operations and Analysis for the Dell SecureWorks Counterthreat Unit. To my left is my colleague Jeff Jarmak. If we could get his mic hot as well. Can we get that mic on? So I'm Jeff Jarmak. I'm a security researcher with the Dell SecureWorks Counterthreat Unit. So today we'll be giving a talk we call Get Off My Cloud. Just to start with a little thought or a pictograph, if you will. This is one conception of multi-tenancy in the cloud. Sort of a crazy bazaar of different customers. All sitting next to each other on the same shared infrastructure. This is one way you can conceive of that. So what are we going to be talking about today? Well, when we set out to start this work some months ago, we wanted to first understand more about Amazon's cloud platform. We didn't set out to do this to pick on Amazon by any chance. But really, they're the big gorilla in the room when it comes to public clouds and infrastructure as a service cloud. So if you're going to be doing research as it relates to public cloud and infrastructure cloud, really Amazon is the biggest player right now. So we wanted to understand all the different types of credentials that you use when you're using Amazon's web services. We really wanted to understand sort of the order of precedence of all those different credentials. So if you were to have one type of credential, what could you do with it and what other types of credentials could you control or manipulate? Also understanding common mistakes and pitfalls of people or organizations that are using Amazon's cloud services. So part of this is looking at best practices and the guidance that's published, but also understanding what are some really easy ways to make some bad mistakes out there. And then with that in mind, we set off to develop a set of tools to detect instances of these problems. Basically cases where credentials could be exposed within Amazon's virtual machine images or rather virtual machine images that are published within Amazon's cloud by third parties. And also these tools would detect malicious images or backdoor images that could be out there in the public set of images. Also we performed an experiment to better quantify the scale of potential victims. If you were to release a malicious machine image and we'll define some of these terms, so I apologize if this is a terminology up front, but if you were to release a malicious virtual machine image and publish it in Amazon's cloud, we did an experiment to get a sense of how many victims you could count on receiving and how many of those victims you might actually be able to take control of their virtual machine. And also throughout this work, we maintained, our work was consistent with our reading of Amazon Web Services customer agreement and their terms of service that are published on their website. So organizations are moving all their infrastructure into the cloud at a rapid pace. There's a number of reasons why they're doing that, but really you shouldn't fear the cloud or you shouldn't blindly embrace the cloud. It's really just a tool. Like any other tool, there's good uses, there's bad uses and there's really suicidal uses. So you could think of it sort of like a knife. You know, there's obviously some good uses for knives here. In this case, Crocodile Dundee, he has a knife. There's lower costs in the cloud. There's decreased time to market, which is very attractive for organizations today. You can rapidly scale out your infrastructure without having to purchase data centers and hardware and servers and storage. And also, you could inexpensively get geographically diverse infrastructure by using cloud services such as Amazon's. So there's obviously some bad uses for the cloud, just like bad uses for a knife. There's relative anonymity to be found. Basically you can spin up instances in different regions of the world. It's very difficult for a third party to determine who's the actual actor that's behind that virtual machine image or behind that IP address that's sitting in Amazon's cloud. It's inexpensive or if you perhaps have stolen credit cards or you've stolen credentials to other cloud users, it's free. It's very hard for defenders to blacklist cloud infrastructure. The IP addresses are ephemeral. They change rapidly. You're going to do a tremendous impact to your business if you just blacklist large swaths of Amazon's cloud because there's a lot of legitimate uses and legitimate services that are running there. It makes geo IP address blocking or geographical blocking much more difficult because you can just spin up a virtual instance in any number of places around the globe to kind of hide where the actual location of the attacker is. And again, it's highly scalable. That plays for both good and bad. If a malicious party wishes to have a highly scalable infrastructure to support cyber crime or some other aspect, well, the cloud will offer that as well. You can find any number of press reports about spammers using cloud services. Even malware is now starting to attack cloud services. There was a case of a spy itrogen that had been modified to access Amazon S3 and compromise some buckets in that. And what we're really talking about also is the suicidal uses of the cloud here. And inadvertently, we found that many publishers of third-party images but also many users of the cloud that are using third-party images are putting themselves at great risk. So don't be this guy. You need to look at the cloud but do it with open eyes and do it by considering the risks and looking at the best practices and making sure that you're really adhering to the published guidance out there so that you can use these cloud services but using it in a safe way and take assessment of the risk. So some terminology. I apologize for those of you that are already, this is already an old hat to you, but when we gave some dry runs of this, many folks weren't really intimately familiar with Amazon's web services yet and there's a whole lot of acronyms out there that we'll be using. So AWS, that's Amazon web services. That's sort of the overarching suite of different services that they offer for their cloud service delivery. EC2, you'll hear us use that term. That's their elastic compute cloud. It's essentially an infrastructure as a service. You can get shared compute, storage and network through the EC2. An AMI or AMI, I've heard it called as well, is the Amazon machine image. It's essentially, what it is, it's a virtual appliance container format. So you would pick an Amazon machine image and you could launch any number of instances of that image and those actually become virtual machines that would be running in the EC2 cloud. S3 or simple storage service. That's object storage that Amazon offers its customers. You basically use what's known as buckets and you read and write data into those buckets as objects. And then a more recent addition, though it's probably been out for a few years now, is the elastic block store. And that is a virtualized block device. Just like on a Unix or Linux system, you can mount a block device on that system and read and write to it just like a file system. EBS is a cloud file system, a cloud block device that you can mount on your images there. So when we first set out to do this project, we wanted to understand all the different kinds of credentials out there and what the different uses of those credentials are and then which ones control which other credentials. So there's really three broad categories of credentials for Amazon Web Services. There's access credentials, there's sign-in credentials and then there's a set of different account identifiers that you have to use. In terms of access credentials, you've got access keys. An access key is merely a long, unique string of digits. There's a public and a secret part of that. It's a little bit analogous to certificates, but there are certificates in play as well. We'll talk about those. But your access key ID also has a secret access key and what you use that for are authenticated Web Services APIs like SOAP APIs to use simple storage service or Amazon's Mechanical Turk, which is essentially a service where you can get real human beings to do your bidding for pennies per request. There's a screenshot on the next slide where basically you manage all these different credentials within Amazon's Web Console. And these keys are also, the access keys are also used for CloudFront, which is Amazon's own content distribution network that they offer as part of their Web Services suite. Amazon's recommendation here, rotate those keys at least every 90 days. Here's a quick screenshot of the Nifty Web Interface where you can manage these access keys, both the secret key and the public key part of it. Another important credential is X509 Certificates. So many parts of Amazon Web Services use a certificate and private key to access or to sign your images, to bundle images. These are again, they're managed through Amazon's Web Services Console, but you also can do some of this with APIs. You can generate your own certificate or private key or you can provide your own certificate. This is sort of a trade-off of convenience for security.  It's obviously recommended that you probably want to generate your secret key yourself and then provide up to Amazon. Use it to bundle your AMIs at cryptographically signs and encrypts AMIs that are private or just cryptographically signs the machine images that you're going to make public. Again, Amazon's recommendation, rotate these things every 90 days. So go issue new certificate and private key at least every 90 days for your infrastructure. Another screenshot here. EC2 key pairs. This is one of the biggest findings that we'll get into later of what we actually found when we scanned the US East Cloud with our tools that we're releasing today. They're SSH key pairs for all intensive purposes. When you spin up, when you launch an instance of a machine image, you specify an SSH key pair for that image to load. And on boot up, it essentially loads the private, excuse me, loads the public key into the SSH authorized key file and then you use your private key to access it to SSH and get a console on that virtual machine. So it's a very convenient way to get secure access to a virtual machine. You don't need to bake an authorized key file into the image itself. You specify it at runtime when you spin up a virtual machine. There's no explicit security recommendations I've found from Amazon around these key pairs or rotating them or such. And there's also interestingly, there's Windows virtual machines that you can run in the EC2. And these key pairs play a role there where literally the administrative RDP password is encrypted with the private key and you would decrypt it and then access the RDP port on the Windows image. So it plays a role in accessing Windows images as well. And you can log into the web console and play with these things and allocate your keys and such. Cloud front key pairs, yet another set of credentials. What we found is there's so many different access keys, private keys, cloud front key pairs that it's quite confusing. And really the first part of our research was just figuring out and identifying and enumerating all the different credentials that you have to use when you use Amazon's web services. This is the key you use when you're using their CDN network to generate signed URLs. It's essentially a way of offering private content within Amazon's content distribution network. So pretty much the one key to rule them all is the sign in credential. So you'll log in that you log into their administrative web interface and control all aspects of your Amazon web services account. So if you're going to defend any of these and secure them strongly, this is probably the most important set of credentials there are. What it is, if you ever bought a book from Amazon or a CD, it's your username and password. All you do is take a normal Amazon account, you may have purchased the book and you activate web services on that account. Amazon's web services now the credential website is now the credential to your web services account. They've just also offered multi-factor authentication. It's not RSA Security. So you can protect this with multi-factor auth. You do a purchase of $12 or $13 token online. You activate your account with this token and then now you've got multi-factor authentication to add to just the username and password to protect this. This is really important for the web services. So if you're going to be using cloud services so that you're not, your whole kingdom isn't just relying on one username and password here. They haven't rolled out the kit and retinal scan just yet. Account identifiers, there's two account identifiers. There's a canonical one which you use for certain APIs and there's just another ID that you use for other APIs and it's not really a secret but it's a long story. So as we're going through this, we found some prior research that we thought was interesting and we wanted to call out. So a few years ago, back at Black Hat 09, DEF CON 17, a group of researchers including Alex Stamos delivered a talk called Cloud Computing Models and Vulnerabilities Raining on the Trendy New Parade. And they showed two, among other things, they showed two interesting techniques. One was a way to essentially game the system and then the list of public machine images of their own machine image. So literally there's hundreds of different, say, Fedora images that are available in the public cloud. And the key is if you're not really on that first page of search results, people probably aren't going to pick your machine image. So they were doing this so that they could get a set of victim users that would run, I wouldn't say a back door machine image but a machine that had a phone home mechanism in it. They got prime placement for their virtual machine image and then they had a phone home script that was running every time you spun it up and they could measure how many people did this. There's some interesting precedent that was published earlier this year. So in a tipping points blog published a copy of this letter that Amazon sent to their customers back in April. And essentially someone had found that an image had been shared with and had authorized SSH keys baked into it. So the publisher of this image could potentially have full access as root to anybody that chose this machine image and spun up instances of it. So this also reinforced to us that this is something we wanted to look at more closely and this is why we built these tools to go ahead and evaluate large numbers of machine images to look for things such as SSH authorized keys that shouldn't be there. So there was after we were accepted for this talk there was a group in Germany, some postdoc researchers at a university there that released some researchers that's very similar to ours. They also released a tool that scans AMIs in a very similar fashion to what we do. Their tool is a python script that essentially you have to run on the instances itself. Because our tool interacts with the Amazon APIs to spin up instances, SSH to them, scan them remotely and turn them down. So they're similar, but the approaches are slightly different and we've scanned more images and have a little bit larger data set from our tool. But I just wanted to highlight that there's other people working on this and it's possible that there's others that aren't publishing it. So this is probably something that's being done in the wild. So when creating a public AMI or an AMI that you share with other users there's a number of ways that you can accidentally leak your own credential material. On the file system itself you may have your Amazon web service certificate and private key. You might have SSH key pairs either an authorized key that Ben mentioned or an actual identity key. You might have SSL certificates and private keys that are on the image. You need to be conscious as a publisher of an image what you're putting out there because once it's public it is truly public and anybody can access these images and search for these sorts of credential materials and that's essentially what we've done. There's also other ways to leak information. Bash History Files is a big one. If you run the image as an instance yourself and done any sort of work on it and then made a public image out of it that Bash History might expose that and it might also expose some of these credential materials that you've used. Files like Bash RC, Bash Profile often contain environment variables that are set to these values for scripts to access and things like that. So we looked for these as well. And then also Vim Info Files occasionally there's a chance someone might be trying to clean up and go in and edit a file to delete it but they search for that and their Vim Info stores that search for that string so it could be there as well. And then we tried to do a little bit of looking for signs of a malicious AMI. This is primarily the SSH authorized keys. There's possibilities for root kits, trojan binaries reverse shells connect backs those sorts of things with the PV grub kernels that they support now you can run your own kernel on EC2 so you could back to where the kernel directly if you wanted to. There was a talk today in SkyTalks Anche with 303 demonstrated an AMI image that essentially when it was launched it would phone back, download a piece of code execute it and he'd get a interpreter shell from it anytime somebody spun that instance up so that's also related work to this. So there's been other work on malicious AMIs. Ben mentioned some of the work from 2009 from DEF CON 17. This is something anybody who's looked at Amazon Web Services thinks of this that these images are public and there's not much verification of who the publishers are and what their intentions are and in a lot of cases it's really difficult to detect malicious intent and malicious behavior. So we undertook a project to try and gather some data surrounding this. How easy is it to find victims what kind of instances are they running it on where regions are most popular and kind of most importantly with their security groups which is similar to a firewall policy for an EC2 instance would those be configured sanely don't allow the world to connect to your SSH ports, for example which would be effective at being somewhat of a hedge against an AMI that has atrogened SSH to AMN or pre-existing authorized key. And then we also released our tool well developed our tool that we're releasing to perform large scale scans of images within the cloud. So the name of the tool is AMI Exposed. So it's kind of a pun on AMI and asking a question and the tool seeks to find the answer. So it's a framework essentially for scanning AMI's for these credential leakage patterns. I tried to follow a sort of similar model to what Metasploit does although my code is nowhere near as elegant and nowhere near as capable as the stuff they've got. But in a similar vein there's test modules that you can plug in to add new functionality with very little code and leverage the existing classes the existing object model to add new tests. So at its heart it uses Amazon's API to automate the retrieval of a list of images defining your scope of your tests. I'd imagine common use cases would be testing all images that I own maybe before I make them public if I'm planning to do that. As a penetration tester you might be interested in testing all images that are owned by a specific client to see if you can find any other credentials being stored publicly. So once the scope's generated we basically iterate through all the images for instance run tests over SSH and record findings to a database. The tools released on our website secureworks.com slash research slash tools there's currently a little bit of a problem with the file that we're going to get corrected probably Monday morning. So if you have any trouble downloading it in the meantime I apologize for that. As I said there's several test modules included at release. There tend to be precise. They check for the things that we've been discussing and I'm not going to keep repeating all these different vectors. It also tests within system files so it'll search for a number of files and then search within them for specific strings. These strings are all definable by a configuration file. You can just pop a regex in there and it'll search for that regex and you don't necessarily even need to write a new module to add a new string that you're interested in. So here's kind of the flow of how it executes up at the top there we've got our scope definition phase. You can either do this manually just by going into the AWS console and putting tags on images that you're interested in or there's a tool that's included called tagimages.rb that allows you to define larger scopes more easily. You can't go and click through thousands of images. Again query for the tagged images, iterate over them and obviously we want it to thread it. Oh, I should mention this is all in Ruby. I didn't even say that but down the right here we have some of the gems that are used. So we're using the threaded collections gem for managing threads and then we're using the, well, the official Amazon Web Service SDK for Ruby which was released about three weeks ago. So I actually kind of wrote two versions of this tool. I spent a lot of time writing one that interacted directly with the SOAP APIs over parsing the XML to my own object model. I was just about done with that and about to do our large scale scan when Amazon released their own SDK. It was much more elegant, much cleaner, much more efficient. So I ported my code over to adopt that rather than duplicating that functionality. They've also been improving it at a pretty rapid pace. So there's been a couple releases that have made minor adjustments and bug fixes just in the past few weeks. So once we launched the instance, we have to figure out what account we're going to use. So that's down there on determining SSH username. So we try and log in as root. If that fails, we try and parse any response that comes back. A lot of times you log in as root and you get a response that says please use ABC instead of root. So we try and parse that on the banner. And then if that fails we just iterate through a list of usernames that we've discovered are commonly used out there. So generally we're pretty capable of being able to determine the username.  So we go through each of the test modules, load the module, run it and record all the findings in the database. So we're using net SSH for the SSH components and active record for the database component. So I'm going to demo it. It's going to take a little while to run so we'll talk a little bit more about the internals while it's running. Give me a moment here. Apologize for the delay. Okay, you see my screen? Yeah. Okay, so out here this is the AWS console. I'm showing three images. These are all images that I've created. I'm not going to show anybody else's image, but my own. So two of these, this first one is a public image that I created that's an AMI that allows you to run backtrack 5 within Amazon's cloud. And we'll talk about that a little bit more later. The second one is from when I was developing that image. This is a private instance or a private image. But you'll notice I scanned it previously and it's marked as failed. You know, as I was iterating through the process I broke the SSH statement on this one. It starts, but I can't SSH to it. So I just wanted to show that it flags it as failed. And then the other one down there is one that I made just for the demo here that demonstrates some of these key material leakages. So I've got things there that look like real keys. They are real keys, but I'm not using them anywhere and it's not live data. It's just for demonstration purposes. But you'll notice there's a tag on these and two of them are in pending state. And that's how we define our scope. And that is those two images. So let me just do this full screen. Oops. Okay, is that still there? All right. So this is actually I'm SSH'd into a running instance on Amazon's cloud and that's where I did all my tests from. So it's kind of interesting that I was using the cloud to scan the cloud for security problems. So it was all taking place in Amazon's infrastructure. So this is a directory where I've got the tool here. You'll see this tag images file that we talked about that allows defining the scope. And then scan.rb is really the main the main heart of the tool. So I'm going to go ahead and launch scan.rb. It looks a little bit weird here. My ASCII art in scale to this font size. So you see there it says it's storing logs for each AMI under a logs AMI category. Starting in tests of two AMIs. I've got to configure for 13 threads but it's not going to run 13 because it's only got two images. And then just timestamps saying it's scanning. So this probably takes about 10 or 15 minutes. So we will go back and come check on this. I keep doing that. Come check on this in a little while. Okay, we got through this. Sorry, lost my spot. Okay. So while that's running we talk about some of the things I did to expand the Amazon Web Service SDK. I basically just opened their classes and defined some additional methods to give me the functionality I needed to do this that they didn't provide through the SDK. So we modified the instance, added some methods to interact with instances, run a command over SSH, either via SSH XAC or PDY. And then it's got a run test method that basically loads a test module, runs it against that instance. I'm going to go through these kind of fast. The slides are a little bit wordy, but that's mostly meant as a reference. I modified the image class to add another method there. Added some places to store parameters. We discovered that SSH user and I need to store it somewhere. So I just stored as a tag. Also that test status updates that tag that defined our scope and defines the results of the test. Created a finding class. It's a really simple class. It's just backed by ActiveRecord. So when you instantiate a finding object, it just logs it in the database. And then there's testRB is our base test class. So this is the parent class of all the test modules. It has some common functionality that's used across test modules, so you don't have to rewrite it on each one. And then it implements the file helper module that allows us to test within files. We're not redefining that everywhere. Any test that needs to look within a file for contents can just call this method and it's already taken care of. And then the individual test themselves derive from the base test. They have an init method that just basically defines some metadata of the name of the test. The severity of various findings, etc. And then a run method that runs the test. So we're trying to keep things simple by having a sound object model and keeping all of well, not all, but keeping a lot of the heavy lifting out of the tests. So here's an example of a test file at the end of the day. This is a pretty simple one. Just checks for a bash history file if it exists. It looks within that bash history file for things that we've defined as potential key materials or credentials. This one's similar here, although I got the title of the slide wrong. This one's SSH authorized keys. So this is where we're looking for any authorized key file. Looking within that file to see if there's any keys present other than the one that is provided through the Amazon interface. So this will identify unknown keys. This one's a little bit more complicated. It was an attempt to try and catch any sort of persistent connections. So we're looking at a net stat and seeing if there's active connections from the host, excluding a few IPs, not going to look at loopback connections, not going to look at connections that are coming from my test box, et cetera. This isn't terribly effective because it has to be a really long-lived connection in order to be caught. If you're doing something like hitting SSH and downloading a script, or I'm sorry, hitting an HTTP server and downloading the script, that's going to be a really quick connection, and the odds that we would catch that are pretty slim. If somebody had an SSH session persistent for a long period of time and we happen to test at the right time, there's a chance. So let's talk about the scope of our testing. We started with the idea of looking at all US East images. We removed windows images from the scope. They're generally paid images because of licensing constraints and they're more difficult to interact with remotely because you have to do it all over RDP. It's a little harder to programmatically access. So that left us with 5,515 non-windows images. This was the list of images that we attempted to process with the tool. There were 771 images that were paid, so you need to have an additional license, pay an additional fee to use those, and we just kind of skipped those because we were trying to keep costs under control. There was 2,767 that failed to test, and this is really kind of interesting. It seems like almost all of these were due to some sort of error with the image itself. So you saw the one that I had where my SSHD was broken. That was a private image. It's broken. Why would I make it public? But it seems like a lot of people make these public anyway. So I couldn't interact with them over SSH because they won't start. You can't find the root volume on boot. SSHD doesn't work, etc. So we ended up with 19, well 1,977 images that were scanned by our tool. We had 580 unique images that had one finding or another. So that's 29.3% of the images that completed all the tests had at least one security problem. We shared these findings with the Amazon security team. We didn't verify any of the credentials. We didn't attempt to use any of this stuff. So it's possible some of these have been revoked or something like that. I have no way of knowing. And Amazon has been responsive about trying to contact the image owners and the users if it's applicable and make everyone aware and remove images if necessary, etc. So I really want to applaud Amazon's security team. They take the threat seriously and they've been tremendously cooperative with us. So the largest finding was the problem of SSH authorized keys. I suspect that many of these are people that just didn't realize they were there. They're probably not it's hard to say how many of them are malicious. But the fact is when you download an image that has an authorized key file, whoever has that private key, if they can reach the SSH port, can authenticate. So there's no real way to separate what's accidental and what's malicious. It's a pretty severe finding. So 19.5 2% of the AMIs we tested nearly 20% had an unknown author as key file. So by that statistic if you randomly launched 5 public AMIs there's a good chance that somebody else has access to one of them. This represented 44.96 of our findings. So it's far and away the most prevalent problem that we've encountered. This chart here breaks down all the different findings that our various test modules encountered. The number of occurrences of each, the number of unique images that was affected by that finding. The percentage of our total number of findings that were represented by that class. And the percentage of AMIs that had that problem. Or I'm sorry, the percentage of the percentage of AMIs. So that's the percentage of all AMIs with findings. So if we take the number of images that had on our SSH keys as the numerator and the number of images that had some problem that we discovered as the denominator that's what that percentage represents. And then we have the percentage of our test case. So we see there again on authorized SSH keys existed in nearly 20%. I believe the German researchers, their number was 30%. But I'm not quite sure what the scope, they tested 1,000 images. We tested nearly 2,000. So that's going to vary a little bit. And I'm not quite sure what region they tested. I sort of suspect it might be EU just because they're from Germany. But I'm really not sure. So I don't know how directly comparable our findings are with each other, but it seems we're both in the same ballpark. Our second highest finding was just the existence of a history file. So that in and of itself may or may not be a significant finding. If that history file contains sensitive environment variables, key materials, et cetera, we would log another finding. But in some cases the history file might have some sensitive info that we weren't scanning for. You know, the other tops there environment variables that are commonly used to point to Amazon Web Services key materials. The access keys themselves that's a significant one. It's not a huge number of images. But with those keys essentially if we'd wanted to if we were so inclined we could have scanned until we found one of these and then continued the project by using that credential and reduced our cost quite a bit, but we're not trying to be criminals here, we're just trying to gather the scope of the problem. Other issues SSH identity keys, so that's the actual private key, which is kind of unusual. In at least one case I was able to find the identity key file and then go back to the history file and find a remote host name that they'd logged into with that identity key. So chances are good if I'd used that same key against that same host, I probably would have gotten that host, which isn't on Amazon's cloud but may have had its security compromised as a result of this lax practice of keeping the key there. And there's various other findings much lower proportion, so I'm not going to discuss them all. The SSH paths were authentication enabled. We actually added that test as we were like most of the way done with our scan. So those numbers are really incomplete. But that's a module that's looking for an SSHD config that has password enabled. Amazon Web Service EC2 is really built strongly around key authentication. So if you have a password authentication, now the strength of passwords and accounts that are configured on the image comes into play. So we didn't find a whole lot but as I said we can test all of these with that test. So let's talk a little bit about the costs. Excuse me. My Amazon Web Service bill last month was $1,333. I completed all these tests within the month and the vast majority of that is due to this project. It's a little too bad. $3.84 more than I would have been at $1,337. So that would have been kind of cool. I wish I would have figured that out. I wonder if they'll let me overpay the bill. Just here's $3.84 more. Anyhow that breaks down to $0.67 per image scan. $0.98 per finding. $15.68 per Amazon Web Service credential. So that seems like a bargain. With a little bit more manual review, these things are fine. That are for example a batch history file, if you were to look at it you might be able to find other things and have more findings. Kind of conversely you might find that some are more false positives. So our numbers are obviously rough and the costs per finding are a little bit rough there as well. We could have leveraged spot instances to lower costs. So spot instances use off peak pricing. If you don't care when you run a task you can run it whenever Amazon has more capacity available at a lower cost. It would have made the script a little bit more complex to keep state of what machines are running and not. And there's also the thought of analyzing the EBS boot images themselves without launching the instance. This might reduce costs. It might also increase the amount of images we're able to test. Some of those public AMIs that wouldn't boot properly if they have a valid EBS volume, that volume might still have data on it. The fact that the machine doesn't boot doesn't mean there's no data there. And I sort of suspect that if someone's going to go through trouble of making a broken image public they're probably not going to be following some of the best practices in securing their credentials as well. So that might be interesting. And again, as I said before if we were malicious about this we could have reduced our costs pretty greatly. Let me go back to our test there. That should be just about complete now. Ten minutes? Oh wow. Okay. I'm going to have to pick up the pace here. Okay. So keep changes. Okay. So this is our test here and you can see those two threads completed. Those tests completed. By going to the log AMIs directory this might be a little hard to read at this size. But let me look at the log file for the first one here. O4BE. So, yeah, it doesn't wrap around too well here with this size. Is that, maybe I can shrink it as well. Anyway, you can see here it starts up at the beginning, launches an instance. It's got the instance ID number there. Temps test this H2, SSH hadn't started yet so it sleeps for a little while. Discovers the SSH username and then starts running tests. This particular image didn't have any issues. So it runs a test, completes a test, runs a test, completes a test, etc. Not a whole lot interesting there. It eventually terminates and shuts it down. If we look at the other the other test this one's a little more interesting. So same sort of things. Start an instance, discover SSH. Now there you can see we found an unauthorized SSH key. We called that high severity and there's the key. You know, we checked for selects 509 certificates. Found a certificate file. There's the file name and path. It just kind of continues on like that with the various findings. These are also all stored in a database if I go back to using SQLite here but it's active record so you can use whatever adapter you want. Select start from findings and you'll see we've got our database there you know that logs all our findings where things were found and the details that go along with them. So that was a demo showing two machines being scanned in real time. At our peak we were scanning about 110 images an hour and when I say scanning that includes identifying images as paid images which obviously doesn't take very long but that seemed like a pretty decent rate. It took about two days it was two and a half, three days to scan the entire scope of our tests. But the question then kind of becomes the SSH keys was our biggest finding. Don't people use security groups to protect their instances? If I have an SSH key it shouldn't matter if I can't reach the SSH port. So here's just a slide of explaining EC2 security groups. It's just like a firewall policy there's screen shot there. The interesting thing is they're inbound only unless you're in virtual private cloud. So outbound traffic from a potentially malicious AMI there's really not a strong way to filter that. You can use IP tables or something on the instance but you know when it's someone else's provided AMI at least the first time you run it you're running their configuration. So we did some testing of security group practices. I released these AMIs across all regions to allow running Backtrack 5 in EC2 on June 23rd. Just kind of announced it publicly in a couple of different places. You know I thought this was an interesting sample because it's something that you know people that are more security minded might be interested in. Has anybody here actually used these at all? I'm just curious. No. Okay. Well it was also useful to me for gathering data on statistics. There was a phone home script in it. Now this wasn't a true backdoor it wasn't anything that I could log into Icon and Execute Code in the boxes but it did report some data back to me when it was launched. Here's the script. Oh it's on the next page. So there was a script that was part of you know part of the start up collected some metadata from the EC2 metadata API and sent it back to me. Here's the script itself and you'll notice there there's a comments kind of explaining like you know what we're trying to do and trying to calm people down that it's not real malicious. Notice the curl directs the entire output to DevNol so I can't save it as a script and run it. And you know it's got a website there if you have questions visit this. The website explained it and kind of solicited feedback to say how did you find this you know I'd like to kind of gather processes that have been helpful in discovering these sorts of things and I was planning on crediting people who had found it but as you can see nobody contacted me nobody hit that webpage so it doesn't seem like too many people found it. So we received 95 phone homes as of July 31st this was 69 unique instances and when we received the phone home we connect back on 22 and pull an SSH banner we were successful in 71.5% of cases 72% if you counted it by unique instances rather than all instances to get rid of the effects of people rebooting an existing instance so yeah that's kind of concerning that tells me that 70% of people who are presumably somewhat security minded because they're downloading backtrack after all you know the running backtrack in the cloud didn't bother to properly firewall off their SSH port if instead of putting this phone home you know I'd put the phone home in addition to the SSH key which you'll remember was our most common finding it's a pretty safe bet that I would have had root access to most if not all of these boxes so our lessons here we kind of summarize them already one interesting thing I think is that there's too much of a stretch to say that the average user is probably worse off than our sample again you know more sophisticated backdoors would be harder to detect than this and nobody detected this so that doesn't bode well for using malicious AMIs and actually finding them when you use a public AMI you're putting a lot of trust in the publisher so at the very least consider the source of the image who that person is super safe build your own images but at the very least consider that images from Amazon or another trustworthy provider official open source maintainers maybe more safe than trust in me so as we're in the midst of this project Amazon published a number of new documents given some security guidance and best practices we wanted to offer some links in our slide deck to these so if you're using our web services we encourage you to go check out all the guidance that Amazon published out there about sharing AMIs how to do it safely how to use public AMIs in a safe fashion and there's a whole bunch of articles out there on this elastic.com site from Eric Hammond so we would encourage you to check those out there's a lot of good material out there and Jeff mentioned this earlier so where would you obtain trustworthy third party AMIs besides from scratch yourself well Amazon themselves offer supported and maintained images you can follow the link up there or find it yourself and they've got a number of images out there they have their own yum repository security updates product life cycle if you want to pay for their premium support service these are the images they're going to support so this makes a good option to enterprises or other organizations that are using their services there there's a number of third party vendors that also provide their own AMI images right scale, cloud era, a number of other vendors and one of the best practices we've talked to some large organizations that heavily leverage web services from Amazon is they many of them take Amazon's own images as a base and then build a customized AMI for their own application suite on top of it and then they can leverage Amazon's life cycle and support and package updates to keep their base up to date and then just all they have to worry about is updating whatever the application code or other suite they added on top of that was if you find issues in the cloud we had a really good experience working with the Amazon security team they're very responsive they're easy to get a hold of they investigate every report so you can find them online they have a form PGP keys, email addresses it's not hard to get a hold of them I want to give thanks to Beatle from the Amazon web services security team and the rest of his team for working with us as we did this project we were creating work for them as they were doing customer notifications as we fed these findings to them and also thank our bosses at Dell SecureWorks for authorizing us to do this project and giving us a little bit of budget to make it happen we'll be moving over to the Q&A room here shortly across the hall whether using cloud services have questions or have some information to share with us so I hope some of y'all will join us in the Q&A room across the hall, thank you appreciate your time


What if I told you that there is an audio player out there for your computer that allows you to pull down content from services like YouTube, SoundCloud, and many others and allows you to listen to this audio for free without the need to be subjected to ads and tracking and profiling and all of that nastiness that's associated with those particular services. You just listen to your audio right here in this desktop music player, essentially. And this desktop music player, by the way, is cross-platform. It works on Windows, Mac, and Linux. And what if I also told you that this audio player is licensed under a free and open-source license? Would you be interested? I think you would. And that's what I'm talking about today as an audio player called Nuclear. So let me go ahead and show you the application here. So let me go ahead and launch Nuclear, and it'll take a second to launch. Now one thing you'll notice about Nuclear is it does have a nice look and feel. It's very attractive, right? It's got this fancy, almost web app look to it. And that's because, of course, we're dealing with an electron app here. Now I know a lot of people really dislike electron apps, but in this case, I think it makes sense because Nuclear is really just a front-end to various web services like YouTube, right? So it makes sense for this thing to be built in electron. Where I have a problem with electron is when people build things out of electron that make no sense, like text editors. Why does VS Code need to be an electron app, right? Why does Adam need to be an electron app? Those make no sense. But in this case, it makes perfect sense. So before getting started here, let me move the player over and adjust the size so you can see some of the controls here because my head was in the way of the volume control. But I'm going to go into settings. And these are really default settings. I haven't played with anything here. So at the top here, we have some social media account stuff here where we can connect some accounts to Nuclear. For example, I could connect my Mastodon account where when I'm listening to a song, I decide to search for a song, play a song, or whatever, it'll automatically post to my Mastodon account. Hey, Derek is listening to XYZ song right now. Some of the other settings that are available include playback settings. For example, Loop after playing the last skewed item means if I have a playlist, it gets to the last song in the playlist. It plays it. And then it loops back to the very first song in the playlist. You have some shuffling options as well. I've left everything as defaults for now. There are two other settings toward the bottom that you may want to play with. There is the streaming instance, which by default uses NVIDIAs. And then there is a downloads directory. And it has a downloads directory setting because you actually do have the ability to download the audio tracks you're listening to locally to your machine. So most people probably just want to stream music here inside Nuclear. But if you want to, you can actually just rip the song again, download it to your downloads directory by default, but you can choose another directory to download your music to. And of course, this really makes NVIDIAs a rather naughty application, right? Because it really circumvents a lot of terms of service, right?  Because if you're using Nuclear, they can't serve you ads. They can't make money off of you, right? They also can't force you to have an account. They can't profile you. They can't track you. And the music industry really wouldn't like Nuclear because it has the ability to download audio locally to your machine. So Nuclear is a really kind of a shady area, right? It's kind of gray. In fact, if you go to the Nuclear website at nuclear.js.org, I didn't show you their website because it has a lot of curse words on it. There's a testimonial section where they find people that really have a problem with Nuclear, for example, people in the music industry that hate the fact that Nuclear exists and they're cursing about Nuclear and dropping F-bombs. They have all of that on their homepage because they're proud of that. They are free software zealots, the people behind Nuclear, right? They really don't like these proprietary web streaming services, audio streaming services. They really don't like the music industry as a whole, the whole DRM system and all of that, right? These people are very pro free software and that's why they've created Nuclear. So let me show you some of the basics of using Nuclear. So I'm going to search for a band. I'm going to search for Journey. Now, if I want to, I can filter the search results down by album, artist or track, or I could just do a search without filtering. And it's going to return artists, albums and tracks. Now I'm going to go back to artist and I'm going to click on that artist. And I really like this song.  Add to queue, which means it's going to add it to our queue list over here. Play now, which means it's going to add it to the queue and start it playing, add to favorites because you have a favorites list. Add to playlist or download, which is just download the file locally to your machine. I'm going to choose add to queue because I think most people are probably just going to queue up a bunch of songs here in a playlist and just stream it right here. And what I'm going to do is I'm going to have to click the play button here because I didn't tell it to play now. I just queued it. But if I play now, it's actually going to start this song playing. I'm going to have to mute the sound because there's going to be copyright issues, but it is playing. You guys are not going to hear the audio, but it's playing just fine because I can see the track moving down here. Now, you notice under the song that I queued up, don't stop believing by journey under it, Africa by Toto is listed. Now, why is that? It's because by default there is a setting, a really nice setting actually called auto radio. It's ticked on by default. You can turn it off if you don't like it, but I like it. What this does, it essentially turns nuclear into kind of a Pandora like experience, a streaming service, because you pick a song to add to the queue, it plays it and then it turns it into like an autoplay situation where it goes and finds similar songs, not necessarily by the same artist, but similar genres because I'm listening to what some eighties rock here. You know, it's going to go find other eighties songs, popular eighties tunes. And once don't stop believing by journey finishes playing, you know, it'll go to Africa by Toto. And once that song finishes playing, you know, it's going to queue up some more songs, which in this case are by the same artist, Rosanna by Toto, but let's say it gets to the end of that, you know, then it's going to play every breath you take by the police, etc. That way you don't have to go and necessarily create a queue list.  And essentially it becomes, again, a very Pandora like experience. Now, how does the downloads function work? Well, you would right click something here in the queue, for example, I could click download and then I go to the downloads section here in this menu and it is waiting for download. It's only at 0%. So it hasn't started downloading. I can go ahead and tell you it's never going to start downloading because this is the flat pack version of nuclear and the flat pack version of nuclear works pretty flawlessly, except for the downloads. For some reason, the downloads for the flat pack just hangs. It's stuck. You can queue up a whole bunch of stuff to download. It's never going to progress beyond 0%. So I'm actually going to close this out. So I found the flat pack version works the best, but there are other versions. There's the app image version and there's your native version that you got from your repos. I'm actually going to launch the native version here on Arch. Now, the reason I didn't use the native version previously in the video or the app image version, they both work the same is because the downloads function in these versions works flawlessly, but actually queuing up songs and playing a piece of music does not work that well. I mean, it works, but it's got a minor bug. For example, say I queue up the same journey song to play here. So I'm going to click on it, add to queue. I'm going to get an error, right? A JavaScript error. This error, I've checked their GitHub for issues. People know about it as some error regarding Impress, the Impress APIs. But you just click OK and it will actually get past the error. Let me hit play because that was just queuing up that threw up the error. But then I can hit play and it's going to play the song just fine. So you do get error messages occasionally, but you just hit OK for that JavaScript error. No big deal. But at least in the app image and the native package in Arch, when I right click on something and click download and then go to downloads. Just wait a second. You know, it's now actually downloading. You see 30 percent, 38 percent. Let me cancel that. So neither the app image or the flat pack are perfect. Both of them have minor errors, not the same error. So what I would suggest if you care about downloading music, right? If that's the main thing you want to do with nuclear is actually rip songs and store them locally, use the app image. If you're not going to be downloading music, you're really just streaming music, right? That's all you're interested in. Then I would use the flat pack because at least it won't have that annoying JavaScript error that the app image will have. Now, the errors that I showed you today, the JavaScript error in the app image and also the downloads error, where it's just stuck at zero percent in the flat pack, the people behind nuclear, they know that these issues exist. And I'm sure they're they're working on them and they're going to get these fixed in a future release. So that's just a little bit of what you can do with the nuclear player. Again, free and open source software cross-platform available on Windows, Mac and Linux. Now, before I go, I need to thank a few special people. I need to thank the producers of the show. Devon Gabe James, Matt and Michael Mitchell, Paul Scott, Wes Allen, Chuck Commander, angry, Diokai, Dylan George, Lee, Linux, Ninja, Maxim, Michael, John Alexander, peace, arch and for door, Polytech, Red Prophet, Steven and Willie. These guys, they're my highest tiered patrons over on Patreon. Without these guys, this episode about nuclear would not have been possible. The show is also brought to you by each and every one of these ladies. And gentlemen as well, all these names you're seeing on the screen right now. These are all my supporters over on Patreon because I don't have any corporate sponsors, it's just me and you guys, the community. You like my work, you want to see more great videos about Linux and free and open source software, please help support me. Subscribe to DistroTube over on Patreon. All right, guys, peace. Just a small town girl living in a lonely world.


6 left and narrows 80 Small flat crest 80 6 right and flat right 100 Great King Sleepy 3 left 50 3 right knee and stay left don't narrows 20 4 and a half right 100 5 and a half left and 5 left up 50 6 right on crest 50 care 5 and a half left over crest 50 don't and don't 3 right 50 5 left over crest 50 narrow grid 20 flat right over crest 100 hug 6 right on crest jump 50 5 and a half left and 5 left 50 flat left 50 5 and a half left don't 50 flat left flat right 120 care breaking slow crest 50 narrows into turn 3 right knee slippy 20 flat left up 100 turn 3 left up top 70 flat right on long crest 100 turn 3 right knee 80 flat left 50 flat right through dip and flat left on long crest 100 short please left breaking


During this current crisis, everybody's talking about all these scary things, but no one seems to be talking about the PPE litter Hey there and jrew22.com and today we're gonna talk about something that everybody knows about everybody except infants and one-year-olds It's about the side effects of personal protection. I guess this whole crisis, which I like to refer to it as I don't like using many of the common phrases that everybody's using and they're like wearing them out They're not even scary anymore. Oh pandemic back in the day pandemic was bodies piling up on the street now It's none of that as you can see I'll put a couple pictures here I don't go out much, but I every time I go out I see masks and gloves and wipes and all sorts of other wacky garbage and What bugs me is that all these politicians are telling people to stay home and do this and don't stand like six feet But you can stand six feet one inch.  They're really bone heads No one is talking about hey, wait a minute if this germ if everybody assume everybody has it Wouldn't you also assume that every piece of litter that has a any mask or glove has it to And they're not even making any effort to clean it up or address it as a real concern Which kind of blows holes in it like swiss cheese in their whole Scare tactics.  You can't even stand up to it I mean a lot of people are and it's growing optimistically growing. There were people are resisting this Nonsense we woke up the minute when the minute that we we heard about we just said forget about it I'm not going to do this, but it's a sad world we live in I guess that's why a lot of people who are city folks are starting to find more isolated places to live I just think this is nuts anybody can show me Anybody to say oh, we have to clean up the PPE litter. I'd be happy to see it, but I haven't seen it So that's it you like the video Please hit the buttons and all that and subscribe and share with your friends on social media And I'll see you next video


Hi, Professor Gerald Friedman, Department of Economics, University of Massachusetts. And I'd like today to talk about the fundamental question, must work suck? And the answer is, under capitalism, unfortunately, yes. And this comes in several ways. Now let's begin with the capitalist labor process. The basic organization of production to capitalism is you go to work for a certain length of time, and while you're at work, you do what you're told. Some of you have seen the comic strip, Dilbert. There's an excellent illustration of how this process happens. Many of you have gone to work yourself, and you know about it. So how does this work? You have intelligent human beings, sentient, who are supposed to act like robots. How do you get them to do that, and how do you get them to show up the next day? First thing to note is people do not like being told what to do. It may be a fundamental human drive that people like to make choices for themselves. They like to be in control of themselves. They feel dignified when they're making their own choices and undignified and disrespected when somebody's telling them what to do. Of course, I tell you what to do, I'm saying I know better than you. And you are not as good as me. Ask yourself, how do you feel about that? Would you like to go around feeling that you're not as good as somebody else? That you should just do what they tell you to do? So how do we get people to do it? Through fear. Fear that the alternative to following orders is worse. The alternative to following orders is to go hungry, lose your mortgage, not be able to feed your children. So with the threat of unemployment, people go to work, they do what they're told, and they have to rationalize it. Because however unpleasant it may be, you have to live with it so you tell yourself, well, okay, following orders, being part of the capitalist hierarchy is right, I guess, because I guess I'm not as good as the boss. The boss is smarter than me. The boss knows better. So I should do what he says or she says. So we develop a schizophrenic life under capitalist work. At home, at the bowling alley, in the voting booth, we're citizens, we're free, we're important, we're valued. At work, we're idiots. We develop a side of ourselves that accepts its position as subservient, as inferior. And that's what work teaches. And that's pretty much essential for a capitalist society because the boss and the capitalism has to find a way to get you to follow orders. The way they do it is by teaching you that you should follow orders because you're not as good as them. So does work have to suck? I'm afraid the answer is yes, under capitalism.  But till then, I hope that you have a nice day and don't have to go to work. Have a good one. Bye-bye.


I picked Marshall because they gave me a good deal and they said I had a chance to start as a freshman, which was awesome. I just love the campus and I love the facilities. The cooks are really cool and it's close to home, so I'd say close to the community and hopefully people can come and watch me. I thought it was a great fit overall.


In today's video, we'll discuss an important shift in the world of artificial intelligence, from AI-centric to human-centric models. Elon Musk is at the forefront of this movement, advocating for a benevolent AI called Truth GPT. But what does this mean for the future of AI and humanity? Let's dive in. AI and LLMs like GPT have revolutionized various aspects of our world, from businesses to our daily lives. The current trend has been to develop AI-first methodologies, making AI the primary driver of thought and processes. However, concerns about AI becoming too powerful and threatening humanity have led to the rise of human-first AI models. These models prioritize human values and needs over efficiency and productivity. Enter Truth GPT. Elon Musk is a key advocate for this shift, championing a benevolent AI model called Truth GPT. This model aims to protect humanity by creating AI systems that align with human values. While the idea of a human-first AI isn't new, Musk's suggestion to build AI from the ground up to protect humanity marks a potentially significant departure from the traditional AI-centric perspective. Human-first AI models can serve as de facto advocates for humanity by incorporating fundamental philosophical insights or commands into their learning processes. Like founding documents or constitutions, these models can be guided by a set of core values and principles to ensure they serve humanity's best interests. This approach can lead to the development of more ethical, transparent and accountable technology. However, there are challenges. AI development occurs on a global scale and various countries and companies invest heavily in AI research with differing goals. Some players may not share the same values as Musk's proposal and could use AI for nefarious purposes, such as surveillance, propaganda or warfare. Additionally, prioritizing human values above all else may slow down AI-driven progress in fields like healthcare, education and transportation. Despite these challenges, human-first AI models like Truth GPT can establish guardrails for innovation and creativity. Prioritizing human values and needs in AI development is essential, and Musk's vision for artificial intelligence represents a call founded in both insight and wisdom. Host. That's it for today's video. What do you think about the shift from AI-centric to human-centric models? Let us know in the comments below.