Still completes A combo, don't know if it was the one you want. All right, that's it, no charging. The fastest level 3 I've ever seen. How's it going everybody? Dachodoy here back with some more Dragon Ball Fighters Rank Matches, this time officially kicking off the week of Kefla with her release. Now the team we're running today with Kefla actually isn't all too optimized around her, but I did want to use these particular assists just to make the most out of her insane dash ability. We talked about it a lot when looking at her trailer. Oh man, this intro. For some reason it looks even funnier with people just waiting in the background like, all right, all right, let's get it over. But no, with Kefla's dash, it is legitimately an amazing tool. And Yonk just assists more just here to lock them down for my auto combo sparking loops. If it ever comes to that, I don't know if I want to go in. Oh, let's go in. All right, all right, all right, how about a beam assist and then I, and then I'm just going to be right here. Oh, how about I go up and I'm right here? No. Oh, all right, we're in. It took a little while longer than I expected it to, but Kefla always gets the hit, dude. Sliding will take that. Beam assist, hold them down. No super dash. That's fine. I'm coming in. Oh, I could have combed off that for sure. Do you see how fast Kefla is, by the way? With the new take throw, Kefla is legitimately a menace, especially with her, you know, especially with just her overall, like, mix up tools. Oh, that was a nice assist, actually. I didn't know Jiren had it like that. Oh, wow, mashing lights. Okay, he tried the green orb move. I don't know if that one got any better, but yeah, it's a little slow. That one definitely requires a bit more setup. Going into the Keyblast loops here. Damn, just brushing Yamcha away. Hold on. You mind if I switch out here? All right, no reservations then. Oh no, how do you drop that?  All right, let's go. PC. All right, at this point, I don't know if it's just me and I suck, and I know it is, but I'm just trying to, oh no. I hope this kills. All right, nice. One bar from Kefla is going to kill. Man, I am just dropping a lot. It doesn't matter. We still have Kefla. What's the mix? There is no mix. We just dash. I did the wrong move for the dash. Okay, that's fine. That's fine. That's fine. You can do this. You're in your right. Hey, bro, I'm about to dash in. Oh, that was a nice projectile counter though. Oh, command grab. Good stuff. Going to have to spend a bar to combo off of it. And with Jiren gone, that's about all he can do. I'm just going to super dash in. Do we want to show off the sparking loops? Let's show them off. Let's show off the sparking loops. Let's make him block. Oh, who needs it? Oh, Kefla's combo looks so sick. I wasn't sure if that was going to work or not. I was like, oh, she does have that air level one, right? All right, so we didn't get to do any of the sparking mix up stuff, but that's fine. We can still easily just get in there. Oh, let's go. Man, how do you, I need to learn how to combo off that from far away because clearly that move is going to hit people. I forgot about the disc. Made the classic mistake. Oh, big lag hitting him in an inopportune time. Still completes a combo. Don't know if it was the one he want. All right, that's it. No charging. The fastest level three I've ever seen. Man, that freezer really thought he had a plan here. Watch the juke. Damn, I keep doing that wrong. Oh, he's, yo, Kefla is so good. Dude, I feel like once her mix ups get late, uh, all right, you can try that. Do you know what side I'm going to be on? Watch the mix. He thinks I'm going to be on this right side, right? But I'm going to wait. Oh, never mind. He had a plan for that, but you can see what I was going for. He just used rocks anyway. So probably not the safest thing to do without an assist around. Okay, check the check freezer. I don't want to let freezer get away with too much. Let's put him in the corner. A little bit of a sliding knockdown. What are you going to do, freezer? Wake up. Oh, you can try it. Is there any mix? Is there any mix? Are you going to go for any mix?  I hope you know that. Oh, no, what am I doing? No, that's not. Oh, no, that's not a, that's not a key blast. Oh, what a terrible time to run out. Oh, no. Oh, he's still alive. He's a survivor with Frieza's limits broken. He's not going anywhere. Hold on. Let me, let me just see if I can, real quick, Frieza, can I get your opinion on something? What's it like to die? Oh, no, hurry. No. Oh, it didn't combo. Thank goodness. Oh, okay, we won. But I honestly think that those rocks probably should have hit us. Game one goes to Team Kefla, although it wasn't the best game. We kind of let it slip away there at the end. I'm going to take full pride in that though. That's one game if Kefla ranked down on the PC. Oh, I should have mentioned that. That's why I'm in Living Legend, by the way. This is the PC version of the game. That's the only version Kefla's out on right now, I think. I think Xbox might have her, but we're back in there, baby. Just do it. No. Oh, no. Oh, yeah. Let me show you guys a quirk of Kefla. Yeah, she can jump cancel even when she has the cinematic around. I was trying to go for so many mix-ups that I ended up going for none of them. I really wanted to do a take throw there, but I just panicked. I was like, do a take throw or do a command dash? Oh, it's so good. So many options. I actually got choice selection paralysis. I didn't know what I wanted to rock with. Oh, I got sigh. Am I dead?   Come on. Drop the combo. I'm Kefla's dead. Wow, the second game of Kefla's showcase. She ain't even going to be here. That's crazy. Damn. I feel like we could have done so much more too. Oh, big lag. That's fine. We're going to work our way through this. We still have the rest of season three to help us out here. So I'm not entirely too worried. Did we go for rocks? Why not? They're half off. Oh, shouldn't have gone for rocks, but he can't combo off that. Okay, I'm getting assaulted right now. Getting assaulted by Kebla is from Jiren, but we're back in. All right, this time I think we just go, come on. Where is why? Okay, something is definitely, I think I'm not, I'm not hurrying up as much as I should be. No. Okay, really slow command grab. Still really slow. I wonder if that was plus. Oh, it does not matter. Let's currently get out of here. We're just going to ex this only for half a bar instead of doing a level one. We got to change up the way we do math to kill now. EX bars are way less expensive. Oh, you must have forgot it was season three. You must have forgot it was season three. I must have forgot it was a what I suck. Oh, no, I must have forgot it was season three. I just put myself in the corner. Geneva stop. Geneva, please. Why are you doing this? Oh, not the full damage. No, I should have vanished. Okay, well, we're in it for the long haul now. Three bars probably going to get some knockdown. Yep, there it is, the hard knockdown meaning we have to get, we're on the ground and we have to get up on his terms except I'm a spark. I'm a spark.  Overhead. He was expecting to click some buttons. I guess that's fair against Yamcha. One bar not going to be enough. I'm not worried about death quite yet. All right, it's level three. Oh, he blocked the patience. But does he know how to react to this? He's got a dragon rush. Not everybody knows that that comes back regardless. So I'm not going to say I bl- I died. I just lost the whole game. I just lost the whole game. That's crazy. I just got double Sunday going. I'm not giving up yet. I probably should give up at this point. No, this is going to be the hardest comeback of my young adult life. Geez, Frieza is hard to get. No, come on. That was unfortunate timing. No. Oh my goodness. What do I do? Look at him. He's just, he's got guns, dude. Frieza has multiple, multiple guns. Look at that. Oh my goodness. That was a correct choice. My level three right there was pure desperation at this fight. It's going through the 2M. I didn't block it. Hold still. Hold still. Don't panic. I'm panicking. He doesn't have any more EX bar. Kamehameha's going to connect. Frieza. This is for Namek, saga, baby. Oh. Season three Frieza is the scariest thing I've ever played against. I'm not even joking about that. Why they thought it was a good idea to give that EX wave half off the Frieza? I will never know. But that is a win for Team Kefla, even though Kefla kind of sat on them. She was coaching. Definite coaching at work there. Damn. I feel like my mouth is right after that one. That was crazy. I was definitely panicking. Good work, Yantra. Let's keep it up.  Yo, yeah. Another yo stamp. That was off. Don't leave. Okay. Okay. He didn't leave. Just a couple of stamps. Just a little bit of a mix up. He knows how I feel. Oh, no, I dropped. That was me. I'm still not used to Kefla's still not used to Kefla's buttons entirely. Man, I got to hit that corner combo. I really, really want to hit that corner combo. But let's get out of here now. Oh, right. All right, guard cancel. That Kamehagra reminded me of my mortality. Dragon rush. That's the new dragon rush. Tick throws very fast. Not everybody is used to them quite yet, including me. Let's not get it twisted. What did I use for Kefla's assist? Oh, yeah, the vegeto button. Just a little vegeto reminder. I don't have much experience with Kefla's assist, but we do have the B assist on just to make sure we can keep him in block for when Kefla's behind. Okay. That's fine. That's going to be okay. And Krillin is gone. Jiren came in with that 2M and that's going to be more than enough damage to put us away. Oh, I did kill. I was going to say that looked pretty close. Kefla, show us the way. It's my turn to have some fun. Let's go. Oh, counter. How did he know I was coming in? All right. Going to take that. Defense. Okay. I'll take it. Come on. That was sick. Kef. Okay. In level three. Yes, dude. Very nice. Pretty basic combo, but man, it felt good. All right. We're back in, we're back in contention for the game now. Okay. Okay. Okay. I'm liking this start. Bad reflect. That's going to mean the end of Genemba, I think. The end of Genemba and the beginning of Kefla. Coming down. Oh, I could have done that way earlier now that I think about it. Oh, that's sick. That's going to be a really sick DHE, but now Kefla has to go up against Frieza. Oh, EX wave caught me. We're going to be okay. Okay. Let's go down heavy. Boom. All right. Hold on. I mean, unless you level three, I take this W. Wow. I didn't take the W. Oh, no. Oh, stop the violence. Oh, we got to protect you. We got to protect Yamcha. Don't click a button or I will unleash the level three. The fastest. I told you, I told you not to click a button. Damn, Kefla's level three is mad nice. I don't, I do not want to see anybody try to zone against Kefla. Okay. Nah, he caught up. All right. Well, Kefla put up a decent fight. We got Yamcha back most of itself. The only question is, can we finish off a seven bar Golden Frieza? Again, Golden Frieza is so scary.  It's okay. We can buy time and maybe even win the game. One, two, three, four, five. No. Oh, no. Jump it. Watch out for Frieza. No, Sorbet. No, Sorbet. Sorbet, Sorbet. Why would you do that? I rushed things. Oh, I watched the whole movie too. I didn't learn anything. Oh, I panicked. Damn it, Sorbet. Why would you do that? I literally got shot. Damn it. All right. One more time. We got to finish this first to three, dude. I'm gonna do it the right way. Oh, you thought I wasn't reflecting that? All right. Didn't get them. I don't know if I had the extra jump there. I wasn't, I wasn't trying to stick around and see if I did. Okay. Block it. Coming in. All right. Too slow. That's fine. I'm still trying to work out how I want those a nice reaction. Okay. Okay. I got to throw in a heavy there once or twice. I'm still trying to work out what I want my Kefla block string to be. I haven't looked up any block strings. I did look up some combos, which we haven't gotten because they're corner. I keep trying to vanish against Jir. How many times have I died exactly like this, by the way? If anybody has an exact number, let me know. I'm just gonna spark here. Guard cancel out. I tried to put on the pressure. Damn. This Jirid is doing damage, by the way. I don't know if that's just the health bar looking a little different, but it's definitely feeling a little different. Let's just get the hard knockdown with Kefla. See what we can do on wake up because man, I am tired of dealing with this Jirid in the quarter. All right. Stop Jirid. You've had enough. He's going to wake up counter. All right. Well, we kind of let Jirid get his day and out in the sun. There's the grab. What did he get on it? Not much. Gonna have to spend a bar to combo. Damage is highly scaled. Honestly, I think I might start taking the grab. Level one. Level one. What's the, what's the wake, what's the wake up on this like? Is it anything to be truly afraid of? No. Oh, that looked vicious for some reason. Oh, Kefla. Dude. Kefla's so good. Kefla's so fat. And I was gonna do the overhead option there if he kept blocking too. But I think I want to go home now. Yeah, I wanted to go home. Let's see if he doesn't eat. Oh, he's really doing that. All right. Let's, let's, let's give him stuff in the, let's remind him of Jiren's place in the world. Nope. You're still Jirid. You got to spend that bar.   Oh, all right. Can Kefla kill from here? Coming down. Yes. That's going to be a knockout for Kefla. That windscreen. I mean, that KO screen is really cool. And it's Kefla time. Just like that. I kind of let him slide. Dragon rush. Again, another thrown that in with Kefla. It's going to get really scary. Okay. I don't know why I went with this option. I keep forgetting that. I don't think that gives sliding knockdown. So slow. Sick. I'm trying to do something a little height. Where are you going? Wait, what? Oh, all right. We'll catch these then. I don't know what his options would, I guess, vanish, right? Vanish would have hit me. We got, we got Zoom. Hey, Kefla. But that's not actually Kefla. It's Khalif Linkale now. We ran out of energy. The first video in turns was Kefla Week. We got the W in the end. Three to one. I think it was three to one anyway.  I can't wait to play a little more. Show off some more of those big B&B corner combos and a little bit more. I didn't, I didn't really show off as much of the sparking loop as I wanted to. So we'll definitely do that next time. But if you want to see that, definitely make sure to go down below. Leave a like and subscribe. And let me know what your thoughts on Kefla are so far. If you want to watch more videos right away, there should be some on your screen. So definitely make sure to check those out. If they catch your eye, Kefla Week is going to be a ton of fun. So I'm hoping you guys are enjoying it. I've been Dr. Doi and I will see you in these next couple of Kefla videos.


So the past, over the past 25 years also of KDEV, it was a very conscious decision that KDEV doesn't employ and contract people to work on the actual products of KDEV directly. And there were many reasons for that, among them that the organization just wasn't mature enough to handle that. There was fear of the organization meddling in development decisions that should be with the teams. It was quite a large overhead. And it was a bit hard to figure out how we can fund the basics of the organization and much needed groundwork projects that maybe don't have so much visibility and still are really important for us and need funding. So that's why we stayed away from that so far. Regardless of that, there was still a huge need in several projects to do that, to do project specific fundraising, which then led to projects setting up their own independent foundations, for example, or people doing, trying to do individual fundraising. And all of that comes with quite a few drawback and risks for the people involved, which is not cool. And because of all of that, for the year before last, I think, we started thinking about this make a living initiative where we tried to figure out how can working professionally on KDEV's project and products be done in a way that the KDEV can support and what should KDEV do to make that happen. And the first results of that whole process are out now, which means we are trialing project specific fundraising, and we're trying to make that possible. And we're trialing this with KDEV in life first, because it's a very attractive project and a very eager team that wants to do amazing things. So we're trying to figure out along this trial how we can make this work and how this can work for everyone involved. And with that, I'm going to hand over to Shonbaptist to talk a bit about the KDEV life side of that. Thank you. Yeah, thank you. So, yeah, I came here, you already heard a lot about KDEV live during this afternoon's presentation. I wanted to also present a perspective from the application maintainer. So also I came here to say a big thank you to KDEV's working groups who really helped us on this. So our challenges were quite usual, I think, so the application was quite successful. We have now multi-platform support, we have more than 100,000 monthly downloads, so it's quite becoming quite popular. But our team is not growing as much, so we have a small team, maybe between two or three developers and three or four people around doing other important stuff on the application. So it has not been growing as much as the popularity of the application. So the workload is increasing on us and we can't progress as fast as we want. So what can we do about this? One thing that helped us is a system automation, having a CEI, having a binary factory that produces binaries, it's something that really helps us. But the other thing was to launch a fundraiser to help us have more free time to work on KDEV live. So for the past few years we had discussions about how to do this and it's almost exactly one year ago that I emailed the KDEV board to announce that we planned to do a fundraising and we started to work together and fundraising launched in September, so it was in fact quite fast because we signed a contract in March, launched fundraising in September and after 12 days we are now at 11,000 euros, so it's close to our goals, so we're really happy, so it's a reason to celebrate. And I really have to say that we were helped by the fundraising and promo group from KDEV because we didn't have the experience or the time to work on the campaign, so this was really helpful. And now the challenges that remain for us are first to make this campaign not just a one shot but to have something that is sustainable, that allows us to work on the long term to have a bigger team, to also we need to increase our presence, so we will need more promo to go to events to be more known and the last point is of course to keep having fun because it's also because why we do this despite having money involved we want to keep fun developing our application and that's it, thanks. Thank you, Tobi. That brings us to what's in the future, so as we talked about, we're now trying this with KDEV and for a while I will support this very extensively and any help with that is appreciated, so we can for example move the fundraiser over to GoPost. So you all can help make this a success. Once we've gained some experience with this and are happy with it we will open this up to potentially more projects and if this is something you consider for your projects then please do reach out to the board and or the fundraising working group so we can talk about it. Thank you very much and with that we are moving on to Harald, no to Albert, sorry.


Will you be willing to give up for Lamar to be a Raven for life? Not alcohol. F*** the Ravens, go Steelers. Go Steelers, Mitch the Superbowl.  Oh my god. Literally, firstborn child. My left arm. Your left arm? Yeah.


Hey y'all, welcome to What Chelsea Eats. Thank you so much for joining me today. I wanted to come quickly and talk to you about tips to heal endometriosis naturally. I know I don't ever single out endometriosis, but I wanted to today because the truth is is that I don't see enough of people talking about it and endometriosis is such a painful condition to have. Like it really is. And there are so many women who are struggling with it. I remember in the year 2001, I know that was a long time ago. I went to work for this company and my administrative assistant, she had just, when I started working there, she had just had a complete and total hysterectomy because of endometriosis. And she was only like 30 years old.  The only option she had was to get a hysterectomy. And there are things that you can do to help yourself heal from endometriosis. So thank you and welcome to everybody who has joined me. I'm so grateful that you're here today and I'm going to get right in it as soon as I remind you about the foods to avoid to shrink fibroids naturally webinar. And I want to encourage you, if you have PCOS, ovarian cyst or endometriosis, the same information applies. So the webinar is December the 3rd, 2017 at 2 p.m. Eastern Standard Time. There's a link below where you can sign up for the webinar and I'm going to do some teaching on foods to avoid and then you'll get the opportunity to ask me questions. So I'm looking forward to that. And also you can sign up for a free 30 minute coaching session with me right now. All you have to do is click on the link below, sign up for it and I will send you a link so that you can schedule yourself to talk to me. Okay, so I'm going to go into endometriosis. First of all, endometriosis is a symptom. That's what I think it is, but that's my opinion because it's a symptom of your body being off balance. And so what happens is when your body is so out balanced it's got to have something to do with all that toxic wastes in your body. So it's a symptom and it is a symptom of, and the root causes are poor digestion. Like if you have, well, I guess the technical name for it would be gut dysbiosis. So for example, you've got IBS, you've got Crohn's, you've got bloating and like your stomach is extended.  So I think that's the first, I'm not saying it's the most important, but it is one of the symptoms of, I mean, one of the root causes of endometriosis. Liver congestion and liver congestion can come from all kinds of different things. In the case of female related issues, it is estrogen. Your liver is backed up with excess estrogen and waste that is in the body that has not been able to be released. Because what happens is in a normal system when you're healthy and everything is working right, your liver will get the stuff from your blood and it'll be able to filter it out and then dump it into your, you know, your limited channels and it just goes out of your body. But when your body is backed up with toxic waste, your liver is just like trying to get through, getting rid of the toxic waste and that means it's congested or sluggish.  And the poor diet is processed foods, meat, dairy, like lots of it, lots of starchy carbohydrates and stuff like that. So, yeah. And Aunt Connie, if you're on here, I just want to say hi. I love you. So let's just talk about one of the things, I'm gonna talk about a few things that you can do to heal endometriosis naturally. First of all, there's no one thing that you can do to heal endometriosis naturally.  Like it means, I mean, to get rid of endometriosis, you have to shift your whole lifestyle. And people may be sick of me here, sick of me saying that, but the truth is that is what causes these female related issues, it's lifestyle. And one is food. We have to stop eating the estrogen mimicking foods, the foods that are loaded with excess estrogens and we have to stop bombarding our systems with it and give our bodies a chance to detox that stuff out of our system. So estrogen foods are like soy and soy is hidden in everything. I mean, like if it's a processed food, there's all kinds of soy ingredients and they have different names for it and you never know that it's in it. So the best thing to do if you have endometriosis is don't put anything in your mouth that's processed and comes in a box. And the other thing is caffeine, alcohol, meat, dairy, I've already discussed those. And also if you wanna know more about that, if you go to the foods to avoid webinar to shrink fibroid tumors, I'll tell you about the estrogenic foods. And those foods are the same thing that affects people who have endometriosis. And what's interesting too is that a lot of people who have endometriosis also have fibroids, fibroids endometriosis. Like it's all the same root cause. It just manifests differently in everybody's body and unfortunately the symptoms also are different but that endometriosis pain is no joke. So when we talk about that, the other thing is that you have to supplement to balance your hormones and in combination of changing your diet. I wish that I could say that you didn't need supplements this day into age but our food supply, even the good food is so jacked up and our bodies are so out of whack. We need the supplements in order to get our body in line. And if you want me to do a video about what foods, I'm sorry, what supplements to take to balance hormones. I would be glad to do that if you can put that in the comments section if you're watching this video later or you wanna tell me that now in the comments section here I would be glad to. Hey Chelsea, I can finally catch a lot of videos. Thanks for the useful, you're welcome to solve fibroids. I appreciate you commenting. Okay, and so if you want me to do a video about balancing hormones, what supplements to take, I'll be glad to do a video on that as well. But most of all, with those two comments, so I've talked about the estrogen producing foods, getting rid of those and supplementing to balance your hormones. And the next thing is just changing your lifestyle overall. Like if you're sedentary and you don't do anything but go to work and come home and you don't do any exercise, you need to start exercising. I'm not saying do insanity. I'm talking about take a walk around the block. I'm talking about get on the rebounder and rebound for 20 minutes or 10 minutes a day. I'm talking about doing some stretching. You gotta get your body moving. Also getting rid of the stress. Some stressors, I get it. There's nothing you can do about it. Like they're just going to be there.  But you can control how you interact with the stress. Just because there's a stressful environment doesn't mean that you have to respond to that stress. And if there is some stress that you can control, then you need to get rid of it. So some of you have heard me talk about this. I'm not sure if I've talked about it in a YouTube video or if I just talked about it in my Fibroid Detox program.  Sometimes it's family members and you can't always control if you're gonna be around the family members but you can put boundaries up so that you know how much you will take and how much you won't. And another thing, especially women, we have this habit of thinking that we have to do everything for our kids. And I'm not talking about your little kids. I'm talking about your grown kids that should be doing stuff on their own and you're doing stuff for them.  Do you know what I'm saying? Like, you have to eliminate those excess stressors. Like, I hear stories like that all the time and I'm not coming down hard on people but I know, because I've been there and I know that I needed to change all that stress so that I could start to heal. So I wanted to talk about that. That's lifestyle-related stress. And the last thing is cleansing. Detoxing your body. A lot of people don't understand what I'm saying when I say detox. But I'm talking about cleansing your organs. I'm talking about, I'm sorry about that, y'all. I'm talking about cleansing your liver and your lymphatic system and your kidneys and whatever else you need to cleanse in order for your body to work optimally so you can get rid of these diseases like PCOS, ovariances, endometriosis, and fibroids. And if you'd like me to do videos on how to detox the body, and I have done some, I'd be more than happy to share that information with you as well if you need more details on how to detox. But those are the main things that you have to do. Now, I know it seems like it's a lot but unfortunately, when you've gotten yourself in a position where you've got fibroids or you've got endometriosis, you are so toxic. You are in toxic overload and your body is screaming to get rid of all of those, all that excess waste.  I mean, in the whole scheme of things. Your body is just like breaking down. And in order to stop, like you can stop endometriosis pain like that by getting rid of the estrogenic foods, drinking plenty of water, detoxing your body, you can get rid of that pain. So yeah, that's all I wanna say about that. But if you have any questions, go ahead and ask me now. And also I wanted to say again, if you missed it, I'll be doing free 30 minute coaching sessions. If you're interested, there's a link below. All you have to do is click the link and I'll send you a link so you can schedule a consultation with me. I'm looking forward to it. It's gonna give me an opportunity to talk to some of you that I don't always get to talk to in the comment section or anything like that. Cause I really do wanna help people. And there's only so much that I can do on a video. And I want to be able to give that help to people who need it. Also, the foods to avoid to shrink fibroids webinar is going to be on December 3rd at 2 p.m. Eastern Standard Time and there is a link below to sign up for that. Any questions, y'all? And I believe if you don't know, you can ask questions. There is a, if you're on your phone, there should be a little box below where it looks like a little note section where you can type in your question and you hit submit. And also, if you are not catching this live, welcome. Thank you so much for watching this video later on and you can also put comments below and I'd be glad to answer your questions. Thanks Chelsea from Kenya, Nairobi. Hi Rose from Kenya, Nairobi. Kenya, Nairobi, okay. So that's the, I guess the state and the country. Like I'm bad with geometry these times. What kind of water do you recommend? Filter, purify, pH eight or higher, et cetera. Okay, so that is a great question and I love your namespeak life. I've seen you on here before so thank you so much for being a faithful viewer. I appreciate that. Water, the only thing that, I mean alkaline water is probably the best water that you can drink and there's a system called Kangan water system. If you want to research that, I think that's probably one of the best water systems that you can get for alkaline water. But I would, the only suggestion that I have about water when it comes to female health is just to try not to drink water out of plastic bottles and purify water, you know, leave that for a last resort. Like if you're out and you don't have a choice, I have five, four, four, I've raised four, I've already lost a baby 18 weeks ago. Well, I'm so sorry. I'll get to that question in a second. But the water, you just make sure you try to drink out of glass bottles and if I had the choice, I would go alkaline first, then a healthy source of spring water then distilled water, but I'd make sure that I was getting my minerals. So that's what I would do as far as water is concerned. For my sister that lost the baby a couple of months ago, you're welcome, speak life. And you have four-centimeter fibroids. You know, there's only so much I can tell you in this little bit of time that we have on this live. But I do recommend going through my fibroid detox online course because it will teach you everything you need to know to get rid of fibroids. But if that is not an option for you, getting in that foods to avoid to shrink fibroid tumors webinar that I'm gonna have on December the 3rd at 2 p.m. Eastern Standard Time is a good place for you to start because I do teaching on what foods to avoid and why. And then you can get an exhaustive list. I mean, you probably, you may already have my list, but I teach on that stuff in that webinar. So that might be a place for you to start and that's absolutely free. And the thing about fibroids, usually it's like, you need some support to help you keep going because it's a lonely, lonely, and end to meet all of these female-related diseases. They're just lonely and people don't understand why you're trying to eat a certain way so that you can start to feel better and get some healing. And yeah, I'm gonna hope that answered your question. Like, you need support. Anyway, but go on that free webinar. That's a good place to start and I'm so sorry that you lost your baby. And there was another question that came up that came up so fast that I didn't see it. So if you want to type that question in again, that would be great. Do you have any other questions today? Also, you know, maybe put in the comment section any subjects that you want to know about. What do you want me to talk about in future videos? That would be helpful for me to know as well. And I know some of you who are watching are trying to have a healthy Thanksgiving and I hope that you're able to do that. And even if you're not trying to have a healthy Thanksgiving, it's okay.  Enjoy your family and, you know, when you're ready to get back on the saddle, get back on the saddle. And yeah, we can kind of go from there. But I just, I want to know what you want to hear about. I do videos, you want to detox. I'm going to get to work. I have a beautiful day. You too, Speak Life. Thanks so much for watching. You want to detox, okay? If you want more information on that, I will, I'll go ahead and start adding some videos to my channel that, you know, talk about more on detox. But if you put detox in the search section of my YouTube channel, you should come up with some videos that'll talk about detoxing the body. It's kind of scattered all over my YouTube channel. Unfortunately, there's no rhyme or reason of how it's situated.  But I do talk about detoxing in my Fibroid Detox program. And if you are interested, there is a link below. It is pretty economical in my opinion, so anyway. But to detox the body, you just have to, you have to get rid of all the excess processed foods. You need to drink water.  So, but anyway, y'all, thank you so much for watching and y'all have a happy Thanksgiving. And, you know, one other thing is I have a lot of people who watch my videos that are from Africa, like a lot.  And I don't know if there's some type of holiday that you all celebrate like that's similar to Thanksgiving. I would like to know that. If you would put that in the comment section, I would love to know that information if there is. Also, if you're from another country, I know there's somebody from the Philippines that I communicate with on a regular basis. And if you have some type of holiday, I would love to know what it is. If you could put it in the comment section below. All right, y'all, thank you so much. And I will talk to you all soon. Take care. Happy Thanksgiving, Heather. I don't know how to end this live. It just kind of won't go away. Don't know what's going on here.


So, welcome to Cracking Drupal. This is a sort of, it's in the PHP track. This is meant to be a general interest to PHP developers, but it's definitely a developer talk. I'll show you some code samples, but not too much in depth, but mostly focused on concepts, and then also connecting it back to Drupal and talking about how Drupal helps prevent some of the most common vulnerabilities we'll talk about, and in which cases Drupal can't really help you, and you do things right yourself. Moche, assuming he shows up, and me are members of the Drupal security team. So I get to put on my official Drupal security team hat. So we do these kind of presentations. So I've done this one actually with Klaus a couple times. He handed it off to me, and Moche did this time, but we do them to basically help improve the general state of security knowledge and improve the overall security posture of Drupal code, especially a contributed module, since obviously contributed modules get a lot less attention than Drupal core in terms of people looking for security vulnerabilities. One of the other things you should know about the security team, I think we'll mention at the end, is that we don't actively look for problems. We basically handle things that are reported to us. So you should not imagine that we are proactively scanning your code at this point, but instead usually it's another contributor. If there's a module on Drupal.org, a contributor will notice there's a problem reported to us, and then we work together with a maintainer to fix it, as opposed to us being proactively looking for problems. Okay. So the overall kind of framework for the talk here is we're just going to talk about security strategies, and we're going to talk then, as I said, particularly about PHP and Drupal. And overall, think about your security strategies. This is a big picture for your website. So in terms of your website, any kind of application, you need to know who you trust and what you trust them to do. So for example, do you trust your editors to reconfigure the site, enable modules? I hope not. You should instead be thinking about how do I give the editors the least amount of privilege that they need to do their jobs. So this principle of trust, knowing who to trust to do what feeds in to the principle of least privilege, principle of trust is also very important about data that you're dealing with. Do you trust the data? And you'll see over and over again, these vulnerabilities basically come down to the case where you trust data that came from a user when you should not have trusted it, because that user might be an attacker. Basically, user is synonymous with attacker. In most examples I'm showing you here, any user of your site could potentially be an attacker. So you don't want to trust the data that came from the user. So don't trust the data. Figure out who you want to trust to do what. Edit, audit your permissions, set them up so you give people the least number of permissions they need to do their job. And we'll talk about that in depth later. And then think about defense and depth. So you don't want to have a single point of failure where if someone gets through that, they basically put the missile into the desk and it blows up. So you want to have, if possible, in all these different attacks scenarios, you want to have some fallback, some possible mitigation, something that makes it not as bad as it might have been otherwise. If you do that, if you have those layers of defense, then any single one of them failing doesn't mean a catastrophic failure. This is a broad principle. Not always possible, but something you should strive for. And then one of the most important, yet obvious, things that people fail to do is just keep their software up to date. So if you're running a Drupal site or if you're running a server, no matter even if you're running your laptop and you aren't updating your browser, the browser software, all these things make you vulnerable to exploits that are commonly known and people automate those exploits. They will exploit you over and over again. They'll exploit all your sites. They will exploit everyone running the out of date browser. So the best way, really, you have as a normal human to not be exploited is keep that software as up to date as you can in all the different layers, your laptop, your server, the web application running on top of the server, the database, server software. All those things has to be kept up to date as quickly as you can when you see security announcements come out. So the framework for this talk is going to be the OWASP top 10. People know about the OWASP project. Good, some, but definitely not everyone, maybe a third. So this is a sort of open knowledge sharing project. It's called the Open Web Application Security Project. It focuses on PHP applications and it strives to disseminate sort of best practices, information and lists of the most critical security vulnerabilities and sort of their attack vectors. And that list is called the OWASP top 10. So that's going to be the framework for this talk, but I'm going to run through the OWASP top 10 and show you how that relates to PHP code in Drupal and specific and then how you can avoid being a victim of one of those OWASP top 10. People often say, basically, if you're a victim of one of these things, you weren't even really trying because it's the top 10.  You at least fall victim to number 11, something a little more obscure. So they update this less every few years based on doing surveys of the PHP community and they order them through a combination of frequency and severity. So you'll see that the number one is not necessarily the most frequent, but is the most absolutely most severe. So the most important thing to avoid and I'll talk a little bit about the frequency of these things within Drupal as we go through them. So OWASP top 10 number one, this is the thing you must avoid at all possible cost. So they broadly term this injection and basically injection means that the attacker is able to send some data to your site and that data is executed in some way as a programming language or as SQL. So two obvious and slightly distinct things are SQL injection, right, where the attacker's string is executed as SQL and runs a database query versus code execution, commonly called remote code execution, where the attacker is in some way able to actually upload PHP code or cause PHP code to be executed. So these are both very bad. They basically both will likely mean all the data on your site can be disclosed. The attacker may well be able to take over your site, but they're relatively easy to avoid in the Drupal context. So if you look at this first example, so most of the code examples are sort of Drupal 7 style. I'll talk a little bit about Drupal 8 also, but just, you know, most people are still using Drupal 7. So here we see a typical database query. We're selecting some data. Hopefully you see what's wrong there. And what's wrong is we're taking user input. The user input is coming from the query string and directly concatenating it into the query, to the SQL query.  If you go look through contrib modules, that's something like this is happening, but this is extremely bad and very easy to avoid, right? So the easy way to avoid this is use the database placeholders. Just use the API correctly. You're going to avoid this. It's not a problem. And those database placeholders, what they do is they escape that user input. So that it cannot get out and be executed as an SQL statement on its own. So the problem with this is that if someone can append to your SQL statement, they can select additional data into the query. Or depending on which version of Drupal and PHP and MySQL you're running, they may be able to execute multiple SQL commands. And you may have remembered in 2014, there was an SQL injection vulnerability affecting Drupal 7 core. And people that were able to exploit that could basically write new rows in the user table. They could write new cache entries. They could write new menu callbacks into the database. They could basically do anything they wanted to your site and very quickly actually leverage it into remote code execution. They could basically turn that database exploit into executing whatever PHP code they wanted and literally hundreds, maybe thousands of sites were compromised within a day of that vulnerability being announced. So you get back to the first point of you have to keep your code up to date or you will be exploited also. So the second example is something that hopefully you will never see in a Drupal contributed module, though I have once or twice, seen something like this where someone thought it would be clever to write a PHP shell into their module where you could just write whatever PHP you wanted and maybe they didn't actually secure it very well. But this is also something that you commonly see if you have a file uploaded vulnerability and the attacker is able to upload what's called like a PHP shell. So basically they upload a file and if they're able to execute that file then they can run other PHP on your server. So this is basically a second level exploit a lot of people would try. So Drupal does try to protect you from some of those file upload vulnerabilities but depending on your server configuration Drupal may not be able to save you and so something like this could happen where the attacker is able to upload a file. That file you see will take some post data and then translate the post data and eval it as PHP and then again the user can do essentially anything they want on your server as the PHP user. So again, this is injection the worst possible thing use the database API correctly, avoid eval code in your modules. Fortunately we rarely see this in Drupal. So this 2014 one was kind of a once in a decade level of severity vulnerability for Drupal. Okay, so number two OOSP.10 is when people have problems with authentication and sessions. So this means you have somehow someone is able to bypass the authentication system and be logged in when not supposed to or they will steal a session and get their browser to essentially get them logged in to the site without knowing the password. So this is an area where we don't see problems too often with Drupal. If you use Drupal cores built in user handling these things are generally not a problem but Drupal doesn't provide any enforcement of password policy out of the box. So you guys have probably run into this right you can have an administrator who and it picks a one letter password if they feel that's the thing for them to do. So especially for site administrators people who can enable modules or change the site configuration you should definitely think about adding on some kind of password policy or writing a simple version yourself where you just say your password has to be at least 10 characters long if you're a site administrator, if you have that role or this password policy module is already written you can basically just configure that. Two factor authentication, hopefully people are familiar with this more and more so Gmail offers this an option, GitHub offers this an option. There's a module, a TFA module for Drupal that basically uses the same mechanism so you can use Google Authenticator and you can basically force your administrators based on the role to have to set up two factor authentication to log into the site. And so you can basically have the best of both worlds so you don't have to bother your less privileged users remember, because you only gave the users the privileges they needed to do their job so your editors, your regular site users shouldn't be able to reconfigure the site so you don't necessarily need to force them to go through two factor authentication but the site admins who have full control of the site you probably want to be much more careful about who's logging in as those administrators in case they picked a bad password or it got stolen. So I would definitely recommend this. Password storage, a lot of bespoke web applications have problems and don't do this correctly. Drupal core does cover this, I'll mention that later also. And then session IDs. So if you're on basically like a cafe Wi-Fi and you log into a site that doesn't use HTTPS an attacker who's also sitting at the cafe can actually see that web request go by and they can see the headers in that web request and they can pick out your session ID. They can put it in their browser as a cookie and they're logged in as you. So this is a very serious problem and it's easy to avoid if you survey website over HTTPS. The really best practice is to do it all over HTTPS now and Google will actually give you a burst boost in your search result ranking if your site is all HTTPS. So there's a little extra reason to convince someone who's not convinced. If you for some reason need to serve, for example, anonymous users still over HTTPS. Again, Contrib has many modules, the secure login module will basically switch the users and force them to HTTPS once they log in. So good options there. Number three on the OWASP POP10 and one we're gonna spend some time on is cross-site scripting. So this is the absolute most frequent vulnerability in Drupal, especially Drupal before Drupal 8. Probably half of all module vulnerabilities would fall into this category. And cross-site scripting sounds a little esoteric but really what it means just is that the attacker is able to in some way inject JavaScript tags or some kind of object tags that runs code like JavaScript into your page content. So there's a couple of different variants in that but that's simply what it means. And the way to protect against it is just that again that untrusted user data has to be sanitized, has to be escaped before it's printed out. One reason why this is less severe than number one, which is injection is that a site administrator has to interact with the site in some way for this attack to execute. So with injection, the attacker could directly go directly execute their code and take over your site. With cross-site scripting, you as the administrator while you're logged in in some way need to interact with the site. But that's not necessarily very hard to do because the attacker could just send you an email with a shortened link, let's say, and they said, hey, check out this picture of kittens and you go click that link and it's actually redirect redirect you to your site to the admin page where this JavaScript is waiting to execute and take over your site. So do not be fooled into thinking that it's hard to trick someone into visiting a page with a crafted URL where, which will actually JavaScript if that's possible. So first example of cross-site scripting is what's called a reflected cross-site scripting attack. And it's reflected because it basically takes some input from the current request, in this case, the query string and prints it out into the page. So it's basically the user's input, the query string reflected back through the browser content to create the attack. And in this case again, so the attacker would basically send you, let's say a redirect link to a very long URL that basically has an entire JavaScript snippet in the query string. If you visit that, depending on your browser, it would actually execute that JavaScript and could take over your site. A lot of times people use the snippet at the bottom as a penetration test. So they will go through their forms, either manually or automatically, and put in this kind of a script tag into each form, into each possible user input, and then look to see if there's a JavaScript pop-up in the page afterwards. And that's a great way to alert yourself to a problem, but people often equate that probe with the actual attack. And the probe is harmless, but the attack can be devastating. So don't be fooled in thinking that cross-site scripting means a pop-up. A pop-up is just a way to find those vulnerabilities before the attacker finds them. So in contrast to reflected cross-site scripting, we have persistent cross-site scripting. So that's where the attacker's JavaScript is actually stored in your database. Most typically it's the node title, the node body, some field on content that you allow a comment title, something that you allow site visitors to enter. And in this case, we see an example where we're doing something that looks like it ought to be safe, right? We're loading a node, we're creating an array of rows of the node ID and the node title, and then we're sending it through a theme function. That should, that's safe, right? It's not obvious here that you see the vulnerability, right, the first glance. If you just saw that good snippet, it wouldn't necessarily scream at you the way that SQL injection one did. But this is not actually safe because theme table doesn't do any escaping of the data for you. So if you wanna be safe, you actually have to go ahead and call check plane, or the equivalent of Drupal 8 on each of those node titles. If you don't, the user input, the node title is printed without escaping, the user can store script tags in the node title, and when you visit that node, that script will execute in the browser. So there's a handbook page here on Drupal.org about handling text securely, which basically describes the different functions you can use, like check plane to escape text. But we also have a table I'll get to run through. But again, I wanna emphasize this cross-site scripting, again, it's the number one vulnerability we see in Drupal, and it is really, really dangerous. As I said, people think that a pop-up is cross-site scripting, but in fact, cross-site scripting can do anything that your user account can do while you're logged in. And this link here has a video showing an attack on a Drupal 6 site, where the cross-site scripting attack basically goes ahead, changes the admin password, changes the site name, takes the site offline, changes the admin's email, and then logs them out so they can't get back into the site. So again, that's the kind of thing you can do with a cross-site scripting attack. So don't, again, don't equate it with that pop-up, equate it with JavaScript doing things on your site. So the golden rule when handling this output, and I mentioned this before, is we filter on output. And that's very important from the perspective of users coming to your site, and they wanna type something into the comment form, the node form, right, and save it, and then they might wanna edit it later. When they go to edit it, they don't wanna see mangled, escaped HTML tags. They wanna see exactly the same thing they typed so they can fix it and edit it, save it again, right? So the golden rule is that we store the user's input exactly as they type it, but we have to know that that user input is not trusted, and then when we output it, we have to escape it. So again, you have this escaping or any kind of conversion that's formed on output, on input, we accept what the user types exactly and we store it for them. So that's, you'll see that principle throughout Drupal. People often wonder, like, why don't we escape on input? Why do we ever let this bad content go into our database? But again, it's like all user input must be untrusted. Therefore, we must filter all user input when we display it, and that means storing it as typed and then filtering it on output. Okay, so here's kind of the hierarchy of escaping text and a link that shows a version of this also, and so you might think the safest text, if you know that it's something as a URL, you can escape it specifically as a URL. You can make sure it has a valid protocol, that it's formatted correctly. So there's a check URL function. There's a check plane function I already mentioned. That will basically escape all HTML tags and present them. That's kind of what you might use also on like a code snippet where you wanna see everything as it sort of preformatted the actual HTML tags and not have them execute in the page. Check markup is what we use with, for example, a text format. So check markup needs to know what text format to apply to the text. And so in fact, check markup may or may not actually fully sanitize the output. So you have to be careful and know what text formats you've allowed your users to use. If you allow your users to use a full HTML format, that doesn't escape anything. That's the same thing as giving them permission to store and execute cross-site scripting attacks against you. So again, your editors, you don't trust them fully. You should not have full HTML. They should have a filtered format that strips out script tags and other risky tags. If you don't know what user is going to be typing in the text or you don't know, you don't have access to a particular text format to filter against, there's a filter XSS and filter admin XSS functions. And you can use those basically just to arbitrarily allow or deny a list of HTML tags. Filter XSS admin is used basically in admin areas where the only thing we wanna block is things like scripted into object tags and we'll let everything else through. And finally, in very rare cases, you can trust the text. An example where we trust text is the node ID in that previous slide. So node ID we know is coming from the database. It has to be an integer. There's simply impossible in any reasonable case for it to be an attack is not user input. It's system-generated integers. So we trust that. We can just print it out. We don't have to go through trouble of escaping it. Okay, so what does Drupal Core do for us in terms of mitigating cross-site scripting? So obviously you have to be careful when you're coding. Drupal Core does a few things also. One of the nice things it does, since some version of Drupal 6, I think, certainly Drupal 7, is it restricts the session cookie so that the session cookie cannot be accessed by JavaScript. And in earlier versions of Drupal and in older web applications, it was a very common attack that the attacker would actually use a JavaScript to copy the session cookie out and then send it to the attacker through some web request. And that meant the attacker could then just enter that session cookie in their browser and be logged in as you to the site. So that fortunately is not possible anymore, basically. The user edit form since Drupal 7 requires the current user to enter their password in order to change their password or email. So this is a protection. It protects against cross-site scripting, also protects against you walking away from your computer at a coffee shop and not locking the screen so that someone can't just walk up and type in a new password for your account or a new email address. There's a caveat here that administrators, while their own password cannot be changed, can change someone else's password or roles. So this is just a partial mitigation, not a complete mitigation. You can ask me in the question section why that's the way it is. Again, I mentioned text formats and giving people the least privilege they need. So your editors should have a text format that strips out dangerous HTML tags. Maybe for the rare cases where someone needs a full HTML access, your site administrators could do that, but it should generally be blocked and it should be hierarchical. So you give the format with the most permissions to the most trusted users. The final thing that we're sort of moving towards with Drupal but is not yet implemented in Drupal Core, though it is relatively, it is possible to do with Drupal 8 without too many hacks is content security policy. So content security policy is a new standard, relatively new, supported by pretty much all browsers. And basically it's a set of headers that you configure your site to send. And those headers can do things like say, there is no inline JavaScript on this page, so do not execute any. And if your browser respects that header, if an attacker managed to get that reflected or stored cross-site scripting into your site, the browser would just say, well, you've told me that there is no inline JavaScript. So I'm just gonna ignore this attack and not execute it at all. So this is a great possibility. There is a sec kit module all linked at the end, which you can add on to your site. But there are some, it's harder to implement this in Drupal 7 because Drupal 7 actually has inline JavaScript for things like Drupal settings. In Drupal 8, we removed all of the inline JavaScript so you can more easily implement these kind of policies in Drupal 8. And regardless, not all browsers respect these or there could be a browser bug that allows the attacker to bypass them. So we still need to keep those principles of always escaping the user input, use check plane, use filter XSS, whenever you have user input. Okay. Our Waspop 10 number four is sort of a one that doesn't happen too often in Drupal, insecure direct object references. And this is basically just, there's a way to type in a URL that loads some data the user shouldn't have access to. You know, don't do that. Basically, if you use access checks, access callbacks in the Drupal 7 menu system, the Drupal 8 routing system in general, unless you make a mistake in writing that, you'll be protected from that. Waspop 10 number five is security misconfiguration. And this is sort of a catch all topic. I don't really like it, but we'll cover a couple of points here. So one example of a common misconfiguration in Drupal sites is having error reporting turned on in production. Now that might not seem like a severe thing, but it actually allows attackers often to figure out the actual path on disk to your Drupal site on the server, and that can help them carry out other exploits. It may show them SQL errors. And if they see an SQL error, they can figure out, for example, which database server you're running, maybe in which version of the database server you're running. And it may give them clues if they're trying to execute SQL injection when they're getting warm or cold by seeing whether they are able to trigger an error. So turn off error reporting for non-admin users. If you're using Drupal 7, strongly recommend you disable or even delete from the code base, the PHP filter module. This, in earlier versions of Drupal was used very often for little snippets of code to configure the site. In current versions of Drupal, you should keep that code in your code base under version control and don't use this module at all. That's not really any good things about it. Another common security misconfiguration and something that's actually hard to avoid sometimes on cheap shared hosting is that the PHP process has access to write its own files. So Drupal can overwrite the Drupal files. Some projects think this is an advantage because you can have auto-updating sites. But if you can have an auto-updating site, that also means the attacker potentially can write their code over top of your site's code and take over that site or server. So we strongly recommend for Drupal that you do not configure it that way. In a best practice example here, you can see the Unix users and permissions is that we have a separate Unix user who's responsible for checking out and deploying the site code. And that Unix user is different than the web server user. So a typical Linux web server user is wwwdata. So wwwdata can read all these files but cannot write the files. Except, of course, for the upload directory where you have to basically invert the logic and allow the web server that one place to upload the user's files, but your deployer may need to read things there also. Handbook page on Drupal.org, security, secure configuration, talks about a bunch of these issues. So please do look at Drupal.org. There's a lot of great security documentation there in the handbook and will help you avoid these common mistakes. Last couple of things here. Again, we talked about principle of least privilege. Who do you want to have access to enable disabled modules, reconfigure the site, make sure that those permissions are not given out to roles where people have the roles and you don't fully trust them? As again, same for text formats. Full HTML means I give you permission to execute cross-site scripting against me. If you trust the person that much, you want them to execute arbitrary JavaScript against you. If yes, give them this full HTML. If no, then you should be giving them a more restrictive text format. Best practice, don't use user one account in your daily work. In fact, even I would recommend blocking it. Have every site administrator have their own login, have their own passwords that are distinct. And you can also change the user one login to something other than admin, something that people can't guess as readily if you don't block it. One other common thing we see is that people put their private files under their document route. So if you're setting up the server, you want to make sure your private files are outside the document route. You can see here where index.php is. That's where Drupal serves web requests, everything under that. And we want to put the private files directory at the same level or above. So there is no possibility you can make a direct web request and access one of those private files. So people make mistakes in their server configuration. They think they blocked access to the private files directory. But if it's under the doc route, if they made a mistake in that server configuration, the hacker can come in and directly read those files out through the web server. So again, another thing that you might want to have outside of your document route is any kind of configuration or any kind of files, let's say containing API keys. You might have a configuration directory that's shown here on the diagram. And again, keep that outside the document route. So even if you make a terrible mistake in your web server configuration, there's basically no possibility that the attacker can directly read those files out of the file system and display them. A little more on secure configuration. So PHP file execution, Drupal, basically every single request hits index.php. And then on normal request, there's no other PHP file that runs. So you can actually basically block access to every other PHP file in the Drupal file hierarchy. And that gives you a little more defense in depth against someone uploading a PHP file and trying to execute it. So Drupal 8 actually comes with this baked into the HE access file. And you can add a rule to your web server like shown here to help protect your Drupal 7 or before sites. Yeah, there's a few cases where people have something else like they have an analytic script in a subdirectory that they do need to make PHP calls to. But you can definitely, you know, you can whitelist those specific scripts and just don't allow arbitrary PHP files to be accessed. Okay, so the last thing I'm gonna talk about before turning over to Moosh is sensitive data exposure, OWASP top 10, number six. So if you are handling sensitive data in your database, such as credit card numbers, you really probably should be encrypting them. Same with people's medical records or their personal, other personal information. You need to encrypt those, make sure if there's a database backup somewhere that someone gets access to, they can't actually read out that raw data. But even better than encryption is don't ever have that data. Don't ever have someone's credit card number if you can avoid it. There are a lot of services now where you can integrate with them and all you will ever get is a payment token. Your web server will never actually get the credit card number and that's a lot more secure for you. It's a lot less liability for you. It's a lot easier to be compliant with the PCI requirements. Same thing for things like medical records. Yeah, you should, and other personal information, you know, you should make really, really sure that you need that information before you ever store it into your Drupal database. And then if you do have to store it, you have to figure out how you're encrypting maybe your data backups. You need to make sure that if you're giving developers copies of the database that you've scrubbed that information out before the developers ever see it and before they put it on the laptop because developer has a copy of the database dump on their laptop. The laptop's stolen, now someone has all the credit card numbers or all the health records and that's a big problem. Another way sensitive data is exposed, of course, is through web traffic.  Maybe that web request, the response contains, again, someone's medical record. Now the other guy in the cafe just got a medical record of one of your clients. If the client finds out, they're probably gonna sue you. So don't do that. Again, set your site up, use HTTPS. We talked about passwords being properly hashed. Drupal takes care of this for you. Since Drupal 7, if you're still using a Drupal 6 or even Drupal 5 site, there's a PHP, PHPAS module will enable a stronger password storage. So I recommend turning those on for your site. Now I will give it to Moe here. Okay, I want to apologize for being late at the beginning here. I hope there wasn't too much drama. I missed it if there was. Okay, we're gonna keep going. Oaf number seven, missing function level access control. Here we have an example of hook menu, which applies to Drupal 7 and before. And the last element there is called access callback and the value is true. All right, that is occasionally the right thing to do. But we're saying it's not in this example. Here's probably what you meant to say. Access arguments and the value is administer my module. All right, so now this page admin my module settings is properly protected by permissions check, all right? So this Oafs thing is like actually use the access control that your framework provides. Definitely a good idea. Similarly, we have access control on listings of entities in Drupal. And you'll see halfway down here the add tag node access. That is what triggers the node access control to add its SQL conditions and to restrict access for people who don't have the right grants. So that's required at any time you're doing a listing in Drupal. If you're all the way back at 6.x, look at the DB reWrite SQL function, okay? Number eight is cross site request forgery. This is kind of a cool attack. What we have here in this example is, what happened? It's back. I think it was a power thing. Okay, so, yes, this one. Okay, so we're deleting a pair of pants in this example. We are taking the second argument. You can see page arguments in the first array and the values too. So the ID of the pants is getting passed to the my module delete pants function and that ID is getting, that pant is getting deleted by ID in the second function there. So if someone can trick you to go into this page then you have just deleted a pair of pants. So the way this attack really works is that oftentimes an image that is posted somewhere on the web and you are encouraged to visit this page, the image instead of actually pointing to the cat image on this somewhere will point to the pants deletion page, all right? Which is pants 1337 delete in this example. So the admin visits what he wants to visit which is the cat image, doesn't get the cat image, instead makes a request back to his own site. His browser will go request pants 1337 delete. He's logged into his own site. He has the proper permissions to visit that page and now the attacker has caused a right operation in the database, okay? So that's cross site request forgery. We say forgery I think because you had no intention of visiting that pants deletion page. Someone tricked you to doing so and took advantage of the fact that you're logged in and privileged there. Sure. Yes, the question was can you make a post request request forgery and you definitely can, the attacker just writes a little JavaScript, snippet and the JavaScript snippet can make a post or the attacker sets up a form on their site and the action of the form points to your site. You submit the form and the post request goes to your site and takes, so post is not a protection against this. That's why Drupal forms have a form token that protects against it. Exactly, so the way to mitigate this kind of attack or prevent it on your site is to always use the form API. When you're doing forms on your Drupal site don't write just plain HTML form elements. Definitely go through the trouble of using the form API because that is what's gonna check for a token and make sure that you haven't been tricked into visiting this URL. There are a few occasions when you want just a link and not a form to make it easier on the person who needs to do an approval of a pending comment moderation or something like that. In that case your get request and you should have a token on it that will check to make sure the token was actually generated by Drupal and not by an attacker. And the Drupal 8 routing system actually makes this super easy. So if you're using Drupal 8 you can do routes that check these tokens just with the routing YML. There's a link there for more information about CSRF. Okay, so we now are building sites that depend on more than just Drupal. Drupal itself has a nice update status system. You can see a screenshot here of it. It will tell you when you have a pending security update. And just wanna remind everyone that if you have other composer packages that your site depends on those need to be checked as well, okay? The composer outdated command is one thing you might wanna look into to help you with that. And there's also a project that will flag your projects if they are behind on security updates. That one's in the Drupal-composer organization on GitHub. Okay, so just a little bit more about the update status system in Drupal. It will email you if you have stuff you need to do if your modules go out of date. And it can tell you when they go out of date or only when they go out of security compliance. All right, so definitely turn that on. If you aren't gonna visit your site and look at that report all the time. And number 10 on the OWASP top 10 are unvalidated redirects and forward. So Drupal has this Drupal go to function. We use it all the time after you submit a form. And in other cases, and we just wanna make sure that the value that gets passed to that has been checked. And you're going to an internal URL and not some phishing site. And so here you see an example for how to do it correctly. The URL is external function. And there's some equivalent in Drupal 8 that I don't recall right now. So just kind of summarizing again, the main things to keep in mind. We don't wanna trust user-provided data, whether it's coming from the URL or it's coming from the content that people are submitting in comments or in posts. And the attackers are using all kinds of browser features against us in order to trick us to visit pages and delete pants and all that sort of thing. And keep your sites up to date with code and that kind of thing. So some tips for being prepared before there's an attack. We wanna put our code in version control. If it's not in version control, you could visit your site one day and attacker has not only owned your data but has deleted the code. And now you don't have code or data and maybe not a job either. So you definitely don't wanna let that happen. You need to make full backups. You need to have separate logins for each admin. And you guys can see the rest of the bullet points here. If you do happen to get attacked, it does happen. Okay, here's a quick list of what you should do. You'll find longer lists on the internet. But maybe become familiar with this and that will motivate you to not become a person in this situation because you're gonna go through this list in a very unhappy state. And some of these bullet points are like, save and scan all your logs for traces of the attack. And that sums up weeks of work in one bullet point. So this is just a word of caution here. I wanna put another pitch for a few modules on Drupal.org that are really helpful for security. Peter mentioned a couple of these. Security review is like a checklist module. Paranoia is a great module that will disable things that you probably shouldn't have enabled on your site. And SecKit, right here for Connet security policy. A lot of the examples here are still Drupal 7 focused. That's deliberate. We have very few Drupal 8 sites in the wild compared to Drupal 7. So at least for a security talk, we wanna still be talking about the sites that people are running and using. We made a lot of improvements in the five years that we were developing Drupal 8. And you can just see a list of them here. Twig autoscape is huge for getting rid of those XSS vulnerabilities that Peter emphasized earlier. And the HD axis is better for executing PHP and subfolders and so forth and so on. So we touched on these. Drupal 8 is a more secure platform. I hope you guys are starting to use it. A special farewell to the PHP module, which is gone in Drupal 8. You'll be missed not by us, but by the attackers. And if you do have security questions, definitely become familiar with the Drupal security team. There's their URL right there. You can read about what they do. It's an all volunteer force that is looking after thousands and thousands of contrib modules and putting out vulnerable essays, security advisories on them. So if you come across a security team member, please give them a hug and say thank you. And- Are you asking for a husband? No, no, I am not. Maybe Peter is, but they do a lot of work for free. So provide a great service to Drupal. A few others at the conference. All the core committers obviously are on the security team also so they can coordinate Drupal core. But if you go to security.drupal.org there, everyone who has a Drupal.org account can be logged in and can submit issues there. So if you come across a security issue, if you go to a project page on Drupal.org, there's a direct link, takes you to the security site to submit any security problems you find so that they can remain private until we decide if it needs to be resolved privately or if it can be public. You can also on that site, even if you can't see anything else, you can see the official list of Drupal security team members. So if someone sends you an email saying, hey, I'm on the security team and you need to give me access to your site, at very least make sure there are official lists but trust us we won't ever do that. Yeah, that's not something we do. As I said at the beginning, basically we respond to your report. So we count on the community to look at the code, find the vulnerabilities, report them to security.drupal.org and then we coordinate with the maintainers of the modules or with the core maintainers to fix the problems. So we can open it up for questions and comments and discussion. I don't know if you guys have anything here. Yeah. Okay, thanks. Yeah, right. I think there's a microphone, probably if for the recording we should try to use the microphone. You think that exposing Drupal version? Yeah, so the question was, is exposing the version of Drupal that you're running a security problem? The security team is taking the position that that is not a problem. It's not in our top 50 problems. Is that accurate? Yeah. So there's a lot of different ways you can discover what version people are running. So yeah, we generally slightly scoff at people that recommend, let's say, deleting the change log file so no one can see what your current version is. Well, I would say you would be better off just being up to date rather than trying to hide the information about the fact that you're out of date. Drupal seven and eight, I mean, if you look at the headers we'll at least tell you that you're running Drupal seven or Drupal eight right in the headers by default. And yeah, there's plenty of ways to see. So I don't think hiding the fact that you're running Drupal is very important. Again, keeping up to date is the important thing. Regarding internal systems, intranets and so on. I've seen that self-signed certificates still widely used. What priority would you give fixing them and what do you think about it actually? So an interesting question about HPS and if I'm using internal site with self-signed certificates which means basically with a self-signed certificate the encryption still happens but your browser is not able to determine whether this is a legitimate site. So if you kind of tell your browser ignore all those warnings, I want to go there anyway. Someone might redirect you. Let's say there was an open redirect attack. Maybe we should talk about that a little more. So an open redirect attack would be you think you're going to a site and the attacker has constructed a query string that causes a redirect and you end up landing on the attacker site and the domain is almost the same, maybe one letter off. The login form looks the same.  So they tricked you that way too and you type in your username and password, it's submit and they say, great. Now I have your username and password, I'll send you back to your site to log in. So I think it's part of that defense and depth strategy that if you are always accepting these invalid certificates it means you eliminated one of your defenses in the stack. I wouldn't recommend it, but it's a trade-off. Someone else that question, yeah? If you can, yeah. Look, yeah. So what I find difficult sometimes is how do you know if Drupal's API and the functions are already handling the security side of it? Because when I'm theming, like in views and no templates and stuff, I never know whether it's already helped sanitizing it or whether I need to re-sanitize it. Sometimes I just do the functions just in case. Okay, so that's a great question. So the situation is kind of different between Drupal 7 and Drupal 8. So, and before, so in Drupal 7 in theory, the variables should be sanitized before in the pre-process functions in the theme, but I agree they're not always sanitized. So, especially if you're using some variables from a attributed module, it's hard to know. Yeah, you have to either run it again and look for double escaping or talk to the person who developed that particular theme call and ask them. In principle, it should be in Drupal 8 we have a stronger guarantee. So the twig templates we have auto-escaping turned on, which means that if it wasn't basically sanitized beforehand, it will automatically be sanitized when it's printed. So that's one of the, I think great things about Drupal 8 for front-end developers is that that auto-escaping relieves that entire stress about whether this has been sanitized or not and you can just go ahead and write your templates. Just a comment on that. I was talking to an agency earlier actually this week and they were saying that one of the things that they do is they put in sample data when they're developing a site that includes cross-site scripting attacks and then header it all over the place. So only useful at a certain stage in development but then you would see it if it came up. So I thought it was a pretty cool trick. Okay, any other questions? You said no configurations should be in doc root. What about settings PHP with the database configuration in it? Yeah, since it's a PHP file, it's pretty poor configuration for you to expose the whole source code of your site from regular web requests. It happened to Facebook, so it can happen to anyone for a few minutes. But it's, I wouldn't consider that like a real serious problem to move that out of the doc root. I don't know if you have the same opinion. Well, I'd say one thing you can do and we actually recommend this in some of the help comments in settings PHP is you can actually, you can include another file in settings.php and you can store that file outside of the doc root. So if you do have, let's say in production very sensitive credentials and you wanna make sure they're never accidentally committed or you wanna make sure they're never exposed to your web requests, I would put those in an include file outside your doc root and then load them that way.  And I guess the other variant on that is that you can read from environment variables, your database credentials and then they're never on the file system at all. I believe that Pantheon takes that approach, which is great. Thanks. So if you are not already planning to attend, please do come on Friday. Contribution sprints are really a lot of fun. If you haven't done it before, there will be mentors there. You can find like-minded people to work on contributed modules, talk about themes. Also, we appreciate your feedback on these sessions. The session slides are already posted as a PDF. So if you wanna review, you wanna go to those links, review the content, please look at the PDF. This recording will be live, I think, within a day. But also go to the session note and please give us feedback. Rate us, give us comments if there's anything we can improve for next time. I said we're doing this kind of as a service to the community, help improve everyone's security awareness. So we would appreciate your feedback if you have any improvements we could make. Thanks. Thank you. Sorry, I wasn't here at the beginning. That's all right. It was kinda funny. It was good thing that I was here the first half. Yes. Really good thing. Yeah. Questions? What can I do?


Olga, tell us something about your game today. It was not so interesting game because it was a theoretical opening line and it was quite long way played this line and in the end there was equal end game and I think nothing special happened. Yeah, it fizzled out to the draw. It's quite interesting at the end, wasn't it? Well, let's have a look at the game. Olga, we're looking at the position after Queen takes e2. What happened next? I think it is a critical moment because White has this very good knight on e5 and I should play fast or have a counter play. So I played c5 and there is... If White plays knight d7, there is move Queen c6. He doesn't want to. I have this idea of Queen c3, so it works, I think. I just calculated Queen d3, take... Oh, it's too fast, too fast. It's very twitchy today, that's good. Take? Okay, but no, it's lost for White. That looks terrible, yes, that looks like a sort of classic way of losing. Yes, so there is no knight d7. Okay, do you want me to click on a position? So, in fact, castle gets played elsewhere. Yes, and after castle, there is also bishop d4 move. I wanted to play rook e8. So now I want to play queen c6 or knight c4, so that's okay. And in the game, we just went to this end game. There are a lot of draws. It looks slightly scary, with a past e-pawn. Yes, maybe I even thought in the end. First of all, I thought about Queen g1. Why does he do that? I don't understand it. He wants to play his own check. King h4, and there are no checks. Maybe do it this way. King h4, and I thought maybe I should go to the rook end game. Yes. Is it in that line? It's easier to play your chess on the board. Queen f2, sorry, where do we need to be? Queen a1, and then we decided to go. Sorry, that's fine. And then white plays. After king h4. Sorry, king h4. So I can change queens. I think it's draw, but the pawn is on e5. It always wants to go there, doesn't it? So I decided to just make checks. I think the screen is trying to tell us something. It doesn't want to look at any more. Thank you very much, Olga.


So this story is almost so crazy. You might think I'm just making it up, but Not even I could make up something this Just insane. So I'm reading this article from Kotaku. It was written by Brian Ashcraft Now the title of it is former Square Enix employee arrested for allegedly stocking up games got consoles for resale In reality, it sounds like he sold some of them and the game consoles that he specifically targeted were Nintendo 3ds's hence why we're talking about this So let me just read this article do says Koji Takata made his name at Square Enix as a sales manager with his name in the credits for games Like dragging quest nine Earlier last month. He was arrested for allegedly improperly ordering game consoles for resale a violation of Japanese trust law according to gg press the 56 year old Takata Allegedly would deceptively buy Nintendo 3ds handhelds and other game consoles when making contracts with clients Reportedly saying the hardware was necessary as in he put the hardware in as a stipulation as part of the contract and Then it said that Takata would supposedly resell the game machines resulting in 1.4 million yen or roughly $12,374 of loss for Square Enix This is alleged to have happened between November 2011. No surprise 3ds released that year and September 2013 the month Square Enix disciplined Takata and The company brought charges for breaching trust law in 2015 And then Square Enix had this to say we're making an effort in employee training to prevent this from happening again This is just an insane story to me a guy I mean, we're talking about you know relative pennies here, you know, you're talking over a couple year period $12,374 is a significant chunk of money. So let's not pretend that it's nothing but comparatively to what this guy's salary was I mean he was he was a sales manager So he was at a management level position and he was probably making more than $12,000 per year. Let's be realistic He was probably up near the 30 to 50 thousand But to risk his career to risk not just his career at the time But any possible chance that he could be hired in the future to essentially steal systems from Square Enix That by the way Square Enix didn't need right Square Enix had had no idea at the time that these systems even Were being requested because Square Enix obviously didn't need 3ds units or dev units of 3ds or dev units of Xbox or PlayStation or Wii U or Wii at the time or whatever consoles he was getting besides 3ds 3ds Seems to be the only console being confirmed in this report, but it does mention there were others The companies of the Square Enix obviously would not need these systems in their contracts, right? They would contact Nintendo or Sony or Microsoft directly to get these systems Probably had a much lower cost than getting them from other companies other third-party companies or companies that they're making contracts with So yeah, so he was sneaking these these consoles in to these sales contracts and then Taking those systems and reselling them for profit This is just insane to me that a guy at this this level and at his age would do this especially in Japan Japan is very cultural and Highly respectable in terms of their business practices. It isn't just Nintendo that's like this across Japan They have a very high level of respect for the business and the company you work for it's just a big cultural thing in Japan's business and To see this guy who made it to an upper management position at Square Enix doing this Just man, how pathetic does he have to be right now? Obviously something to come out of this where we find out he was doing it because he had a terminally ill daughter And he couldn't afford the bills or something like that Which would be a sad story, but it's still not necessarily an excuse To be selling these systems and stealing from the company if anything That's an excuse to go to whoever your boss is and ask them for a better health insurance policy Or that you're gonna have to move on to a position at another company that has better health insurance and all that jazz And yeah, this is I'm just really confused and obviously, you know, I'm just pulling that out of my butt We don't know that he has any rhyme or reason to be taking the money other than he just wanted to make a little extra bonus for himself on top This is just a crazy story to me. It's hard to believe That somebody would do this at a company like that now someone doing that in the United States Would not be such a big shocking thing But someone doing that in Japan at a big company like Square Enix Wow I mean as phantom renegade said in the comments on the kataku article. He stole about $12,000. I mean that's completely bush league. What an amateur. I mean if you're gonna steal you might as well go for broke, right? But it's just insane to me that the guy risked his entire career and potential future career and now jail time To get these systems to resale There is so much better ways to make money if you need to make money than this. Yeah, man I Oh This is I don't even know what to say I mean what tell me what you guys think about this down in the comments below It is just insane to me that someone would even think this is okay this would be akin to me working at McDonald's because I used to working McDonald's a fun fact and me Every time a delivery truck comes in with food me deciding that I would take You know a handful of hot mustard off of the condiment cart every time we got a new condiments put it in my pocket and then Turning around going to the street corner and selling those packs for like ten cents a pop Which is cheaper than what McDonald's sells them for and making a little bit of extra money on the side I would obviously eventually get caught eventually getting big trouble lose my job potentially be dealing with thousands of dollars in fines and Potentially jail time depending on just how much of that condiment I ended up stealing and selling in the first place But to put that in perspective like it's such a minute thing to be doing Relative to all the things that Square Enix deals with Maybe that's why he thought he could get away with it because it was such a small thing like oh They're gonna give me these systems that square doesn't need so squares Not even gonna realize they're missing in the first place and I'm gonna sell them and it's not gonna be a big deal Just like McDonald's might not notice they're missing condiments because you know what they hand out condiments like candy to pretty much anyone who asked for I'm so it's reasonable to not really Realize there's condiments missing, but oh man This is I can't believe that this guy did it and the fact that his name is in the credits of You know Dragon Quest 9 like a huge game from Square Enix And to find out that a guy that appeared to be on the path of success at Square Enix Would sabotage his career to do something so stupid This is just a reminder of it doesn't I don't care where you work or how scummy You might think your bosses are or whatever excuses you come up with it's never okay to steal from your employer It's insane to me that he thought this was okay, or even if he didn't take it It was okay that he would just get away with it Man all that I mean come on who does someone really want to risk their career to steal some 3ds units and make a little money On the secondhand market selling them ah Man imagine that I was I lost my job at some major corporation because I was stealing 3ds and turning around and selling on the game stop Man I don't know you guys let me know what you think about the story in the comments below I am Nathaniel Ruffeljad from Nintendo Prime. I just read the story and I couldn't believe it I had to share it with you oh Let me know what you think if you like this video You know what to do and if you dislike the video hit that dislike button subscribe for more content and I will catch you in the next one