All right, it's me, John Park, and it's time for John Park's workshop. Thanks for tuning in. We're up and running. Let's do this thing. Thanks for people over in the chat there on Discord. Let me bring that up right there. Hey, hi, everyone. Hey, Johnny Bergdahl. Hey, okay, you're on Steve, in parentheses, Dr. Hello, Johnny Bergdahl. Hey. I said hi to you twice. Hey, Dexter Starboard. Nice to see everybody, and hi to people over on YouTube as well. If you're watching us on Twitch or Periscope or one of the other fine streaming services and you're wondering where all the chat is happening, head on over to Adafruit's Discord server, and it's on the live broadcast channel. And that's at adafruit.it-slash-discord, and you can jump right in and get an instant invite into our server. Hey, wavey hand. Oh, Steve. All right, let's see. What are we going to do here? First thing I want to do, actually, is mention that we've got, I believe, a few spots left for this Adabox. Hey, look, I look like I'm wearing a big box right there. Hey. Adabox. 19. We've done quite a few of these, huh? Head on over to the Adafruit Adabox page. I can bring that up right here. That's what it looks like. And you can either subscribe for this one coming up. We may have a few slots left. We've just started sending out shipping notices, and I think maybe even started shipping. And if not, you can subscribe to the one after that, number 20, which will be coming out sometime in October. This one's going to be shipping real soon, or it's actually started. I sense movement in the whole shipping side of things. And I'm getting geared up to do an unboxing in a little under two weeks. It'll be on, I believe, the 28th, which is a Wednesday. It'll be a takeover of the normal Ask an Engineer time slot. And I'll be doing an unboxing there and then. So head on over to the Adabox site and sign up if it lets you. I should tell you if there's any left on this one on 19. Otherwise, you'll get in on the one following that. So who's excited about your Adabox? Has anyone gotten shipping notices? I think those have gone out. I don't know if any have hit people's doorsteps yet. I think it's a little early for that, but we've set the process in motion. So exciting, exciting Adabox. All right, what's next? I also wanted to mention that we've got the job board over at jobs.aderfruit.com. You can head over there and you can take a look at the available job postings. They look an awful lot like this right here. And this is a free jobs site where you can post positions. If you're looking to hire someone, if you're looking to have some freelance or contract work full-time, part-time, on-site, off-site, all of those are options. And you can also, if you're logged in, I don't think I'm logged in on this browser at the moment, if you are logged in, you can check out the available for hire. And you can also post your own info if you're looking to pick up some work. So that's the jobs.aderfruit.com site, and I recommend you check it out. Won't you please? All right, let's see, what else is happening here? Yeah, Johnny Bergdahl brings up a point that the Adabox, due to changes in shipping throughout the world, the costs of shipping in particular have gone bonkers. And so Adabox is available only in the United States and Canada right now. I don't know if there's any plans for changing that, but we're currently only able to do those in the US and Canada. So beware of that before you head over there to that website. Let's see, did you know that I've got this show, the JP's Product Pick of the Week show on Tuesdays happens at this time slot, so it's one o'clock Pacific, four o'clock Eastern. You should come tune in next Tuesday because on the show I have a deep, deep discount, usually around 50% off on a brand new product pick of the week. Sometimes it's digging into the archive, sometimes it's something that's been refreshed. Most often it's something that's brand spanking new. And this week, that's no exception, so let me give you a little recap. This is normally a 15 minute show, but I like to do a little one minute recap so you can see what you missed. The 24LC32EE Prom Breakout. This is some memory that you can write information to and it's not gonna go away when you pull the power on it. So what I'm gonna do is I'll go ahead and plug in one of my EE Prom Breakouts and nothing fancy, I'll just reset the board. And now when it restarts, you'll see it loaded in the first four bytes of information on the EE Prom, so it looked at address 0, 1, 2, and 3. And from that, it grabbed these hex values, so what others? Those are the RGB values of a number of neopixels. Now what I can do is go ahead and unplug that just like a game cartridge. Plug in a different one. And again, I'll just go ahead and reset. And now we've loaded in some different values right off of the chip there. That's the product pick of the week. It is the 24LC32EE Prom Breakout on I squared C, StemaQT form factor. EEPROM, it's fun to say it. EEPROM, I like saying it. All right, what else is going on here? Let's why don't we dive into a Circuit Python Parsec? Check it out. All right, well, let's get set up here. For the Circuit Python Parsec today, I wanted to talk about ModOperator or ModuloOperator. What is this? The ModuloOperator is a really useful arithmetic function that you can use in your code in order to iterate through a list endlessly. So one great use of this is you want to press a button. And each time you press it, you go between, let's say, three colors of neopixels, which is what I'm going to do here. So first, let's demonstrate it. You can see I've got a little Circuit Playground Express here. And when I click it, I'll go between orange, blue, and magenta. And each time I click it, we go through those three colors. So how do we tell this thing to cycle between those colors? Well, the way I'm doing it in this code, one thing I actually want to set up for you here, if you give me a moment, is I'm going to open up my serial. And let's see what's going on here. So I've set up some code here that I think makes it clear what ModuloO does. ModuloO is essentially a divided by b and the remainder is c. So in this case, I have this counter. Every time I press this button, the counter increments by 1. So you can see that going 35, 36. So 36 divided by 3, which is the size of this list I want to iterate to, that goes in evenly. It goes in 12 times with a remainder of 0. So I'm going to use that 0 as the first index in a list. The next time I increment this, we have a remainder of 1. So 3 goes into 37, 12 times remainder of 1. One more time, 3 goes into 38, 12 times remainder of 2. The next time we go through this, hey, we're now back at a remainder of 0. So you can do that the sort of complex way. You can do that the nice easy way, which is what you see at the bottom there. 42. And then that percent sign actually means Modulo. So 42, ModuloO3 equals 0. ModuloO3 for 43 is 1. And ModuloO3 of 44 is 2. And this goes on endlessly. And so the list here that you can see I'm using is this set of three colors, blue, magenta, and orange. There is the list. And so those are the items, 0, 1, and 2 are blue, magenta, orange.  But then really every time this button gets pressed, we just increment A by 1. That's the counter. And then we run that Modulo operation on the list value, which is this right here. So C, which is the index, is the answer to A, Modulo B. And so that is a way that you can use the mod operator in order to increment through a list inside of CircuitPython. And that is your CircuitPython parsec. Now you know I'm going to have to go and edit that down into a little two minute version later. And boy, I hope I wasn't clearing my throat the whole time. Excuse me, I got something stuck in there. I'm going to have some water. All right. Andy Calaway says Modulus, my favorite operator. It's a good one, huh? And over in Discord, I appreciate that, OK, you're on, Steve. Echoed my sentiments of how much fun it is to say eee prom. Thanks. All right. Let's see. What else? I think we're going to dig into the meat of the project today. So let me jump over to the browser, actually, for a second here. And we'll talk about a couple things. So let's bring up this little Chrome window here. So by the way, if you just go to adafruit.com slash new, you'll see our new product section. You can see the fun stuff that Lady Aida announced last night in the new, new, new, new section. And if we scroll down a bit on here, you'll see the macro pad, which I'm going to be using for today's project. There it is. So if we click on macro pad there and take a look at, scroll way down to the learn guide, primary guide. I've been using this for a couple weeks now. But the exciting thing is that Catnee has been working on a macro pad library that will make a lot of the things we're doing easier.  So what Catnee did was wrapped up the most common stuff that you'll use into this macro pad library. And so now the code is actually quite a bit more succinct. And it's a little easier and more consistent to jump in and see how it works. So what I'll do actually is let me show you some code here in Atom. And you may have seen this last night I demoed it on show and tell. I've made a sort of nice basic MIDI tester. So when you're using MIDI for, and I love MIDI, when you're using MIDI for speaking to a synthesizer, you usually want to send things like note on off messages, which is what plays actual different pitches. You want to send CC or controller changes, which is the knobs or sliders on your synth for lots of modulation and parameters and filters and things. And you want to send pitch bend often, which is just to take a tone and warp it one way or another, shift it. And in this project, I actually also wanted to use the bank or preset capabilities of a lot of synthesizers, which is, if you remember, ever playing around with any kind of synthesizer. You're usually going to find a keyboard synthesizer all in one. You'll find there's buttons, like 128 sounds on there. And you can hit buttons to go between piano and maracas and drum kit and xylophone. So those are presets or patches that are often ganged up inside of separate banks of presets and patches. So I want to send a type of message called program change that we'll talk to that. So all of those things I just mentioned, those are built into the MIDI library. So in previous versions of this kind of code, I would have also, so I said, I would have imported keypad, rotary IO, digital IO, Neopixel, MIDI. So now take a look. This is my code here. I'm going to zoom this up a little bit. I've got just two imports that I'm doing, importing Adafruit MacroPad. And I'm importing Rainbow, which gives me the color wheel, which is a really nice convenient quick shorthand for being able to adjust colors. And what I'm going to do is I won't go through all the code right now. I'm going to just talk about a couple things. Then I'm going to give you a demo of how it works. And then we'll come back and look at it in more depth. So in the setup here, you'll see, for example, instead of the normal Neopixel setup where you have to say, how many Neopixels? Which pin it's on? What order of color you're using? I'm just talking to MacroPad.Neopixels right away. I wanted to set a brightness. And I wanted to fill them with a color. And I've already set that color using this key wheel, so this color wheel, rather. So the first thing that happens is it just fires up. There's almost no setup for a lot of these things, which is great. MIDI, I am doing some setup on here, where I'm creating some lists of notes and things like that. And then I'm jumping straight to display. So again, you'll notice I didn't have to import display.io and tell it the width and height, because we already know that. The MacroPad library knows what's on here, so we get to be really succinct about it and just immediately start using this text lines and tell the display to show lines of text. So very quick and easy to do this kind of setup. And then I'm also creating a little sort of state for my encoder position, the rotation of the encoder. And then you'll see, in running the code, just like with keypad, this is using keypad under the hood, I'm saying, OK, a key event is whenever macropad.keys.events get, which is once a cycle, it's going to run through and just check. Is any of these keys being pressed or any of these keys have they been released? And I'll skip over this code for now. We'll come back to it. Same thing with the encoder switch. So pushing the switch, it just uses a part of the MacroPad library to use a debounced switch pressed or released state. Super simple. And same sort of thing with the rotation of the encoder. So the last position here, I'm saying, is that different from macropad.encoder? So that's how easy it is to ask for what's the position of the encoder. And I'll get back to some of the sort of details of that later. But why don't we jump into a little bit of a demo here that I've set up. Let me go and wake up a laptop over here, and I'll do some demos for you. So here's what we've got. I don't know, will that wake it up? No, I've got to. There we go. And let me turn off notifications on this one so it's not bugging us. It might bug us. Do not disturb until tomorrow. That'll work. OK, so I've got a laptop here, and I've just set a little piece of wood on top of it there so I could arrange things under the camera neatly. So you'll see I'm running some synth software. This is the Mog model 15 synth software. So it's sort of an emulation of a classic synthesizer. Let me zoom out a bit so you can see that a little better. And I might focus on the macro pad here. OK, so you can see the synth back there. So macro pad, by the way, I'll show you the code for this. I'm using it upside down. And again, this is kind of a neat thing. Since we have a matrix of keys, which we choose to call the first key, key 1, 2, 3, 4, 5, 6, on down through 12, you'd probably have a bunch of annoying math to do in your code if you wanted to use it in the upside down mode, or that sideways mode, or that sideways mode, because this is sort of considered the natural state of the macro pad. But Katni wrote a little bit of code inside of the macro pad library. It might have been a lot of code, but exposed to us is a really simple thing, which is just rotation equals 0, 90, 180, 270. So I've got this in this 180 mode. And it automatically flips the screen for me, flips the button order for me, so I don't have to change my code. And that's both the buttons and the neopixels. So it just works, which is great. So you see here, I've created some MIDI notes. So it's a chromatic keyboard working from the bottom up. And I have a little output on my display there just telling me which MIDI note number. So that's note 48, 50. And then you'll see here it says Mode Patch 4. So I'm using the fourth patch, which is a preset, a stored arrangement of stuff on the synthesizer. This is what it sounds like. Now watch this. I'm going to turn my little encoder knob here. And you'll see my synth changing back there. So it's just rearranged a whole bunch of patch cables. That's why it's called a patch. And it's also changed a bunch of settings. So quite a different sound. Again, really different sound just by picking a different patch. Now you could do this by clicking in the menu and dragging down. Or you can use, I think, some arrow keys. But this is a really nice, quick way to fly through some patches. So let's go to one that's got a lot of rich harmonics in it. OK, that's a good one. So I picked that one because it has a lot of harmonic content in it, which means we'll be able to hear if I change the filter cutoff frequency of this with a low pass filter. And so what I'll do is I'm going to actually click the encoder wheel, which changes the mode. So right now we're in this patch selection mode. And now what I've switched into is CC mode. So CC mode means that I can use a continuous controller change, which is one of the knobs on here. In fact, let me refocus so we can see the synth a little better. So you see here is this low pass filter fixed control voltage. As I change my knob on the macro pad, you can see the knob on the synthesizer software is changing as well. And here's what it sounds like when we do that. So it sort of muffles the sound, which is what this filter does, is it cuts off the frequencies that we can hear. And then we've also got, if I click this wheel again, we'll go to another mode. And now it says pitch bend. And right now it says zero. So it means the pitch is not being altered from the expected setup that we have. So let me play a little higher note. So you can see I can pitch that up a little bit or down. And this one's polyphonic, meaning we can have two notes at once, which are sort of beating off of each other. And then we can, of course, wrap around back to patch there. So these are the modes, patch, CC, and pitch bend. So I can flip among those. And I can always access these 12 keys to play.  But it's kind of neat to think of building a little utility like this. In fact, I was inspired, I'm sure. Subconsciously, I'm sure I was inspired by RetroKits, which is a great synth and MIDI gear company out of the Netherlands. They have a DIY project called the RK007, or 007. And it uses a matrix keypad, a little display, a knob. And it's used for sending MIDI, not USB MIDI, but I think it's just for classic MIDI. It'll probably be adapted for both. And it lets you do things like pick different messages like these program change messages, control change messages, changing MIDI channels even, I think. So you could go a pretty long way with this as a sort of diagnostic tool, same with the RK007, this idea of having a little box that just lets you access a lot of different MIDI parameters. So what I'm going to do is actually I'll unplug this from my little laptop here and let's head over to my workstation. We could talk about the code a little bit. And I will take a look at the Discord chat to see if we have any questions. Let me bring that up in fact. So there are gifs. OK, that's good. I like that. Lars thinks he's in space.  That nutty guy. Hey, Dr. said their Adabox 19 is preparing for shipment. He must have got an email. That's exciting and fun. Got a little elf gif there. Very nice. I'm so excited. Let's see. That was very spooky sounding, yes, for sure. A lot of those Moog patches, I think that's the, I had the pads bank. Actually, that's something I'll talk about. I'm going to jump into a different synth software in a little bit and we'll talk about banks versus patches. So first I'm going to re-plug in my macro pad. Allow that to start up. And by the way, one thing I didn't mention, I'll just show it on here, I mentioned it last night. Remember, I put rainbow in there, the color wheel from rainbow in the libraries. So as I move through the patches, you'll see I'm actually changing the color and I'm going from essentially blue up to purple. So I'm adjusting through about half the color wheel and that's matching up with the number of patches. So the number of patches you can send over MIDI is 128. So I'm basically using 128 degrees of that color wheel just for fun, just to show. And you could get, like I said, really sophisticated with this. You could have, say, colors assigned to particular patches or colors assigned to particular banks. And so there it is, I've got it launched back up. Let's see if other questions we had. Question about rotation, can you change that on the fly? Oh, that's a good question. I'm not sure if that's, if Catney's watching, let us know. Because I just did it in set up, but maybe we can test it if we have time, we'll goof around in there. Let's see, other, oh, Todd answers it. You can change display rotation on the fly, but you'll need to change your graphics layout. It doesn't change the keyboard layout. What does that do then? What does it change, the neopixels? I'm confused. But yeah, when I set it in the initial, creating the macro pad object, it switches the whole thing. In fact, I'll show you that. Let's take a look at that. Let's do that first, in fact. So let's bring back this display, and I'll move our little friendly Circuit Playground Express off to the side there. By the way, you'll notice I've got a sort of different arrangement here of the macro pad back layer. I decided to expose this cool space art here with the Vera Rubin quote. So you can put that on either way. And that looks pretty good. So let's take a look. In the code here, right up at the top, macro pad equals macro pad rotation equals 180. Let's set that to 0. Oh, actually, you know what? Let me reopen the code right off of the macro pad, because I think I made a couple changes that are not shown there. There we go. OK, so this is the actual code running on the device. I'm going to set rotation equals 0 and hit Save. And now we have it right side up, instead of upside down. And it's still going to send the notes from sort of lowest to highest bottom to top. Nothing else will change. I don't have a synth hooked up now, so you won't hear anything. But that's we'll do that. Let's go 90 degrees. I don't know which one's 90 and which one's 270. If it's clockwise or counterclockwise, there we go. It's counterclockwise. Oh, no, it's clockwise. We just made it all the way around 270. So you can see, let me do 90. And after it restarts, there you go. So now that 50, oh wait, did that not work? Oh, that's interesting. Might have found a bug, because that should be the lowest number. But it's acting like that one is. I don't think I tested the sideways button order. So bad me. I should have tested that. But you can see you've got shorter text lines, but more of them. So for some applications, this may be the way you want to go. In fact, I have a project in mind that's going to use that. But for this one, let's jump back to 180. And then let's talk about what else is going on in here. So color wheel I'm setting up. I mentioned setting up the pixels right there. Very simple. The text that I'm creating to display there is a little list, because that changes with each of these button presses we switch out. So again, this is this macro pad display text. Let's you just create lines like 0 through 4 or 0 through 5 in this orientation. I can't remember. And it'll just display those. In fact, you can put a space just by calling this line 2. It'll skip line 1. And then saying lines show pops that up on the display. And so as far as the MIDI events go, or the MIDI sends, when I detect a key event using the macro pad key events get, this uses the keypad library underneath the hood that Dan Halbert created, which is excellent and works on matrix keyboards, one switch per pin keyboards, and shift register keyboards, of which I do not have an example. So I can't try that. But maybe with an old SNES controller, I think that uses a shift register. And then this is the bulk of the code for the key presses is if a key event happens, so if key events pressed, just change the state from not pressed to pressed, I am creating this variable called key, which is the key event key number. So if I press this one, that's going to be 1, 2, 3, 4, 5, 6, and so on. Then macro pad MIDI send, macro pad note on. And then we could send a note. We could send MIDI note 1, which is so low, you probably can't hear it. But instead, I'm going up and grabbing from a little list I made of MIDI notes. And those are correlated to the keys. So remember, actually MIDI note 1 is up at the top. Sorry, the macro pad key is up at the top. I got that backwards a second ago. So this key down here is 10, or what, 10? Yeah, 10, 11, 12. So 10 is this note 48. 11 is this note 49. 12 is this note 50. And then after I press that key, I adjust the key to be green. So you see when I press them, they turn green. Can't see it on the screen as well there. And that's just using 90 on the color wheel. It's this 0 to 255 color wheel. And then I change the line 1 text to say note on, and then using a little of our string formatting to write the note. And that's what gets printed down here, 48, 49, 50, and so on. When I release, here's what we do. We, again, find out what number did that just happen to?  So right now, if I want to release a note and have that go from green back to blue, it has to know which one that happens to. And so it'll do it for each of those in turn, because it's aware of which key just got released, which is great. We send the note off command. So these will play as long as they're held. So this sets that note to stop. And then I set the key color back to whatever it was based on our knob turn. And then I print on the little display there that we've released that note. So note off and then the MIDI note. So for the switch that's on the encoder, this push encoder switch, click, click, that's what switches between my modes. And what I'm doing there is, again, using a really nice convenient script that Catney wrote. By the way, Catney is in the chat now over on Discord. So hey, and thank you. And ask her deep, important questions about this stuff. If I've gotten anything wrong, please correct me. So when we press this, we just check for the macro pad dot encoder switch debounced press. So it uses a debouncer. So we don't have to worry about holding it and it runs through a bazillion times doing something. It just has that debouncer state change. It doesn't get ghost hits or multiple hits. And we don't have to do anything complicated in code about that, which is great. So what I'm doing is I have a little, remember our friend Modulo. This was what I showed in the Circuit Python Parsec earlier. Here I'm using it again. So mode is mode plus 1, Modulo 3. So every time I click on this mode thing, it switches its index. So it's going to go 0, 1, 2, 0, 1, 2, 0, 1, 2. Mode can be one of these three things. Sorry, let me scroll up a little. If mode 0, then I'm going to print the mode is whatever that current text mode is, which is when it's 0, it's the patch mode. When it's 1, it's the CC mode. And when it's 2, it's the pitch shift mode or pitch bend mode. And then I print the value. Now, the values that I'm printing here are slightly a lie just because some things are in kind of weird different scalings. Like pitch bend is 16,543 or whatever values. It goes negative 8,000 something and positive 8,000 something. That's just how MIDI works for that. Other things are 0 to 127, but we want to see them 1 to 128 and so on. So I'm messing with the display a little there. And I also want to do some scaling. So with the CCs, I didn't want to have one click of the rotation on the encoder equal 1 CC because then we would have to rotate the thing like 10 times in order to go from minimum to maximum CC. So I'm actually scaling that by about 4, 4.1. And this is just for the display up here right now because that's all clicking does is it changes that display and it changes the value of mode. How we use that happens a little later. By the way, also one other thing happens is there's a little red LED there. You can see it glowing my finger when I press it. So that's a little LED built right onto the macro pad board.  And then when I release, all I'm doing is turning that light off. So this released state just lifts that LED off. Then this is how easy it is to check for changes in the encoder rotation. So my last knob position was what we started with when we turned it on or reset it. And then initially, if we go up to the top, that is either I set it to 0 or just to read the encoder. Yeah, so last knob position is whatever the macro pad encoder is at when this starts, which it resets itself to 0. So then what we do is we check and see if that position is different from what the encoder position is, which is this rotation. As soon as I turn this, those two numbers become different, so that is essentially a state change that checks and sees, OK, you're turning it. Now I have a variable called knob position that equals whatever the encoder is at. And then I do some math here to be able to put this into usable ranges and also to essentially limit how high or how low it can go. So we use some min max, which credit where credit is due. Todd Bot helped me figure this out, so thank you, Todd Bot. You can ask him in the chat if you have questions about this in details on this. But you can see it in use, let's see, right here. So the midi values of mode when we're in program change, those can go from 0 to 127. And so this min max midi values mode plus the knob delta from 0 to 127 basically means we'll only allow the knob to register down to 0, even though it can get positions infinitely lower than 0 and infinitely higher in the other direction. Then we send that value. So again, macro pad midi send, macro pad program change midi values and whatever that number is 0 through 127. And then that's what the synthesizer is using to change its presets or its patches. Then I do this color, this key color value is a variable that I change as I turn the knob. And I wanted to start for whatever reason at the cyan, so I added 120 to it at the beginning and I keep that up here. And then we fill the pixels with whatever that color is. So again, that's kind of a slow change. That would be a lot faster if I hooked that to the CC because that one whips through in about a couple turns. So if we switch instead to mode 1, so we go from CC rather from program change to CC, now we do a slightly different scaling. So I'm saying I just want to go from 0 to 31. So I want 32 possible values, which is a subdivision of the 128 that it can actually be, which means I turn the knob four times fewer to get to the top. Or every little click of the encoder goes up by 4 or 4.1, which gets me the full range 0 to 128. And then for pitch bend, we do a similar thing except now it's just the range of 0 to 15 gives me a full range of the pitch bend, which usually is a two-semitone pitch bend. Your synthesizer or your synthesizer software can change that. But usually that 16,384 values equates to two semitones below 0 and to below the root pitch and two above. And then for state detection, we set that last knob position variable to be equal to whatever the encoder is at. So let me look and see if there's any questions before I move on. I'm going to show just a little bit of a demo of some of these MIDI values coming out of here. We'll spy on those. And then we'll look at one other synth thing that I wanted to show you. It's super cool. Let's see. Todd says, rotation of keys and LEDs and displays is super handy because people have different needs about where USB cable should come out of device. This is true. You might want a 4 by 3 instead of a 3 by 4. I actually kind of like this having for this, which is kind of a handheld. I imagine this is a handheld thing. I like having this little display down at the bottom like that. It's kind of nice. This is the more typical on your desk display where you can see the screen up on the top. And oh, doctor asks if there's an I squared C slider board because that could go on the side with 3D printed brackets. So do we have, I don't know if we have a slide potentiometer with I squared C yet. We just have the Trinkie that's a USB. So we don't have a ready-made solution, but you could probably do that with an I squared C ADAC analog to digital converter and then plug a potentiometer into that. Meridian Prime is showing a cool 303 acid synth. Awesome. And let's jump into taking a look at some of these MIDI messages. So I'm going to launch my little MIDI monitor program here. And I got to share this, sorry. I forgot to set this little guy up and share it earlier. How about just add a screen if you'll bear with me. This might make my broadcast glitch. So sorry if it does that. Add a screen. And now we wait. Promise it's thinking. There we go. Switch that to a window and MIDI monitor. There we go. OK, so this is now just spying on the outgoing USB MIDI messages. So if you see here when I press this first note, this first key, my display on the MacroPads says I've sent note on for 48. And you can see there in the MIDI monitor. Yeah, sure enough, note on over channel one for note 48. And it also is telling me that we have a velocity of 120. Now we also get this extra byte, which is just a bug that's being worked on in our USB for all the USB MIDI stuff on our devices. There's just a bug right now. And then when I release this, you're going to see it's going to send a note off message. So note on and then I release note off. And I'll clear this just to make the display neater. I don't think I can zoom this, unfortunately, can I? No. You'll see if I press another note, like note 56 here, then I can release either and either. So that's how that MacroPad pressed and released from the keypad library works, which is terrific.  Someone just said zoom enhance. Well, I can do zoom enhance because I'm not going to show too many messages. So let's allow me to zoom enhance. There we go. So now you can see when I click the encoder to patch and I rotate, I get a program on channel one and the data is sending a 127. So that means I was all the way cranked up at the top. So as I scroll this back, I'm going through every possible of the 127 possible patches that we can send. So now I'm going to clear that. Now I'm at the bottom, the very first patch, one, two, three, four, and so on. You could, of course, set this to send over a different MIDI channel if you had a reason to. You could have MIDI channel selection be part of the UI on here. You could have MIDI bank selection be part of the UI. You could have which CC number you're sending be part of the UI. So it's all things that you could code on here pretty readily, I think. So I'm going to switch to the CC mode here and you'll see as I turn this, I'm sending on MIDI CC number 74, which is often a filter frequency. You can assign it in your synth software for whatever you want. And then it jumps up by four every time I turn one notch of this encoder. And that's because I just didn't want to be turning forever. So if we start at the bottom here and I go, that's basically a half turn that gets me to 36, another half turn 65, another half turn 94, another half turn. So it's about two full turns will get me all the way up there or a little crank, a little half turns. All right, so let me close. Oh, I won't close that. Let me just hide that. Last thing I wanted to do is just kind of share a pretty cool synth that you can get your hands on for free. That Moog synth, I think, might be $15 or $30 right now. Sometimes it's free. It went for free back in April, I think. But here's a really cool app. In fact, I'm going to jump to my browser. And this is a free synthesizer that is near and dear to many people's hearts because it is an emulation or a simulation of the realistic or Radio Shack brand MG1, which if you look at it, that's the Wikipedia page on the MG1. It was called the Concert Mate MG1 as well. And Radio Shack had a line of synthesizers in this Concert Mate series. But this is the only one of them that was actually manufactured by Moog. So it was at the time a $500 synth that came out in 1981. And it is not the same as any particular Moog, but it has a lot of the same characteristics as some of the Moog synths of the era, just with a couple of differences. But it's a really neat synth, really fat sounding. And this is the Cherry Audio. It's a synth company. They make this software synth that is currently free. I don't know if they have plans on selling it again because they say now free. And then down here it says $25 and that's crossed out free. So I recommend this one because it's got a ton of presets in it. It's got, I think, 128 presets in it that we can scroll through with our knob there. It actually does polyphony. So you can hold down multiple notes at once, which is somewhat accurate to the original. It had, I think, two oscillators and then this polyphony third oscillator. And I think it allowed you to play more than the three notes, though. So I can't remember if that's para-phonic rather than actually polyphonic. But you can get multiple notes at once, which is kind of cool. And it allows you to assign CC to change things on it. So what I'll do actually, I'm going to jump back over there. I don't have it installed on this machine, I don't think. But I'll jump over there and show you running through its presets because unlike that Moog synth which thinks in terms of banks, this one instead just has one long list of presets. So you can scrub through all 127 of them, no problem. Let me just get a USB adapter here. Let's re-launch. I'm going to quit that one, and load this one here. There we go. And I think I can just scale that. That's nice and big. Whoa. So if you're wondering about, I'll turn the output to my amplifier. Hold on one second. Audio and MIDI, audio through headphones. There we go. So in the software, you'll see there's a big list. If I set it to all presets, these are the bazillion presets and you can go through and pick them by name, which is cool. But again, that's the big list that we're switching when we use our MacroPads patch. You can do things. A lot of these have detunings among the three oscillators so they can get pretty raunchy sounding, which may be what you're after. I don't judge. I'll set this back here. So again, this will work. Let's find a nicer patch. I like that. So you can see here, this is that filter. Again, I've assigned this MIDI number 74 to drive that knob. And like I said, you could in here code something where you get to pick CC numbers, which is then assignable to pretty much anything in here. So you could go through one at a time and play things. In reality, you'd probably want a box with 8 or 16 rotary encoders on it to do lots of hardware style changes on the fly. But this is fun for testing for sure. And then pitch bend will work as well. So that's the MG1 based on that Radio Shack Realistic Slash Mogue synth, which is super cool. And apparently, one of the more common ones to find, just because they were cheaper than mugs, so they sold a lot of them or sold at Radio Shack. So you can still find them. They, I think, usually run around $700 to $1,000 in the used market for one that's a little grungy. But it's been a while since I looked. I don't have one. I wish I did. All right, so I think that's going to do for today. Let me jump back over to the work bench there, workstation, and see if anyone's got any other thoughts and questions before we sign off. Hi, Dave Odessa, who said they were late. Sorry, you were late. Let's jump over to Discord so I can see it there. More rotaries, yes, in fact. Oh yeah, Meridian Prime said that there was a 303 clone that Lady Aida made about 12 years ago called the Zoxbox, X-O-X box, so instead of 808 or 303 or 909, it was X-O-X. It was based on the 303. Hard to find them now. I have a PCB for it, but a lot of the parts are hard to find, so I've never built it, maybe one day. Doctor said something I didn't catch is the macro pad sending the MIDI instructions directly or is there software bridge? It is direct. So USB MIDI flies right into the software. You don't have to do anything in the middle. I was using that monitoring program just to look at it, but this will work also for hardware synthesizers that have a USB MIDI host built into them. So you'll see I've often used this 1010 music blue box, a little sample station. That has a USB host MIDI port, so you could plug something like this into it and then use its own setup to say what influences what, as you turn knobs and press buttons. Let's see. Oh, and Todd answered that question. Thank you. So I'm behind the curve by a couple minutes here. Oh, you can still get the Xoxbox synth kit PCB set. I didn't, I realized that. Check it out. Yeah, here it is. That is, that's the Xox kit. It costs $3.03. Oh, $3.03 is four of them. So if you're thinking about doing it, it is an intense build with a lot of hard to find parts, but people dig them. There's a whole world of people using those out there. Let's see, other discord happenings. Oh, Steve has one. You've got a Xoxbox right there. That's cool. I don't have any 303 type of synths. They've got that syrupy, drippy, filter-y acid sound. Doctor said Cherry synths requires an account. Okay, good to know. So you will need to have an account in order to get the free synth. Dexter says JP has all the cool tools. Man, that's a free synth. I don't have the real one. Oh, Steve's got a picture in the discord there of that lovely build of the Xoxbox. Maybe you could bring that on show and tell some time and play it for people. It's been a while since anyone's heard those. All right, I think that's gonna do it. So hey, thanks so much for stopping by today. And thanks again to the whole CircuitPython team and Dan Halbert in particular for the Keyswitch library and Katny for the MacroPad library, which is making life so easy for coding this kind of stuff on the MacroPad. Love it. And thanks also to Todd for help with that MinMac stuff for rearranging my values there. I wanted to see if I could do that without importing extra libraries. And I think that's gonna do it. And thank you, the viewer for stopping by today and hanging out and coming into the chat. And so please remember, we will have a AidaBox unboxing coming up not next Wednesday, but the one after that. So that's the 28th of July. And that'll be at the normal Ask an Engineer time slot, which I'm not gonna say, because I always forget by like an hour. I think it's at 8 p.m. Eastern though. If anyone knows in the chat, let me know. Hey, Minnesota Mentat, thank you also. And next Tuesday, I'll have another JP's product pick of the week. I probably won't be dressed up like a cat. But you will probably get a great discount on a cool thing, so why not come and check it out. And that'll do it. So I believe there's gonna be a deep dive with Scott tomorrow at five o'clock Eastern time, so please stop by. And then we have a bunch of other happenings going on with different people going on podcasts and hack chats and things like that, Haxter and all kinds of things. So check our blog, because that's the best place to find out about it, or ask people in the Discord, what's going on, what's happening? All right, so that's gonna do it. Freighted Fruit Industries, I'm John Park, and I will see you next week. Bye-bye.


Up until three years ago I wasn't a gamer, even less a game designer. So I come from a very political and social background. And I started to see the potential of games to create inclusive and very impactful online education. And seeing how, you know, more and more people have access to the internet with mobile phones, etc. And there are still millions of people who don't have access to education. I saw it as a way to, you know, create online quality education for those people. Yeah, so this game is about two young kids who have to go to the toy store to choose a toy that they really want because they received toys that were gender stereotypes. So they have to overcome a few challenges to choose the toys that they really want. My research is about how to democratize educational game design. So to enable anyone to design games for learning. So I created a framework that was applied during a weekend-long event where anyone over 16 years old could come and design an educational game on social topics. Personally, it was very important to have more women, more people of color, people with disability, you know, the LGBT community, minorities, etc., into game design and having their voice included in more games. So, you know, games have very strong issues related to discrimination and to representation. So people coming to my event were usually people who had never designed games before, who weren't even necessarily gamers. And it was mostly people from those specific underrepresented groups in the gaming sector. Games are a way of self-expression. The voices of who designs the games are usually represented in the game they create. So if we have more diversity in the teams, then this diversity is going to be reflected in the games as well. Something that was really interesting from the studies is that in the two days of this event we spent one day learning about, in this case it was about gender inequality, so about gender, about education, about game design. And the second day was about developing the game, so actually taking the computers and making the games. So we did spend a lot of time on the learning. And I think this was crucial because we could see the impact of learning, especially on gender and on education, into the games that were created the next day. You know, our PhD is a long journey. And during two years and a half I was researching, questioning this topic as much as you can imagine. And I actually didn't know if it was going to work or not until the end of the event. So when I started seeing the interest and the motivation, and especially the enthusiasm of people who were participating, it was amazing for me.


almost a little bit surprising to see him not completely dominate a lineup.  So any time he any time he gets hit around a little bit and doesn't have doesn't have his best outing. It's you know, it's a little it's a little surprising. You know, we we expect him to go out there and dominate every five days when he takes the mound. You know, he's a lot of fun to play behind a lot of fun to watch him work. And you know, the second inning, I think things just kind of things just kind of went their way. They hit some balls well and and obviously we were able to get the lead and you know, we weren't able to get a whole lot going after that. It seemed like in the first offensively, you guys had a little bit going, but then really quiet thereafter. Why do you think that was why? Why were you guys able to be shut down? I'm not sure to go back and look at some video. I mean, I think that Miles did a good job of of keeping his breaking ball, you know, on the edges and down a little bit out of the zone, some tough pitches to hit and getting ahead of guys. And you know, we just you kind of had our had his way with us. And like you said, we weren't able to get a whole lot going there after that.  You had a single there and that second inning and then a triple. Did you feel better at the plate tonight? I did. I felt really good. Felt good with my work today before the game and felt good going into the game. Felt like I was, you know, on time, on time, the majority of the pitches that I saw tonight and, you know, felt felt good, felt aggressive up there.


And now, random man. Apparently I need no introduction. Thank you. So, yes, a few of you know me. I've been speaking for like six years. Who am I? Consultant. Yeah, yeah, yeah. I just got my CISSP. Decided to troll ISC Square and had Kevin Mitnick as my first work reference for that. That was fun. Written some books, I do trainings after the day. Renderlab.net is my site. Remember a few groups. I've been here every year since DEF CON 7, since 1999. There are kids running around that weren't even born when I first started going to DEF CON. I have the scars to prove it. It is scary how many years I've been here. And every year it gets better. You guys make this a friggin' awesome con. I quit jobs to come down here. There's nothing that would stop me. I'm the guy that goes to a conference in Poland and has this waiting for me. Apparently my reputation precedes me a little bit. But first I want to address something. The Kaminsky problem. Over multiple cons, Dan Kaminsky and I are speaking at the same time. I have yet to see him actually speak. This is getting absolutely ridiculous. In his blog he actually plugs it as the render man birthday paradox. Which is highly ironic because yesterday was my birthday. And I don't think he has any cookies this year.    Apparently I get to drink. Absolutely no one make a head joke. But basically I'm thinking next year, basically with Dan I think we just need to find a way to really screw with DEF CON and any other con we end up at and speak together at some point and see how they schedule that one. So for this talk I have to do some ass covering and I have to thank the EFF for vetting this and giving me some suggestions as to what to say. For the love of SpongeBob, do not try anything you're about to see. We're talking about screwing potentially with commercial air traffic control and airliners in flight. This is not a natural tenable position for a human being. 500 miles an hour, 6 miles above the surface of the earth. Use this information to make air travel safer. Use this to alert people that gee maybe there are other systems out there we should be looking at to protect ourselves. Think about how this happened and how we can make sure that future systems are built in a more secure manner because as you'll see this is absolutely terrifying stuff and this happens a lot. We as hackers have a unique insight. We think about things in terms of security. We always think about the outside. We always think about that X factor, that thing that nobody else in the world seems to do. I mean yesterday you had the chief of the NSA standing up here saying the same thing. Don't necessarily agree with everything he said but the sentiments there. We as a group have got to be more involved in the world. So just for reference, here is the statute of the United States criminal code about interfering with air navigation systems of which basically half the stuff I'm talking about if you actually did it would be violating.  This talk is kind of weird. I want to be wrong. I want to find out that I am completely wrong about everything I'm about to talk about. I'm not a pilot. I am not an air traffic control operator. Could you imagine me as an air traffic control operator? I am in no way associated with air traffic or commercial airlines or anything like that beyond flying cattle class a whole bunch. I'm very good at stuffing people in the overhead bins now. If I get some acronym or some minor detail wrong, I apologize. You think the computer industry is bad for acronyms, start reading some of this documentation. It's insane. This research is ongoing and the air traffic control system is so huge there's no way I could talk about everything in it or understand it for, you know, it would take me years. But this stuff is too important to just keep quiet. So I wanted to point it all this out now so I can get other people on board so it's not just all me and another handful of people. The whole crux of this talk is I want to prove to myself that air travel is still safe, that moving to the next generation air traffic control system does not make things any more dangerous. I'm continually trying to prove this to myself and failing. So I need your help to try to assure myself that this is working. So I get interested in this stuff purely by accident. But a program called Plain Finder AR in October of 2010. Some of you may have remembered this program because it was pissing off Homeland Security and I can't remember which congressman or whatever it was but basically stood in front of the, on the floor of congress and said all these horrible things saying oh my God the terrorists can track our airplanes and all this stuff and it's like you have absolutely no idea how this works, do you? As one can say for a lot of things with congress. Essentially what happens is you take your iPhone, you point it at a con trail in the sky or in a direction. It knows where you are, what direction and angle you've got it pointed at and you're looking through the camera and it overlays the flight information where the flight is. Kind of cool, sitting in an airport and say oh what flight is, oh that's one going on to Lulu, okay that's kind of neat. I've played around with this for a while. I started asking okay well how does this work? Where are they getting this information? It can't all be just downloaded onto the phone or something, it requires a web look up. So this led me to sites like Plain Finder.net, Flight Rider 24, Radar Virtual. Essentially what these sites do is they aggregate data from all over the world. Users set up ground stations wherever they are and then collect data from flights going over and feed this information into a common database for each of these sites runs off a different database. But then puts all this stuff into nice Google maps or flyable maps and you can see you in pretty much real time air traffic. Okay this is kind of cool. It's about 10 minute delay on that traffic but still you can see what flights are coming in and out of town. Lots of interesting info. You can query and see okay what flight is this? Oh that's the one on the Honolulu. What kind of plane is that? Oh 747 owned by these guys. There's a huge amount of information there and this is really neat stuff. The sort of stuff that just a few years ago was unfeasible to think that we'd have access to. So it all went downhill from there. I've been vastly underemployed for a year which means I have a lot of free time on my hands. Generally what I say is that when I get bored bad things happen. What I have been doing a lot of is speaking. All over Canada, Europe, U.S. So I fly a lot. So I'm spending a lot of time at airports which considering my background in wifi usually ends badly as well.  That's an awful lot of metal, money, people moving around. How does this all work? How does this all fit together? You always hear about air traffic control but does anybody really know how it works anymore? This is why I should always be employed. I started thinking about this stuff. So I did some research. Air traffic control really hasn't changed much since the 1970s. So you know if you ever watch airplane, you know, wonderful movie, with the exception of you know the comedic elements, it's pretty much like that. Primary radar. You know the big radar dishes you see rotating on top of the conning towers. Basically they just send out a signal, bounces off metal, comes back. That's how you tell where something is. That's what they've been doing since the 1970s. They now have a, whoa, drinks are kicking in. They don't have a transponder system, a secondary radar system. So as that radar goes out, it sends out a pulse that the transponder receives and then sends out a signal back with a transponder code as well as altitude information. So previously with primary radar going around, they knew the bearing and approximately the distance of the flight but they had no idea of altitude. They didn't know anything. All of that was transmitted over voice channel. Now with secondary radar you at least have some sort of tracking saying, oh, this is American Airlines flight. But there's still a huge amount of work required. Still a lot of voice communication going back and forth. Disinterrogation only happens every few seconds. And when you've got something flying 500 miles an hour, its position changes really quickly. So you aren't getting as accurate a picture of what's going on in the sky as you think. The pilots get no benefits. Air traffic control knows where they are. The pilots don't. You know, any saying, oh yeah, you need to be careful. There's another flight over here. That all comes back from air traffic control. The pilots are essentially flying blind in a lot of ways. It's kind of scary. This requires that there be a large separation of planes.  You have to maintain a certain level of separation for safety because you don't know, you know, exactly where things are. You know, it could get too close. Bad things could happen. So we're still pretty much running by our seat of our pants. IVR, which is basically a waypoint based system, is not optimal. So a lot of airlines are saying, well, we need to improve this because if we're flying point to point to point, you know, shortest distance between two points is a straight line. They aren't doing that. They want to be able to do that, saves gas.  And air travel is increasing. You've got limited capacity. You can't build an airport every five miles kind of situation. You've got cities where, you know, you look at the Las Vegas airport here, McCarran, there's only a limited amount of space that you can do there. You can only so much throughput you can put through there. So you need to do everything you possibly can to squeeze everything you can out of there.  There was that volcano a couple of years ago in Iceland, which I am certainly not going to try to pronounce the name of. These sort of events can cause havoc all around the world. And those effects in one location can ripple because the entire situation is dependent. A flight leaving Europe landing in the United States is then going to continue on somewhere else. If that plane doesn't arrive, well, it just backs up the whole system. So the decision was made, something needs to change. That change became the next generation air traffic control system. The late 90s, FAA and others created an initiative to revamp air traffic control in the U.S. and by proxy, essentially the world. They wanted to do more with less, take the existing systems. Because the problem is you've got, you know, like, what was some of the numbers? It was almost half of the air fleet is in the air at any given time. So it's not like you can stop all air travel, take it to some hangars for a couple of weeks, retrofit everything and then put it back out. The world would grind to a halt. And that would be a bad thing, by the way. So they wanted to modernize this over a period of time, approximately 20 years. Some of the mandates for the system kick in in 2020. So we still got lots of time here. They wanted to save costs on air traffic control equipment because big primary radar dishes that spin around on top of towers are very expensive. But at the same time, they also wanted to save fuel for the airlines so they could cut costs, save time and increase capacity. The key for this is ADS-B. This is the data source for the plane finder sites I mentioned and the focus of this talk. And I need a drink. So ADS-B is automatic dependent surveillance broadcast. Planes are now being equipped with GPS to determine their own position. They broadcast that over a 1090 megahertz length or for smaller planes, 978 megahertz for general aviation. At approximately one hertz. So once a second. So you get a much faster update than you did with primary radar. This information contains the aircraft ID, altitude, position, latitude and longitude, bearing speed, all that stuff, airframe numbers, et cetera. This is received by the network of ground stations. Now, these ground stations can be a lot more plentiful because they're a lot cheaper than a big spinning, rotating radar dish. This is particularly useful because you can also stick these ground stations on things like offshore oil platforms in places like the Gulf of Mexico where there hadn't been primary radar coverage before because you couldn't put a radar dish there. So before it was, oh, plane is entering Gulf of Mexico. We can't track it for a couple hours while it's flying over. And then it pops out the other side. Sort of a triangle thing. But now they can. The early pilots of this were in Alaska where there's just a very mountainous region that they needed to know exactly where they were because on landing, you're basically going through this mountain valley. If you're a couple of hundred feet either side, you've got problems. The certainty of location allows flights to be a lot closer. If you know that a flight is here and another flight is here, your margin of error is a lot smaller. Apparently I'm offline. Your margin of error is a lot smaller and you can pack flights in, which means you can have more flights landing and increase your capacity. This protocol works in two forms. There's ADSB out and ADSB in. So quick graphic here. You can see planes using GPS to determine location. Send a signal down to air traffic control. There's also some interplane communication which I'll get to and data coming back from air traffic control to the plane. So it's a lot more data being pushed around than previous systems. There we go. But when you start looking at the protocol itself, this looks like it's off a lot like a network packet, doesn't it? So with ADSB out, this is from the plane out to the world and out to air traffic control. No interrogation needed. This is the automatic part. That's getting annoying. Instead of the primary, secondary radar system, planes just report their position via GPS. Send omnidirectionally every direction to the ground stations and other aircraft that are in the area. Air traffic control scope used to be the big sweeping arm going around in the old CRT tubes. That is now replaced digital displays and populated from this information.  General aviation uses another system on 978 megahertz, UAT. It's a slightly different link format, but effectively it does the same things. So ADSB in is information flowing into the plane, which is something that's fairly new. It's optional equipment that can be installed in aircraft. It allows them to receive these signals. It's not mandatory, but it's one of those, it's a nice to have, because what it does is it allows planes to be aware of each other without air traffic control intervention. I am just going to say, go away. There we are. So suddenly you have plane to plane communication. You can say, hey, I'm over the Gulf of Mexico, but I know that there's another plane not far off my starboard side. Starboard? I'm not nautical either. For UAT, for small aircraft that never had weather radar, they're now able to get weather reports in from air traffic control. So this is awesome if you're flying around in your little sesson. You can actually know what weather is coming up. You're not having to guess or look at forecasts, which are notoriously not the most accurate thing. The amount of situational awareness increases dramatically. This makes air travel safer. You know exactly where everything is around you, plus chance of collisions, et cetera. Also works for ground equipment, you know, taxiing aircraft, other equipment on the ground. It is expensive though, to put these systems into commercial airliners, $5,000 to $10,000 for just the broadcast out, up to $20,000 for in, because you've got a whole new display panel that needs to be put in. This stuff ain't cheap. Generally aviation market is getting a lot cheaper.  The problem is for a lot of the testing I was looking at doing, there's not a lot on the used market yet. So this gets to be a bit of a problem. This is as of 1.35 p.m. this afternoon, London. Gee, isn't there a really big event going on in London right now? Just looking at this, do you think it's a good idea that, you know, the average public is able to look at something like this?  You start looking at these things and you start thinking, well, how is this actually being transmitted? Like, what does the actual protocol look like? And as I showed you the packet there earlier, I couldn't immediately find anything where they talked about how they mitigate potential threats about this. Every answer seemed to be trust us. Well, I don't trust easily. Previous experience usually means that they either haven't thought of those risks and are trying to cover it up or they had thought of these risks and were just completely oblivious. I started digging and found out I'm not the only one. ADSB is unencrypted and unauthenticated. Right there, that sound. I love that sound. Anyone can listen to 1090 megahertz or 578 for general aviation and decode the transmission in the aircraft in real time. It's a really simple pulse position modulation.  You don't want your signal scrambled. You want this to just go through its really simple stuff. There's no data level authentication of the aircraft. Just a simple checksum. You don't know that it actually came from that aircraft. There is some correlation with primary radar in this hybrid time as they're transitioning. They're starting to implement multilateration in a lot of cases. I'll get more to that later, though. But I'm running a ground station at home sitting on my desk, little box, modus beast that records, that sucked to a big like four and a half foot antenna, that takes in this ADSB signal from the surrounding area, processes it, uploads it to the internet to some of these sites, and I'm able to look at my own, you know, personal virtual air traffic. I'm able to see all the flight paths for the area around my home. And this is actually really interesting because there's times where like at four o'clock in the morning, this flight goes over when the airport's usually closed. Like, where the hell is that?  Like five years ago, the ability for me to check on the air traffic in my area without relying on anybody else. That's nuts. Others have been able, starting to look at this as well. Ryder Kunkel, Defcon 17 and 18, did some talks where he briefly alluded to this. He was basically looking at existing air traffic control systems and looking beyond that. Baylent Sieber, Spench.net, has been doing a huge amount of research with software defined radios, and also with ADSB and using those cheap RTL USB TV dongles, using those to actually become ADSB receivers. USAF Major Donald McKellie found his graduate research project from a couple of years ago where he was researching this stuff. All of these people so far have not, if you read their work, had not found any mitigations for this. They were just saying, well, there's all these potential threats. Nobody's mitigating this. Nick Foster, SDR Radio Professional Badass, has been doing a bunch of research in this and helped me out a great deal. But really no one has come up with solid answers as to is this safe or not? Everything's conjecture and hoping, and that isn't comforting. Largely a North American problem, because the FEAs demanded that this be, their order came down, that this be all implemented, that every plane, and within certain criteria, be equipped by 2020. Europe is waiting until 2030. But this is already being utilized all over the world. I believe Australia is pretty much already implemented at everywhere. UPS has equipped all of their flights with ADSB out. They were an initial testbed for the FAA. There are planes over our head right now that are ADSB equipped in using this. It's the inevitable direction. We've only got eight years before it's mandatory on this continent that, you know, to ask some of these hard questions as the flying public. I fly a lot and want to get home safely. I am very aware of the irony of talking about attacking next generation air traffic control when I have to fly home. But there's a multitude of threat vectors we need to look at. First threat, ADSB out. So this is plane 2 air traffic control eavesdropping. This is simple, you know, as I said, unencrypted, unauthenticated protocols. I'm running a base station. I'm able to record all of this myself. Gee, this is all clear text. What can I data mine with that? I get multiples of these stations. I can do my own homebrew multilateration. Even if a plane is not broadcasting its GPS coordinates, if it's broadcasting anything that I can identify, I can still locate that. You know, Air Force 1 being a prime example of this. The data mining potential, we know it's in the air when, where, remember the extraordinary rendition flights from a few years ago where they grab a guy in one country, take him to another country to beat the living crap out of them? All of that was uncovered by a bunch of plane spotters who were looking at flights that weren't on normal data channels and tracking where they were going. Because, essentially, in order to play nice in airspace, you have to tell air traffic control who you are. I highly suggest you stick around for the next talk, busting the bar, because they're talking about this exact sort of stuff where they're data mining this information. Their method is a little different than using ADSB, but you augment their method with ADSB and you're going to have a hell of a lot of data to mine. Another obvious attack vector injection. What is to stop us, other than a very long jail sentence, from injecting ghost flights into air traffic control systems? Documents that discuss using primary radar, you know, actually bouncing signal off metal, that talk about fusing that with ADSB in order to verify, okay, this plane says it's here, we actually have metal in the air at roughly that location. We can kind of trust that. The same documents that talk about using this system also talk about, hey, ADSB is cheap, we can now turn off primary radar. That's scary. What happens if we introduce just slight variations of existing flights? Say, you know, starts with broadcasting the same location of that flight, but just sort of make them diverge. How do you know which one's the real one? Generally cause confusion to the interopportun moments. You've seen what a snowstorm will do around the holidays at hubs like New York or Atlanta or wherever. It causes chaos for days, people sleeping in airports and all that. Gee, there's an Olympics going on. If you could suddenly introduce a whole bunch of random crap, because air traffic controllers are busy enough as it is.  There's planes now circling. You've now got other, you got things backing up. It's instantaneous. It is scary when you start thinking of the possibilities of this. Could you train the system? Create a false signal that goes same time every Tuesday at 2 p.m. this random flight that never responds and is never found to have actually metal there. You know, do that for a few weeks and then, gee, that's where your smuggler's flight goes. There is some discussion of multi-lateration in this documentation. So multi-lateration is basically sort of the opposite of triangulation. You have a signal being broadcast from a location, your plane, picked up by multiple base stations. Based on the differences of time between those, you can actually build an arc as to where that signal came from. You get three stations, you're able to draw three arcs, where they intersect, that's where your plane is. But there's nothing that I found that says that this is actually mandatory. The systems are being set up in North America. The company that's implementing them is saying, yes, our systems are capable of doing this. We built it in because it's essentially the same radio. It's nothing fancy there. But there's nothing mandating that airports use this. It may be buried somewhere, but you'd think something, you know, information like that you'd want kind of out front and important. What about jamming? You know, it happens. Radio misconfigured, something like that starts broadcasting on 1090 megahertz. Could you sit outside in the airport and jam their ability to receive flights? Quite possibly. It already happens, he says.  You could detect these, direction find these fairly quickly, multilateration, you know, roll out some trucks to, you know, FCC trucks or whatever to try and find this stuff. But does every airport have this capability?  I don't know. What plans do they have? If you target a particular location, again, the Olympics, if you could jam London right as all the athletes and VIPs are coming in for an hour, imagine the amount of chaos, coordinate jamming across multiple travel hubs. Like I said, you've seen what weather will do along the east coast of the U.S. during a major holiday. Introduce, you know, a bit of noise. It could be just a pelican case that you just, like, magnet to the side of a receiving station. Something's gonna happen. I don't know. ADSB doesn't have a contention protocol. It's just a simple broadcast. So if you get too many planes in the same area, the system falls apart because there's just so much noise. No, you can't get the signal through the noise. You could augment this artificially maybe. I don't know. Let's look at ADSB in. So this is plane to plane and air traffic control into the plane. You could inject confusing, impossible, scary types of data to illicit a response.    I don't know. Something's gonna happen. Probably something involving a sphincter. 500 miles an hour, you can still brown your shorts. You could introduce conflicting data between air traffic control and the cockpit. Air traffic control says, oh, everything ahead of you is clear. No. According to my display, there's a conga line in front of me. What's going on? Because the aircraft have no source of multi-lateration. They don't know where this, they have no way of correlating where this signal is coming from. They just get GPS coordinates. That's it. They can't verify which where that signal is coming from. This is only used for a traffic display. So this is just a, you know, sort of a nice to have. It's not as important as other systems, but we'll get to those. GPS jamming. The whole source of this thing is GPS locating.  North Korea is currently running GPS jamming along their borders. So it's already happening. The UK ran a bunch of tests along their highways where they had listening posts, listening for rogue signals on GPS frequencies and found a whole bunch of them over a couple of weeks. Usually trucks mounted with jammers so that, you know, they're low jacks so that the boss knows that you're where you are at any time. You know, some guy would just plug this thing into a cigarette lighter to jam that, so the boss couldn't track them. New York airport in New Jersey actually had a situation with this.  Couldn't figure it out. We finally knew, okay, it's a regular basis. We're able to track this down. We'll go out there, we'll camp out with fresh and finding gear and figure this out. What it was was a delivery truck driver whose boss had low jacked his vehicle so that, you know, keep tabs on him. The guy'd plug in this cigarette lighter GPS jammer and then take a nap. He would park right at the end of the runway in the parking lot and was jamming the friggin airport. These things are only like 20 or 30 dollars on deal extreme, so it's not like they're hard to get. Who's a fan of deal extreme? Aye.  Is anybody actually able to order stuff from there that costs less than 100 dollars for the whole order? You go there for a three dollar cable and it's like, you know, 150 dollars later. But these sort of things can be tucked into baggage. You know, could be sitting on a timer. Okay, what's your fallback position now? You know, we jam GPS for the entirety of the flight. All the advantages of ADS-B suddenly go at the window and if you now disabled a bunch of the original primary stuff, okay, what do we do now? I don't know. Something's gonna happen. GPS spoofing. We manipulate the signals from GPS satellites to say, oh, you're at a different latitude and longitude. The aircraft location tracking is no longer reliable. Okay, best case, we fall back traditional navigation ads, get rid of some of the advantages of ADS-B. Worst case, such as if you're flying through a mountain valley in Alaska, yeah, you intersect something that's a lot bigger than you and that would be bad. Iran may have used this technique to bring down a U.S. drone earlier in the year. That one I don't think will ever actually get a complete answer as to what happened, but still it's interesting to consider and there's just that university team just this past month that was able to take over a U.S. military drone and guide it by just spoofing GPS. You know, it's for like less than a thousand dollars or the stuff. So this stuff is capable of being done right now. Some threats are total unknowns. I don't know. The air traffic control system is huge. The stacks and stacks of documents that are out there and publicly available because so many systems interact with each other in weird ways. I can't understand all this. These guys, I have serious respect for that any of this works at all. But things like, okay, so all these ground stations are networked together. Could I be sitting on the west coast and inject something that shows up on the east coast? I'm sitting in the west coast but my GPS that I'm injecting says east coast. I don't know. I'd like to find out. Honestly, has anyone actually sat down and fuzzed a 747 or in our traffic control tower? There's data going in and out of there. Yeah, there's checksums and everything like that.  How does it deal with that? I don't know. We've got very mature, you know, networking protocols that still fail massively with basic fuzzing techniques. Look into, is Chris Roberts in the audience? No? Okay. Chris Roberts, one role labs.  Not just because he's in a kilt. His work, basically, he does stuff with, you know, the onboard Wi-Fi on a plane, breaking that and then finding an interconnection between that and the engine control system. So to where he's looking at the output of the Intellibus network for the engine that's outside his window, well in flight, look up his stuff. It is terrifying the stuff that he has found. And then at all this ADS-B stuff into it. From also from his work, how do you know that the chip level code that is being used in these implementations is actually what was originally submitted? A lot of the stuff made in China. We're already finding situations where the code that's in the chip may not be exactly what was supposed to be there. Could this be used as a control channel? We now have data going in and out in a clear text fashion. If we have a particular, you know, change in the checksum or some, you know, mangle the pack in a certain way, could we now use this for controlling onboard malware on a plane? You hope that the engineers, the FAA, DHS, everybody else looked into these threats. But I actually had an interesting conversation yesterday where it was pointed out, they're safety engineers. They're trying to get a plane from A to B operating under certain circumstances as safely as possible, human life, you know, the material cost of the equipment. They're not security engineers. They're not thinking, what if somebody decides to go doing something completely random or horrible? What happens? Okay, they're thinking, oh, if we fly through an area where there's some random interference, that's fine. But what about targeted intelligent, slight manipulations of data? This isn't their normal operating thing. This is new to them. Not for us though. We're sort of the opposite. You know, they're safety engineers. We're security engineers. They're used to thinking about getting things safely and not thinking about security. We're used to thinking about security, definitely not safety. Says the guy with a bottle of crystal head here. So the FAA submitted their ADSB implementation idea to NIST, National Institute for Science and Technology, for security certification. Great, cool. Somebody else independent verification. But in this one document I found, said the FAA specifically assessed the vulnerability risk ADSB broadcast messages being used to target air carrier aircraft. This assessment contains sensitive security information and is controlled under 49 CFR parts one and blah, blah, blah. And its content is otherwise protected from public disclosure. It gets worse. Well, the agency cannot comment on the data in this study. It can't confirm the purposes of responding that the comments in this rulemaking proceeding that using ADSB data does not subject any aircraft to any increased risk compared to the risk that it is experienced today. This is comforting. Yes, we submitted it for security evaluation.  What threats were they testing against? Do they think of everything? Maybe there's somebody in this room who could think of something else that I haven't. Or that they haven't. Why not threats of tomorrow? Yeah. So how do we mitigate some of this? Multilateration is an obvious one. Time differential between signals. You can approximate the location of where that signal is coming from. But if you're relying on this, then what's the point of putting GPS and everything on the plane so that they know where things are? You just nullified all of your advantages. No indication that this is being used everywhere. What about if the data doesn't match? If I'm able to introduce, you know, have multiple locations and potentially spoof ADSB or spoof the multilateration signal, if I'm saying that there are two planes, same tail number and everything like that at two different locations, how is the UI of the air traffic control system, you know, how does this represented? What are the liabilities if I decide, oh, this one's probably fake. I'm just going to not show it. But it's the real one. The response to most inquiries I've seen are trust us. Yeah, no. Last time I ran into the language from that NIST test was RFID passports the US was looking at implementing. That turned out well, didn't it? Yes, we submitted this to NIST, but we can't tell you what the results were.  I'm trying to raise some awareness and pressure. I know that there are people from the FAA in the audience at the moment. I want to work with them. I want to find out that this stuff is safe. I fly home in a couple of days. I want to know that this is safe. I want to know what their procedures are. How do the air traffic controllers deal with weird crap? I have 50 extra planes on my display. What do I do? I don't know. Saying to a room of 2,500 hackers that they're suddenly now interested in air traffic control systems? Will they listen to a response? And if that response is me getting arrested, at least I'm going to have a very nice looking mug shot. A common response is also going to be, oh, but it's too expensive for the common man. A $20 USB TV adapter can be modified to do basic ADSB reception. Currently working with Dragorn trying to get him to implement ADSB in tracking with Kismet Newcore so we can go war driving for airplanes. I got word while in the air on route to Poland that Nick Foster had actually implemented ADSB out through GNU radio. You can see we actually have a valid packet able to go out through GNU radio. The honeymoon's over. Exploiting number one is here. We have the potential now to putting data into the air. GNU radio plot for a MODES extended squirter packet. He also raised his game and impressed the hell out of me. He basically took ADSB in on flight gear in the open-source flight simulator. Populate basically had one radio receiving real-world ADSB packets populate the virtual world of the flight simulator and also has another radio that outputs from your little Cessna out to the real world. So got a little video here. You can see on the my right Google Earth display that is the output from the real world ADSB receiver, the real world tracking. The virtual plane there and at the bottom is the ADSB data stream out. Now this is done in very controlled conditions basically dummy load, you know, two radios connected to each other. It wasn't actually put out into the air. But you can see, so just to explain what's going on here you see okay you've got real planes there, VDR 211 and everything. Those are the real flights.  Your mom may be as big as a 747 but that's not her. You see it's got valid packets, valid information. And I don't know, I can't tell if it's showing up on the displays or not. Okay so it is you can see the flight path as he's turning around there over the bay.  Now does anybody think that's a good idea? Um, what is he doing? Uh, okay, is he about to buzz the tower? Really? Okay. Yes, so if I was air traffic control right now I, um, how fast would I be running? Fortunately all this is done in a closed environment by training professionals. Um, but yeah you could kind of get the idea that this isn't a good thing.  That shows over. Okay come on. Oh there it is, okay. So we have the capability of uh generating arbitrary packets. I basically prodded Nick a little bit about this. He had thought to do it, you know, a weekend. Anybody can do this. All the major testing was done at 900 megahertz ISM band. It would not be difficult to adjust this. You can use UAT, ADSB as well. The next guys who do this might not be so nice. There are other things in air traffic control that scare me. Taylor's arrival, where air traffic uploads a flight plan for landing to where they basically pilot receives it, pushes a button, flying pretty much lines itself. Apparently this is also unencrypted, unauthenticated. Having looked into it, I can't confirm, don't call me on that. The air traffic control system is huge and complex. Reading once about one system leads you into a whole bunch of others. It's all tightly integrated. This will be mandatory by 2020. This will be the primary method of air traffic control. It's already used all over the world. There's still time to build counter measures, like not turning off primary radar. Basically if anybody has a 747 or an air traffic control tower that we can borrow, let me know after the talk. I promise to return it in as good condition as I take it from you. But also if you have access just to the avionics, we'd love to actually test this stuff for real. We want to find out. There's some suggested reading, a few documents I found particularly interesting, but there's a lot of information out there. And this is a very scary stuff to consider. Who's thinking about taking the bus home? We should be working on finding and solving these sort of problems. If guys like me can find this stuff, so can bad guys. Significant investment, billions of dollars has already been invested into this system. I want to hear your comments. I want to hear your ideas. I want to work together and research this stuff. But wait, there's more. Nick, get up here. So this is Nick Foster. This is the badass behind the video. This afternoon he was telling me about something he just figured out. So I figured out after a night of heavy drinking last night, first of all just to say this is like shooting fish in a barrel. If you're not scared about this, you should be. This is really easy to do without encryption, without any thought of security in the protocol. It's just not hard. So there's a collision avoidance system called T-CAS that predates ADS-B. It's called traffic collision avoidance system. It's how airplanes keep themselves away from each other. It operates on the same modest data link that ADS-B uses. ADS-B doesn't supplant it. It works with T-CAS. T-CAS is how airplanes avoid hitting each other. ADS-B is how airplanes know where each other are outside of that. So it replies on this cooperative ranging system. It's like a ping-pong. And it slave directly to the pilot. The pilot can see T-CAS reports. If there's a plane nearby that T-CAS says you should watch out for, it's going to show up on the pilot screen. If it can be spoofed, this is bad. Now the pilot is seeing false information. It gets worse. On Airbus and Eurocopter aircraft, it's actually tied in to the autopilot. So if the flight director's turned on and T-CAS says, hey, somebody's coming up close to you, the autopilot is going to take corrective action. Really. This is bad. So T-CAS, in normal operation, the interrogator sends out a ping. It gets a reply back. Okay, it does a little bit of math. It figures out how far the plane is. What's key to this is that there's a fixed 128 microsecond turnaround time that T-CAS has in the protocol that gives the electronics time to gather a response and then transmit it. Well, I don't need 128 microseconds. What if you're not cooperative? If you send out a reply sooner, if you can get a reply out sooner, say you can do it in 70 microseconds, now you can fake your distance from the aircraft much closer. You can create essentially an arbitrary range to the aircraft. Altitude is encoded in the reply, so you can create a synthetic arbitrary altitude that happens to match the aircraft's altitude. That's it. You can create a range track, a collision course between two aircraft, one of which doesn't exist, that's slaved into the autopilot. So that's what we just figured out last night. I'll turn it back to you. Thank you. So, do we have time for questions? No. Okay, I think I know who you are, so no? All right. So apparently Kaminsky actually supplied to me out of the Q&A room, so it's actually going to be in the hallway outside the Q&A rooms. So out this door, down the hall, left, down there, look for me. I'll hang on as long as it takes to answer questions. Nick will be here. Thank you, Nick. Thank you, the EFF. Please talk to us about this stuff. Communicate. Thank you.


Hi, it's William Chow, and welcome to Introduction to Law and Legal Risk Management, Module 1, Part C. In this part, I will give you a brief introduction to law by first explaining what is law, and then explaining the difference between the two legal systems that we have in Canada, common law and civil law, and then look at the different sources of law that we have in Canada. What is law? Law is similar to rules. Law is also similar to morality or ethics. The key distinction is that with laws, laws are rules that can be enforced by courts. Let's look first at rules versus laws. We can say that all laws are rules, but not all rules are laws. There are many rules that we are subjected to in our day-to-day lives that are not considered to be laws. For example, whenever we play a sport like soccer, there are many rules that apply when we play that sport.  If you break that rule, that rule is not enforceable by courts. You don't go to court to say that the other player touched the ball with their hand. That rule is enforced by the referee. With morality or ethics compared to law, when we commit a moral wrong, a moral wrong is something that goes against some kind of moral rule that a person holds. If you lie to your friends, there are what we call informal sanctions. These are informal or undefined consequences that flow from the moral wrong that you committed. If you lie to your friends, you might lose them as a friend or it could also damage your reputation. None of those consequences are specifically spelled out anymore. That's what makes them informal. If you commit a legal wrong, if you break a law, there are specific consequences. There are what we call formal sanctions. If you break a law by committing a theft, there are specific consequences that flow from that. It could be imprisonment or payment or payment of a fine. In Canada, we have the civil law system and the common law system. The civil law system is found only in Quebec. Quebec is the only Canadian civil law jurisdiction. In every other province, we find the common law system. When we use the word jurisdiction, just to take a step back here, we mean a particular geographical area that uses the same set of laws. Each province in Canada, it could be considered to be a jurisdiction because each provincial government passes laws that apply anywhere in the particular province. The whole of Canada could be considered one jurisdiction as well because federal laws apply anywhere in Canada. A municipality could also be considered a jurisdiction in terms of the bylaws that a municipality passes. With the civil law system, civil law traces its history all the way back to ancient Rome and in particular France. The civil law system, without getting into a deep discussion about it, is essentially based on a code of legal principles. The common law system traces its history back to England. Any country that used to be a colony of England is likely to have a common law system. For example, Australia, New Zealand, and also here in Canada, and also the United States is also a common law jurisdiction. The distinctive characteristic of the common law system is that there is much greater reliance on what we call judge-made case law. We look very carefully at the written decisions of previous courts in making decisions in current cases. And what that legal approach is called, it's called the doctrine of precedent. There are three sources of law in Canada. The first is the constitution, which we will talk about in detail in the next module. The second is legislation, or government-made law is another way of describing it. And the third is the courts. Legislation is often referred to as government-made law. It is law that is created by any type of government in Canada. It could be the federal government, provincial government, or a municipal government. Those governments, or in particular the federal parliament and provincial legislatures in creating laws, are using the powers given to it under the division of powers in the Constitution, which we discussed in the previous module. The three types of legislation are statutes, regulations, and bylaws. Statutes are laws made by either the federal parliament in Ottawa or a provincial legislature. The provincial legislature for Ontario is the one located at Queens Park in Toronto. Either the parliament in making law or provincial legislature, they are exercising the law-making powers given to it under the Constitution in the division of powers. Any statute, the name of any statute, will have the word act at the end.  For example, the federal parliament has created the statute which governs banking in Canada called the Bank Act. The process of creating a statute is a long and complicated one. There is a similar but slightly different process for the federal parliament versus a provincial legislature. We will have a simplified overview of the federal legislative process. At the very beginning of the process, the proposed statute is called a bill. So that bill is introduced in the House of Commons, which is a part of the federal parliament. The House of Commons will examine that bill. They will vote on it three times. So those are called first, second, and third readings. In between those readings, there will be one or more committees made up of members of parliament who will examine the bill in detail. After the House of Commons has approved the bill in third reading, the bill is passed on to the Senate. The Senate does something very similar to what the House of Commons did. It will vote on it three times with a first, second, and third reading. And it will also review the bill in detail by groups of committees. After the Senate has approved the bill, the very last step, and this is usually just a formal step that occurs. But it is a necessary step to make the bill into law. And that step is sending the bill over to the Governor-General. The Governor-General is the representative of the Queen in Canada. The Governor-General just simply signs the bill upon signing, which is called royal assent. The bill becomes law. It becomes an act at that very moment. The second type of legislation, or government-made law, is called regulations. The way to think about regulations is by looking at statutes as containing all of the general rules, and then the specific rules that we need to implement those general rules are found in the regulations. For example, in the Income Tax Act, which is a statute created by the federal parliament, it requires that employers deduct tax from employees' pay. Now, to determine the actual amount of tax, or the formula to determine the amount of tax that has to be deducted, we can't find that in the Income Tax Act. We find that in the Income Tax Regulations. Now you're probably asking yourself, why do we make life so complicated by having two sets of rules in two different places? We have to look in more than one place to figure out how much tax we need to deduct. The reason that we have these specific rules in the regulations instead of the statute is that the regulations are much easier to change and quicker to change than statutes. To change a statute or to create a statute, we have to go through that legislative process that we looked at in the previous slide. That legislative process is complicated, it's long, and it's also quite often very political. The process of creating or changing regulations in comparison is very quick and usually not political. If the government needs to change the rules or the formulas for determining the amount of tax that needs to be deducted from an employee's pay, they can easily do that if those rules are contained in the Income Tax Regulations versus the Income Tax Act. Now who has the power to make or change regulations? To determine that, we have to look at the specific statute and see what it says. Who does it give that power to? That power is usually given to a government minister or a specific commission or a tribunal. Regulations are considered to be subordinate legislation. The third type of legislation in Canada is called bylaws. Bylaws are created by municipal councils. If you recall in the previous module where we talked about the division of powers under the Constitution, the Constitution gives the provinces the power to create municipalities. Whenever a province creates a municipality, in that process the province has to pass on some power to the municipality that gives the municipality the ability to make its own laws, which are called bylaws. Bylaws are also considered to be subordinate legislation. For example, for the City of Toronto, way back when the Ontario Legislature passed a statute called the City of Toronto Act, and that act created the City of Toronto and also gave powers to the City Council of Toronto to pass bylaws on various specific matters, which would include things that cities typically deal with, like parking rules, zoning, municipal zoning. Anything that the city has the power to do, that power came from the province. Let's now look at a quick quiz question. Please pause this video so you can consider this question. The answer is C, bylaw. The town of Blackville created a set of rules for the licensing of businesses. Those rules are considered to be bylaws. Bylaws are laws created or passed by municipalities. The third and last source of law in Canada is the courts. The courts in Canada perform various functions. One function is to interpret and apply the constitution. So remember the constitution includes both the rules governing the division of powers and also the Charter of Rights and Freedoms. Another function is to interpret and apply legislation. So legislation would include statutes, regulations, and bylaws. The courts, and this third one is something that's not obvious to most people. The courts themselves can also create and apply its own law, which we call common law, or a more simpler way of referring to it is judge-made law. For example, many of the rules that govern contract law do not come from any kind of government legislation. It doesn't come from any act or regulation or bylaw. Many of these rules, like for example the rules that govern the creation of contracts, those rules come from legal principles in many previous and older cases written by judges. So over the years, many of these legal principles have been developed from case to case in order to create a general set of rules which govern contract law.