So this is a lecture on the packet and packet attack technique We're familiar with attacks of the standard sorts right I mean we understand how to do a stack buffer overflow in order to get execution of machine code in a vulnerable binary and in that case we're exploiting the CPU itself, so like a string buffer runs long something. It's overwritten and that's a software bug And we understand it as a class of software bugs and there's been so much research into extending it into doing it in more difficult situations We also understand attacks for SQL query injection and These are similar in that we're injecting code in both locations where we should only control data But they're both software bugs as different as SQL injection and stack buffer overflows are This lecture is about packet-in-packet injection attacks which are not attacking a software bug This is a way to remotely inject a layer one packet by abusing a Sort of chance happening at the physical layer In a perfectly standard compliant way So in this lecture and in all of the examples that I show you in this lecture everything that I am doing in my attack techniques will Exploit a perfectly standard compliant implementation of the relevant protocol first for a to two dot fifteen out four and two FSK and Then later for a to two dot eleven B in the second half of this lecture Sergey Bratis is my co-author on the original paper and I would like you to read the fucking paper Sergey has 30 copies of this printed you can mob him afterward not me And he'll be happy to pass them out. Thank you, Tress. It's very kind of you neighbor So I'm gonna let him introduce the technique and then I'll continue on for the remainder of the lecture So this is why we're standing here. This is how it's happened In 2005 something really interesting was happening Joining cash was pictured you see in this sort of pseudo chat illustration Came up with a trick that Allowed him to do a virtual W lands by switching the BSS ID in the Association response and then also as he noticed In the authentication response one of those things was standard compliant. The other was not yet The key observation was that For various implementations of 8 to 2 11 the response of clients was different and For some of those the response was that the client required power cycling Before it could connect. So when you have Differences like that on that level, you know, you can exploit them. And so in 2006 That was the seed for hijacking the Mac book in 60 seconds again by journey cash and David Maynard And then the month of Colonel bugs so that's hopefully, you know the month of Colonel bugs and I Was there a torque on when he gave that lecture and I was thinking well this has got to be fingerprintable and it turned out to be fingerprintable and If you're wondering why a cat the cat is sort of what you really want to see when you don't want to see me My picture really would not come out. Well, so Fingerprint but then of course that was layer 2 But there is layer 1 and layer 1 for it 8 to 2 11 is Quite complex. So you've got all of these fields before you see anything that why a shark would show you and I was thinking well if we could manipulate that Maybe we could do interesting things with the actual chip that is Responsible for processing all of these fields behind is beyond these fields. You've got the actual layer 2 and the Mac and all the flags and the nice exploitable Complex frames, but what if the exploitation starts well before in layer 1? Well The next thing to come up was Travis Goodspeed and Mike Osman a playing with the other kind of Digital radio chips. This is the chip con 2420 and this is the I am me that's been turned into a spectrum analyzer and Wow, you know, this is a chip. That's a lot more malleable and a lot easier to control than your 8 to 2 11 chip, which is kind of looked down and so Zigbee is what these chips were produced to implement or rather 8 to 2 15 point 4 and various other proprietary things besides Zigbee and so Why can't we fingerprint that? based on how Chips respond to various irregularities in these layer 1 logical fields and Indeed, you know, I met up with Travis. I think it was a recon. Yes. Yes Yeah, and I said well fingerprint and he said hell. Yeah, and I said well So let's get some really expensive hardware This is your usrp2 sells for something like $3.5,000 and Travis said hell no we are going to use the commodity chips and So we started a fingerprinting effort which has produced interesting results yet to be published But in the process while playing with these Layer 1 fields something else which was a lot more interesting came up And that was So this was a remote physical layer frame injection exploit While we were working on Packets and packets. I mean unpacking some packets while we were working on fingerprinting We got a little bit bored because fingerprinting is largely defensive and it's largely nitpicking you have to find You know, which parameters vary between all sorts of different? Chipsets there are lots of experiments that have to be run lots of data that has to be collected and at the end of the day The only difference is that you can You know distinguish two different brands so to make it more interesting. That's what we thought though. Yeah But as you're doing fingerprinting as you're studying it you sort of have to learn what's going on under the hood and in the same way that You know someone with layer 7 understanding of how a network works won't be able to write Lower-level exploit or anything that takes advantage to say layer 2 You can't exploit layer 1 until you understand it and the only way to understand it is to go through the rather painful process of Reading a standard and seeing how it works So what we came up with was a remote file air injection We had a theory of how the vulnerability should work. This theory was completely wrong But the exploit worked anyways This almost never happens, but in this case it did and The resulting attacks turned out not to just be specific to that radio, but actually portable to the entire class So we're dealing with a situation which Mallory wants to attack Bob But Mallory does not have a radio and Mallory's exploit only works over the radio For example, you might want to attack someone over the internet through a Wi-Fi beacon frame exploit such as those published in Uninformed volume 6 Well, there's no way prior to pack it and pack it to wrap a beacon frame exploit into Regular TCP packet you are not supposed to be able to send Wi-Fi beacons or probes or probe responses over the internet these exist outside of TCP IP they exist outside of all of that and When you want to remotely inject them you're kind of out of luck The same goes if you want to change fields that are properly locked down by a firewall So suppose that a firewall does not allow me to send any broadcast packets remotely But I want to send one anyways Before packet and packet I would be out of luck supposing that the firewall were properly configured and Fragmentation tricks when it work and that sort of stuff So a packet and packet injection works by especially crafting a string So that when this string is sent at any higher layer Sometimes it gets lucky and drops out and becomes a layer one packet so you can then take any sort of wireless frame that you would want and Wrap it up with a bit of padding send to that over the internet as an email attachment as an HTTP download as a UDP frame as The body of an ICMP ping in anything so long as it is unencrypted and So long as the wireless network that you're trying to inject through supports a variable frame length And we'll get to why these are important later but The these aren't very hard criteria to meet This hits everything in industrial control systems This hits a lot of the digital radio standards for handheld radios You can do all sorts of nastiness with this and it's portable among them And when I actually show you the exploit you're gonna think there's no way and how that can work And then I'll go back and show you how it works Helps when this thing is turned on Sergey. Yeah, so I have a confession to make These are the things that I would not have challenged when presented with them You know prior to February 2011 I used to believe that you only get frames Over the radio that are sent by a compatible device or an expensive software-defined radio Which sends a compatible signal basically? impersonating a compatible device, but on the a frame that got sent and Did not get damaged Could be received I used to believe and that turned out to be a lie And I mean how many of you believe these things before the start of this lecture? I mean these are not unreasonable assumptions everything that you get is either perfect or has a bad checksum right, so you drop it and you don't see those things as being a problem and As computer scientists and as computer programmers were taught that noise is something that has been taken care of by the abstraction layers and Is not our responsibility to deal with and most importantly? you're not getting something that Somebody did not transmit as such correctly and this is a lie Okay So I'm gonna take it for here from here for the remainder of the lecture Sergey and I will be giving a different packet-in-packet lecture at Berlin sides And he's the one that you should hunt down for a copy of these Thank you kindly So the source of these misunderstandings is that we treat layer one as a black box We don't think that it's our responsibility to learn how it works and the OSI model it discourages us from attempting to learn how it works and This wrecks all sorts of havoc We're taught that the black box will only deliver valid or slightly noise damaged frames And that this noise can always be identified and taken care of That's not true This is the exploit as it's framed for Zigbee This is a complete layer one frame This is more than your packet sniffer would show you and The difference is just in these first few bytes. Does anyone have an illegally powerful laser pointer? Mine was taken in Scandinavia, but excellent If I could borrow that for the duration of this lecture, it'd be ever so grateful So these first four bytes are the preamble and they're all zeros in Zigbee and this only exists to Present the the timing This final byte in the beginning this a7 That's the start of frame delimiter and inside of the radio chip. There is a physical machine Okay, it's a shift register and all this shift register does is cycle packets through Until it sees this final zero byte and the a7 You can even reconfigure it to different values, which is used in my attacks on the Microsoft wireless keyboard Which I would love them to issue an advisory for by the way The So these zero and the a7 This gets latched in The receiver is sitting there spinning processing background noise as bytes It's pulling bytes out of the air until it finds zero zero a7 and then it snaps in and that's where the packet begins It doesn't matter that no packet existed before them Because the radio chip doesn't understand the concept of they're not being data on the line You can actually tell the radio to give you data when there is none and it will give you bytes up Because that's what a radio does This is then followed by the familiar fields the 19 hexes the length Zero one zero eight eight two. Those are flags Cafe is the source address and babe is the destination address or the other way around And then if inside of the packet anywhere inside of the packet You put that same beginning these zeros the a7 and then you have a shorter frame. That's the one in italics here That ends with a valid checksum We actually found a typo in this the zero a should be a zero nine, but In any case if you send this string across Then most of the time you'll get the full packet Or if you're at the edge of the range or if you have Wi-Fi around because none of us ever have Wi-Fi around The packet might be damaged in different areas. So if you start sniffing with checksumming disabled Which you should always do just so that you have a more complete record You'll start seeing some of these bits flip or some of these words flip Enzyme the nibble size is Sorry, enzyme the symbol size is one nibble. So you'll usually see damage of an entire nibble instead of an individual bit Like F and D are not are no closer to each other than F and zero are or F and AR But and when this happens your driver will see that the checksum is wrong and it will throw it out And that's why we're told that this isn't something that needs to be worried about in Communications theory textbooks they'll go over the probabilities of these individual bytes being damaged But the thing that they miss out on is that some bytes are more fragile than others in In particular, it's more likely for you to have a large expanse of your packet blotted out by interference then for Individual bits to flip by accident and if the top gets blotted out Then as the receiver is spinning around and it's looking for that 00 a7 pattern it never finds it Until it gets into the body which the attacker controls So if you transmit this packet a few thousand times a Few hundred times if you're lucky Most of the time your packet sniffer will see the entire packet But about one time in a thousand the tail end of a Wi-Fi frame will stomp on the beginning of the Zigbee frame and That a7 or that 00 will change to a different number and Then the start of frame latcher never latches on it never realizes that the packet has begun So when it's receiving the remaining bytes of the packet it thinks it's listening to background noise and that no packet has begun yet and Then it will latch on to the a7 that the attacker controls See the length that the attacker controls count off that many bytes of data that the attacker controls Look at the checksum that the attacker controls See the inner packet is being valid and then it forwards it on The operating system can't know that it's fake because the operating system doesn't see anything before it and This is perfectly standard compliant because the standard has no way of dealing with noise other than checksumming And this is true of the Zigbee. This is true of 802.11. This is true of several other protocols This is a photograph of the first time that we got it working We transmitted the longer packet which I've highlighted here and that highlighted region became the shorter packet in the second recording The second recording differs in that we're only sniffing the broadcast address so the difference in addresses of the two packets is enough to To grab the right one This is the packet format as it's drawn in crayon It begins with a preamble that's the the bytes of zeros in frequency shift key radios such as the The app code project 25 radios that I hacked recently It's just the high frequency and then the low frequency alternating For direct sequence spread spectrum. They have more choice in which symbol they use This is followed by the synchronization field which is intended to mark where the bits begin and This is where we're looking for damage. It's perfectly okay of more than the sink gets damaged and The interference in the damage is not attack or controlled the attacker just waits until he gets lucky and It doesn't take that long Packets are damaged in the air all the time. They collide all the time things like clear channel assessments Only work as a performance hack. They don't actually prevent collisions from happening so this packet and packet injection attack in which the A preamble the synchronization and a complete body are just placed inside of another packet is sufficient to remotely inject a layer one frame and It works so this style of Having a beginning to the packet then a middle and then the end and counting on the receiver Missing the beginning in Order to hear something else or didn't misinterpret the entire message was done before I Have a running competition with Meredith Patterson to see who can cite older papers. I Win with 1938 She's of course threatened to follow this up with an attack on the Babbage differential engine So in the war of the world's broadcast Which wrecked havoc in many of the countries in which it was played and many of the languages in which it was translated The play begins with a two minute and twenty second long introduction That says you are listening to the Mercury radio theater in the air with HG Wells War of the Worlds as performed by Orson Welles And it tells you what you're listening to but that's only two minutes and 20 seconds long and As people are channel surfing They might move past the station and come back and not know that it's the same thing or they might not hear it at all And this started at exactly eight o'clock on a Friday night It's then followed with a 38 minute long first act And in this first act there is not one word out of character. There is not one message from a sponsor There is not one commercial break and there is not one station announcement Most communications government agencies now have laws against this because When people were listening to this, you know, and they're told that they're listening to a musical show to Ricky Raquello's orchestra in the air which we interrupt for an emergency broadcast from the National Weather Service And this continued repeated interruptions, you know the first the weather service then the New Jersey militia the militia actually nationalizes the Central Broadcasting Service Because of a state of emergency during the broadcast When they translated this to Spanish and played it in Peru the audience was listening to it and you know, they heard that the army was going up the road to Attack the aliens. They thought bullshit if this were true Then we could look out the window and see the army, but the army had heard the same broadcast and thought it couldn't hurt to send a couple of tanks I mean we laugh, but in the ensuing riots. They burnt down the Radio station killed six people and the director had to flee to another country And then we laugh some more So these packets work the same way whether it's a 30 minute long broadcast or a very Short broadcast the only difference is that in a short broadcast you have more preambles and synchronization frames to catch That's why in a modern radio broadcast. You'll hear the station identified several times throughout the show So that you won't be confused for very long You could imagine a packet-in-packet defense in which every packet was fragmented and then the individual fragments were checked to Make sure that they all matched up with one another This would then require the attacker to have multiple synchronization frames damaged, which would reduce his odds But in the end this radio signal is a lot like an audio signal when you're using software to find radio you might even record both as a wave file before demodulating and You can put one message inside of another If you control 30 minutes of my audio broadcast You can wreck havoc You could pretend to be another station you could have a fake government announcement You could announce Some sort of news event or terrorist attack which hasn't happened and get people to freak out And in the same way you can trick a computer by putting what it expects to see in the middle of a packet What it expects to see in the beginning of the packet into the middle This is a picture from a textbook on the OSI model And raise your hand if you thought it was useful to read about the OSI model Usually when I ask that I barely see one hand and that guy's like embarrassed and he's pulling it down afterward So the OSI model is sort of force-fed to us, you know, if you take any sort of networking course If you read any textbook on networking Even in casual conversation You're told that you need to learn the OSI model even though the seven-layer count might be antiquated What the OSI model does is it encourages us to build layers of abstraction around each layer of the packet so that we can build them up and Make very complicated machines using Like base components that we don't really understand It's possible to write a web server without learning how TCP sequence numbers work Because from the layer seven view You just have text coming in and text going out and it's not until you need a high performance. So you need to understand Specific attacks against sequence numbers that you ever care that they're not in order or you ever come across the notion that they might not be in order and We're taught that you know just like these little Russian dolls these things just sort of nest inside of each other and they don't break out and We're told that this is because of check something But check something only goes so low So this is how it's supposed to work in theory and this is how it works in practice And this is how I make it work in practice Because if you control the middle and you have encapsulation with errors Then you can make one thing burst out of the other and at the bottom of the seven-layer model You've got this little black box physical layer That you're taught is voodoo magic that only people working on software-defined radio should ever care about and By coincidence the people working on software-defined radios are usually just trying to get packets in and out And when they're finished with that they're done or they can move their exploit to a higher layer But what packet-in-packet shows is that you can also do these exploits at layer one and you can trigger them from a much higher layer You don't need a software-defined radio to mess with the radio remotely You don't need any radio at all. You can let your victim take care of the radio and when these things are plugged together You wind up with horrifically fragile contraptions that happen to work because the lower layers fake reliability If any of you seen this one If this had worked it would have shipped last Russian construction forum slide. I promised When you plug these things together How embarrassing would it be to have died while taking this photo? So don't trust this black box Specifically I've attacked the synchronization or starter friend the limiter matcher There are other machines inside of every computer that are less than Turing machines But there are exploits that can be written for things that are less than Turing machines this synchronization field matcher is a Lot simpler than even a regular expression engine a Regular expression engine cannot properly filter html You have similar computational limits here And you have a machine that cannot distinguish between malicious and non-malicious traffic and you can exploit that machine This is what the machine looks like You know, it's hardwired There is no patch for it This is the chip kind of 1110. It's what I used in the girl tech. I am me You can even zoom in on the logo and such but the the physical chip itself Contains as hardware the implementation of the language and like any other language you can come up with an exploit for it The difference is that it's not a driver. It's not an application. It's not something that can be patched these vulnerabilities for defenses to be made they have to be figured out and Patched before the product ship or before the standards ship if I keep this up. They're gonna draft me into a standards body God help me So these lang fields are terrible because they can't tell the difference between data and metadata and they make a context sensitive language This is both bad for parses and bad for input handlers and it's really bad for hardware because it can't be fixed Lens has been in Meredith Patterson made a video that you can find called towards a formal theory of computer insecurity a language theoretic approach That explains this at the theoretical level and it works on the practical level Yes, go to Meredith's talk tomorrow. What time? four o'clock tomorrow So there are complications though in Zigbee. I had the advantage that Zigbee's layer one is quite simple if anyone from Chip Con were in the audience. I'd have something thrown at me by now, so But it's simple in that the packet only exists at one data rate Every Zigbee packet is 256 kilobits per second and no other rate and Every Zigbee packet is in the same set of symbols. So you never have to worry about One piece of a Zigbee packet being slower or faster than another The similar linemen is easy so long as my Zigbee attack is aligned properly to a nibble boundary Then the inner side will go through and the injection will work if I make it off by some Number of bits that's not evenly divisible by four Then it will stop working But that's not Complicated to find out and in the end you can just stick the bytes in and transmit it and it works The Wi-Fi is a lot more complicated Other complications include differential signaling Which isn't so hard to match but allows you to create obfuscations of your packet and packet injections So you can create packets that do not look anything in hexadecimal like the packet you intend to inject but wind up producing the same sounds on the air and allowing for the injection So don't think that in any case or that in every case these will be as easy to inject as the example I've shown you or that they will be as easy to recognize as the example that I've shown you We saw the same thing with SQL injection in that when SQL injection attacks first Came about and they started happening people said oh you just have to double the number of single quotes And yeah, that keeps a little timmy from doing it, but You know later on you realize that you have character set differences That you can use a backslash to escape one of the things all of these different complications That don't necessarily make it impossible, but do make it harder and Wi-Fi accidentally implements some of them Bluetooth has a particularly interesting one in that it reuses the address as the synchronization field The Microsoft wireless keyboards do the same thing. So in Bluetooth One device Can't actually know that another device's packet has already begun So I don't have to gamble on any damage to do injections into those sorts of devices if you're trying to inject from a Microsoft keyboard into a similar device and You know, it's whitening state you can do so reliably like hole in one every time you send the packet out It gets misinterpreted you can even do it across data rates The Nordic chips used in the Microsoft keyboards run at either one or two megabits per second at two megabits per second You can just double every bit and it falls through and it works. I wish Wi-Fi were that easy, but and so Wi-Fi Various the data rate inside of each packet Wi-Fi packet will begin at one megabit per second always So you have to be able to produce one megabit per second Wi-Fi sounds and symbols In order to inject a Wi-Fi frame This might not be true for 11n, but I'm only dealing with B for the subject of this lecture Wi-Fi also varies the encoding so if you have a Wi-Fi packet that begins at one megabit per second for the header Halfway through the header it'll decide that it would rather be at two megabits per second because that takes less time on the air and that improves performance and Two megabits per second is the fastest that the header is allowed to run Then at the end of the header it will actually switch to an even higher rate. It is 5.5 or 11 megabits and In the shift between two megabits and 5.5 it actually changes its encoding mechanism entirely I've not yet figured out how to inject Wi-Fi packets from 5.5 or 11 megabits but I can do it from one megabit per second rather easily and I can do it from two megabits with some effort The effort is manageable and we'll get to that in a minute GSM uses time slots and 3g has its symbol coatings and These things are also difficult to work around and in some cases it might be that there is no workaround But there's a lot of new work to be done in porting this attack to new sorts of radios and a lot of them are going to be vulnerable So this is the end of part one in which I've covered pip injection for a to 2.15 out 4 and we're now going to move on to a to 2.11 To quickly review in 15 out 4. We just put 4 or 5 bytes of zeros and a single byte of a7 before our packet If you take that you put it before the length field of the packet that your packets never gives you have a valid check Some at the end send that as a string over ZigBee a thousand times it will fall through and you will have an injection I think escapee plug-in has already been committed One for Wi-Fi should be coming soon enough And there's a general pattern you're trying to put in those bytes that when sent over the air will produce the sounds That could be mistaken for a packet by a receiver that doesn't know it's inside of a message So for part two, I'm going to show you how to do this for a to 2.11 b The complication of this is that half an hour is not enough time to explain the entire 11b standard I'm going to be leaving some parts out and I'm going to be coming out with a very long very detailed paper on how to do this later on If you've ever read the Wi-Fi standard We should start a support group So as I already mentioned the editor 11b header always begins at one megabit per second But it can jump up to two megabits per second The first half has to always be one the second half will probably be two But for simplicity if you're injecting and you leave it at one, that's not a problem The body is then one two five point five or eleven megabits Sometimes radios will not support transmitting at one megabit per second Especially in Linux a lot of the drivers were just pushed far enough to get WPA connections and no further So in many radios, you won't be able to sniff packets with damaged checksums You won't be able to force a data rate of anything awkward We've had good luck with the atheros chipsets The other problem is that because one megabit doesn't offer many performance advantages over two megabit as far as reliability goes That a lot of radios won't drop that low So for practical injections you want to be able to inject at both one and two megabits per second You'll also want to be able to port this to 11g and n and a and the rest So you have three data rates you have three different five standards and you can only inject from the fastest one This sucks Because it means that if my payload is going over your radio at 11 megabits per second I have to inject from one very different style of radio to another and I haven't yet figured out the translations for that Now the final data rate varies with signal strength and with packet loss and This I like because this means that when the radio is getting interfered with It will drop its data rate to spot it which I can attack it And it's when it's being interfered with that it's easiest for me to do my injection So this works out in my favor and the final rate because it varies with signal strength and with packet loss it sometimes helps to cause extra traffic all of these techniques for causing Extra bandwidth usage on the local network like you could easily write JavaScript that just Waste the time of the browser and waste the bandwidth of it that can help in packet and packet injection Although it's not necessary So how slow is the fastest? At one megabit per second Everything becomes as easy as Zigbee If you put the bytes in the error in the right order everything works out But many networks can't or won't drop that low at two megabits you can recreate one megabit symbols In the same way that on the Nordic radio you could just double every bit to go from two megabits to one That almost works here, although for a different reason and there's also a scrambler In radio protocols, it's bad form to send a lot of low bits or a lot of high bits in a row because this Fails arbitrary communications tests for like the FCC so if my radio sends lots of zero bits and lots of one bits I'm likely to be disqualified and I won't be able to ship my product The solution to this is a scrambler, but the scrambler is not intended for security reasons, it's only intended to Pass an arbitrary test, you know, you have to keep the signal strength beneath such and such a bar When sending anything or else you get in trouble, but it's averaged over time So if they have two peaks instead of one then they pass the test So the state of the scrambler is only seven bits Which I like because it's only a hundred and twenty eight Possible values So I can guess one of them. It's not even required that these be random Although in practice if there's a single byte before your packet that you don't know then you likely won't know the scrambler state For 5.5 megabits 11 megabits and 8211 g you have very different body rates and occasionally you're allowed different header rates the header and Wi-Fi is Very sparse all it says is that the following body is at such and such data rate and It specifies how long that body will be in microseconds because it doesn't even Demand that the receiver support that style of packet If you have a palm pilot that it only does one megabit per second That palm pilot will still recognize that an 802 to 11g packet is going to be on the air for so long And that it shouldn't try to broadcast over it even though it has no ability to receive 802 to 11g This is what the preamble looks like after going through the scrambler this is just the beginning of it it's much longer and The preamble in the unscramble form is just 128 ones This runs through a scrambler to produce the waveform that you see below and the scrambled form Never includes regions of lots of ones or lots of zeros This is how the machine looks like on paper. I have verilog code for this on github A nifty thing about this is that you have these different tap points and if you run data through the upper device and Then you get the scrambled bits out when you run those same bits through the d scrambler function itself synchronizes and automatically fixes everything It will even do this if you choose any other set of bits to run through the function So if you mess this up or if you haven't off by one error while reading it Not that I would ever confess to such a thing The bytes will come out in a way that looks like you got it right If they had made this 128 bits long Then you might have to guess on a 128 bit number Or even if they made it 32 or 64 bits long it would drastically reduce the ability to do a rate-to-rate transition the reason why we don't need to To mess with this scrambler at 1 megabit per second is because at 1 megabit per second We don't have to do any simple corrections so if you remember in The FSK radios where zero zero at two megabits would become a single zero at one megabit Here you have to double those bits in the unscramble state and You can't do that if you don't control what they are If you don't control which rate your sounds will appear in the air and it's legal for this to be initialized to anything But all ones So if you are a hardware engineer and I tell you to initialize something to anything But all ones you will obviously initialize it to all zeros which is perfectly legal by the standard Because again, there's no requirement that it's random. This was not intended as a security feature You can either predict this or you can guess it There are 127 different start positions, but by the time it gets to you There's probably one bite before your packet that you don't control like a sequence counter or something like that So it might as well be 128 And it self synchronizes but the attacker can't observe the bits so the attacker can't follow the self synchronization Because remember in our attack the attacker does not have a radio Not even for listening So for one megabit to make it to one megabit. There's the same symbol set same data rate It's just like Zigbee These are the exact bytes that you put in if you want to inject a one megabit per second packet You do 128 bits of ones or F So whatever you want to call them then you have F3a0. This is the Wi-Fi equivalent of the a7 You then have your flags your data rate Your checks on but this is a check some for the header not for the body So you can take this magic string and you can put any body with a proper checks on after it And that body will go in at one megabit per second To inject from two megabits per second your symbol set changes So in one megabit per second you have zero degrees difference and pi degrees difference So the phase is changing by up to half of a waveform Two megabits you have four symbols you have zero pi over two That's a quarter circle then a half circle then three-quarters circle, right? But you notice that the two symbols that you need for one megabit exist in the two megabit version and you can correct for them So because all of the one megabit per second symbols exist at two megabits This is not true of the five point five megabit per second This is the table Again zero zero represents zero and one one represents one, but these have to be after scrambling and We don't know how our data will be scrambled At one megabit the scrambler fixes itself, and we don't have anything to worry about But at two megabits per second we can't count on the scrambler So because this scrambler no longer self-corrects we have to guess it and then we have to produce a string That when scrambled with our guess Produces the two megabit symbols that we actually want to be on the air To match the one megabit per second symbols that we need for our injection Very long code for doing this is at that URL just github.com slash Travis Goodspeed So the the present state of packet in packet in wi-fi Is that 11b is definitely vulnerable at one megabit ended two But only when the network transmission is in clear text I've got a lot of you are thinking i use wpa, so I don't have a problem here But in uninformed 6 2 there's this nifty little exploit The hd more and scape and jenny cash wrote And they attack wi-fi beacon frames Your laptop will receive and interpret a wi-fi beacon frame even if you're not associated the network Better still the attacker does not need to know your mac address Or anything unique to your connection so In that paper they present a number of wi-fi exploits some of them require a probe response, but others do not For the ones that do not the ones that work on a straight beacon frame You can take that beacon frame and you can embed that into a packet and packet injection Throw that into a large file download like an iso image Put it up on a web server and say hey download this And then if you're sitting in your office on the wpa protected network with cryptography that my packet and packet techniques can't touch and your um Your neighbor is using a wi-fi hotspot in a cafe In clear text and is downloading the size of image Then the beacon can fall through and hit you Even though you did nothing stupid even though you downloaded no untrustworthy files Just by the very fact that you're sitting there Through packet and packet injection another lovely Attack of the sort You can inject into satellite communications this way So when you have a satellite network, uh, let's say a geosynchronous satellite You know, you've got your victim somewhere you can watch all of the downstream traffic just by pointing a dish at the right bird Okay, but injecting something that the bird won't carry over is rather hard Because in order to aim the antenna properly you would have to launch a spaceship get a bit higher in orbit and get the same pattern It becomes unmanageable with packet and packet you can just send a message that gets ferried over to any other user of the same transponder on the same frequency That contains a malicious packet And whenever the message comes to the victim's radio It either works or it doesn't this is a probabilistic attack You have to try it lots of times whenever it doesn't work the victim's radio says oh, this isn't addressed to me I'm going to ignore it because gentlemen did not read each other's emails So from that user's perspective the injection becomes a whole in one And we have all sorts of these different pieces of technology based upon layer one Uh protocols that we don't understand Or that are so complicated that you can't easily understand it the The key um the key piece of this Is that when you have these layers of abstraction in the osi model They become boundaries of competence They become pieces that you're not allowed to look beneath And you begin to respect these boundaries even as you're smashing ones a few layers up Even as you're jumping down to layer two to do layer two attacks you're still using a layer one infrastructure that You haven't had time to learn yet And you shouldn't assume that just because it's so Low level that it can't be implemented in software That it doesn't have vulnerabilities or that it doesn't have exploits so It intended to demo this for wi-fi And then the demo god struck Instead I have it running for a zigbee and for the duration of the conference If you packet sniff me anywhere within the conference hall You will be able to catch both the outer form and the inner form The wi-fi preamble and plcp header are included in these slides You can also find the verilog code for the scrambler up on github And escapee plug-in should be ready soon enough Are there any questions? So the question was why don't I want to have a radio? And I don't want to have a radio because having a radio puts a greater requirement on the attack Packet-in-packet certainly works when I do have a radio and that's how I test it in the lab and that's how I write the x-plates But when you start using them in the field Quite often you don't have physical access to the victim's environment I don't have a spaceship so I can't fly up to attack geosynchronous satellite receivers Packet-in-packet is specifically targeted at those sorts of situations in which you don't have the ability to bring in a radio Or in which you don't know where the physical environment is Or in which you want your radio attack to spread further than you can individually send packets Any other questions? Yes uh, I was wondering if you have any lessons learned from that especially uh as Quite now there are more and more industrial protocols being developed based on 15.4 especially I know And I know that especially uh because of European legislation there is within the etsy a new harmonization going on between all those uh networks based on In the ism bands, so if you have any lessons learned to prevent these problems So cryptography prevents this attack even when the cryptography is bad Um, wep is really crappy cryptography It can be broken by scripts that you can download anywhere But it's still effective at preventing packet-in-packet injection because packet-in-packet injection only works for the attacker knows what the symbols will look like on the air So using cryptography and using good or at least mediocre cryptography is an effective defense to packet-in-packet Yes, okay, I think you left out a fairly important detail given a reasonably well connection with low noise How much data do you actually have to send until you get a reasonable good probability that you will hit one of these possibly exploits? I haven't measured in a very low noise environment But in the average university building We tested it in a laboratory room at Dartmouth College in New Hampshire We began broadcasting packets repeatedly over a to 2.15.4 And it was less than two minutes before the packets began to arrive They also tended to arrive in clusters when the nearby wi-fi networks became busier So you have to be patient but not terribly patient In the two megabit to one megabit injection this might become an hour or two Okay, but it still falls through if you want to make your evaluation stronger I would like to see something like a 3d graph with the probability of the injection the data rate that you need and things like that Thank you kindly


situation so if we go into a situation with anger and blah blah blah we're gonna what we're not we're not gonna get a good healing result out of that we're gonna get more anger out of that we're gonna get a consequence of anger which is not healing which is just more at more whatever not stuff


Hey guys, welcome back to come again TV the only place on YouTube. We're all geek culture collides. I'm Shannon and today on the show We're gonna be taking a look at the diamond select toys Disney Kingdom Hearts Donald Chip and Dale action figures So as you can see it's got a nice little window box display Very nice. You got Chip. You got Dale. You got Donald. You got his little staff I've never played the diamond or the Kingdom Hearts game But I thought these guys would go really well with my Duck tails Funko figures the scale They don't really scale as well Donald is a little bit shorter than Scrooge a little bit smaller But Chip and Dale would work really good because the Funko size ones They are a lot bigger. They are about the same size as Uncle Scrooge So they would scale a little bit better But as you can see here, here's the side nice little window nice little window Here's the back Collect them all based on the hit video game series Action figure series 2.5 Donald Chip and Dale. You got limit form Sora and dusk So I did pick this up at Walgreens pretty nice find Now let's go ahead and open the box and take a look at Donald Chip and Dale It does come in kind of a clamshell and The box it was held together by one piece of tape So you can put them back in the box and slide them in and close it back up and Display them that way if you want to I don't like I don't really I'm not an in-the-box collector of my figures The only thing I'm an in-the-box collector of Are my Funko Pops and As you can see there are four tabs Which connect the clamshell and some tape it looks like so let's go ahead and cut the tape I never really saw the point of in the box collecting I Mean yeah, if you plan on reselling them You know you will get more money out of them if it's still in the box But you know what's the fun of that? What's the fun of? displaying these in the box not Physically holding them in your hands There's Chip There's Dale. Let's go ahead Slide this down a bit and we'll zoom in there we go Very nice detail on these guys One side of Donald's face kind of looks angry the other side kind of looks neutral. I guess that's Because of the way the lighting is I guess Anyway, let's go ahead and go over articulation With Donald his arms are on kind of a ball joint hinge. They can go There's the hinge and they can go all the way around and No wrist swivel The legs do turn move just like that I guess it's kind of a ball joint But The head does turn but it's very tight for Chip There is no articulation and I'm assuming the same for Dale, and you got this little wand and That will fit into Donald's hand. I think maybe maybe you'll need both hands His hands are too big to really hold it so I'm not sure what the deep deal is with that Falling all over the place, but I really like this detail really nice detail very nice sculpt Here's Donald There's Dale Dale as we talked about with the Funko figures Dale is the one with the red nose and the Two teeth that are far apart Very nice sculpt and here's Chip Chip has the black nose with the Two teeth up front close together Got the Mickey Mouse logo on the back there very nice and To give you guys a little bit of a size comparison let me Get my Scrooge McDuck Funko figure and we'll do a size comparison stay tuned All right. Here we have Donald Chip and Dale next to Scrooge McDuck from the Funko line as you can see Donald is Quite a bit smaller than Scrooge Chip and Dale are pretty close to the right size though I Mean I guess they'll display okay side-by-side together this but I Would have liked it if they would have made Donald a little bit bigger So that he would have displayed a lot better next to Scrooge Size comparison wise I would have also liked more of a closed hand on Donald so that he could actually hold This magic wand So anyway there you have it guys the diamond select Disney Kingdom Hearts Donald Chip and Dale Hope you guys enjoyed this video make sure you hit the subscribe button Season can come back for more toy reviews Have a great one guys take care If you enjoyed that video make sure you hit the subscribe button right there So you can stay up-to-date on all things geek culture Also, make sure you check out one of these two playlists on the side for more videos Just like the one you just watched I'm Shannon for comic-getting TV the only place on YouTube.


Hello and welcome to the antenna implementation guide. My name is Miroslav and I will walk you through the session. I don't think you will be bored, so let's start. Due to expansion of virus devices and appliances today, a proper antenna design is becoming more important. Virus devices are widely used and can be found in any kind of application. This guideline is going to give you a general insight for implementing PCB antennas in to BLE or generally 2.4 GHz design. Although I have no doubt that there are experienced engineers among you who can do so. Another possible way is to use a ceramic antenna for which similar rules can apply as stated in this guideline. In part 1, we will grab the information how to implement antenna correctly and what to avoid to not lose a performance. We will focus on metallic object and environment. Today it is not very convenient to have an external antenna or an antenna connected to the enclosure. Therefore, the antenna began to be an integral part of the PCB and you must create the conditions for its proper functioning all the more. It is necessary to become familiar with this component. The antenna is a key component that can simply better or degrade the RF link Thus when designing or implementing the antenna several important aspects need to be acquired. Here are several basic aspects we need to consider. The permittivity or if you want the altriconstant of laminate is a critical design parameter for PCB trace antennas. Variation can cause severe detuning of narrowband antennas, especially if the stackup of various layers is used. At frequencies in GHz bands a low loss laminate should be considered. Unlike chip antennas PCB trace antennas cannot be copied to another device expecting a good performance. If implementing the PCB antenna you should always consider a custom design or at least adjustment for your conditions. The reason for will be explained further. When the PCB trace antenna is placed on the motherboard it is in fact a 2D structure in the same plane as the ground. The amount of surface area for the antenna is then very limited than because of lack of the third dimension. It can lead to less performance than other antenna type. PCB antenna can be matched to 50 ohm and in most cases they are. Due to external conditions an antenna needs to be fine tuned as it is often out of dedicated band. To have good performance it is necessary to adjust the antenna by matching network that is in front of the antenna port. It is a kind of resonance circuit or a filter that enable more power to get into the antenna from a feeder. In RF we call this as impedance matching. Antenna matching components allow compensating uncertainties related to PCB material and other external impacts as mechanical objects nearby. This also help to decrease an amount of prototype rounds due to simply adjusting lamp components instead of adjusting antenna shape. Let's talk about inverted F-antena. The inverted F-antena is a kind of basic monopole antenna that uses a shorted arm to define an impedance. This antenna needs a sufficient ground plane to operate. This is not only a difference between such kind of antenna and dipole ones but from design point of view it is a significant factor. The ground plane is a mirror for the antenna and it is integral part of antenna. Radiation efficiency depends on the size of the board or metal planes. There exists a limit where antenna becomes not operating and getting loss and efficiency. Therefore when considering about antenna look at a PCB to evaluate antenna performance and select the right type and location for the antenna. Many antennas of this kind needs a clearance. This is an area under the antenna where no ground, no metal is present. This clearance must be kept in all PCB layers. The size of clearance is designed in such a way to help antenna to radiate effectively and to not impact its performance so never interfere to this reserved space. Performance of the antenna depends on dielectric material and its thickness, especially a resonance frequency and return loss is affected. For frequencies of our concern it means 2.4 GHz a common FR-4 material is used as a cost-effective solution. Reducing antenna length is possible as this is quite common task to make the board smaller. Therefore the antenna is in folded form. It preserves a resonance frequency but it can have smaller efficiency especially if this parameter is not taken into account when designing it. During this session I will introduce a couple of examples to explain consequences of various implementations. All of them will be presented on planar inverted f-antina, designed in full 3D electromagnetic simulation tool. The first example is the clear antenna design. All the others will be affected by various matters. And I will show you how the parameters change. So let's explain the basic one. The highlighted area is the clearance for antenna. We already know this should be out of metal objects. The antenna is located at the edge of PCB. And this area creates ground plane for antenna. Such size is enough for keeping efficiency. Here is so called return loss parameter depicted. This is a basic parameter showing how the antenna is adjusted. The left hand side representation is a magnitude plot and we are trying to get the graph as deep as possible and at the same time to preserve enough bandwidth. Looking up by difference of outer markers. A representation on the right hand side is smith chart that depicts the same but in complex numbers. In this case we try to get the plot between markers close to center of smith chart. As we already stated a bandwidth is measured as a difference of two crossings with horizontal line of appropriate region loss magnitude level. Resonance frequency corresponds to the mineral level of the plot. These two dimensional plots are the basic radiation pattern cuts. It is an envelope of the three dimensional far field in certain angle. These can be in absolute numbers expressing some of the horizontal and vertical components of the field or only in particle component. In the particle pattern cut we can show the angle and appropriate value of antenna directivity. This telling us again or directivity of antenna from various angles depending on if efficiency is included or not. A 3D far field for this type of antenna is an omnidirectional pattern. This plot is almost optimal far field we can get from planar inverted f antenna. We can determine three basic radiation pattern cuts. Let's mark them in the picture. The plane YZ specifies the red circle here. The plot shows an envelope of 3D far field. The plot is 8 shaped. The XZ plane specifies the green circle here. So the envelope creates a nice circle. The XY plane is made by blue circle. We can see here it is a cross section which plot is number 8 shape. Let's discuss more about the antenna implementation. Considering planar inverted f antenna we have to endure a couple of meters. The outline of the antenna is given by its clearance. No other components are allowed here as those could impact performance of antenna. There are designed certain spaces around the antenna, mainly on the right and on the left ground edge. These are important from radiation pattern point of view as this impacts a shape of the far field. The distances must be kept if you want to preserve performance of the antenna. As to keep it out of any metal side strips. You never know if these metal edges were taken into account when designing the antenna or if they can be removed as they impact radiation pattern. But if the PIFA antenna is designed with such side ground areas and they will not properly fit into PCB, don't use them. Always it is feasible to assess if this is necessary to keep them or better to remove them. The clearance is located from the main arm of antenna toward the feeder and or let's say desirable ground. This distance affects efficiency and bandwidth. Keep this distance as it is from design. Antenna trace width depends on used FF4 material the electric constant and its thickness. In the case of composed stack up it is even more complicated but the antenna should be adjustable by matching network and its length even so. This example is about modification of a clearance size. The antenna shape is a bit closer to a ground plane so this can be a case of wrong implementation of antenna non-respecting needed space on PCB. The situation is expressed in the picture on the right hand side. The red frame portion was moved toward ground plane so the clearance became smaller. The ground plane is preserved in size. Let's look at the return loss changes. Here are the return loss results in already well-known representations. This can be expressed in VSWR as well. A resonance is slightly shifted downwards and magnitude of return loss is much worse. This should be possible fine-tuned by matching network to get back to the center of the desired band although not in all cases this may happen. Resonance is decreased by 2 dBs in this particular case so it is only 63% of original value. It is predictable if the antenna would be even closer to ground plane would be worsened all the more. You should always consider the spacings of the antenna shape to the ground plane and it is always necessary to tune it in the environment where the antenna will be operated. The results visible from return loss are, resonance frequency is shifted down, worse magnitude of return loss and reduction of efficiency. Radiation pattern didn't change. Even in the 3D far field is not visible any change. This radiation pattern shape is preserved. Included directivity however gain is decreased by smaller efficiency. A radiation pattern is preserved only small changes are visible as the character of the antenna was preserved. We will make a short detour to explain matching network. Antenna port is at the edge of the ground plane where the antenna is connected with a feeder. Relocation of antenna port also means relocation of the antenna within PCB thus you will get different antenna behavior. Features of antenna is related to its placement. The important integral part of antenna is matching network. You can adjust the impedance of an antenna to the feeder with matching network. It allows as much power as possible to the antenna and subsequently radiates the power out. Matching network is a kind of RF filter so this is often made by reactance components inductors and capacitors. For BLE only discrete components are used. These parts should have to be high Q and low ESR utilizes. A planar components aren't feasible. The point is to get an antenna impedance that is almost never 50 ohm to impedance of the feeder. Better to say it matches the complex impedance of antenna to complex conjugated impedance seen at the end of the feeder. These circuits can be pi or t structure or even simpler shaped and they can serve as an additional RF filter as well. It can be used for suppression of harmonics. The matching network is adjusted after fitting all the components on board in operating conditions so inside the housing. Namely the antenna is affected by all these matters thus its impedance is changed then therefore you would fine tune the impedance in this step. As we already talked about the antenna is affected by all these matters therefore its impedance is impacted. An issue could be with significant difference between impedances of the feeder versus the antenna and then the quality factor of matching network becomes higher thus it makes a bandwidth smaller. Difficult case is a metallic enclosure. Generally a metal object is heavy NMA4 antenna. Metals make it impermeable for radiated waves and if nearby the antenna it impacts its impedance. In result it may change a character of antenna. The first case occurs while metallic object is far from antenna in far field. The waves are reflected and make the region behind the metallic object partially in shadow. The second case occurs when the object is near field or reactance field. The object is then becoming a part of antenna so the antenna can be completely detuned. From this perspective it can be a metallic enclosure for water meters, gas meters etc. In special cases if the PCB with antenna is enclosed only partially inside the housing then you can use the open part for radiation. Suitable is patch antenna or similar one that do not radiate backwards a lot. It must be well designed in terms of opening in housing. First is to use an external antenna but it is not usable everywhere or the solution makes it expensive. In cases where antennas are close to metallic objects it needs to be well adjusted by matching network. This example shows the performance of an antenna whose implementation in this PCB is not correct. The antenna seems to be sunk in the ground plane. This is represented by the side strips. So the antenna shape itself has not changed but the side strips change its character and features. Although they increase the ground plane size a bit they have a major effect on antenna tuning. The strips caused a shift of resonance frequency downwards significantly. The antenna became very mismatched. Efficiency has dropped considerably by 70 dBs in this case. The desired return loss in band is completely out of resonance. The ESWR in demanded band is really out of the good numbers. Fundamental resonance is at lower frequency than it should be and further resonance is appearing higher. This state should not be easily fined tuned by matching network only the layout change is the option. The results from return loss. The antenna is completely mismatched and further resonance is appearing there. There is significant efficiency loss that makes a radiation almost impossible. It has also consequences to radiation pattern. The antenna became more directive and its omnidirectional character is lost. The far field change can be seen from the images of pattern cuts. There is increased maximum directivity number. It is some 1 dB more. However, the efficiency is so miserable that antenna is useless. Moreover, it doesn't have the typical apple shape. It shouldn't be a problem if the other parameters weren't so bad. As a conclusion for pattern shape, the antenna became a bit more directive and its omnidirectional character is lost. Antenna is useless for transmitting a signal as efficiency is very low. This experiment concerns to antenna that is placed perpendicular to another ground plane. This may be the case of the Bluetooth module that is connected to the motherboard with headers. In general, a larger ground plane has a more positive effect on the antenna, especially to the efficiency. But this may not always be the case. Often, it changes a far field in terms of directivity. Let's look at the results. It shows up a similar result as detuning the antenna with distance to a ground plane. The return loss is somewhere between 2 and 4 dBs in magnitude in the desired band, and a resonance is out of band as well. It corresponds to some 4 to 7 in VSWR. Efficiency is decreased by 3 dBs. The antenna is tuned clever. At the same time, the return loss has worsened in magnitude. The antenna would need to be set up with a matching network. A new insight, there is a hint for further resonance at higher frequencies. The results for return loss are the antenna is mismatched a bit, there is further resonance appearing, and higher efficiency loss is present that corresponds to some 50% of original value. Why the efficiency is smaller? On the one hand, the role plays the mismatched and second apparently a location of the antenna versus the added motherboard. What is new in the effect on the radiation pattern? This is simply a consequence of the large ground plane which makes the antenna highly directional. If you place an antenna above ground plane, you basically get a similar far field as depicted. A shape depends on the mutual placement and the distance of the antenna and the added motherboard. Antenna pattern has changed a lot and it is more omnidirectional and worsen efficiency is not visible on the directivity but on a far field plot of antenna gain. Now we will deal with small size PCB. The next category is small PCB where installation of antenna and other electronics is task task. A reason is hardly reachable and enough counterpoise for the antenna. This is related to monopole antenna type. If the small PCB isn't a part of larger unit, then a significant decrease of efficiency will be a reality. The result is a range reduction. You have to realize that it overlaps to power consumption. Let's consider a flowing. If you would like to increase a range, you have to increase the output power or directivity of antenna. Even used antenna type is hardly made directional so the output power change is only the option then. The further parameter is an efficiency of antenna. You can manage it by increasing a size of antenna end or PCB size. But when you are going to design a large antenna on a stand-alone small board, this could be an issue as well because large antenna cannot be sufficiently mirrored in a small PCB ground plane. The mistake could be the adjustment of the size of the PCB board itself, which forms the ground for the antenna. This can have a very important consequence. Let's see what kind. So we reduced one dimension of the PCB by 20 mm. Next we will show what properties an antenna designed for a different PCB size will get. On contrary the case, with enough size of ground plane, this is about the reduction of ground plane. It is visible on resonance frequency that is going upwards now, but the written loss is becoming considerably worse in the desired band as same for larger ground plane. VSWR is on the wrong numbers so the antenna will redate badly. We are interested in the behavior of the antenna in the Bluetooth band where there is a significant reduction in efficiency. The antenna has almost lost the ability to radiate the delivered power. The results are the antenna is mismatched a lot so it has worse written loss. Low efficiency is present corresponding to some 20% of original value. The antenna must be placed on proper size of the board, otherwise it cannot radiate due to small so-called counterpoise. At first glance no changes are noticeable, perhaps only to blur the minimum in the characteristic. On closer view we can see a reduction in antenna directivity which we have not observed under any other external conditions. So definitely avoid this, as the matching network will no longer help the antenna. This is about small counterpoise which is the issue. The antenna pattern shape has changed a bit and antenna becomes more omnidirectional. But the antenna gain is very small so the radiation power will be very decreased. Thank you for watching the first part of the video focusing on general information and on metallic objects and environment. In the second part we are going to introduce you to the cases concerning dielectric and the human body effects on the antenna parameters. We will see you next time. Take care, bye.


What's going on everyone Sam here with late in sports cards ripping 2020 Bowman baseball HDA jumbo 4 box break number 10 random Team style there's a look again at your random results as always you can find those on the website under the results tab as well as the link in chat Good luck everybody again 10 box Tuesday baseball down to just 8 to go multi-year through the years Bowman mixer There's 2019 2018 Bowman chrome 2019 Bowman chrome 2020 Bowman jumbo 2020 Bowman draft super jumbo 20 2023 Bowman Hobby and jumbo as well as inception Bowman's best and first edition as well Think all cards shit. Can you just double check about all card ship on this? I think they do Nothing big there in box one Hold a red true true red Bobby wit last time I opened this Cody bellinger to you 499 sky blue paper Lou Bob so this will get right into dynasty everybody three scoob all Yeah, we'll be a bit behind You probably won't even see dynasty on the schedule, but we'll be able to get right into that Get through 10 box Tuesday once that does sell out and then make up a little bit of time There's Jason Dominguez paper on some Bowman or some Chinese New Year Revolution as well shouldn't take too too long To rip those and revolution PYT's as well gold shimmer of Thomas Diller to 50 for the Brewers nice one there Milwaukee. That's brew crew Milwaukee is Robert S. There you go Robert last spot mojo gold shimmer to 50 Bobby wit first He's in this In fact Volpe first paper Alvaro say us do 499 card is Dominguez first paper. I mean a chrome first chrome Dominguez Making easy for wander to 125 for the race till shimmer Adam Hill for the Brewers again base auto It's up Joshua Thank you guys again for selling out dynasty that is done and ready to be ripped after this I'll get the random type in pretty much as soon as we're done with this Get into that and then we'll get into 10 bucks Tuesday as well. Yeah, we'll be a bit behind Do apologize had to fill some breaks up that happens It's the name of the game right there To move some stuff around so we got another gold shimmer base now on regular Bowman mode just flying through the paper Can and Smith to 5 or to 50 to 50 gold shimmer for the Yankees Put your hands up with your hands up White speckle is grant little to 299 on the auto for the Padres Bobby wit first Volpe first chrome Robert plus all What'd you say Another 10 bucks Tuesday spot another 10 bucks Tuesday football spot as well down to just seven to go on 10 bucks Tuesday guys might drop Ten bucks Tuesday all teams in there are seven spots for baseball now, Bobby. What paper first? Volpe chrome first So the noisy there's Ian Anderson to 125 I Was looking at is like what am I going to explain to you another gold shimmer that is Lensy Delgado to 50 gold shimmer auto for the White Sox. There you go. Shy town Kyle Lewis rookie scoobal shirt to the hostel Me and Jake were laughing about that on Xbox to 250 about that individual And he goes I don't think I've ever seen anybody as bad as that guy That's classic too That's classic. Gerard incarnacion to 299. I see coach here. I know it looks good, honestly I Think it's better better with the haircut. Oh, yeah. There's Micah bail For the brewers killing it right now. There you go. Milwaukee. Robert asked for that last spot mojo Robert Let's go Robert Do I'm tweeting that too? For both Next box Yeah, I'm sorry. We'll be a bit behind guys. I do apologize I had to get some breaks had to move some stuff around get some breaks filled up So most likely end the stream a little bit behind tonight. Bobby witt Scott a with Two in each of the other ten box Tuesdays plus three teams and pyt so thank you there scott Appreciate you buddy Scott a on that one. Thank you scott. You're the man. You are the man. Appreciate that very much I think you bring your shirts in To make us first. I still think it was funny at the show You remember that? Yeah We got all for the shirts too. Jason to make us first. My shirts We got it in my car in the hamper Not clean. No, I'm good Uh, Bobby Bradley rookie auto for the guardians. Nice one there. Cleveland Guttians, Joe Adele Jeremy Pena first chrome first Pena the break Volpe first paper When Allen Hill dirt's an apostle Firsts, yeah, no notable first Yeah, I'll stop on all the the big four the Volpe's the Pena's the Dominguez and the wits But other than that we'll kind of just breeze through the paper It's the only reason I'm even not like even taking time on the papers because of those guys All right box three now everybody. Thanks again For getting this filled up And 10 box Tuesday still with some spots available That's what we need to fill up next Some pyt spots still available as well over in revolution six down to six Awesome. Thank you guys Six to go on 10 box Tuesday That would have been a pyt spot Jake d taking a spot. Thank you, Jake Jake Bobby Whitt first paper cool whip I think so much emphasis on the H I was putting so much emphasis on the H Classic candle guy quick Classic Weakle Horner's having a quietly really good year by the way too Robert Poisson True blue Ronaldo Hernandez the 150 Too fast too fast I mean like I said, I'm in the boom in mind state of just breezing through paper Uh, Jordan Groshan's to 499 Just completely I remember I did that on like a paper base when I came when lane was in here Joe Ryan Nice one there for the race first the 499 Lane's like you could do it on an auto. Why do you have to do that out of base paper? I gotta know that we just pulled Robert Poisson I want I want the neighbors to know that we pulled the Robert Poisson Oh, they know. Oh, I know they know. They know they know because of me, right? I mean, that's why I said I made sure made sure they know I hope they catch you outside How about that Karen Duran Jeremy paying you first See if Boston get one at home tonight That's right.  I wasn't expecting that one. That's cool facing Dominguez first paper Anthony Volpe first paper virus task camera into 150 Blue paper Just two of us George springer to 499 sky blue paper I forgot to I think I told you this I might have told Donnie's or you were Donnie But we were doing the 10k sir like I brought it up I like Brought it up the lane beforehand we were laughing at it and lane was like helping me rip And just like randomly like four hours into the break lane said something about like shirts. I started dying dude there's Eric Rivera base auto for the uh angel stop timmy timmy Wilfred or uh, yeah, Wilfred Acidio I'll do it for that box Our 10 bucks Tuesday spots coming in another baseball another baseball Another football as well as well as some more pyc's what's 10 bucks Tuesday out now four to go guys four left What's up, Jonathan? Jonathan, how you doing buddy? Four to go on 10 box Tuesday That means our next three breaks will be sold out once 10 box Tuesday sells out dynasty is full First revolution Chinese New Year is full Got a bunch coming in for pyc teams are on sale and revolution as well If you guys would like to take a look True blue Andy Paz first wow to 150 for the Dodgers very nice Congrats on that LA I have Sean put a dust cloth to this one really quick One of the uh, I forgot he was in this jeez, dude It's actually pretty big Bobby witt the good or no it is Get that into a mag for you There was that part of the card I can't tell No, I think it's part of the card Oh, I wiped off some of the I want to go to the beach and watch seagulls What was that? Blue Bob's a $4.99. Yeah, really nice pot heads there Jason Dominguez Yeah, pretty good four boxes actually Two gold shimmer autos and a pretty big prospect All right, so that's like two hours in that stupid line Quiet Diaz Bell arise first for the Rangers nice one there All right 10 box Tuesday baseball down to three three to go everybody again. We'll be able to make up a little bit of time once that Fills up as well And we are going to be behind probably going into And Andrew the other Andrew taking a bowman that's down to uh, two I believe now two think it's a two now This it is two to go on bowman 10 box Tuesday, you will not want to miss it Bunch of years of bowman in it It's a pretty uh, pretty sweet pretty nifty mixture. That's me nifty nifty You're nifty. Thank you Dominguez paper first My shoes around his neck Just surrounded by some interesting I was quite the squad right there Yeah Yeah, you went on a bus Yeah, not back Refractor Joey Cantillo to 499 for the uh, Padres on the first Volpe and refractor Bryson Stott to 499 for the Phillies and another basketball at 10 box Tuesday spot came in. They're Craig Craig a Volpe first paper Who would you say right now would be leader of steamer of the month? Any new additions You got Matt Matt's new addition. Yeah steamer. Yeah true after he forgot to text you Yeah, that's true. So that might have knocked him way out there You might be on the top. Yeah Atomic is chris paddock to 150 gold paper is on Diaz rookie to 50 Wait, so he's just pure what?  Love it, dude. Grats on that. We'll get that mag for you. Congrats. Yanks. Do a quick recap here as well Great little bulky action there. It autos Joey Cantillo Diaz Bella Reyes, Eric Rivera Joe Ryan, Bobby Bradley, Micah Bale, Adam Hill Grant Little, uh Thomas Dillard, uh, Kenny Or Lindsey Delgado, Andrew Vaughn to 30. We have the Andy Pahes true blue to 150 And Anthony Volpe to 125. That'll do it for the break guys. Thanks again for the fill up next dynasty. It's not


So, collaborative package maintenance with SourceGit. Welcome, everyone. Before we start, blank screen, I have four questions for you. Who of the audience is actually maintaining a package in federal, center stream, rail, somewhere? Quite a lot of people. Good. Who of these people who are maintaining packages are actually doing with someone else? Like, they are not the only maintainers, and they have an active relationship with someone else maintaining the package. OK. A few of them. A little bit redundant question. Who knows what the DisGit is? A few people, OK. And the most important question, who has any idea what SourceGit is? Wow. Why are you here? OK. I'm going to start then to talk about DisGit a little bit. And DisGit is basically the place where sources are stored in all the distributions in the rail ecosystem, meaning federal, Linux, center stream, rail, and so on. And basically, the structure of DisGit is something like this. There is a Git repository with some files in it. These files are like spec files, patch files, if there are any downstream patches. Some other files, like the ones used for testing, gating, YAML, and all these nice things. And then there is this special file called Sources, which is actually just a pointer in the Lukasite cache, which is going to store the source archive, going to be retrieved during build, and apply the patches, and so on, and so on. And this structure is then populated in some way from the upstream projects. I don't know. Some people are going to produce the source archive directly from the Git repository. Other projects are going to fetch it, like the official release storeables from whatever website they want. And then the current developer workflow is that maintenance downstream happens in DisGit. But this is a little bit weird, when somebody joins Fedora and wants to start maintaining, it's like, OK, why do I have to do this way? Why do we need to work with patch files, and not like regular Git commits? And why do we need these source archives in the Lukasite cache? And you have to learn all these to be able to do downstream maintenance in these distributions. And whenever I ask these questions, I get the answer well, historical reasons. And actually, this January, I will share this nice quote from an email from Jesse Keating said in 2010 when Fedora 14 branching and DisGit rollout happened previously. There was such a thing that was called DIST CVS. So the text says that, of course, this is just the first iteration to transition out from the old version control system. But we have great plans, like automatic patch management with exploded sources, linking to upstream source repositories, automatic change log from Git change logs, and things like that. And yes, 22 Fedora releases later, source Git still wants to do exactly the same thing. So what is actually source Git? Sometimes, a lot of people raise their hands. Can somebody help me and give an explanation to the others? Volunteers? No, no, no, no, no. Didn't prepare for that? Oh, OK, then I think I lost this game. OK, source Git is just like a regular fork of the upstream project. It's nothing fancy. Source Git tries to use Git as it was meant by Linux, meaning doing changes in Git commits instead of patches. And if you need something downstream, you just create a branch for it and use it. And the way my team, the packet team, visions source Git to work is really just an add-on on top of this Git, which gets into the middle between upstream projects and this Git. And then everything becomes, or the maintenance work could happen in source Git. And you can use proper Git to work with your downstream packages. You just pull from upstream whatever change you have. You do it in your branches. And then the transformation to this Git can be done by bots. And hopefully no future maintainer will need to actually learn it how to do that. So source Git is really just Git. But we have to put that source there because we have this Git, and so we need some kind of differentiation. Another important thing to say is that when we are discussing source Git, some people think that this is going to be required and everyone is going to need to use it, well, no. We know that there are some kind of, it doesn't make sense for everyone, for example. So we want to make it an add-on. It doesn't make sense for packages which don't have downstream patches, which are, I think, the majority of packages in federal Linux, at least. But when you get to center stream where you have long living versions throughout the life cycle of the distribution, you start having more and more packages which need to carry downstream patches and rebase them periodically. And in these cases, working in proper Git and reviewing actual pull requests, for example, instead of reviewing a pull request with a patch file, it should be much easier. Workflow. The workflow we try to develop and propose for source Git is nothing new. Many teams already do this. Like pretty much all the teams who were present here in the first panel system, the weird kernel, are all doing this already. They simply fork their upstream projects and they are doing their work in downstream branches. The only difference is, our goal is to come up with a unified workflow, one which could be adopted by any package, and basically you don't have to develop your own solution for the same problem. And the overall workflow is really just simple. Work in downstream branches, open MRs or PRs for your changes, merge them, and everything is taken care in the background by bots. Tooling. The tooling really has two layers. One is the CLI, which I like to think about it as the backup layer. Because we try to do automation for it as bots, bots can fail. I mean, those are also applications. Infrastructure can fail. Things can go wrong. We need a backup plan. And that actually comes from kind of the philosophy of our group, which is the cyber group, where we say that bots are first class citizens. They can do the same things as engineers can do. And an engineer can take over a bot's job whenever they want. If the bot fails, somebody can step in. A human can step in. And they can do it. So we developed, like we have the CLI, which is the basis of all the source gate workflow, and which could be used by anyone to do all the operations that the bots would do themselves. And if I can find a window, OK, this is going to be true. So here is a short demo of the whole CLI is packed into the packet command. And because in packet, packet is really an upstream tool, and source gate is more like downstream, there was a confusion in our users, like, OK, which commands are for what. So we started grouping everything under packet source gate. And currently, there are really just four sub commands, one in it, which is a helper to initialize a source gate repository, a status, which can tell the sync status between a source gate repo and a disk gate repo, whether they are in sync. And then there are the two update commands, which can transfer content from a source gate repo to disk gate repo or the other way around. And so let's see how this would work. To set up a source gate repo, you just really need to take, clone the upstream and clone the downstream disk gate repository. So this is the disk gate repo. You can see that this one, I like ACL because it has a single downstream patch. It's not too much, but it's just enough. So I use this always as an example. So this one has a patch file, has some other files for checking signatures, has the sources file, has a test directory. So this is in disk gate. And then we can get also the upstream sources. Basically, locally, when working, I like to use this convention of cloning disk gate into rpm slash package name, and then the upstream sources into src slash package name, and then just work with these directories. So once we have this, we have to figure it out which is the version, which is released in Fedora. Now I'm looking at Rohite. So that's version 2.3.1. And once I found it, it's possible to compose this source gate init command, which is just taking three parameters. One is which is the git graph from which you are going to initialize your source gate repo, actually. To be more correct, it's a source gate branch. And then directory where you can find upstream sources, branch on which to initialize the source gate branch, or source gate repo, and the same in disk gate. And this on the background is going to just run the prep section of your spec file, create a git repo from it. And in this branch, you can see that there's going to be a coin with some initialization. And there is going to be the patch as a git commit. Now here, we are using some git trailers for backwards compatibility, so that when we are transforming back to this git, we can actually reproduce the same patch file name as you were using before. Or we can add those comments above the patch lines in the spec file, which say why you are carrying these downstream patches, and so on. But obviously, if you leave them out, they are going to be just some sane defaults. Okay, let's do some, if we do some update in the source gate repo, sorry, forgot my own demo. So one directory added in the source gate repo is the .distro one. This is going to collect all the files from disk gate, plus it's going to add a source gate YAML configuration, which should help tooling figure it out how to do these transformations from one format to other. This is a lot of text, but actually most of this, it's default, it should be the same for each package. So with time, that's just going to be much shorter. Doing an update downstream is just like modifying the file. You don't need to generate a patch.  And once you have your commit there, you can just run, you can check the status that now these are out of sync and can tell which commit you need to sync, and then you can use the update disk command to sync, which is going to be going to update the disk repository, and also going to add your patch file in the spec file correctly. We also have a backward command for the case, because program packages most of the time are going to do their changes in disk gate, and we want to get back these changes into source gate. So we have the update source gate command, which is going to get changes from this gate back to source gate. I'm going to step this. OK. And back to the CLI. Another part of the tooling is going to be bought. We have a few of them deployed already in GitLab, namely in the center stream SRC namespace and Fedora SRC namespace. These bots, for now, the only thing they do whenever you open a source gate PR, they are going to mirror it in disk gate and then take all the CI results that is published by CI in disk gate and bring it back to source gate so that it's visible for you. It's a little bit redundant, but it basically comes from the fact that source gate is just an add-on on top of disk gate. But on the long run, we would like to have a nice user experience so that you don't have to touch disk gate, you just do all your work in source gate. Packet, we have source gate, because we also get this question a lot. The whole source gate workflow is building on top of packet, as you've seen. The main difference is the packet's main use case is to have upstream developers test their changes downstream while source gate specifically focuses on downstream maintainers. And of course, many things are common, but the use case is different, so priorities and functionality might differ. What is next? Monorepo support, this is already research and implementation should start soon. This is going to let packages where the upstream projects holds multiple packages. It's packaged into multiple packages downstream or maps into multiple disk gate repos to handle this. This is going to be fun. Handling new versions, which is basically rebasing. What do you do when your upstream release is something new? We've seen in teams who are using source gate already that there are many, many ways of doing this, from rebasing to merging. So we are still exploring these ways, and we need to figure it out how this is going to make sense for most of the people.  The workflow here is not really clear. We had multiple discussions with teams. Some would like tooling to first merge the disk gate ones so that they are sure that everything works. Other teams would like to just cancel all the PR and pick the commits and push into branches. So yeah, this is still under exploration. If you want to get in touch, please get in touch if you have questions. And documentation is unpacked at .dev slash source gate, and you can reach us or me on matrix, if you would like to. Yes, Tomas. So the question is, what if there is one disk gate repository and there are two sources? Those are two upstream gate repositories. So one for the application and one for the test. That's a good question. I haven't seen such a package. Which is this? OK. I would definitely like to think about it. Honestly, I didn't know that there is such a thing. But yeah, it makes sense. And they are pulled into one disk gate and released as one package downstream. This is why these sessions are good. You always find them. Yes, please. So the question was, how specific is for Fedora? There is a reason why we propose to use this .distro name for that directory. Like one of the reason was that we want to use in all rail distributions. Our implementation of this is very rail ecosystem Fedora specific. But I really see no reason why the same format with the right tooling developed could be used in other distributions. Actually, I know that Debian is doing something similar. And they are doing for a very long time. They also don't do for all the packages. But there are some packages which do this. Other questions? Yes, please. So the question is, how are rebases done with source gate? Source gate, yes. As I said at the end, we are not sure yet. We have a proposal for doing. So the main problem is that in this gate, right, you cannot force push to branches. Now when you do a rebase, you would need to force push. So that's a challenge. We have a proposal for source gate of actually allowing to force push some branches, but still making sure to be able to track back past history, like from where the rebase happened. Because this would help especially to give some tooling for developers when they pull from source gate to their local clones. And suddenly they notice that the branch on which they were building was rebased. So it would be nice to have some tooling to help developers to easily get out from these situations. It's not impossible to get out of the situation, but people should know. And it would be better to have some tooling. So we have a proposal for rebases. But we also know from Kernel team, for example, and if there's someone here from Kernel, they can chime in that they are sometimes doing just merges and don't rebase. They just merge new versions into downstream benches. We are still exploring what's the better solution, whether we should support both of these, should be customizable, we don't know yet.


Tessall Leipzig ITTT's Tessall course in Germany is based in the city of Leipzig in the state of Saxony. Leipzig was once an important trading center in Europe and has a long and interesting history dating back to the Holy Roman Empire. Today the city has grown to become an important economic center once again and is also an important cultural hub. Leipzig music plays a vital role in the life of the city and you can hear world-class musicians play at the Juandos Concert Hall. The Ober Leipzig is one of the most famous opera houses in Germany and one of the oldest in Europe. Bach worked in Leipzig for several years and his life here is documented at the Bach Arch of Leipzig. Tests are catered for in the clubs of the sub-first-out area and in May each year, Leipzig hosts the largest wave and gothic festival in Europe. Outside of the city you can head to the lakes to the south where people enjoy walking, jogging and cycling and generally soaking up the sun in the summer. Winter weekends can be spent at the mountains which are just a couple of hours away to the south by bus. Whether you are looking to enjoy modern urban culture, experience world-class classical music or explore the fascinating history of a city that once lay behind the iron curtain, Leipzig has something to offer you.