It's just above. So I have not really preferred slides. I will sit down. I will relax. I will show you the red lines where I was traveling around the world for DVMid and similar things. So if you want to have a kind of travel, just join us. It's fun. So what about the buff? Well, I just want to show you who is in the team. And maybe we start. What's your interest? Why are you sitting in this buff? Are you working in the field of medicine or biology? Just start. Take the microphone or so. Or you are just looking for some chair in the shadow, right? Some entertainment or so. Looks like I will just talk now. I mean, I don't work in this field. I study medical computer science and therefore I have some interest in this area. I mean, the moment I don't do that much in this area, but I have quite an interest because I mean, otherwise I wouldn't have started studying it. I think it's also nice. So I think it's interesting for me to see what's going on and maybe help to be able for people working in this area that they are able to use free software, maybe use Debian. I mean, so yeah, that's my interest here. Yeah. Okay. Somebody else who wants to explain why he's here? No. Just curious. Okay. And that's nice that you are coming. He is interested in Davychem team. Well, basically, Davychem is doing similar things like Debian Made. Debian Made is packaging medical and biology software and they are packaging chemistry software. And if we are not aware what Debian Made is all about, then I possibly should start differently. But to stick to my slides, we have some people who have some interest for various reasons to build packages from biology and medical packages. Biology is included because it's microbiology is quite used in medicine. And actually, there is some free software to manage a medical practice or manage a hospital. There's also software, but not that much. And we have to fight hard to get this. And in biology, the targets are mostly easier to tackle. And these people who are in the team, we are even more, but these are the top 10 people who are, for instance, uploading packages. Started in 2002, there are some packages even uploaded in 2001, which are by chance in Debian. And you see there is some kind of five years, not so much happen. And then something happened. We met, we met in, I just said this in the other talk. We met together face to face and people are joining the team because they think it's interesting to meet to do some common things. The same effect is on the mailing list here. The interesting thing is that we have also very active upstream. For instance, a third frequent poster on our mailing list is a doctor, medical doctor who is working on a GNU made package. It's a practice management program. And his brother is also quite active. So these people are working on some software. So this Debian made user list is the connection between users and developers. And Debian made is all about connecting users and developers. We try to make the missing link between both because I had the impression that users are taking Debian usually as a full-grown product, which can't be changed. Download DVD or whatever or download the packages from internet and use it. And no, it's not really that way. Free Software is all about doing something, enhancing it. And so this team, Debian mid team, is trying to help people working in medical care and biology research. So this is on our mailing list. And we have a developer mailing list, which is for the development of packages, not so much about the users, to not scare away the users with technical stuff. We have also some statistics about who is hunting bugs in Debian mid. You also see some active people. Also, since we met in 2011, we had some increase. And this is about the commits in the version control system using Git and S4n. So we have also some people who are regularly posting here. And here you see some overview about so-called tasks. Any blend is divided in task or organized in task. We have here packages which are working for biology research. You see about 120 to 140 packages all to solve problems in biology research. I think that is kind of a lot. I don't know any distribution which has more than we have. And we have also a section to develop biological applications. This is also some interesting thing. We have some support for epidemiologists. There are quite a few of packages. We have also a lot of packages for medical imaging. So if you know something about these dichom images and solve this is a keyboard. And you can, we have some dichom fuel, something to analyze the software. And we have also software to develop medical imaging applications. And medical practice, we have some packages. So actually, if people hear the term debian made, they assume, well, this is some software to run my practice. Well, no, it's not. It contains some software to run your practice and besides a lot of other stuff. We have also, or what I also want to say, if you are new to debian made, I do not have the opinion that a medical doctor should just fetch the debian distribution, install, for instance, GNU made and run his practice on this. This is technically possible. But I do not really want to make the doctor fix his computer, but he should fix me. And so he should not be distracted by his computer. But the way I see debian made is to give some as best as possible preparation for some service company. So they could install on the doctor's computer and they are responsible. They get money for it. They get really money. And we are providing all the stuff they need. We would be happy if they would send some money back to debian. This would be okay. But otherwise we are doing free software. Yes, the question? Not that I'm aware of. I would like to, but I'm not aware of free to start a company. Yeah. Yeah, it's, it's there. Okay. Then there is something in cytology. We have some, some team in debian, which is a small team, but very efficient team. It's called neuro debian. They have their own website. And so in principle, you could also call neuro debian a blend. And we, I'm working on it to, to take them over to, to use our framework. And so, because it's quite easy to apply this. And they could organize way better and have a lot of profits. And we have some tools, I say, for health care use. There are some, some software like quit count, if you want to stop smoking or so. And something, yeah, work, work rave. If you work too much on your computer, it pops up every 45 minutes to say, no, you make a break and do some exercises also. Something which is, yes, also something connected to health. But yeah, and we all do this categorizing. It is not necessary that, that we all maintain the packages. For instance, in, in biology, there's a lot of stuff which is cross connected to the chemist. And we just organize the packages. So we are not a packaging team. We are just categorizing stuff. And we also package, but this is not the main points. The main point is that we try to enable the user to easily pick the software he is seeking for. This is basically, well, this is just, these are just my slides. And I can show you what we have for packages, because this is kind of good overview. I had this just in the other talk. We have, well, this is a German locale. I can change my browser to, to the French, but I just want to show you that it's localized. You do not need to understand the description. We have just, as I show you in the graph, biology, biology development, imaging and so on. And we could go, for instance, into, into imaging. And you see, there are some, some packages with their package descriptions with screenshots. You can mouse over the screenshot and you see it. And the, the description is translated. You have the information. How many users are using it? You see there's a new upstream version. So there's some work to do. And actually, this is what, what I wanted to do also with you in the workshop. How can I find tasks to do in our team? We really want you to do something. It's not just about hearing. Well, this is German fix the translation. If you see the translation is wrong, you could fix it and just click on it. But unfortunately, this server is currently not running. We just talked about this. So the idea is users who are visiting this page are most probably experts in medical imaging. I don't understand this. I can't really translate it correctly on the, the other specific field. But people who are visiting this page have a good chance to, to really are good translators. Or if there's missing a screenshot missing, you can click on it and you can upload it. And it's, it, it goes all into the official service of Debian screenshots.debian.net. You go there and you find the place to upload the screenshot. And we are also quite happy that we have these citations. We have frequently packages which are done by scientists and scientists are happy if they are quoted. And so they see, oh, if I get my package into Debian, I get another hit for my quotation. That's nice. So I try to get my package into Debian until we are doing it. That's why the way we, we are trying to build the bridge between users, upstream developers, and this is an important point. So here you can translate. This is not just translated. Just you can translate. So this is the way we organize our work. And we have also something which is not yet ready. We have some preparation in Git, right, or in SVN or whatever. What I'm doing is I'm checking the version control system of different teams. Not only Debian Meet, also Debian Jam, whatever. And trying to get all the machine readable information. So we have information here which is not even in Debian, but it's there. And so if somebody comes and says, well, what can I do? This is your work you can do. This is your to-do list. And this is available for all blends. It is for Debian, Debian, Edu, Debian games. And so you can use it. I'm frequently asked about DevTex because DevTex is another way inside Debian to categorize packages. This is a good technique. And we are trying to use it inside this framework. The problem is DevTex works only on existing packages. And these packages do not yet exist. So we can do some more. We are not competing with DevTex, but we try to integrate and add some additional features. So I think either you have questions or we just start finding a target and start packaging it if you want me to do this. And then you see how to work with this framework. But I would love to see some more questions from you or people who are becoming late. What's your interest in showing up here? Any questions? I have tried experimentally to find the packages related to Debian Med, to Debian Cam, and to NeuroDebian. Because you mentioned that there should be tasks for each of these. Actually there should be for each blend and also for NeuroDebian probably there should be more than one task. And I could find the Debian Cam and I could find those for NeuroDebian. Actually those for NeuroDebian are within science, Debian science or something. But I couldn't find those for Debian Med. Can I have a look what you mean? Because I'm not really sure. So what I do is going to package search and search by keyword. Debian Cam works, Neuro something works, but Debian Med doesn't work. There is a source package I can show you. There is a Debian Med source package. There is a source package which is divided into several, I shouldn't make it larger, right? The source package Debian Med is divided and Med package is made bio, made bio-dev. This is a development part. Med data, Med dental, Med pharmacy and so on. This is what you get. I think the Debian, the Debian packages are also the binary packages are starting with Debian and the Debian Med are just the prefix made, well, okay, maybe. This is actually not really the way we should advertise it, but you are right. This might be different. In Debian Edu has education prefix and Debian Science has a science prefix. I'm a friend of not so much typing, so Debian is under the beginning and so Med seems to me, well, okay. This is answering the question. Another question. What do we want to do? We could do, this is actually not really a Debian Med package. It is not teammate, but we can check on the, go on top here. What common packages we have in Debian Med and Debian. This is easy. It's only in the biology task. Yes, it's me again. Okay. I didn't see how you found, how you find the list of to-dos and also how do you find the list of to-dos for Debian and for other plans? There is no common to-do list. I just want to show, I come back to your finding to-do list. I'm just seeking here for Debian and you see the packages are maintained. This is Gamgee, General Atomistic Modeling Graphic Interface. Some packages which we are listing on our biology section are maintained by the Debian Med team. There is no conflict in different packaging teams because one package might be very interesting for biologists and for chemists as well with a different perspective. You have several things there. You have statistics packages which are relevant for several sciences, but also for our target user group. Here you can see the common things, but this is finally not so interesting for the user. Regarding the to-do list, everything what is marked in yellow, right? On this page you have a lot of yellow things. Upload screenshot. Upload screenshot. I've done a lot of work at Debian and to Debian conference. We had some several new version available problems here. They are gone since I'm here. Here we have a new upstream and we can look. This is package, right? You can see upstream has version 1.28 and there's new upstream version. This is by clicking on the yellow button you find the work to do. Then we can go download the source. This is most probably pretty easy. I'm just uploaded. I recently uploaded this package and just some simple uploads. We have also done a lot of stuff. Before I went to Debian conference, a lot of yellow stuff. Go tagging. You can go to DevTags and I also made it here in Enrigo's talk and made the DevTags. Oops, not found. Didn't it found? Go tagging. You see in this DevTags interface, this is just tagged. The reason why it's yellow on the web page is that DevTags are manual processed. I put this DevTags on Monday also and it's not just processed. This is only not true for all the things. If you want to do some DevTagging, you find your work here. Uploading screenshots is always possible. Sometimes these applications are commander and applications. It's hard to find a reason with screenshot, but other times not. Then we have here a new upstream version, new upstream for DSP package. This is some internal knowledge because Laszlo Kajan is upstream and I will not touch his upstream version. He will do it himself. This is no work I will do now. This is some interesting thing. Ambos is a large beast and we are lagging two minor versions behind. We are lagging one version behind because there was a Debian release when we did not touch it. Now it's time to tackle this one. I'm not really the main Ambos package, but the other person, Charles Plessy, has some kind of time constraints now. It's probably my thing and I hope to get it done at DevConf maybe in the weeks later. This is the usual QA work you can do, and then we have on the left side, it's a little bit hard to distinguish this color. This is green. Here we have Debian packages in experimental. Here we have Debian packages in new. I'm also checking the new queue. These packages are uploaded to new. There's not anything needed to be done because it's just waiting. The next section is we have some inofficial packages or we have something in VCS. Wait a moment. This small screen is not that comfortable. The information is obtained automatically from the version control system because I'm checking the team, the version control system from the relevant teams, from Debian Edo, Debian Giz, and so on. All the information is read into ultimate Debian database. Now we can display this information and if you see something which you are interested in, just find the relevant code and finalize the package. There can be different reasons why the package is not yet finished. There are also examples where there are inofficial Debian packages. Maybe I find one. To do this, it's quite long. Here's one from Ensembler. There is an inofficial package. You can click on it and find on the upstream page the package which you can install with varying, yes, user experience, I don't know. But if you want to package it, it might be a good start to look at what these upstream developers did and perhaps enhance it, fix it, or just upload it if it's okay. Some more questions? The description for uploaded packages come from the packages file or it's a separate database. No, okay. Yes, we are using all the information which is automatically available. So a person contributing to Debian that met also improved the translation for all the users. Yes, we are always using the Debian infrastructure and nothing in between or in parallel. This would be crazy. We started with, in 2002, when I started with Debian Meet, I started with manually written web pages on www.debian.org. And this definitely does not scale. And then some people got the idea to put it on the wiki because the wiki is always up to date, at least in theory. But if only one person cares for one wiki page, it isn't. And so I came up with this automatic update mechanism. It is basically on the very same information as you are creating the meta packages. The meta packages are created from so-called task files. It says depends package one, package two, package three, full bar. And then you get the meta package rendered and also these web pages from the very same information. So what you are doing to create meta packages, these web pages, or I can also show you the bug pages. You have also pages about bugs. What you are doing is just to fill in this very, very simple control file, similar shaped file, and then you get all the information. So the idea behind the bugs page is also easy. If I'm biologist or whatever chemist, I want to fix some bug. I go to the package where all what I'm interested in is assembled, and this is actually here. And this is also from the same, very same database, which is carrying the information about the task. Some color scheme is applied here. So we should fix the red ones first and then the yellow ones and so on. Any other questions? We have just 12 minutes left, I think. Is there a view about the translator? Following the countries says there is how many translators for this country? Can you say it again? I have not understood. Is there a view to follow how many translators there is by country? Well, we had this view, and this view is possibly a good way to make some competition between countries to push people to translate. But this view is not working anymore. I would like to get it again, but it's currently not existing, and it's not so high on my priority list, but I think we should get it again to say, well, French people are the best, or so like this. Yeah, it's competition is something you need some motivation for people working for free software, right? And this kind of competition could provide a little bit to competition, right? I think the Italians were quite good and Germans also good. Yeah. But and there are some fields where the Portuguese translators from Brazil put some effort in, but I'm not really informed, and we had this list of packages with tick marks and the flex and so but it's, I put it a little bit higher on my to-do list because you ask, okay? So some other questions? Yeah, I'd be happy about questions. Sure. Come on. Okay. I'm very confused. There is Alliot. Yes. Alliot looks like a collaboration platform based on FusionForge. Devian Med has a page on Alliot and they became two, but then from that, call it Alliot homepage, there is a link to the homepage of the project. For they became the link to the homepage of the project points to nothing. Yes. For Devian Med, it points to a wiki page. I don't see how I get to the actual project page that you have been showing us. Okay. And I wonder if there is one such for they became because I haven't found it. Yes. Well, if you Google for Devian Med, you get to the official www.devian.org site and yeah. Well, this is what you get when you the first hit when you Google for it, right? And there is a link to the task page. It is in full text. Every enhancement everybody's here in the room who tries to see can he thinks you can do it better. Please do it, right? And the second link is Devian Med wiki. It is possibly also on this homepage. We do not even have an official logo. This is a kind of suggestions. We are lacking of manpower. Please make better. We are very happy. And it seems I don't I don't can't speak for the devian devicam team that the devicam team is lacking even more of manpower.  We really need people who help us the documentation right. So this also on this wiki page, you find your way to the task pages. They are there. Right. Yes. This is definitely some point. I'm always working with these task pages because it answers the question if my mother asking me what are you doing. Look, this is a lot of stuff. Or if my colleagues are asking me, I'm working on a medical institute and I'm using some of this software we have, but they don't realize because they are users of this different operating system where every software is installed by some magic and whatever. And when my colleagues say, well, this package or this program does not work under my operating system, I say, well, I had a suggestion for you, just use this one. But it takes some time until this is approached. Actually, my motivation to run devian meet was once my institute might decide to use free software, I want to be able to present a ready system. And I think from my point of view, I'm there. We have something which is really, really usable in my environment, but they did not yet decided to use it. We have some more years left to become even better. More questions, more criticism points we could do better. If you're interested, just subscribe to the mailing list. I hope we have interesting topics for you. We have also some training program, how you can learn packaging, which I just was talking when I came here, this mentoring of the months. So if you want to learn packaging, pick an example from our task page, which is not yet done or find a bug or something like this. And I will teach you for one month how to do packaging. This is your chance. Maybe if you are connected to the David Shem team, well, you don't need to be an official student of this mentoring of months, things to get some help on our mailing list, right? If you have a problem, we try to solve it for you. And just don't be shy and ask what you want to know. But this is kind of a formalism we put on it. I would have loved to see some more real members of the team, which are what means members of the team, people who are just uploading or working together, but they are not here at Debian Conference. Actually, the Debian Made Project is a very small leaf project inside the Debian Universe because there is a small common set between medicine and free software. And we are just trying to cover this one. So we have a very branch or leaf project. And we only can survive because Debian exists and we only can survive because we are caring for a lot of people in our team and because we are caring for the technique, which is used also by others. So this is the main strategy.  So it should also cover medicine, biology, and other fields. It's lacking a little bit on this last part, the other fields, because they are not that much provided. Chemistry is quite good. We have a Debian science, which is kind of an umbrella over mathematics, physics, electronics, astronomics. And so these could be all covered a little bit better. So if you are just stumbling by and coming from a different field, maybe Debian science is something for you. And maybe we could make also more focus on some certain sciences, which is quite interesting, but it's also work. If you are afraid of work, then it's not really for you. So three or four minutes left. Other questions. I can also stop talking if I'm boring you. It's fine. By the way, I just asked about the translation server. It's not yet running. He just wanted to do some translation for us and was stumbling about the fact that it's this effect I will show you. Just manage correct or fix the translation. We try to do it and the network is weak, but it's not working anyway.   But we are losing translators. It's not normal. It's somebody who had contact five weeks ago or so. And he is patient waiting, coming to DevCon, trying to learn something, but other people just will go away. If I try three times to translate something and it doesn't work, I will never try again.  Well, I think we should stop here. It's okay. Thank you.


President of Ukraine, you know, Steve. Good afternoon, your Majesty. Thank you for being here on this occasion. Thank you so much. Great honor to be here. Thank you for finding time for me. Well, we've all been worried about you, thinking about your country for so long, I can't tell you. Thank you. Thank you so much. Anyway, here you've had to address both houses of palm, I understand, is there? Yeah, I'm what they are so, so big support. Thank you so much. I'm so glad. Anyway, come and have a seat here. President of Ukraine, you know, Steve. Good afternoon, your Majesty. Good afternoon, your Majesty. Thank you for being here on this occasion. Thank you so much. Great honor to be here. Thank you for finding time for me. Well, we've all been worried about you, thinking about your country for so long, I can't tell you. Thank you. Thank you so much. Well, here you've had to address both houses of palm, I understand, is there? Yeah, I'm what they are so, so big support. Thank you so much. Wonderful. I'm so glad. Anyway, come and have a seat here.


Just to give a short background, it has already been mentioned. Own of Africa really at the center of the impacts of climate change, the intensity in droughts, the impacts that it has on human life and livestock has already been mentioned. But the thing that we also cognizant about and that informs our work is the fact that the thinking that drives response and resilience heavily borrows from perception that pastoralists are in essence vulnerable because of the practice of pastoralism, which is from experiences and research, not actually the right perspective. Indeed, pastoralism is in itself an adaptive response to that environment. So of course, we see recent shifts in thinking, and we could see that policies at various levels have also adopted the new shift, and also a lot of programs, resources have gone into addressing drought. But still we see massive challenge when drought again happens, and it brings back the question again, what is it that we are missing out? Are there opportunities that we are missing out, particularly now from our focus for this particular project, in terms of engaging the community-related actions? And for this particular project, we premise our understanding of the issues that actually pastoralists themselves have wide network of knowledge systems. They have critical resources that support them, and these are all central to resilience building. And we have seen, I think you have all seen that pastoralists have varied ways of responding, you know, keeping their hands mobile, sharing, you know, resources, learning of livestock in times of difficulties, name it, and also feeding livestock in times of stress. But at the same time, you could see that not all these things work. But one thing that we recognize is that there's a sense of high reliability management that at the center of all these, there are networks that are skilled that take actions that avert prices. And this already here, as mentioned, is akin to other infrastructure projects, for example, like running, for example, electricity grids. There's network or high reliability professionals who run, and we assume now that that is what pastoralism also run upon. In terms of our proposed research now for this particular project, then we say towards understanding these issues, there is need now to undertake comprehensive documentation of these, you know, locally employed pastoralist practices. And also this accompanied by what are some of the actions and the efficacy of these actions and how these actions are socially differentiated, as well as know by the different shocks and even different, in the different contexts. So the outcome that we expect from all of this is to deliver sort of a grounded, you know, locally relevant perspective on the opportunities that are there for building resilience and climate adaptation which are linked to, you know, the pastoralist own reliability management practices. That is the main essence of things. And of course, the locally generated approach to reliability and management and resilience building will also be contrasted with the various projects and programs that have been taking place. How has been the linkage between what the communities do and what has been happening in terms of response by various actors in this. And the overarching goal is how can we in French rethinking of resilience from community level and linking with other stakeholders in academia, you know, in practice and policy.  So as already been mentioned, the policy environment is critical bringing all we are talking about together. So it is quite important to establish policy disconnect that are there that exists. And then look at also what opportunities are there within the existing policy. And move forward in terms of looking at how then resilience from the perspectives of pastoralist themselves can be infused into policy landscape. And secondly, we need to have of course, continuous collaboration. Such a forum is just the starting point. There's need for engagement much more even after this, such that this integration of, you know, the local actions can be central in resilience building. And of course, my colleagues who will come will talk about early actions as well, which follows the same thread. And definitely with all this, we have to pitch it again within, you know, government at different levels in the Kenyan context from the county to national levels and of course the regional because policies are all these levels do affect implementation as well as also taking advantage of international forum such as the one upcoming the international year for rangelands and pastoralism. Therefore having you here really underscores the significance, you know, of this forum. And it's a pleasure for us to keep in touch with you to see in what small ways can we enable and build resilience from today. So thank you so much and thanks for your attention.


programming problem using exterior penalty method. So, our problem statement is like this way minimize this function f of x, f of x is the non-linear function and it can be a get constant g of x also will be non-linear. So, our job is to solve this problem using the exterior penalty function method. So, the we construct first the penalty function as like this way that means whatever the constants are there that constant function that square you have to do the square and multiplied by a penalty coefficients. This one and then add with the objective function and this is the penalty function at the term associated with this one is called the penalty term and this tau of k is called the penalty coefficients. That this term mu j g j these values will be either 1 or 0. If the constants are that g i of just if these constants are satisfied in the other sense that if the point is on the feasible region then this value of mu j of this value will be 0. If the constant are outside the feasible region many infeasible region the value of mu j g is 1. So, that is what we have discussed last class this one. Let us take an example and explain how this problem can be solved by using the exterior penalty function methods. So, first thing that that what is called the penalty coefficients value how to select the penalty coefficient values are there. So, let us call this is the non-linear equation we have to minimize this one and subject to g 1 x is equal to 2 minus x less than equal to 0 another is x minus 5 is less than equal to 0. These two inequality constant can be retained into this form that x from here you can see both side you multiply by minus 1 that means minus 2 plus x is greater than equal to 0. So, x is greater than 2 from here x is both side you multiply x you see x is less than 5 that is this. So, these two constant equivalent to this if it is given one can write into a two constants x 2 minus x less than equal to 0 take x in this side and x minus 5 is less than equal to 0. So, if you plot this one it is a cubic function like this way when x is increasing x is 0 function will be 0 and x is increasing positive direction this function is strictly increasing of the power of x cube. Similarly, here also this function will be increasing like this way because x is equal to negative the function value is negative is you can say it is the odd function of this one. So, this is our x in the directions to our feasible region if you see lies between 2 to 5 this is our feasible region of that one. So, this that is what we are going to discuss last class. So, we can equivalently you can write it that one f of x is equal to if you see what we have defined f of x is the penalty term this term is this term is the penalty term f of x. So, that term I am just writing it now. So, f of x I can write it this equal to 2 minus x whole square if x is less than 2. That means, if x value is not in the feasible range then this f of x value is that one. Then if it is in the feasible region that f of value that means when x is less than equal to 2 and greater than equal to 2 less than equal to 5 that function value is 0 when it is because it is the exterior point penalty function method if you see by the things. So, when it is when this is greater than 0 means it is not in the feasible region that this m of f of x is g of x and more specifically if you see this expression that will be because when g of x is greater than 0 then maximum of this one. Maximum of this one means which one that g of x because g of x is positive quantity now. So, that what we are writing in other region we can write it x minus 5 whole square if x is greater than 5. So, this f of x is greater than 5 f of f of x function which is called penalty term penalty term can be region in infeasible region is nothing but a function square g 1 or square in this is another infeasible region this is g 2 square, but infeasible region f of x penalty term values is 0. So, this mathematically this two expression equivalently we have f of x is equal to max 2 minus x sorry 2 minus x comma 0 this whole square plus max x minus 5 0 whole square. Now, you see when it is in this region see here in this region when x is less than this quantity is positive maximum of that one you take, but whereas this one x less than 2 this quantity is negative maximum of this one is 0 this is not coming into the picture when x is less than this. Similarly, when x is greater than this this will come into the picture when this part will not come into the picture because this quantity is negative maximum of this one will be 0 this from only contribution is coming penalty term contribution is coming from this part. So, if you plot this curve now you see let us see this our if you look this one our feasible region is 2 to 5 and this is our x 2 to 5 is the infeasible region. Then when it is x is less than 2 in this region when it is less than 2 in this region then this value is what you see this value is this is a square term. So, this value when x is equal to this value is what when x is less than 2 1 point let us call 1.9 something that slowly it will increase and it is squarely it will go like this way because it is x minus 2 2 minus x whole square or x minus 2 like this way. Let us call this function weight is because that is multiplied by tau. So, if this tau value is tau 1 value is 1 then this is the expression now this tau value if I increase it then what will happen this is the same function increase means actually I am plotting it now tau of k f of x of k in the region x less than 2 I am plotting this one. So, tau of k I am considered 1 now tau of k I am increased by 2 let us call. So, this function value will be same only it is multiplied by 2 point by point. So, it will be like this way this is tau 2 is equal to tau 1 is equal to 2. Similarly, if you go on increasing it will be like this way and ultimately when tau is infinity this will come to a picture at this point it will be infinite values of that one. So, it will be like this way now similarly x is equal to when it is 5 x is equal to 5 this is 0 this is 0 that means this when x is greater than 5. That means when it is not in the feasible region similarly it will go like this way this is tau is equal to 1. Then you increase the value of tau increase the value of tau and this way and if you consider this is tau 1 this is tau 2 this one tau 2 this is tau 3 this is tau 4 then you can say that tau 1 tau 4 is greater than tau 3 is greater than tau 2 and greater than tau 1 then this is the curve. That means when tau is infinity then it becomes a what is called just at this way it will be very steep value of function value will come like this way. So, if you see this one when tau value is very smooth let us call tau is less than 1 it will be like this way similarly here tau is less than 1 it will be like this way. So, when you if you start the tau value very small value and approaching to in increasing it value and approaching to infinity then we are approaching from infeasible region to feasible region. Similarly, in this case when tau is this is the tau is let us call is 0.1 and tau is further increasing that means we are away from away from the feasible regions. If you increase the tau value we are approaching to the feasible value boundary boundaries of the feasible variables we are forming. So, in our iteration what will do tau value will start from a small value which is far away from the boundary layer boundary region and then next iteration we increase the tau value that means penalty coefficient value will increase it increase in an approach to the infinity in other sense it tells that we are approaching from infeasible region to feasible region and we are getting and then we are getting the optimal solution of that one. And in our example if you see this example it is straight forward it is straight forward what is the minimum value of the function in this region in this region if you see that one in this region what is the minimum value of this function just here. So, if you see this one what is the minimum value of the function at this in this region at x is equal to 2 we will get minimum value of this function agree x is equal to 2 because this region is 2 to 5 you increase the value x in this region function value is decreasing it is obvious from this figure and also you see you are approaching the values of tau from low value to increasing we are approaching to the optimum value of this functions at that at what point we will get the optimum value of the function that we are getting. So, let us work out some problems so before that I will just say because when you will solve this problem by analytically we have seen that we have to first find out the necessary condition what is the necessary condition for the non-linear problem. And then you find out the solution of this necessary condition a set of equation you will get it and from there you have to solve the values of that decision variables values. So, from the figure it is clear that f of x is really differentiable using chain rule now see this one this is a continuous function of this one so this function is differentiable. So, if you differentiate f dash of x this then what is this function see this I will do I will do the differentiation with respect to x then what will do this one then twice this will come twice then this differentiation if you do twice max 2 minus x 0 and the differentiation of that minus x this is a square differentiation minus x 0 and the differentiation of that minus x this is a square differentiation minus x is minus 1. So, it is a minus the procedure with minus 1 plus the second term differentiation the square 2 term will be coming to then differentiation of x minus 5 that means 1 that will come max of x minus 5 into 1. So, our values is now is like this way minus 2 max of 2 minus x that another bracket is there here max. So, this is not there so the max of this is this 0 here max of x minus 5 comma 0 bracket closed. So, this plus twice max bracket x minus 5 of 0 this one. So, this is the differentiation of that one that is the important relation when you are going to find out the non-linear problem solution linear problem solution we find the necessary condition first what is the necessary the gradient of that function when you will find out the gradient of this function this expression will come in the max expression of f of x that means what is called penalty terms this is the penalty terms. So, this so our if you recall our problem recall the penalty function what is this one p x tau of k is equal to f of x tau k penalty coefficient summation of how many inequalities condition is there j is equal to 1 to m inequality condition is there then max max g j x comma 0 this then this max whole square. So, this is our the penalty functions and this is the penalty term and this is the penalty coefficients. So, max of g out of this which one because our initial guess is the infeasible point. So, this value will be greater than 0 then and feasible region means x j of x is less than equal to 0. So, this and our problem is minimize this penalty function for x find out the value of x for which this is minimize, but tau k will supply the value of tau k from very small value. So, this is our problem. So, what is our algorithmic steps to solve such type of problems that non-linear algebraic problems with constraints using exterior penalty function method then what are the steps we have to follow and the steps are simple because first you have to take a one point which is outside the feasible region then infeasible region that point. And then you find out the necessary condition for this one second time necessary condition of this one solve it in terms of lambda sorry tau k. So, our first step is select an initial point solution x superscript 0 which is outside the feasible region which is outside and set tau 1, tau 1 value you set very low value. Let iteration starts with k is equal to 1 and next iteration k plus 1 by tau k this value is c with c greater than 1 say c value is 10. We have seen in this example if you see in this example when tau value is increasing this one this function value that is what is this function value that infeasible region agree that penalty function value is approaching to the optimal value functions that we have seen it. So, now you consider c is equal to 10 this one. So, first iteration tau k is equal to 1 tau 1 I have selected some small value then next iteration tau k plus 1 you select 10 times of tau 1 that is the first step is like this way. Next is step 2 use x superscript k minus 1 that first iteration what was the initial guess you have initial starting point you have considered use it that value use x k as the starting point to solve the unconstrained minimization problem UMP unconstrained minimization problem that means minimize x p x tau of k is f of x the objective function plus tau k you the penalty coefficient and summation of our inequality constraints. And that is written as max of g j g j of x this whole square this is the objective function minimize this one solve this minimization problems that optimization problems resulting if you solve this one resulting in a new solution let us call x superscript k you got it. So, now how you solve this one there are different ways already we have discussed our earlier lecture that if you have a non-linear problem is there with constant one can convert into a unconstrained optimization optimization problem then you can solve this problem unconstrained optimization problem by using steepest descent method Newton's method modified Newton's method and what is called the conjugate gradient method agree that different techniques you can solve this problem. So, after solving this problem step three that how you solve this one you know this function then you find out the necessary condition find out the gradient of this function agree because we have a n decision variables x 1 x 2 dot dot x n this x is a dimension is n cross 1. So, you will get n such type of equation n equation which is associated with max term agree each equation having a m max term because m max square term is that each equation. So, step three if all the constant are satisfied at x k that indicates then x k is a feasible solution and it also gives and it also and also the optimal solution of the original problem agree. So, that means if all the constants are satisfied all the constant means g 1 of g j of x less than equal to 0 because if it is not constant is satisfied indicates that we are now still we are in infeasible region then we have to do our iteration process we have to keep on doing until unless all the constants are satisfied. In other words until unless we have reached from infeasible region to a feasible region and that gives you the optimal solution of the problems. So, the whether we have reached or not one can check it that one function below f of x k that function below minus that is the stopping criteria f of this f of x k this mod this should be less than equal to epsilon and epsilon is the very small positive quantity. Another stopping criteria is there you find out the penalty function you find out the penalty function f of x. So, long it is in the feasible infeasible region that f of x value is positive agree. So, this value if it is less than some epsilon epsilon is greater than 0. That means if you see the or objective function or penalty function if this term is very small quantity agree if this term is very small quantity then you can stop the iterations of that one. That means this quantity f of x into tau sorry f of x into tau is small quantity then you can stop the iteration.  So, we have reached to the optimal value of the functions. So, this and last step suppose is this two criteria is not satisfied all the constraints are not satisfied not feasible region all points are not in the feasible region. Then what to do that means you are not reached to the optimal point then otherwise that means if the constraints are not satisfied at these are not satisfied then you do or this condition are not satisfied. Otherwise you do you go to step two go to go to step next step go to next step what is the next step go to next step what is the next step is you have to do because you have already got the values of input value of x 1 and x 2 that from the point which is furthest away from the feasible region. That is now approaching to the feasible boundary of the feasible region. So, what will do it now update the penalty coefficient for tau k plus 1 is equal to c tau k tau k you have assigned earlier you multiplied by c whose values is greater than 0 we have assigned c values is say say 10. So, 10 times you multiplied and start the process once again. So, regarding remarks that each of these iteration the constraints violates that the constraint violates the violation decreases. First remarks is the constraint violation constraint violations decreases at each iteration this is first because from each iteration constraint violation slowly it is decreasing means it is approaching to the feasible region. Second is in other words what is second is the solution is approaching from outside to the feasible region the solution is being approached from outside means infeasible region to the feasible region that is two things and ultimately the design approaches the design approaches the optimal values. Finally, design approaches the design approaches to the optimal value. So, this is the things first it is the iteration if we have gone increasing the iteration that it indicates that constraint violates decreases and next we can observe we are approaching from infeasible region towards the feasible region from infeasible region to towards the feasible region. And ultimately we will approach to the optimum value of the function or optimal at what point the optimal point will occur that will achieve. So, next is let us call we that solve this problems example or problem use the exterior penalty method to solve the problem non-linear problem solve the non-linear problem which what is the non-linear problem minimize f of x is equal to four one third x 1 plus 1 whole cube plus x 2 this subject to g 1 of x is equal to 2 minus 2 x 1 is less than equal to 0. And another constraints are there is minus 2 x 2 is less than equal to 0 our function f of x is a non-linear function and the two constraints are linear inequality constraints. If you see carefully what these two equation indicates this one our region is if you see carefully our region is here that this we can write it that minus 2 plus 2 x 1 is greater than equal to 0. So, x 1 is greater than equal to this implies this one is nothing but a x 1 greater than equal to 1 and that is one is with that x 2 is greater than equal to 0 this equivalently we can say this one is that this equivalently. So, if you see our region is x 1 value if you this is x 1 in this direction and this is x 2 then x 1 value is greater than equal to 1 in whole region is the feasible region and x 2 is greater than x 2 is greater than 0 that means the upper portion of this one is 0 that means our region feasible region is our that whole portion this whole portion x cannot be x 2 cannot be negative and x 1 varies x 1 value is greater than equal to 0 the whole region is this is our feasible region. But our problem is we have to solve the problem by using what is called penalty function method when exterior penalty function method then what you have to do this we have to convert into a what is called the standard penalty function form. So, our solution what is the standard problem. So, our penalty function is like this way x minus tau k is equal to objective function f of x plus there are two inequality constants are there tau k summation of j is equal to 1 to 2 there are two inequalities are there and this that is penalty terms we are taking into account max g j x 0 this whole thing square. When it is a when it is in the feasible region this portion g j is negative quantity and 0 maximum of this is 0. So, this term will come into picture when this g of j is greater than 0 g j is greater than 0 in other words it is in the infeasible region that means when it is in this region when it is in this region this is our infeasible region infeasible region when it is in this feasible region this term will come into the picture. If you write more other that more clearly that this one what is f of x this is our f of x the four one third x 1 plus 1 whole cube plus x 2 I have written the plus tau k what is the first term max i j is equal to 1 max i write it max g j means g 1 x comma g j 0 whole square the first term I mean in plus tau k max g 2 of x comma 0 this one whole square again. So, this is the two terms I have written like this way now next you see this one because if it is in the because we will start our exterior point means infeasible point we will take and in this situation this g value in infeasible minus exterior point g 1 of x value is positive g 2 value of this is positive. So, maximum of this and this g 1 x is 0. So, g 1 will write it and that square. So, this I will write it next is like this way. So, you can write it this g p x tau of k 4 then one third x 1 plus x cube plus x 2 this is this plus tau k tau k then if it is x 1 plus x 1 plus x 2. I am just writing same thing where the tau k this minus 2 x 1 just you say I am writing the value of g 1 k, because this I know in feasible region this value is greater than 0. So, maximum of this one will come g 1 value and what is g 1 value the max of this comma 0 out of this which one is maximum then that square plus tau k max then it is minus 2 x 2 0 then that square. So, that is our penalty functions we have to minimize that function with respect to x, because tau k is we have assigned some value very low value very small value of tau k not sorry very large value of tau k will assign initially, because we are starting from the far away from the feasible region that is what tau k is finality coefficient will start initially very large value. So, now you see this one analytically see that one tau value we are considering very low slowly you are increasing and approaching to the what is called feasible region. So, analytically the necessary condition the necessary condition. So, we have converted the non-linear optimization problem into a unconstrained constant non-linear optimization problem is a converted into a unconstrained optimization problem by employing the what is called by adopting the exterior point penalty function method. That means, we will take the initial guess the outside the feasible region exterior point and then slowly approach to the feasible region. So, our necessary condition is what del p dot del x 1, because lambda 1 is known to us this what is this values if you differentiate this with respect to x then what will this coming that this that before it will come x 1 plus 1 whole square first term, because you differentiate with x 2 will not be there. The second term will come twice tau k is constant then max 2 minus 2 x 1 comma 0 bracket this one. I am differentiating with respect to x into that it is minus 2, if you differentiate this minus 2 that equal to 0 there is this term there is no x. So, ultimately it is coming or 4 this is 2 to 4 cancelled. So, I will write x 1 plus 1 whole square minus this is minus tau k max this twice minus 2 x 1 twice minus 2 x 1 comma 0 this again. So, this is equal to 0. So, let us call this is equation number 1. So, you see here you see here that when it is a infeasible region this quantity this quantity is positive infeasible region means when x value is less than 1 when it x value is less than 1 this value will be positive quantity I will take this quantity only. So, let us now next is there are 2 decision variables are there del x 2 is equal to if you differentiate this with respect to x there will be a 4 x first term there is no x 2 term here x 2 is here then it is twice tau k max minus 2 x 2 0 then into minus 2 is equal to 0. So, again if you 4 you cancel it 1 minus tau k max minus 2 x 2 0 is equal to 0 let us call this is equation number 2. So, this is a necessary condition is this you got it then 1 can write it from equation 2 and 1 and 2. So, let us consider we are in the because we are started with a infeasible region means exterior point assume 2 minus 2 x 1 is greater than 0 this implies x 1 is less than 1. So, what is we can say this indicates that means this is our g 1 x is greater than 0 that means we are taking a point which is outside the infeasible region that is that whole thing. So, this implies that first constraint is not met is not met and this leads leading to max 2 minus 2 x 1 0 is equal to 1 2 minus 2 x 1 so this because this is a positive quantity in the infeasible region. So, max of this one is this. So, now from 1 from this equation from this equation what we can write I will write the value of this one is nothing but a 2 minus 2 x 1 only. So, from 1 I can write it x 1 plus 1 whole square from equation 1 from 1 minus see this one tau minus tau k into that one 2 minus 2 x 1 minus tau k 2 into 2 x 1 this equal to 0. So, this is known in the sense if you do iterative method this is known otherwise this is unknown then what is the I can easily find out the value of x 1 in terms of tau agree. And that tau slowly if you increase the value of tau k each iteration and when tau k is very large we will approach to the what is called the optimal solution that is what we have shown it here. If you see this one when tau is increasing we are approaching to the this called the optimal value of the function. So, now see this expression how x 1 can be written in terms of tau k. So, this is x 1 square plus twice x 1 plus 1 minus twice tau k plus 2 tau k x 1 is equal to 0. So, now you see x 1 square plus x 1 square plus 2 tau k square. So, if you take the 2 common 2 common if you take then 1 it will become 1 plus from this one and this one 1 plus tau k x 1 then what is the remaining part is left 1 minus 2 tau k is equal to 0. So, I can express x 1 in terms of tau k now.  So, 4 you take it out. So, it will ultimately will come 1 plus tau k plus minus then what will be there 4 this 4 cancel if you expand this one if you expand this one 4 and this 4 will be cancel from here you will get 8 from here 8 tau k here is plus 8 tau k agree. So, in total you will get it if you consider this one 4 plus 4 tau square tau k square plus 8 tau k minus 4 plus 8 tau k agree. So, this this cancelled and this 4 tau square 4 tau square minus 4 tau k. And this is the 8 what is this 2 8 and this is 4 into 2 8 plus 16. So, now we have taken this out 4 we have taken out agree.  So, ultimately I will get it this one is 1 minus 1 plus tau k plus minus if you tau square this this cancelled. So, tau square is there.  So, 2 2 4 4 tau k agree now out of this plus minus sign which one we will consider note note the positive sign is closer to the feasible region rather than negative sign. So, we will consider the positive sign in this case. So, our x is equal to x 1 is equal to minus 1 plus tau k plus that you can write it tau k square plus 4 tau k.  So, we have we have taken tau k in that sense means the plus sign if you consider the x 1 is closer to the hour what is called feasible region x 1 is closer to the feasible region rather than if you consider minus sign it is far away from the feasible region. So, similarly we can do similarly assume 2 x 2 is greater than 0. The second that is what g 2 x is greater than 0 means it is a infeasible region. So, if g 2 is greater than 0 the second constraint is not met. So, from equation 2 from equation 2 that one we just say that if you consider from this equation 2 that necessary condition from equation 2 we can write it 1 minus tau k because this quantity is positive. So, I will write it minus 2 k. So, into minus 2 x 2 is equal to 0 agree. So, this so that will be 1 plus 2 tau k x 2 is equal to 0 I do. So, this equal to x 2 is equal to minus 1 divided by tau k. So, let us call this equation number 4 this is equation number 2. Now, you see this one this and this when tau k approaching infinity very large values this merge to a 1. So, from 2 or from 3 equation from 3 tau k when tau k is tension infinity from 3 x 1 transform x 1 optimal value of this one is minus 1 plus tau k that is I am writing from 3 is tau k 1 plus 4 tau k half. So, if you expand this thing binomial expression because you cannot put tau is equal to infinity because one is negative one is sorry infinity 1 by infinity 0 that tau k is your infinity this. So, you cannot do it do this what is called binomial expansion. So, if you do this one it will be 1 plus tau k plus tau k 1 plus 4 tau k into half plus higher term. Now, you push it tau k. So, 1 plus tau k plus tau k then it is a 2 this this cancel to this and other terms when tau k tends to infinity this will be 0 other term will be infinity 0. So, this will ultimately it will be a 1 and similarly from 4 x 2 star is equal to if you see 1 minus 2 tau k is tau k tends to infinity this is 0. So, our optimal value of this one x star is equal to x 1 star x 2 star that value is equal to 1 0. So, this is the optimal solution by using the mathematical analytical expression using the necessary condition this one and express x 1 x 2 in terms of penalty coefficients. This is the solution this problem one can solve it by iterative method also that we will discuss next class.


And you mentioned Phil Agee, and we have a surprise guest. He's not on the program, but we have his son Chris Agee here today, Executive Editor of Covert Action Magazine to give us a few lessons from his father. Well, hello everybody. Can you guys hear me? Yes. Okay, great. Hello everyone. Thank you. Thank you, Rachel, Frank, all of you put this event together, and all of you have joined the webinar and are watching online. My name is Chris Agee. I'm the Executive Editor of Covert Action Magazine and an adjunct professor at the City University of New York and the State University of New York. I'm also the son, as Rachel mentioned, of Philip Agee, former CIA case officer and whistleblower, who provided a firsthand expose of the Central Intelligence Agency. Let me just first say that as I registered for this webinar, I was asked to join a Facebook group, which I did, and it said, do you have a family member or friend that has been affected by the Cold War? Yeah, it upended my whole life. You know, it also gave me a front seat onto the crimes of our era. As we have been discussing, we are all victims in many ways. Let me explain and describe a few significant lessons from my father, Philip Agee, who taught me, and I thought I'd share those principles around a couple of stories. The first is debunking the myth of the Cold War, understanding U.S. plutocratic interests and third world revolutionary movements. The second principle was internationalism. Who can say no to international solidarity, right? And the third is political activism, keeping our eyes on the prize. All right, so what are we talking about here? Back in 1979, when I was starting high school, I was in a history class and I was being told what the international political situation was. And the teacher was presenting these graphs, which he gave us like a flyer. It had two big bubbles and one bubble said like the United States and the other bubble said like the Soviet Union. And so he presented and the title was the bipolar model. And I took this home to my dad and I said, what the hell is this all about? And he said, okay, sit down, son. Let me explain. All right, so he said, wait a minute, it's not that simple as these two models. But actually that oftentimes, for example, in cases like Angola, Iran, places like, you know, Guatemala, what had happened was that people were trying to struggle for their own sovereignty and independence and access to their own resources. And so he gave me a book and he said, read this, I was 15 years old and it was called The People's History of the United States. So by all means, everybody grab that book if you haven't already. Howard Zinn wrote it, A People's History of the United, and since then my life changed. From then on, then on in that class, I became the class dissident and organized the students in my class to take on the official narrative. This was part of many lessons from my father. Another one involved the summer job, for example, he gave me between my high school and sophomore year, my high school sophomore year. He asked me to organize the umpteen filing cabinets of newspaper clippings on my father.   And so the propaganda campaign against people who stand up against these, the Cold War myth and all of these issues is truly gargantuan. And so the US, I became to learn that the US that US foreign foreign policy actually serves the plutocratic elite, and their efforts. And so I became I came to learn that the Cold War myth serves the following purposes to distract the masses from imperial strategies to justify huge military budgets for geopolitical control all for the purpose of securing cheap access to raw materials, cheap access to labor, international markets for corporate interests. And then, and then ultimately to oppress efforts to build truly democratic societies, politically, economically, and socially, the examples are endless Iran Guatemala Vietnam Chile and Golan Nicaragua. You know just to mention the few and during during that and during the middle of the last century. And so what we have is an imperial strategy that by the way did not begin with the Cold War as we have mentioned various times during this these testimonies, but goes back to the founding of this country. Read a book by William Bloom called killing hope. So, another story for example if you just take a look at my father's works, you can see that when for example he was a stationed in Uruguay, as a CIA case officer. While he was told when he was recruited that he was going to be building freedom and democracy for the rest of the world. He found that what he was actually doing was like rounding up dissidents like human rights activists, labor rights activists, and he would meet with the regularly with the chief of police. And at one point the chief of police says to him hey, you know, you know, as as he's meeting with him he's hearing these sounds of screaming going on in the background and he's saying to the chief of police hey have it what's what's that sound. So who's that screaming and he goes oh Philip Felipe.  Okay, so he started to realize that the work that he was doing was, he was really acting as the as a secret policeman for international, a multinational corporate interests. I'm sorry. So, I know I only have probably a minute or two left. So the second lesson that he taught me was a very basic one called international solidarity internationalism, and you know what who could say no to being friends with people around the world. Okay, so he said hey you want to come to Cuba I was 13 years old and have a skateboard. And I said sure and I went to Cuba via East Berlin by the way, it's a long story. But I ended up finding that people were very interested in being friends and developing a society that that that prioritized friendship with all people's food, shelter, clothing, education and healthcare as a national priority and anti imperialism and self determination. So you can go through the examples with with respect to Cuba, and how the United States is trying to destroy that effort to to build that stuff. Yeah, and, and then and so like for example one of the jobs that my father had as a CIA agent was to literally put an incriminating message into a toothpaste tube and plant it on a Cuban diplomat and get that diplomat taken into custody. I mean so this is the kind of stuff that you know when you go into the details, and you figure that stuff out. And lastly, there are many more stories to tell my time has run out. I would simply say that we are doing the best we can to continue the work of my father we've relaunched covert action, read it. And get involved and we'd be very, very happy to, if anyone wants to write for us for example or even get involved and help. That would be great. So ultimately what he taught me was educate yourself about these things educate those around you and get involved. That's what we need to do to to have an impact on all of this stuff that we're talking about. Anyway, thank you very much. Thank you very much. And now Frank will introduce our next speaker who will give testimony. Yes, thank you I just want to say to Chris, your father is a big hero of mine. I went to Cuba 2000 I got to meet him at his travel agency. In my film when I learned us foreign policy and you mentioned two other heroes of mine, Howard Zen and William balloon. And thanks for your presentation Chris.


Hi everyone. I'm Mike and today I wanted to speak with you about Velociraptor. I wanted to go through a few examples of how we can use Velociraptor in a real DFIR case. You must have heard of Velociraptor. Velociraptor is a unique DFIR tool that gives you, the user, the power to be very flexible about the way that we collect artifacts or information from endpoints. And the thing that makes it really cool is that it has this very powerful Velociraptor query language and I'm going to show you today how we can use that to do some advanced hunting. So it's a very short talk so we're going to go and skip a lot of the information but there's going to be some references at the end so you can have a look at some more information about this. So let's just take a quick look at the overview. What does Velociraptor look like? So it's an agent based system where we have an agent running on different assets and we have the Velociraptor server. Usually it's deployed in the cloud and the admin UI, which is what we're going to be using today, we can use that to task and control the server. The nice thing about it is it has persistent communication to the endpoints so we don't really have to poll or anything. We can just go ahead and query the endpoints interactively in seconds. So I'm just going to go through a quick tour of the Velociraptor UI because I'm not going to show you guys how to install it because we have a lot of references about installing it already. But I just wanted to just point out that it's a very fast, very efficient scalable system and typically we're looking at about 10,000 endpoints on one server so it is actually pretty efficient. We can do some very, very fast hunting with that. So let me just show you a quick Velociraptor GUI tour. Let me switch to the UI. So this is the Velociraptor UI once you have it installed and the first thing that you can do is you can search for different machines. Let me just show you the sidebar here. The homepage is the dashboard. We'll just have a look at the dashboard here and you can see that I have this server running for a while and this is the memory usage of the server, just a bit of monitoring. And this server has about 2,000 clients connected to it. We're going to do some hunting in just a minute. What I will do is first I'll show all the machines. There's a whole bunch of them and it just goes on for ages. But we can actually search for specific machines by label so we can label a machine and we just highlight it here and add a label and that allows us to group machines into groups so we can hunt in a more targeted way. I have a machine here which is my machine here which I've labeled as the label's mic. Let me just find it. I'll just show you on another machine. Let me just quickly have a look here at the dashboard. We've seen that. We can investigate individual clients interactively. Let's just pick a client and so this is just some information about this client. If we have a look at the VFS we can actually go and interact with files on the machine so we can go through and at the moment this is just showing us what information the server has on this machine. So we can just refresh that by clicking that. That just syncs that directory listing so we can see what's on there. We can also do a recursive directory listing and see a whole bunch of files and on that machine and we can go in and download individual files or whatever from that machine. So when we look at a file let's say and user that this one we can simply click collect from client and then it just collects that file from the machine and then we can look at it. Let me just stop that. I'm just going to go through that part very quickly because I wanted to show you guys an example of what we actually use. I just wanted to show you quickly the interactive shell feature that we can actually go through and we can get a shell on that machine at any time. So for instance in this case if I wanted to know what are the local users on that machine you don't have a little power shell snippet here I can simply paste that here and collect that and that just basically runs the power shell on the machine and we get back the responses. So you know in this case this particular power shell just tells us what the local admin users are so we've got this. So let me go through and so we've seen how we can fetch files and interact with the machine but what's really cool about Velociraptor is because we have that query language that we can use to really customize the way that we are actually interacting with the machine and querying things. I just wanted to show you an example of what we call a forensic artifact or Velociraptor artifact and we use that term a lot and you'll see that a lot in the documentation of the artifact, the term artifact. So when you look here in the UI we have our artifact viewer and you can just click on any of these artifacts randomly you'll see that these artifacts are essentially just queries that are packaged up inside a YAML file I'm not going to go really into details about the query language itself in this talk but you just need to know that these artifacts are just queries that are named so they have a name and so we can actually just use those queries and just ask the endpoint about them at any time. So just to give you an example of how useful it is having these artifacts in the YAML form allows us to interchange them and share them with the community. So I'm just going to go through an example, a really quick one and this is just something that I just put together in the last few days because it's actually like the current zero there you know that at the time of recording at least it is the Sirius Sam or Hive Nightmare example. So let me just go through that and you can see that there is a CVE for it and there's an advisory art and you know we can have a look at you know the different resources there are many resources that explain this vulnerability but essentially what this vulnerability is if you read the details is that there is just a weak permission on the SAM file so if you look at it the built-in users group has read permission on the SAM directory where the SAM is contained and that allows you to allow low privilege users to just read the SAM crack the hashes and escalate to domain admin from there. So it is actually quite a serious vulnerability and so you might have you know a whole bunch of machines and you can say oh well how do I how do I fix that well you can see the advisories and Microsoft has released an advisory about it and we need to check the ACLs but how do I do that to 2000 machines how do I check that you know 2000 machines are patched or whatever so this is where a query language really shines right I can the idea is that I could write a query right now and run it on all my 2000 machines and then see the results in seconds right so so let's let's have a look at some at our public artifact reference which is a public place where we can share these kind of artifacts these queries so this is our website the commutation website and we have a thing called the artifact exchange the artifact exchange is a place where we can change information about current threads and people can write different queries different artifacts that we can share with the community so most of the time you don't really need to be able to write your own VQL you can just have a look at the artifact exchange to see whether there's something similar I mean you see we've already got something here but the one that I just wanted to show you today was this access control list artifact which is allowed which basically pauses uses a partial to get the access to the ACLs of the of of the SAM this is the SAM files right so I'm not going to go again into too much details here but all you have to do is really just find the artifact that you're interested in and then you just copy it from here and then we're just going to go back to our server into the artifact viewer and we're just going to paste that artifact into our server right so this is very simple we just click the plus button here highlight delete you know paste and and that just pastes the artifact from the artifact exchange so so you could just directly use it I mean if you're you can pretty much see that that's the first part that's the power shell script a very small power shell thing and then we wrap it in VQL and then we do some filtering there with with extra extra processing right so it's a pretty straightforward approach but now when we save it then you'll see that it actually we have a customized artifact it's part of the UI part of the also raptor and we can just use it in any context that any of the other artifacts can be used in so let's go back to our to our machine let's see if we can find it again yep so this is my my label right so this is the machine here and now I'm just going to look at that one machine here over here on the top I've got the name the host name of the machine and it says connected so it's now connected to the machine so we don't really pull we are directly connected to it so when we task it we can immediately immediately get information from it so I'm just going to go through the collected artifacts and Velociraptor just deals with artifacts that's all it knows about so this is the list of the artifacts that are collected when when we first start we collect this information general information artifact but what I'm going to do now is I'm going to click this plus button here and we're going to collect that new custom artifact that we've created which is the access control list so I'm just going to select that I can search for it first and it again shows me a bit of a description of it reminds me about it but you can see that there are a couple of parameters here that I can use to customize this artifact that I've got from the artifact exchange so I'm just going to configure those and you can see that I can change the glob so I can you know check for other files and access controls in this case I'm interested in the SAM specifically so it's it's going to be in this directory with an S star and this is the ACL filter that I'm specifically looking for I'm only interested in files that have that that permission that filter so because this is the vulnerable permissions so once I do that and configure it then I can just launch it and and off it goes so this is going to go to the endpoint to that endpoint and run this partial thing and and then it will come back with a result that would just be all of the see it's finished and it's uploaded for rows so just like but also after is a query language really queries only just return rows I mean click on the results and we can see here that it's showing me the SAM this is the owner administrator but these are the ACLs on it and you can see that this is the kind of problematic ACL here so this machine is vulnerable to this to this Hive nightmare zero day so so that's cool and so I could I could do that and I could and I'll show you in a minute how you can do a hunt of thousands of machines and find that out in which ones of your machines are vulnerable in seconds but now what am I going to do about this I mean like okay so I know this machine is actually so this is just a big of a recap to show you just the general structure of this VQL query and how we adjusted the parameters and we could see the the vulnerable thing so how do we what are we going to do about this this machine is now vulnerable so we actually really need to remediate it now I mean of course we can always log into that machine and and use our remediation steps and in fact if we look at our references there are some remediation guides and particularly we need to run this command here but this command so you know we can do that to one or two machines but we want to really be able to do it to many machines and this is where the lost raptor can really help us because we can just change this VQL to add that extra command here that extra mediation step and then and then we can use that to remediate that machine so let's let's give that a try okay so this is their remediation step and what we're going to do is we're going to go back to our artifact here and and instead of we can now customize that so the one that we copied from the from from the artifact exchange is is good it just tells us about it but we want to change it so we're going to just click the pencil button here to customize and and what we're going to call it is you know remediate for example we change the name so it's going to be a different artifact but it's very similar right like essentially the same thing except we're going to add that that thing here and what we're going to do is we're just going to out let me just check this this format what it was supposed to be out now okay so this one basically just runs it without yeah without any output because we don't want to mess up the the JSON that we are we are extracting right so so we're just going to as extra step run this extra remediation step and then we're going to look at the permission so hopefully that will show us that the permissions have been fixed after we do this so we're going to save this so now this is the remediation step and I mean generally we want to be very careful when we do remediation because you know we don't really want to mess up the the system right but let's let's have a look so so we're going to do a new collection going to collect this new one this is the remediation one and we're just going to launch that so it's it's doing the same thing except it's going to do that extra partial snippet to just clean up the machine and then hopefully once we once we finish we should see that that uses one disappear so let's hopefully it worked that's remediated oops sorry let's check that again and hopefully that that would have worked so this gives us an idea of how we uh oh it's still there maybe that remediation is not working too well uh I mean it should run the remediation step maybe it's yeah that's right sorry this remediation is not for PowerShop so we just want to do this in those system 32 yeah okay so let's do the remediation one we can copy it again and launch it around the same thing but with the modified one and this time we should expect to see that command worked and yeah it returns zero rows so it actually worked correctly uh and there's no more results so now if we do that access control this check again so we just copy that same artifact collected again second time uh and then it should return zero rows because now we have no uh vulnerable SAM the SAM is no longer vulnerable right so it doesn't have that ACL on it because we've we fixed it right so again we have to use the correct partial version of the of the of the fix but once we do that we just edit it to partial and it just goes off and does it so we can now do a hunt to to remediate all of these machines okay so that's that was pretty cool um so let's have a look at the second example and this one is a little bit more involved and it it basically uses a bit of research so in this second example is about disabling log files and uh and you might not know that you can actually download things in Windows using the beats downloaded that's a pretty common this one's a pretty common persistence that a lot of a lot of uh people people use right so uh attackers use so here's an example of a command line and it uses something called the beats service right so the beat service is used to download the windows updates and various other updates but essentially it's like curl basically it goes off and downloads stuff from the network now if you have something like an edr that watches to see you know oh is is there a power shell connecting out to the network it could be suspicious so a lot of attackers use this beats admin to download their malware because uh it just beats admins part of windows and it just it's usually white listed and signed and so it goes off and a lot of videos just let it go because they don't monitor what exactly it's downloading so you can actually use it to download anything including you know any any power shell or whatever you want as as a download cradle so let me just try to uh to do this as an example so we'll just open up the shell and what we're going to do is we're just going to download uh let me just put it in mic test okay and if I just run this command then it's going to go and it's going to create a beats job and goes off and downloads this uh google.com into uh see users mic test dot oops test dot ps1 right so that that is what it went off and downloaded that now so this is actually kind of suspicious thing and a lot of people know about this so usually you actually can monitor for that using the event viewer so if you look at the event viewer uh then often uh you will see an event and the event is in windows beats clients operational right so you see the event and this is pretty suspicious a lot of people have like event forwarding and they forward that to their same and you know and then there's alerts and all this kind of stuff in escalates right because this is actually pretty suspicious when you look at uh at this event you can actually see who downloaded it oops the username and you can also see um in one of the other events where it was downloaded from and who created it so you can see this is the url that we downloaded from this is what the downloaded and that would set off a lot of flags as power shells coming from the internet so but i'm not going to talk to you about this bit thing because it's well known what i am going to talk to you about today is this very interesting uh thing that a lot of people don't realize is you could just turn the logs off so if i right click on this and if i just disable the log like so very easy and if i just clear this log i'm gonna i'm gonna clear this log and do it again and show you that now the log is not logging right because the log is disabled so if i had an event uh forwarding type seam that i'm just gonna you know forward event from this then i'm just now completely blind and all it takes is you just right click on this thing and you know just disable the log it's not a big deal right and so you know if attacker is about to do this they're just you know they can do that they can disable the log and off we go so what we would like to know is defenders is like has anyone done this has everyone disabled the log what was the baseline what should it be the baseline so first the first step is figuring out you know what is going on when i disable this log and when i disable this log um what happens is that so let's say if i don't know what it is so usually i would just run prokmon so i have prokmon over here and i would start it up and and then just you know do this disable log business maybe i'll just re-enable it again now enable and then i can stop prokmon stop capturing and i can add a filter i've already added a filter here just for this talk the filter is looking for an operation which is a registered value so basically when i change this in ui something is going to set a value somewhere in registry and i don't know exactly where so i'm just going to see a filter for those and you can see very quickly that when i turn the um the event log on or off disabled it then you'll see a particular key uh somewhere here uh which corresponds to that that setting uh where is it here this one right so this event is a windows current version winivt channels Microsoft beats client so this is a typical example of somehow the attacker is misconfiguring the system and we want to know uh what's going on right so we want to write an artifact here that just detects this across across our system so let's uh let's have a look at this example so this is the example i have here so we did this we look through uh we checked about the disabling we did prokmon we checked this value and in the end we can write an artifact to check for that key that specific registry key and again in this talk we don't have a lot of time to to be able to see um which uh to work out how to write this this query so i'm just going to paste it so we can actually run this query as it is uh and create an artifact from it but let me just show you what that query looks like we're just going to run the query in the ui so in the ui uh we have a thing called a notebook which we can create a new notebook here test and in this in this notebook we can write any vql that we want we can run different vql so uh let me create a new cell vql cell and paste again i'm not going to show you how to actually write this in this talk because it's not enough time but you can see that here's the registry key that we are looking for there's a globe here so there's a star so we're looking at all the events uh all the uh logs and then looking to see whether they're enabled or not so we can run this query and what it will do is it will basically show us which query is enabled and which query is disabled right so we can actually write this artifact using this query to know which which event log is enabled which event log is disabled right so so let's let's uh let's do that so we'll write an artifact so this time we're going to create an artifact out of this query so just like we did before but this time we're going to create a new artifact we're going to go to the artifact viewing the artifact viewer and we're going to add a new artifact but remember before we just copied it from the artifact exchange but now we're just going to write our own artifact so we just need need to give it a name so it's going to be a windows event log uh event log enabled I don't know we just give it a name description and so forth but really the most important thing is to paste our query here oops and because this is YAML we have to kind of like tab it over a bit and you see as soon as I do that the syntax highlighting helps me here I have the precondition so that's telling me that it's only this artifact is only running on windows so I'm just going to delete that and I don't really want any parameters here so I'm just going to just do that so that's that's my new artifact I just create that and there we go we have a new custom uh windows enabled event log enabled artifact so now we can simply collect it from our endpoint right so we can simply go back to our endpoint collect that artifact just as we did before remember there's no parameters this time so we just hit launch and off it goes and that's going to tell us basically which um which uh clients are which logs are enabled or disabled here we go so the same thing so so we've gone from an observation of uh something weeds going on how do we hunt for it and then we create uh an artifact for it so this is the the standard workflow in Velociraptor it's the hunting workflow so we start off with an idea we explore the idea in our vql in our queries once we come up with a query that we like then we simply convert it to an artifact and then we can go hunting this is the part I wanted to show you right now is how we can go hunting for this so what is normal and if you look at the event log you'll see that a lot of them enable a lot of them disabled and you don't know which one's supposed to be enabled that's not enabled which one's supposed to be disabled that's not enabled disabled right so you you don't you want to know is whether one of them has been changed but you don't know what's normal so if you don't know what's normal that's called baseline where we need to guess get a baseline of what's going on and in order to do that what we want to do is we want to collect this information of all the logs that are enabled all the logs that are currently disabled from all the hosts so we want to do a hunt a hunt is basically when we go through and we collect that same artifact this one across the entire network at once so at the moment we've just collected it from this one machine here the mic machine but we want to do it across the entire network so let's just for the sake of argument let's have a look at this log so this log here is enabled right so that's enabled let me just quickly check my other machine here and this is my other machine this is the mic's machine and I'm going to disable the log just on the one machine so I'm going to see like this is going to be the one that stands out right and let's go and do a hunt and see which one is disabled a lot of machines are enabled this this log is enabled by default but we're just going to disable it so we're going to go to the hunt manager this is the hunt manager and we're just going to create a new hunt so we're going to add another artifact we can give you the description so you know events logs select the artifact that we want to collect so it's just this one whether it's enabled or disabled and literally just launch it in this case because there's no parameters it just goes ahead when we create the hunt it's paused so we're just going to launch start it run it and you'll see that as soon as that happens the endpoints are starting to get scheduled and they're starting to that number will increase as they're getting scheduled and each one is going to go off and check its event logs and send back the results and then and then it would be finished right so it's going to be scheduled and then finished and and that goes off and this is basically how we go off and hunt through all our machines right so once this is happening this you know we don't really even need to wait for it it's going to be uh we have like 2000 machines on this on this system so it's going to take a couple of minutes but we can immediately start and analyze the results so this is the processing step in the notebook and the notebook is where we can write different VQL and we can analyze the results so you see for example this is the results that came back from this machine 87 and you know it has some zeros and ones but we don't really know which one is um which one is valid or not so we want to basically just do a group by we want to do a stacking we want to stack all of our results and then see which ones are different so um so what we really want to do is we want to do a group by and then we want to we want to count right count as count and then we have the log all the different log and the value right and the hostname that's the hostname here and then what we want to do is we want to group by the combination of log and value right so group by basically counts together all the unique ones of the same value combination so for example this bit client operational is one on one machine and then it's zero on another machine that's a different group so we want to just do that right so so then when we do that so it's going to go off and and essentially just count them and this way we will be able to see which ones are common and which ones are not not common because they'll sort of stand out this is a pretty classic hunting technique called you know stacking where we can just count just counting different things and we can see that some machines are a bit different to other machines it's going to take a couple of seconds while it's doing that let me just jump on to the presentation to just see what we're doing here so again what we've done is we've done a stacking exercise across all the groups and we counted all of them or we should have also ordered by a little bit but maybe we'll find when we order by we can see the counts you know in order so we can see the ones that are a bit different so that's going to take a couple of seconds while it's collecting the data from the endpoints but typically this is what you see you'll see that that one machine that has it disabled so the value is zero it stands out right and then the other ones are all the same so that's more or less the baseline and then that one is the one that stands out all right so we only have a couple of extra seconds so I'm not going to show you how to do this but I'm just going to tell you how we can turn that artifact into a detection rule and this is a little bit of a more advanced use case I would say and in VQL you can actually create event queries so you can actually write monitoring rules that use the query to detect when something happens in the future and this is kind of what it looks like on the endpoints we have the query running and it basically ends up sending partial results as it happens I'm just going to skip to the architecture so we can see that event queries are running on the on the client and then they're getting buffered and they're sent off to the server when the server when the client is back online so we can write a query that simply you know detects whenever this log file is changing and this is an example of this is an advance over the typical you know OODA loop in a normal EDR type scene system you have basically a whole bunch of events that are going into the scene and then we have escalation and then it goes back through and then the user an operator actually goes back to collect extra information but we can actually do that on the end point by simply adding a query an event query that runs through it so to give you an example in this case we have I'm just going to skip through because we are out of time we can add this particular event artifact to Velociraptor that will simply check whether the event logs are enabled or disabled periodically and when they become disabled then there'll be a difference and the and the event will and the query will basically report a row that will be different so an event log has been disabled so I think we are out of time to actually demonstrate that particular one so we're just going to just show you a screenshot when that happens basically once we install that artifact here then we will see whenever someone added or removed a an entry from the the event logs from from the the registry key so whenever the registry changes we will see on the server an event raised and so that's how we can turn VQL into a monitoring type system so we didn't cover a lot of stuff it was really quick a really quick talk so I do encourage you to go and have a look at all the resources that Velociraptor has so there's many many things that we didn't cover and you know we only just introduced it so hopefully this will give you a bit of a taste to see how you can scale up BFIR and be able to to collect information from thousands of machines in seconds and then in the last slide here I have a whole bunch of references here but really docs.velociraptor.app is a website it's if you go there you know there's lots of resources here we've got training packages announcement documentation and the artifact exchange you could use that to submit to it and so on it's an open source project found on github you can visit us on github file issues and also we are always on discord so you know help help out any questions or anything like that so thanks for thanks for your time and and and have a good conference thank you