Extreme street Malorinas, you know, live on a mean street in Chicago, but today, rather than pure wedding through, rather than pure wedding through Chicago, they are now pure wedding through the coast. So, I want to introduce all of them, and they are going to talk about securing your rails application, right? So, everybody welcome, Jim and Matt. I hear the beer has already started flowing, I think, advantage of that already. Good morning. Good morning! That's better, that's better. We are here to talk about securing the rails application, and while Matt gets the video set up there, I'll just ask... Let's pass the ballot music, and I'll save that for later. How many people here write about rails applications? Leave your hands in the air if you feel that your rails application is totally secure. Okay, we've got a lot of smart people here who realize that securing is a big issue. And I got interested in this a while back. Do we read it with the slides? Yes, here we go. I got interested in this a while back by a fellow wrote an article. Patrick Buchanese took a look at the BIOSPRA Brails Code. If you're familiar with BIOSPRA, it is a Facebook replacement, and its emphasis is in privacy. It's designed to make sure that your private information is kept safe. So, with that in mind, you think it would be a very secure rails application. But as you look at it, it was struck by numerous severe security errors. And when all of a sudden none, it turns out because of coding mistakes these people made in the rails application, it was quite easy for someone to come in and hijack someone's account, and absolutely nothing. None of your private data was secured because the rails app itself was not secure. That made me stop and think about rail programs. How secure are my rails applications? I've gone through all the standard security classes.  But I began to wonder, you know, does rails have that? It came in right. Secure rails programs and all. I really didn't get word. I had the opportunity a couple weeks ago to pair with a guy at our Hackfest after a Ruby, Cincinnati Ruby grade meeting, and he said, hey, why don't you pair with me? I said, sure, what are you doing? He says, I'm writing code that monitors the power usage of the chip on your car key, your plugger, your fob. Yes, thank you. Your key fob that you open a car door with, that has encryption on it. He's monitoring the power levels on that chip and detecting what the password is by watching the power function relations. It takes more power to flip bits than to not flip bits. So when the password is correct, these zeroes in the right password, you can see here, he's running a simulation here. He's actually figuring out that this 64-bit key is, you can see up there right above the break, dead beef dude face in X. Dude people do that. What an awesome thing to do, first of all. But who would ever think about monitoring the power on a chip to detect when the password is correct or not? And that, you can see it was at a .96. That means he's 96% sure that is the right password. The longer this program runs, the more certain it becomes what the password is. I don't think like a hacker. I would have never thought about doing things like this. So to put yourself, to get a secure Rails application, you need to think like a hacker. Okay. So a little bit of reading on work here. We're really talking at a very high level about various security concerns and concepts related to writing secure Rails applications and web applications in general. But we're not going to be pausing ourselves to security experts. If you haven't read the Rails guide on security, read it absolutely. A lot of the Rails guides are very high quality. And the security guide is one of the best. And there's plenty of great information, a lot of which, the things that we're touching on are going to be discussed in more depth here. As well as what this security guide was pulled from, it was a paper. It took 48 pages long, not too long. This should be required reading. Written by Pico Webbers for OWASP, which is the open web application security project. Also a great site and organization to remember if you want to support and claim information, the authoritative source for web application security. That says 40 pages really long, but it's really dense 40 pages. Yeah, it takes a while to work through all that. We have an OWASP guide come and speak to one of our local user groups, and it's really interesting whenever he does. Let me give you some of the basics here about Rails security. Here's architecture for your typical web application. You've got a server, you've got a browser, and you've got a database. Of these three things, what do you trust? None of them? None of them is a good answer. In particular, you can't trust the browser because you don't own the browser. That sits on the desk of the user and he can do anything he wants on that. So you can't trust anything to come from the browser. You can't trust the database because even though you think you have control if whatever goes into the database, a lot of the stuff in the database is user input. And there are sneaky ways of doing input that might sneak past your security measures. So don't think just because it's in the database is something that can be trusted. The Rails server itself, if someone's gotten in and corrupted your Rails program, you've got bigger problems of what we're going to address here. So we're going to concentrate mainly on browser issues and database issues in this particular talk. That's not to say that there aren't security issues around the server itself. They are more related to admin issues. So let's talk about the very first issue, SQL injection. How many people have heard of SQL injection? Okay, very much. This is the common one.  So let's suppose we have a little controller method that looks like this. This goes in and it wants to find users who have a name like some kind of filter text in there, matches the filter text and who's not an admin. So it's a little bit of SQL from there. And notice this. What's wrong with this right here? It's not a scheme. You are putting filter text which presumably comes from a user right into the text of your SQL query. And if you're not careful, that is a big, big security hole. Let's demonstrate that, Matt. Sure. We'll go ahead and take a crack at this one. Matt is my local hacker, isn't he? No, not exactly. The purpose of this talk, yes. So we have a very simple example app. Of course it's very dark, unfortunately. But it's written to schedule movie nights with your friends. So you get together and you watch movies and you have to hear them. And for the purposes of this talk, we put in this extra little page here which gives us access to certain things to make examples out of. But we see here a list of users that are in the system. And then we've got four users that have signed up. It's a very education-centric user base at this point. But if we click, we like our movie. It's true. As you can see, there's one administrator of the site, which is Joe Brian, who happens to be our boss. So even though there's only four users here, and perhaps this is too overwhelming for me, there's an opportunity I can go and filter this a little further down. So I'm going to filter by Jerry. Okay, now the only users being shown is Jerry, who's our designer today. If we can go up and look into the URL, we see that we've got a query parameter, a filter equal Jerry, as being our... as the way the filter is being done, which tells us that we may have an opportunity here to do some injection with a copy, or something for a cheatable... I'll say, I'll test that out and see if that's the case. Even if you don't have a comment there. There we go. So now, in filtering, you can see they're coming back. Instead of just plain users, you can see that now we're going to be administrative. Because what we've done, we've... by injecting this one equal one, we're going to be a national every possible user, and tossing it into comments, it's going to comment out the remainder of the SQL that we've written, which was doing the not-inadmin checks, and now we're getting everyone back. And that's the basic SQL injection rate. It's not terrifying. But if we change that up a little bit, it's something that's a little bit more complex. This long string here, and run it this time, we're giving back the administrator. And in this case, what we'll be seeing is encrypted password, but apparently to twice in a row, it's really active, of course. What we're doing. We have a lot of live code demos. Actually, there is a string there. We got working at least one point of time that we could actually dump the encrypted administrator passwords by putting in enough unions of the SQL tables. Once you got SQL injection, your entire database is open for browsing, essentially. You can put any SQL in there, essentially pull anything out, with a complex enough string. So you're going to have to pick that up and play again for a voucher. So basically, you're about to see something like that, but what a hacker will do will put code like this into your SQL that essentially comments out the rest of it and can totally control your database at that point. The fix for this is to use what Rails gives you for building up SQL queries. Use the question mark like this and put the text that you want to filter on separately. When you do this, Rails will escape that text. Make sure any quote characters are properly quoted themselves. Make sure comment characters will hurt your SQL queries and it just works. So use the built-in facilities. Little buggy tables. All right. Next security problem. And this, I think, is a common one. One we probably don't recognize too much and at least for myself, I know this is one that I've committed in the past. It's mass assignment. We have some Rails to code here. We want to update a user and we just pull the parameters off of the form, programs, sub-user. We stick all those parameters right into the user and we save them just like that. The problem is it's coming from the form and we're not doing any filtering on that data that comes from the form. Therefore, we can change any field on that user whether it was in the form or not. Yeah? Well, this one. Okay. Okay. So we've added in, this is a symbol and a user form, right? I can update a couple pieces of data that have belonged to me. One of those is my name, there's my email address, so in theory I should have the authority to change those things. But if I utilize the web developer's friend and bring up an autonomous vector, and I can look and inspect here and see the end of the form, you can see the very shell we used to. You can see these input fields and how their names went down. See that the name of this input is user bracket email, right? Because it's going to be the element for the email address and that's how the rack France parser will create the income frame patches one note. So I know that I can probably go in here and try something else if I use a little bit, make some assumptions. If there's an admin flag, I might want to set that to true. You probably figured that out by the SQL injection. Yes, I did. So now if I change that, instead of being the instead of being the email field, it's not going to be the admin field, but an update. Now, as you say, I'm no longer showing up with your users, and if I click you and thens, I'm not able to self-administer it. I'm not on the mass assignment, but a feature of Rails. What you want to do to prevent this is something along this line. You can declare on your user model what fields are not allowed in mass assignment. What fields should not be included in a mass assignment? And there's two ways to do it. You create a fight list like this where you say everything that's allowed to be changed or you can create a black list like this that should not be changed. Quick survey. Which is better? I'm going to say a white list.  Okay, you're right. The white list is better from a security standpoint because if you forget a field, it'll be obvious that you can't edit it. However, if you create a black list and forget a field, it's very easy to miss the fact that someone can start injecting new parameters. Okay, so white list. Prefer a white list. You were going to talk about leaking work. I'll talk about leaking because I know plenty of them. I'm not going to finish that sentence. Anyway, leaking information. So this is a little more subtle topic. You're not necessarily going to talk about this, but just to talk briefly about it. Timing attacks fall in this category and what the timing attacks. Basically any time that the malicious user can well, the malicious user can gather statistical data about the timing behavior or application and clean some information from that. So let's say, for example, that we've got some sort of compare digest method and we're using that to check our session key that's being stored in a cookie, for example, against the expected value to do authentication. And it's just doing simple comparison. String comparison in this case. So what's that going to do? Well, the first sign that it sees that two strings are not equal. If A, B, C and A, B, Q well, at the point where we hit Q we know that they're not equal. So it's going to return to false, right? Basically they held that point. So what if we have a session key that looks something like this, right? A random hash. And then I decide to generate sort of a set of input, a potential input that I think might match this key. And so first I try E of 0, 0, 0 1, 0, 0, 2, 0, 0, 3, so and then I try B, 0, 0, 0 and I notice that with this one that the response, the time it takes to get a response back takes just a little bit longer. And it makes a statistically significant difference. It's not determined that okay, now we'll not cut the first byte, right? And you can continue that process and march your way through using statistical analysis. And it might seem like well, that's either very slow or that's an unlikely scenario but the reality is it's based out of a series of a few days with a relatively small and probably undetected number of bus you can determine this with some information it actually detects and smooths the session by. For a nice law article that talks more about this and some practical implications that we're not going to have as a great article, a lesson in time for your task. And then one other thing that could follow in this category is the tax social network and communication status. So if you're un-logged into Facebook then if I, if another user puts on their web page a link to some image that they know of Facebook that will resolve properly for a logged in user but will not for a non-logged in user using some JavaScript for example of either the amount of time that it takes to request that, get the result of the image request down, or the actual HTTP response code if it's a RESTful service for example. You can use that to detect whether or not another user on your site is logged in to say Twitter, Facebook what have you. What you do with that information is particularly useful and delicious. I don't know, it's the kind of information that you can pull down based off of this sort of information leakage and there's not really much you can do about that ladder issue. Cross-site scripting, another big issue. Okay, so we're talking about the browser and the database here in this particular tab and this is a tab where the user is able to get delicious information into your database. Let's double this one. Back on the job with my lead access skills which involves a lot of copying and pasting. Okay, so now we're actually going to exercise this app. The point of the application is to create a schedule movie that has to be friends, right? So I'll go ahead and schedule this new movie. We'll do the back cave. Yes, people should bring drinks. And then notes, right? So maybe I will say bring pizza and that should be important so I might want to be able to do something like this. And as the design of this application I might want to allow users the ability to do some markup in their fields and their messages, right? And that is a nice user experience in some ways. But instead of say using a bold tag I'll use something different so I wonder if this is going to work. I'll go ahead and schedule it and that does. All right. So that's, yeah. It's really in your face. There's no way my friends are going to forget to bring pizza if I have that nice pop of that. So that should be good. And that's kind of annoying. That's an obnoxious thing to be able to do but could you maybe do something that's a little bit more a little bit more dangerous and the answer is potentially yes. So if I could schedule something else and this time I'll have it at the old management on the street and use a little bit more complex piece of JavaScript in this case. So what we have here. So here we're saying document.write and then we're writing in an image tag. And that image is pointing to in this case it's pointing to a local host on a report but you know it's pointing to hacked at some dot symbolical site dot com and in fact it's also writing the document.cookie so it's writing a cookie knife to a string. Pending it to the end of this so well what's the result when we're going to save that all I see is a broken image right right here. It just winds up being an image tag because obviously that is not pointing to a valid not pointing to a valid image on the server but if I can run over here and just check the logs for you know all I did in this case was generate a new Rails app and start it up for another you can see that in now in the in the log of this third party malicious application we now see all cookie data including session data that I had as authenticated into a different site and obviously that's the problem of course in this case you should be noted that we did subvert a security measure that Rails puts in place which is to mark cookies as the session where these HTTP only so I can't manipulate my JavaScript so I guess to take on there is we'll do that but nevertheless it illustrates the kind of thing that we kind of should pick and learn once the user has the ability for JavaScript on their site that's under their control they can do a lot of bad things grabbing cookies is just one particular thing when we get to what is a cross site the forgery request we'll see another example where a running JavaScript you a piece that leads to bad things the key to this is that they put JavaScript on your page you saw just a image tag that was broken that sent off a request to an external server that was under their control that logged the session data that session data is the key to all of your information on that site once they have a session they can log in as you they can do anything on that site in your name so protecting that session key is very, very important this happened because in that notes section here we had the raw tag a raw allows all the user input to go everything in this nice not notes thing you go directly to the web page without any trying to filter it by default Rails used to do this all the time to prevent that we put the h command in our views new Rails Rails 3 does it by default filters our data by default and if you want the old behavior you have to go raw again but if you want the ability for the user to put bold tags or strong tags or block quotes or anything like that you need to allow something like raw to happen so yeah you might want to use text on our markdown so what do you do well don't use raw you recommend not using that don't use raw with anything that comes from the user if it's generated entirely by you that's a little bit better but don't use raw on user input don't use a black list and don't try to correct for example here's an example of someone who tries to correct user input to make it safe he says well we'll just remove any script tags and then we'll sanitize it until the user enters this so don't try to correct it if the input is bad, reject it don't correct it beware of javascript in unexpected places for example you might expect it in an href tag that's not unusual but as the background on a table you might not think to check there for unusual javascript so probably what you want to do is a Rails method called sanitize and it actually will go through a white list of tags you want to allow and we'll let those tags through and we'll prevent other tags from going there and sanitize is pretty well written I recommend using it rather than trying to write your own white list sir because he probably did a better job than what you would have been able to do real life process scripting incidents here 34,000 34,000 names and passwords were stolen from my space using this what they did, they used process scripting to hide content and presented a fake login screen genius, yes that was in 2007 so it was a big problem let's talk a little bit about privilege escalation this is another thing that I'm prone to do in my code that I am learning to change here we have a find command where we're finding the nights that are attached to a particular user R2 yes, finding the nights based upon this night ID and it should be restricted to the nights that a user is allowed to see however again we're using params that comes from a form which comes from the browser which is unsecure so let's demo this one okay, so we'll do a simple demo here real quick I'm logged in as myself and I can see my schedule of upcoming nights if I log out for seconds and log back in as generally because he was kind enough to give me his very complex password for this site notice that he's got a couple of upcoming movies and everything including one that looks like what it goes to but I know that I've not been invited invited Joe, invited Kevin, invited me I'm sure it's my feelings but that's the way it goes so which one were you interested in? Star Wars? well if it were me I would want to see actually I'm torn I would want to see Star Wars but technically I'm not invited but what could I do I could have noted that even though I'm not invited this night I know that I'm currently logged in as my software so but here I am viewing this movie of gents that I happen to not be invited to and not being invited I really shouldn't I shouldn't be allowed to vote I shouldn't be allowed to see this but maliciously since my feelings are hurt I'm going to vote and make them try to watch Ninja Turtles instead of Star Wars obviously we're all awesome although frankly they're all awesome movies but I'll go ahead and vote and see that okay so I got the way out and make a decision on this movie even though technically I'm not invited so that seems like that should not be the case you notice you did that by hacking the URL you just put in the idea of the night and we went and fashioned it the problem with this search is that it doesn't limit the number of the nights that you're allowed to see by the current user there's no current user involved in this and it's a very simple way to fix this instead of doing a night not fine go to the current user ask for his nights and then find based on that and this search this search will limit you to only nights owned by the current user that will restrict the number of nights you see I cannot do this in my code and it's having a foreigner over the years because I don't particularly like to do a fine on the associations I like to treat associations as kind of just objects and the fact that it's active record based I try to ignore that in my code so I will probably not do this but since it's actually safer the other way of doing it this is a better way to go so I'm changing my code habits because of this would you say you were doing that previously for testability reasons? just kind of kind of extraction reasons I like to treat my models as objects and only deal with the fact that they're active records in particular points of my code I don't like to spread the fact that this is an active record object all over my code base so I tend to limit the points where I actually do saves and finds and things okay cross site request forgery this one was a new one for me when I started researching this topic I always knew that Rails did something about this but I didn't understand what it was or what they did and how it fixed it but this is actually a very fascinating one this is a scenario you're sitting at your browser and you visit a hackers web page conveniently labeled so you know it's a hacker actually probably not and you grenade it down into your browser and it's an image that references movienight.com slash one destroy that is an image request the browser then sends out to the movienight website and since you are already logged into the movie website your session data is still in the cookie in your browser so you have permission to log in and do anything and the destroy command runs out there and bleeds your movienight okay there's a couple counters were we going to demo this one you just move plus I'd like to show off my awesome design skills that were in unsuspected pools so if we go back here and check my schedule I can see I've got several movies coming up including can I go see Blade Runner we're going to do Blade Runner I'm just going to have enough time by myself to watch Blade Runner that's number 12 that is number 12 and if you know that I'm logged in let's say some of the link comes along since we didn't ask you to email I don't know exactly where this goes from but I can direct you to this page and I cannot possibly resist the chance to click for Epic Wood you know that's just entirely irresistible so I'm going to click here on this button and it's going to tell me what this is which is hilarious yes thank you let's try that again there we go I hope you went to Elite later tonight well no I didn't that was not the Epic Wood that I was looking for and yeah I proud of home itself and how was that done was very simple it's just back to this element see the movie click on that it's just a form and the form was pointing to movie night at local slash 9 slash 12 the method post and it didn't quote it of delete and manage it for the real stressful structure there can you say that yeah I mean it could if you trigger anything you want to trigger a form so as long as in this case we're making a conceding that we know this ID that we can which of course that and it itself would be the the difference as long as you trigger a form out of post okay counters to that we rustble in other words don't use get to modify the database basic rails convention anyway so if you follow that you're somewhat safe but that won't prevent you from more sophisticated attack similar to what Matt did here we're using the post method to get in there what rails does is in every form that you generate in a rails application has this strange thing called an authenticity token that has a really long hash value that's a key and that is in every form so when you send a form to your website rails will check for that token and if it's not there it will fail so a cross site request forgery won't have that key in the form so it can't forge that pass over however if cross site scripting in other words they got JavaScript loaded onto one of your movie night pages they could detect that and they could find your token and use that as well so these things kind of cross-pollinate and are sort of just get together session spoofing I'll let you talk about this okay and I'll talk a little bit about session spoofing so who remembers this one fireshoot right so fireshoot was kind of a big deal right it was for the first time it was incredibly simple and straightforward to exploit a long known vulnerability in my applications but you could simply install browser plugin and view and spoof the sessions popular social media sites around you it didn't work based off of being on an open network an open wifi so an encrypted wifi so I can do a demo back here would anyone am I going to capture anyone's session? I'm not going to do the demo but basically how do you work around this because it was taking advantage of the fact that so it was unencrypted network traffic and you're never carved into a promiscuous mode you would capture ongoing traffic from a browser to a third party site and scoop the session information out of it and just submit that session info as your own writing on top of the react session so how can you get around that how can we use web developers and the creators websites prevent this one require SSL this is 2011 that time has come you secure cookies so by default you can do it with cookies you can mark them as HTTP only so they can't be manipulated through JavaScript by default they will be passed across either an HTTP or an HTTPS connection you can mark cookies as secure so they only be pushed up to the server on HTTPS connections and for session cookies particularly that's a great thing something else that's an upcoming I believe it's going to be an upcoming version standard search transport security it's going to be a new HTTP header that's securely in draft that a server can actually direct browsers and clients that they must operate over TLS or SSL to communicate with SSL that's at protocol level one way to quickly enable all of those things with the drop-ins there's rack SSL written by Josh Peake you can just use the rack middleware and will automatically force SSL we'll mark cookies as secure they include that the emerging header I think just within the last couple of weeks we saw Twitter finally enabled an option still off by default and now there's an option you can go to your account and force all connections over SSL you can have a while back this was entirely over H2DS which is a good thing Gmail quite a long time ago went entirely SSL or Google apps and there's a white paper that I don't think we have a link to in here but people will maybe Google published a white paper while back basically claiming that the energy and the cost impact of enabling SSL across the board was negligible with respect to the potential cost of a secure to reach the myth of the notion that SSL is too much to know or had to be computationally or what happened in the past so let's summarize here I want to state up front when I started this talk I thought I would find all kinds of problems in Rails turns out they exist but we had to do a number of things to enable them in this particular web application we had to turn off Rails protection against sending cookies to JavaScript we had to bypass the raw filtering that Rails does naturally now so Rails by default will do a lot of these things for you there's just a couple coding things that you have to be mindful of in summary trust nothing don't assume that the user is on your side because he might not be standard data security patches, get the latest patches for Rails because they constantly fix things as they find holes and if you're on a back rev you're probably missing some security issues there there is a rail security mailing list and if you're not on it you should be bypass the things that we had to bypass to do a lot of these demos always scope your finds by the proper user to make sure you only find things that are permitted avoid using raw or use a whitelist to sanitize your output here's a good one do a security audit we had an outside firm do an audit of a couple of our programs it was very enlightening and worthwhile to have a firm that knows what they're doing and ask them to look over your database and finally just be aware you and I probably don't I know I don't, don't think like a hacker but put yourself in that mindset and think of sneaky things that could be done and just be proactive about that I think we're out of time 30 seconds maybe one question in the back, yes did you guys look at the OWASP SAPI project what that does to measures and rails right now I've not looked at, have you I am I'm aware of it but I've not actually read it so who would you recommend doing so well I've always been curious I don't know enough myself to really compare and know where the holes are between them but really there's only we probably should there are automated tools that can detect some of these common faults and they'll start looking out there and look for places they can inject SQL, inject JavaScript and kind of report so I think when we did the security audit that's how I thought we'd do it okay well thank you very much


Our presence and our partnerships with our allies in the region are increasingly important. The opportunity to spend time here, interface with our partners, is vital. It's so much easier to work side by side with somebody who you've met, who you know, who you can interact with on a personal level, not strictly on a professional level. Everything that we do during ballet coutain is integrated. There is no aspect of the exercise that happens just US or just AFP. Every step along the way builds our ability to work together to solve not just military crises, but humanitarian crises. The people themselves, they welcome the HA activities with open arms. Through ballet coutain, it is substantial because now when you see those school buildings being constructed and being used by the children, they will immediately remember that this was through the effort of ballet coutain. The Philippines and the United States have a shared history. When we do ballet coutain, it's like you are meeting a friend that you've known for a long time. This is how we see ballet coutain. There are things that you can do alone, but the act of doing it together makes you more effective. It's a force multiplier. It only goes to show that by working together, we will achieve more results, then you will have more success. Coutain strengthens the Philippine and US alliance by having a shared approach to safety and security in the region. What we're doing here, and the reason that we're doing it, is providing both trust and confidence to make our communities better. We gain as much from the Philippines as the Philippines gained from us. It is through this shared relationship that we both grow stronger, we improve our interoperability, and this ensures peace and prosperity within the alliance and within the Republic of the Philippines.


Hey everybody, it's Brian. This is not a tutorial, this is a follow-up to a tutorial that I've done and also a personal hobby of mine. I've done a six-part series called the High Performance TCP Server Design and I wanted to revisit this because it's kind of a hobby of mine. It's just kind of like a personal challenge to see how far I can take this. I've always been intrigued with TCP server design. Don't ask me why but maybe I should be employed with like Microsoft or patchy or something. Who knows? But anyway, so we really stress tested this thing and on my Linux box at the time it was hard-capped at about I think 1,024 connections because that was my you limit if you will. Let me bring up a little... I've kind of just you know for the sake of doing this I really wanted to... I changed my soft limit because that's what was really stopping me to 20,000 so I can open 20,000 file descriptors in Linux. Now whenever you open a file or a socket or whatever you're opening essentially well you guessed it a file and that is stopped by the you limit. Now I set this to 20,000 so I could potentially open roughly 10,000 connections. Remember the other program will have to open 10,000 and I open 10,000 and then you got all these files in the screen so we won't actually get that but it'll get close. So I re... I spent... let me back up. I spent the pretty much bulk of my weekend rewriting this thing from this ground up really and we've got a TCP server which you know just inherits QTCP server and we're overriding, listen and we're doing some some socket managing the background and I'm using Threadpool and the reason why I'm using Threadpool is well it's very streamlined it's very easy to work with a pool of threads and I read somewhere I don't remember where it was that it actually leverages multiple cores and it's very scalable. Now I'm not sure if that's 100% accurate I swear I read it somewhere but I'm sitting here going it's 2016 you know programs should leverage multiple cores. I know under the hood the operating system really determines how many cores your program actually uses etc etc but I kept that in the back of my mind during the design. So what this does is when listen is called it's gonna go through and say for I equal to whatever the max of the global instance of the Threadpool count is it's gonna create a new pool. Now it's not a Threadpool it's a socket pool or a connection pool which is this class up here so if we have if Qthreadpool has a max of 8 it's gonna create 8 TCP connection pools and put one in each thread basically. So this is a Q runnable this gets run through the Threadpool and it's also Q object so I can bind into the signals and slots and what this does is this holds a essentially a list of TCP connections. The TCP connection is just pretty much a wrapper around the TCP socket or the QTCP socket so in short what this thing does is when a new connection is made it goes in and I'll actually just show you. Oopsie hit the wrong button there. Compile and run this. So there's wow that is really large for some reason let me size that in. So the max for my system a Qthreadpool is gonna give me eight threads and you can see how it starts each one of those Q runnables. So when we go in and we're just gonna do a telnet session because why not? 0, 0.1 cannot type tonight. We'll connect. You see all it does is it just loads a connection. So what this does is when a connection comes in it checks the number of connections each one of these pools has and says which one's the lowest one and then you know let's just say this guy's the lowest one it'll throw that in there and the next one comes in and it does this you know round robin again and it just keeps doing it over and over and tries to balance the connections out between the threads. Now as the connections are made and disconnected the pools will you know raise and lower in volume depending on how many they get and this was a bit tricky because obviously we're working with pointers which is always a adventure and awesomeness and then you have to do all the memory cleanup and instead of doing the direct delete move this off to the side here actually went in and just did delete later where was it where was it I think I lost it oh yeah started pending blah blah blah except yeah I played around with the straight delete and the delete later and there's really no noticeable difference in performance I'm just kind of curious in practice what you guys use I kind of do delete later just because I think it's a little safer than just right out deleting the object when I'm not myself 100% certain that we're done using it so we've got our little server here and we've got eight of these pools spawned and I'm actually just gonna close and restart it so that interface looks nice and neat so we've got eight little connection pools in there and we're gonna load up handy dandy couple little things here maybe if my mouse will work with us here all right we're gonna load up a little program called siege which you probably remember that we're going to go with the system monitor so we can see our CPUs and everything you can see my computer has got eight CPUs or eight cores if you will and you can see there's really not a whole lot going on that just spiked up for whatever reason there's some silliness going on but spiked as a relative term you see they're all around you know zero three percent core seven for whatever reason spiked up core seven is probably what is running the app but so we're just gonna throw a thousand connections in here on siege and you can see it just goes and goes and goes and this is kind of going crazy in the background here and you can see our network usage spikes up that's all the connections being made right off the bat and the CPU usage starts going and you can see each CPU is sharing in the work here or I should say each core is sharing in the work and if we just control see that and you might see down here this might move a little bit it'll be more obvious when we start ramping these connections up you may see these connections being deleted and that's the delete later being called you can see the CPUs are doing their work and all the cleanups happening and all that so hundred percent availability concurrency about 521 that's really not bad longest transaction was 17.22 that's for I mean for a thousand concurrent wasn't that bad elapsed time 20 seconds so what I like to do is I like to take things to their breaking point notice how we're not stopping the application we're just leaving it in place this is good practice when you want to test things to make sure you don't have memory leaks and let's just see if we can find this Q process stub is currently using 88k of memory here I'm gonna hit the sucker with 10,000 concurrent transactions let's just watch our cores now I should know that this will start breaking but you'll notice the software itself doesn't crash and it's gonna actually take a few seconds to spin up 10,000 connections I honestly don't think Siege is capable of spinning up 10,000 connections I think that this server that I've written is probably going beyond what Siege is really gonna be able to help us test with I may have to actually write my own test program to do this we're just gonna let that hammer for a while but you can see memory usage it's really kind of just sitting there it's not doing a whole lot Siege isn't really doing a whole lot either well actually 500 bags but that's one question I had for anybody out there is the Q process stub this guy right here is that's not actually my program is it because here socket test three this is the actual name of the program and it's pushing 40 megs now that's something that I've really kind of perked my interest here as you can see that Siege is using like 500 megs and my program's only using like 40 megs so there's a big memory difference there that really had me kind of curious and if you've been watching you can see that you know we're getting socket errors and disconnects and all sorts of timeouts and stuff it's because we're really just hammering the heck out of this and you see that's really apparent and looking at the CPUs they're just going ballistic here so that is probably hitting the upper limit of what this computer is physically capable of doing that or I've hit the limit of what Siege is capable of doing we're gonna control see and Siege actually crashed segment fault core dumped so we actually broke Siege in our little test here that's kind of scary my program didn't crash so so this is just something I've been playing around with here let's actually close that and I want to I kind of feel bad that we crash Siege sorry Siege you've been nice to me and I wanted to actually just play around with us a little bit because you know it's no fun unless you play with it right so we're gonna uncomment this out and we're gonna actually make a hundred threads which is complete and total overkill I wanted to address this or somebody inevitably is gonna say well the more threads you have the more performance I have no it's actually quite the opposite threads are a very expensive operation and so when you do cross thread operations it's very very expensive because you're dealing with two different threads and you have to sync them and this code actually does that we're like where is the count function here connection pool yeah count see I'm using a qmutex locker so I mean you have to actually lock this entire section of code just to read the variable so yeah it gets a little kind of nutty but anyways we're gonna actually create a hundred threads and see if the performance improves a little bit here I doubt it will it'll actually probably go down because we're using a hundred threads instead of eight so we're using a hundred threads and you see it actually created a a connection pool a hundred times so we've got a hundred q run q runnables in memory here get my system back up system monitor get siege back up and go in here let's try not to crash siege this time let's do 5,000 concurrent connections and just see what the memory and cp profiling looks like yeah you can see they're really starting to grind away and work at it so I guess the the questions I had to focus out there is is there anybody out there that's knowledgeable about TCP server design and is this like the preferred way of doing I'm not the 100 threads just the using a thread pool and then having multiple sockets on each thread in the pools and we're gonna start crashing siege here I can already see it happening siege is already starting to buckle so we'll just cancel that and you can see that we had 87% availability not great not bad we had 12,000 hits and about 1,800 of those failed most probably failed due to timeouts just because they're sitting in the connection queue waiting and of course if we lower that number we have much better results because we're doing less operations and say a hundred percent availability so I guess some of my questions anybody out there who knows more than me on the subject is thread pooling the way to go is multiple threads even the way to go I know sockets themselves under the hood are intrinsically asynchronous so using a thread is kind of redundant overkill especially when you build a a server that's like one thread per socket it's just very bad server design so that's pretty much all for this I just wanted to kind of get you guys's feedback let me know via personal mail or preferably join the void drums Facebook group I'll be posting this video and trying to start an open discussion in there about this there's pushing 470 folks in there some of them are extremely bright smarter than me which kind of scares me I'm not sure if I'm comfortable with them being in the group and they're that smart but so let me know


So, let's move on to our next topic. So, as I said, this was a jam-packed week. And it wasn't just because this news came out of left field. None of us knew that the NES Classic News was coming. But we did know there was an Nintendo Direct happening. Well, I didn't, but... Well, again, Switch is bringing him into the fold, and it's been three weeks, so I didn't mean to over that. I should have let him know. I think I told you the day of, but it was happening while you were at work. Yes. Should I tell him that maybe he should watch it? Eventually, he'll just watch it on his own. Like, he'll show up and he'll be like, Dude, did you see the Nintendo Direct? I'll be like, wait a second, you watched it? I thought I was going to have to watch it with you again. Yeah, yeah, right. So, no, there was a Nintendo Direct. And what I found interesting about this Nintendo Direct is that they came out and said it was going to be for Nintendo Switch and 3DS games. And they said specifically it would focus on arms and the Splatoon 2. So, when Nintendo has said this in the past, it's usually like 90% of a Nintendo Direct are the two games they mentioned. And then they just throw in a few extra tidbits. This Direct was pretty big. Yeah. There was a lot of announcements in this thing. Yeah, a lot more. I think at one point it was like 40 games or something. Yeah. Like, 40 games were talked about between 3DS and Switch or something like that. That was like a tally we had in Nintendo Prime on the back end. And some surprising announcements like Payday 2 was coming to Switch. That game looks awesome. Yeah, you can get it on Steam. Like, the thing is, it's really weird because I followed this guy, this Jim Sterling fellow, I'm sure so many of our audience have heard of him. And he reviewed like Payday 2 or reviewed. I don't know if he did an official review. Maybe he did because he loved the original Payday. And the problem he had with Payday 2 is like everything was like microtransaction-y. But from what they said, it sounded like a lot of contents just going to be included with Payday 2. So maybe they're trying to make, you know, Switch people realize, hey, we know how to make a game, sorry, to our PC owners that we made spend like an extra $7,000 to get everything. But, dude, like Payday 2 is a legit, decent, indie offering. Well, Robbie Banks, man.  Yeah, the original Payday was great.  We'll probably end up doing some live stream multi-action of that. But what I kind of want to get into is first off, let's let's talk about what are some of our favorite announcements from this? And let's start with Darren, the third party here. Well, I here's the thing. Pokemon Moon was the last 3DS game that I will ever buy. So none of the 3DS announcements, you know, I was really hard to get out. Why's Pokemon Moon it for you? Because I have a Switch now and I'm going to buy Switch games. Like the 3DS is old news. Like you didn't buy 3DS games and you had a Wii U. What did you say? So you didn't buy 3DS games and you had a Wii U? Well, I did, but I treated them like a home console and hand console. Whereas with Switch, I didn't think I would do this because I usually use a home console more. But I use it primarily as a handheld console, which is I have to wash my mouth out with soap after saying that because I thought I would never ever do that, but I do. I use it in handheld mode most of the time. So it's basically my one console that I'm playing now and I'm playing in handheld mode. Sure. So, I mean, the 3DS, it's up on a box on my shelf and it's like I don't want to play. Hey, Pikmin, I want to play Breath of the Wild and Mario Kart 8 Deluxe. Like there's really nothing on the 3DS that excites me as of right now, unless for some reason they were to announce a new Zelda or Pokemon game for the 3DS, which I highly doubt they'll do So as far as the 3DS stuff in the Direct really wasn't excited about a lot of that, even though I was very interested to watch it just from an analyst point of view because I am interested in how Nintendo is marketing the 3DS after the Switch is launched. So it was very interesting to watch that, not hyped at all, really. But I'm glad to know that Nintendo is still supporting 3DS owners. But I think what, I mean, oh, the new Zelda Amiibo. OK, I just remembered that. That's probably the best announcement for me personally that they had because I love Amiibo and I love... Some new Amiibo. The Legend of Zelda. Yeah, the new Link Amiibo. That was your favorite announcement out of the whole Direct? Yeah. I mean, it's cool if it was. That's just a very interesting perspective. Did I miss anything? Because I did not watch the entire thing, but I caught up on the news afterwards. Like, was there any mind-blowing announcements that I missed? I wouldn't say mind-blowing, per se. But we learned a lot of things, especially for... Well, I guess for both systems that we didn't really know before. You know, like, Mata Hunter Stories is coming to the West, which had reviewed very, very well out in Japan. OK, yeah, I've never played a Monster Hunter game in my life and I'm really not interested in that. Yeah. Well, there was that, but like, here's the thing. Like, well, you're not interested in 3DS games, so that's not going to tickle your fancy right now anyways. But what really got me was that this was the Direct where they needed to prove Splatoon 2, improve arms. And I feel like they did it. Because Splatoon 2 had a popular opinion out there that it was just Splatoon 1.5. It was just the same game, with most of the same maps and the same weapons doing the same thing over and over again. And they came out and they announced, no, one, we have an entirely new mode that's completely different than anything you did in the original Splatoon. And that Horde mode or whatever it was looks absolutely fantastic. And I can't wait. I see that perspective. The thing is, I'm not going to buy arms. Probably not. I mean, it looks fun, but it doesn't look fun enough, because one, my internet sucks, so I can't really play at my online multiplayer. And number two, I have no friends, so I cannot play at local multiplayer. Why can't you play at local? Because I have no friends, Nate. You have family. Well, this is true. But they're not really into video games. And then Splatoon 2, I was going to buy it, but it was just a straight port of the original because I never got to play the original. I mentioned earlier how my... Oh, so how could you not be excited about Splatoon 2? Well, I am excited. That should be your number one thing. I am excited about Splatoon 2, but I already knew about it. So, we kind of already knew there was going to be new Zelda on me, bro. Yeah, but we didn't get to see them. Like, I already saw Splatoon 2 and it's already been played by... You're going to be editor-in-chief of Zelda Informer, and you're excited about the thing you knew was going to happen. Yeah, I'm sorry that I specialize in the Legend of Zelda, and my favorite announcement was the Zelda amiibo. I mean, I'm kind of disappointed, actually. I mean, I'm glad that there's new Zelda amiibo because I currently have all the Zelda amiibo, and I'd like to collect more on my shelf. But I kind of wanted the fierce deity to be an amiibo because spoilers, not really spoilers, I mean, it's everywhere that fierce deity in the outfit is in Breath of the Wild. I kind of wanted more Breath of the Wild amiibo. Yeah. I'm actually surprised that they're like, yeah, we're going to do the Majora's Mask one, the Skyward Sword, and the Twilight Princess. Yeah, and they're all the links from the game. And it's like, I'd like the fierce deity and Fi and freakin' no middle. Well, it feels like they should just Breath of the Wild is doing insanely well at sales. I'm surprised they're not building on the hype for that because they're going to have future DLC coming. You know, we have the four guardian characters that all could be amiibo easily. If the king, he could be amiibo. Oh, yeah. Calamity Ganon himself could be an amiibo. Mm-hmm. But yet they're just going old school and being like, yeah, we're just going to make some more retro amiibo. And while I appreciate it, they look fine. They look exactly like their official art. Yeah. And can I just say... I think that's maybe what's most disappointing about it to me is that they look exactly like their official art. It's like someone just took the official art and 3D printed it and handed it to you. It's actually definitely possible that's what they did. Well, can I just say that Link... That's what I'm saying, like... Right now, before this announcement, Link was the most produced amiibo. I'm not talking like the first Link Smash Rosami, but I'm talking... The character had more variations of amiibo than any other Nintendo character. Of course. Other than Mario. Not even Mario. More than Mario. Which is kind of mind-blowing to me. Is it more than Mario? It is more than Mario. And now it is way more than Mario. You're gonna have to... I wish we were the Easy Allies podcast where I had the Proobit ticket so I could be like, I don't need you to go look that up right now. I saw a statistic the other day. You can quote me on this, but it was like the amiibo alerts Twitter account or whatever. One of those amiibo accounts that had compiled the data. So as long as they're legit, that statistic should be legit. I could be wrong. I don't think I am, but... No, it's okay.  If I'm wrong, I have to do something on the next podcast. Yeah, maybe.  I don't know what else to do. What would you say? You're not on camera. You're not being on camera, ladies and gentlemen. That was a fun fact. Yeah, it's one of those things that I think... It's so hard for me to believe it. I mean, there is a lot of links. There is. Truly a lot of Link Amiibo. But man, I keep thinking of all the Mario Amiibo. There's a ton of Mario Amiibo. Yeah, but I mean, just looking at my shelf right now, there's Link Archer, Link Rider, Link Friggin Smash Bros, Wolf Link, Link 8-Bit, Link Ocarina of Time, Toon Link, Other Toon Link, and then what is there for Mario? There's like two... Smash Mario, Mario Mario, Fire Mario, Gold Mario, and Silver Mario. There's more... Two different 30th Anniversary Mario's, Cat Suit Mario, I'm trying to think. There's a ton of Mario's. They have Majora's Mask, Kyler Princess, and Skyward Sword Link. Well, there's going to be more Mario Odyssey Mario coming out. Well, yeah, down the line. But I mean, right now... What do you mean right now? Okay, but out of the Amiibo announced, there are more Link Amiibo than Mario. It's a totally irrelevant conversation. But it's still so much fun. I'm actually quite enjoying it. It's amazing conversations you get to have when you're a Nintendo fan. Oh yeah, that's a no-prime, baby. Eric, what was your favorite thing that happened during the Nintendo Direct that you literally watched just before we started here? So it's really fresh in your mind. I would have to say that overall, I was just kind of... It really didn't, like, you know... I'm actually not surprised. Reach out and slap me with anything? I'm actually not surprised.  I really had...  Yeah, oh yeah, that's like a new thing. I think they're setting that up for all future Nintendo games. Yeah, that was pretty awesome. Yeah, that's the headlines as they go. And I kind of laughed because the last headline was can you figure out what this headline is?  And that kind of made me laugh because I go and end up... Well, yeah, well, it's one of those... The Nintendo's always done a really good job presentation-wise. So I don't want to say, oh my god, it was bad. I'm like, no, the presentation was great. We're talking about the content. Yeah, it was just kind of... I'm not surprised that the Pikmin game has a crappy name. Like really, I'm going to go play Hey Pikmin on my 3DS. That's Hey with an exclamation point, by the way. You have to type that out. Did you actually see the logo? Yes, I did. The logo's worse, the logo's worse. It's like dealing with all the Nintendo's weird stylization. Like you have to type Amiibo with all lowercase and it's plural. Amiibo. Like now you have to type out Hey exclamation point, Pikmin. It's not the first time they've done it. It's worse than New Play Control exclamation point. No, this exact title, they've actually done this exact same thing it's called Hey Pikachu. It's a game. So Nintendo's actually done this before and the fact that it's borrowing the exact same title with a very similar format to how they're doing it makes me wonder if this game, because we actually didn't see a lot of this game in the footage, makes me wonder if this game actually functions a lot like Hey Pikachu does. Kind of like Kirby's Epic Yarn and Yoshi's Woolly World where they're basically the same kind of games just with two slightly different play styles to fit the characters. The theme is the yarn. Hey Link and Hey Mario next. Now you won't get Hey Link, it'll be Hey Zelda, by the way. Ever since the venture, Link can't be in the title. But it's one of those things that I think they're just playing around with it, the Hey whatever and making these smaller simpler games and just seeing if they can make that like a series like they've done with the yarn stuff. The weird thing with the yarn thing is that they're totally different names, Kirby's Epic Yarn and Yoshi's Woolly World. Totally, you wouldn't even know they're related unless you played both the games. So it's interesting that it's Hey Pikmin and Hey Pikachu. But the thing is, setting the title aside which is absolutely goofy, maybe that's the point. Maybe they were trying to attract kids, I don't know. I'm sure my children would think it's funny and want to buy it. Can you buy it for me? No? Ask Santa, Santa's broke too so don't ask him. Don't waste your time, get switched games. I guarantee you that the very first game Nintendo is going to sell, send Nintendo Prime to review is going to be Hey Pikmin. No one's going to request it. No one's going to request it so there's going to be begging for people to ask to review that game. The thing is, the game looks good. Yeah, it doesn't look bad. It looks like a 2D Pikmin game. I guess. I've never been a Pikmin. It's not anything that it looks like what I would think a 2D science-growing Pikmin game would look like. It's just, I don't know. But while everything was in, what were your favorite parts of it? Payday 2 was literally... Well Payday 2, that was the most surprising announcement to be with Payday 2. I'm just like, wait, it's like Payday 2, an M rated shooting cops game of what Robbie makes. Nintendo okayed that to be on their system. The last time that happened was Devil's Third. We all saw how that went over. Yeah, but we already know what we already know what good Payday 2 is. From what I've heard, it's pretty awesome. It's a solid game. As I said, the issue is the microtransactions. The game itself was nice. If they fix the microtransaction issue for Switch, then awesome. I'm their day one. Payday just looks like a fantastic game. Since no one seems to be excited about anything, I guess I'll speak up a little bit. I'd say I mentioned before that I'm excited for Splatoon 2. I love the original Splatoon a ton. Funnily enough, I have this kid at my elementary school I work at that just tries to talk to me about Splatoon all the time. Dude, I was playing Splatoon all weekend. It's so awesome. He's like, when did you last play Splatoon? I'm like, I don't know, two years ago. I'm kind of waiting for Splatoon 2 to be honest. I don't even know who you are now, man. It's just really cool because he's the only kid I know that's played it. It kind of showed that maybe Splatoon did what it originally was intended to do, which was cross barriers. Make shooting games feel like everyone can play it. Smash Bros. did it for fighting games. I think Splatoon did that very well. I think Splatoon 2 is going to continue that. What I liked is that if you pay attention to anything, this is definitely a true sequel to Splatoon. It doesn't feel like they cheated me out. They just said, oh, we're done making content for Splatoon 1, so everything we make goes into Splatoon 2. It's more like, no, they had a concrete plan for Splatoon 2. They have a whole giant new mode. Right now we've seen four total maps that are new and only one that's a repeat. That's a very high new to old ratio. Mario Kart-esque, if you are. Is Mario Kart 8 any less of a Mario Kart game than Mario Kart 7? Because they're both racing games that look the same? Yeah, no. No, like that's the thing. Nintendo does have series where it feels a little iterative, because it's the same thing. It's just the same thing plus all this new content. And that's what they're doing with Splatoon 2. Even the old items, they've swapped out all of the specials for completely new things. So even the old items feel new. So again, I like a Mario Kart. Double dash, adding new mechanics to things you're used to. And even now, Mario Kart 8 Deluxe are making it so you can hold two items now. They're even changing up that in addition to new characters and all new battle mode and everything. And maps. And the thing is, yes, Mario Kart 8 Deluxe is not a fair comparison of Splatoon 2 because it is Mario Kart 8. Like 95% of the content in the game is Mario Kart 8. So it's not a sequel. That's why it's called Mario Kart 8 Deluxe, not Mario Kart 8-9. Or Mario Kart 9. Yes, Mario Kart 8-9, yes. Mario Kart 8-9, yes. I wouldn't have casted it to call it Mario Kart 8-9 or Mario Kart 8-2. I hope I live to see a day when there's Mario Kart 8-9. I don't know how old I'd have to be to see that. I'm just waiting for him to come out with Mario Kart 8.1. No, those are updates. No, I know. But I'm waiting for him to actually come out and just say, Okay. I actually wonder if they're going to make another Mario Kart after 8. They have to. Well, you would think they have to, but then, like the big step for Mario Kart 8 is that now we have our HD Mario Kart. And now they're porting that HD Mario Kart and adding content to it. And now they have the ability to continue to update that game on Switch. Why do they need a 9? They can just keep adding to 8. New maps. Other times that they made a new Mario Kart, they had a reason to. There's a new system. Games weren't backwards compatible. There was more graphic capabilities, but there isn't really anything visually more you really want out of Mario Kart. At this point, 8 kind of perfected it already. So now you're just kind of stuck with, like they coded it into Mario Kart 9, because Wii U games don't play on Switch, but they did. They ported Mario Kart 8. It's like really beautiful. And I know the Treehouse did say it was 1080p 60 frames per second on Switch. So, I mean, what more do you want out of the visuals, unless you want to take it outside? It was 1080p 59 on Wii U, because there was a frame issue that they never fixed. I said 1080p 60 on Switch. I was just noting that it was basically that already. Oh, okay. It's actually not much of an upgrade. But again, they're doing more with the Switch version. They had two items. Maybe the Wii U could do two items, so that was an idea they just could do there. The battle mode. Maybe they couldn't make battle mode work on Wii U because of how limited it was. I don't know. But either way, we have everything we want for that. At least. But you look at the Direct itself, and I came away, I guess, more excited. Maybe because out of the three of us, that was the only one covering the Direct. Darren wasn't even around, so it was other people doing the stuff at Zelda Informer, which is basically one post about Amiibo. I was handling all the stuff at Nintendo Prime. If I wasn't posting it, the two other writers that I had, Anna and Jessica did a fantastic job, but I had to copy it and all their stuff to get it live. So, I literally saw every single piece of news that it was for this thing, because I didn't get to see it live either. I was at my other job. So, it... I was excited. The more and more stuff I kept putting up, the more and more excited I kept getting to both things. I'm probably the only one among the three of us that I want Arms Day 1. Period. And not just because I bought a second set of Joy-Cons ahead of time, knowing that I was going to buy Arms. Congratulations, Eric. I think we found someone that wants to play Arms. Yeah? Like, I don't... For... If you just watch it and it's not appealing to you, then I guess it's not appealing to you. To me, it's literally the next evolution in fighting games, because this is a fighting... This is a fighting genre game. This is their next Smash Bros. Except, you know, a totally different kind of game. Like, maybe it's more comparable to, like, a Street Fighter or something. Like, this is their entry into, like, really... Like, there's a lot of stuff behind this. There's a lot of strategy, a lot of hardcore strategy behind all this. And it doesn't require motion controls. That's the one thing I was hoping they were going to show in this Direct was how to play it without motion controls. Again, they didn't do it. They just keep saying you can. And I get it, they're trying to push the motion controls, but honestly, unless the motion controls are literally just that much better than the standard controls, in tournaments and stuff, it's going to be standard controls being played. Can I just say I'm really sad that it didn't make it to Evo 2017? I'm really sorry about that. The arms thing? Well, arm... It was up for...  And it looked like arms was going to get the most amount of money, but then the last minute, like, another game got a bunch more money. And I was kind of sad because I would love to see competitive arms. That would be amazing. Well, it's going to happen. I think the big thing with arms is that it needs to get out in the public first so the fighting community can get a grip around it, not just to get good at it, but to see if it fits in with that kind of community. It seems like it would. And I think one thing that helps it stand out from other fighting games is it's got a 2v2 mode. And imagine that in a tournament setting where you have to have a team of two. That part did look pretty cool. Like, just the strategies, the players, the different ways you can deck out your character and all the different movesets, the elemental stuff. The visuals look great. It looks like it's running in a perfect 60 FPS, which is needed for hardcore fighters. It... To me, it's trying to do what Splatoon 2 or the original Splatoon, I should say, did for shooters. That was Nintendo's entry multiplayer shooters. And they did it their way. This is Nintendo's entry into hardcore fighting scene, doing it their way. Smash was never intended to be a hardcore fighting scene game. It just became that. And even Nintendo was only sparingly supported the idea of it being that way. Because the creator of Smash Bros. only sparingly supports it. He doesn't think it should be a serious fighting game. Sakurai is not in support of it being a serious fighting game, but people treat it as a serious fighting game. But ARMS is like intended to be a serious fighting game. Just like Splatoon, and the way Nintendo is pushing Splatoon 2 is now intended to be a kind of serious multiplayer shooting game. They want tournaments of it.  Nintendo wants Splatoon 2 to be in the tournaments and be at Esport. They want ARMS to be at Esport. And I'm really excited about what they're doing with ARMS. Because it is the first time... I'm not really big into the fighting game genre. I like Smash Bros. because it's my favorite Nintendo characters battling in hell. There isn't really other fighting games I enjoy that much. I wanted to like PlayStation All-Stars, but it wasn't very good. It was Sony's attempt at a Smash Bros clone. It just wasn't good. I like those Sony characters. It wasn't good. I keep bringing up Street Fighter 2 because there's a new version of it coming to the Switch. There's a lot of fighting games out there, SMT, Street Fighter 4, Tekken. All these fighting games out there, I'm just not into them. When I was a kid, I played them a lot more.  Especially on arcades. I love Primal Rage. I don't know why dinosaur fighting games went away. It's dinosaurs. It's like Jurassic Park era. Dinosaur fighting game. This is perfect. Oh, I need the giant gorilla. Got a little Primal Rage. They need to bring that back. A new Primal Rage for today's era. Indie developers. I'm giving the ideas here. But no. Arms is a very exciting game to me because it feels like the first fighting game I've watched I actually want to play because it's doing something different than what I played 20 years ago. Most fighting games, even Smash Bros. to be honest, when I played Smash Bros. on Wii U, and when I played the inevitable port or brand new Smash Bros. game they make for Switch, it still felt like just like the game I was playing back in the N64. Yes, I know it's different. I know the pacing is different. There are more items, more characters, this and that. But in terms of me playing it, it feels the same. And that's expected, I guess, because it's in the same series. But I feel that way about all games. Street Fighter IV feels like Street Fighter III and it feels like Street Fighter II. Yeah, they visually look different. They add new moves, but in general how they play just feels very similar and very familiar. And that's fine, but it also feels like fighting games have an advance beyond that. Whereas this one is the first one that I could do. If the motion controls are better than standard controls, and this is the first fighting game where you want to use motion controls because that gives you the best advantage. And not only do you want to use motion controls, how you are fighting is completely different. You're fighting in a physical 3D arena space instead of just two 3D models smashing together on a flat screen. Yeah. In a single plane. And doing it in a way that's better than like pocket monsters try to do it or poke and turn and I should say try to do it. And doing it in highly unique ways with very customizable characters which usually the characters aren't that customizable in fighting games. You can just change some colors up. It's usually about it. The characters aren't that you master them. Yep. So this game just looks intriguing to me. Now whether it's going to hold up once I have it, I don't know. I do want to try before I buy. Hopefully Nintendo gives me that ability to get review copies. Review copies. Never got a review copy of Breath of the Wild for Zelda Informer there. Nintendo, what's up with that? Yeah, what's up with that? What's up with that? I'm still editing our chief there for like another couple weeks, man. Where's my review copy? It's okay. And the thing is they told me... You have it. It's called your own copy now.  Never got my Wii U copy. I probably just gave it away to be honest with you, but... Or maybe we have a poor staff member who doesn't have the game yet. Possible. It's possible. This Direct I think was a necessary one. And that it didn't have a lot of really exciting announcements besides the things I paid it to. But what it gave me is one, for people who don't own a Switch but own a 3DS it let them know, hey look, we still have good games coming out for you. Yeah, maybe you don't like the title of hey pick me but the game looked good. We have monster stories coming. I can't remember. There was a couple other RPG kind of games we have coming. And the fact that I don't remember the rest of the 3DS games isn't to knock on them, it's because I also don't play my 3DS anymore. Ever since I got Switch, I have not turned on my 3DS. I haven't felt the need to. Probably if I get a review copy of a game that's about it or if I'm going to live stream on one, otherwise I don't really have a reason to pick up my 3DS because the Switch gives me everything I want because it's portable and I get higher quality games in affordable form. And I like that. I didn't know that's what I wanted it for until I had it. Now I am unlike you and Darren. Eric and Darren, you guys mostly play your thing in portable mode. I still have yet to dock mine. I do dock mine all the time. Yeah. Because maybe it's because you're still with your parents maybe you don't have like do you have your plasma in your room? Oh yeah. How do you not hook that thing up to a plasma and play Breath of the Wild on the big screen on your bed? No I know. What's wrong with you? I know, I plan on it. As Reggie says, what's wrong with you? Yeah. Is your body not ready? Yeah. Not ready for that big plasma screen experience? But no, I played it a lot in dock mode, it's great. I played it a lot on dock mode. It's awesome. I played it in tabletop mode a lot. Like when I met over at the elementary school with the kids, I played it like some one-two switch and stuff with them. Surprisingly, I'm surprised how well it works in tabletop mode. But I guess my general gist of this whole direct is that it felt necessary in that one there's quite a bit of content coming to switch between now and E3. I'm surprised Arms is pushed to June because that officially takes it out of spring. But whatever, Arms is in June. You have Splatoon 2 in July. Arms actually hits right at the end of E3. It's really weird. Again, they're going to talk about it at E3. Of course, because they're going to push it as an e-sport and try to get everyone to get all hyped about it before launch. But, you know, we have Minecraft coming out next month. That's kind of like the biggest game coming to switch next month. I know people are like, oh, Minecraft. Yeah, but still, it's Minecraft. It's a very popular game and it's hitting early in the life cycle instead of at the end like it did with Wii U. Right, and actually, I kind of like the Nintendo flavor that it added to the giant Mario. Yeah, that's a DLC pack they added to it on Wii U. And now it's just included, which is great. That does look pretty freaking cool. It does look cool. I'm not a big Minecraft player. I'm afraid to play Minecraft. Like my daughter loves Minecraft. Yeah. As soon as she notices that I have Minecraft on my switch, I'll probably never get my switch back. She loves. She is like a Minecraft addict. And she's only six, so it's only going to get worse from here. I am afraid to get into Minecraft because I know it's going to be like World of Warcraft for me. It's going to be a crack. It will consume you, speaking from experience. Yes. So, anyways, it's still good that it's coming. It's not a bad game. Great game. What I saw is that Nintendo has a ton of indie and small game support for the switch. It's a ton. And this is despite the fact that we know now that Nintendo has been kind of limiting who could be on the switch at the beginning maybe to give games a longer run for indies. But they have that. They have two bigger games coming. And then after that, it's kind of a question mark. But I feel like they needed to get all this stuff out of the way for Switch and 3DS now because E3 is coming up in two months from now. Like almost to a T, two months from now. And that's where they're going to have all the big ones. They're sort of going to show off Mario Odyssey. More of that. And that's where they're going to have all their big, big announcements that are going to get you hyped for the rest of the year and get you hyped into 2018. And I feel like if they didn't talk about this stuff, even the stuff that comes out after E3, like say they didn't talk about some tune tune now and they waited until E3, they waited to talk about arms until E3. I think it would take away time from the E3 presentation to hyping the system for things that are coming down the line. Because right now it's now after this Direct, we know everything coming to 3DS and we use 3DS and Switch for like the next three months. We know. Our next three months are taken care of. So E3 will now be what's next. And I think it was very important they got this out now. And also fun fact, ever since they launched Nintendo Direct, there's been an Nintendo Direct every April. It is the only month they have consistently released Nintendo Direct in their year. Kind of a cool little fact. But I guess we don't really have much else to say because none of us were overly excited. I'm really excited for arms, obviously. I think it looks like a fun game. I don't know if I'm going to get it day one. Well, I think because I have it, it also helps like you'll get to play with me. It's one of those things that it looks like something I would possibly pick up, but it might not be day one. Like is it going to like, are you going to get to play with me on Splatoon 2? More than likely, yeah. So I think it's going to be one of those, if you end up loving Splatoon, I can see you deciding, you know what, this is a new IP, it was great. Let me try arms. Then you'll try it on mine and be like... Yeah, no, no, it does look like a fun game. It's just, again, it's one of those things that I don't know if I'm going to get day one.